Terms of Reference - Board Risk Committee

Terms of Reference - Board Risk Committee The Board Risk Committee is authorised by the Board to oversee the Group s risk management arrangements. It ensures that the overarching risk appetite is appropriate and adhered to and that key risks are identified and managed. The Committee's responsibility and authority covers the entire Group and any joint ventures that may be entered into. 1. Membership 1.1. Members of the Committee shall be appointed by the Board, on the recommendation of the Nomination Committee in consultation with the Chairman of the Board Risk Committee. The Committee shall be made up of at least 3 independent non-executive directors (one of whom shall be the Chairman of the Audit Committee). 1.2. In addition the Group Chief Executive, Chief Risk Officer and Finance Director will be in attendance. 1.3. The Board shall appoint the Chairman of the Committee. The Chairman has responsibility for overseeing the performance of the Board Risk Committee. 1.4. In the absence of the Chairman of the Committee the remaining members present shall elect one of their number to chair the meeting. 1.5. The Chairman of the Board has an open invitation to attend any meeting. 1.6. Other individuals such as Board Directors and/or their representatives may be invited to attend all or part of any meeting as and when appropriate. 1.7. Appointments to the Committee shall be for a period of up to three years. This may be extended for two further three year periods, provided the members still meet the membership criteria. 1.8. Membership will be reviewed on an annual basis as part of an annual review which will include a) a review of attendance over the previous year and b) an assessment of the ongoing appropriateness of the membership. 2. Secretary 2.1. Secretarial support will be provided by the Company Secretary or his/her nominee. The Committee Secretary will be responsible for all pre and post meeting administration together with tracking and, as directed by the Chairman, following up on any actions arising. Minutes of Committee meetings will be circulated promptly to all members of the Committee and, once agreed, to all members of the Board unless a conflict of interest exists. 2.2. The Committee Secretary will also assist the Chairman with any issues/changes arising as part of the Annual Review. 3. Quorum

3.1. A quorum will comprise of two members, one of whom must be the Chairman or his/her nominated deputy. 3.2. Decisions are normally reached by consensus but, in the event of a disagreement, decisions are made by simple majority and the Chairman will have an additional casting vote. 4. Frequency of Meetings 4.1. Meetings will be scheduled to convene quarterly, and on an ad-hoc basis as required. 4.2. Papers are required to be sent to the Committee Secretary no later than 7 working days before the meeting in order that all documentation can be sent to Committee members no later than 5 working days before the meeting. 4.3. Papers must be approved for submission by a Committee member. Minutes of the previous meeting, actions points and papers must be circulated by the Committee Secretary at least 5 working days prior to the Committee meeting. 5. Annual General Meeting 5.4. The Chairman of the Committee shall attend the Annual General Meeting and be prepared to answer questions from members of the Company on the Committee s activities. 6. Duties Key Responsibilities (Matters Reserved) 6.1. Recommend the Group framework of risk appetite, limits and constraints to the Board for approval; 6.2. Advise the Board on the Group s overall risk appetite, tolerance and strategy. In doing so account should be taken of the current and prospective macroeconomic and financial environment drawing on financial stability assessments such as those published by the Bank of England, Prudential Regulation Authority, Financial Conduct Authority, and other authoritative sources that may be relevant for the Group s risk policies; 6.3. Oversee and advise the Board on the current risk exposures, risk management and compliance strategies of the Group and its future risk strategy; 6.4. In relation to risk assessment, the Committee shall: keep under review the Group s overall risk assessment processes that inform the Board s decision making, ensuring both qualitative and quantitative metrics are used; review regularly and approve the parameters used in these measures and the methodology adopted; and

set a standard for the accurate and timely monitoring of large exposures and emerging risk of critical importance. 6.5. Review the Group s capability to identify and manage new risk types; 6.6. Advise the Board on proposed strategic transactions including acquisitions or disposals, ensuring that a due diligence appraisal of the proposition is undertaken before the Board takes a decision. Any such activity shall use the Internal Model to demonstrate the impact of the decision in question and focus in particular on risk aspects and implications for the risk appetite and tolerance of the Group; 6.7. Ensure that the material risks facing the Group have been identified and that appropriate arrangements are in place to manage and mitigate those risks effectively; 6.8. Approve and monitor compliance with the Own Risk and Solvency Assessment (ORSA) policy; 6.9. Provide oversight of the ORSA process; 6.10. Provide oversight and challenge of the design and execution of stress and scenario testing; 6.11. Review and challenge risk information received from the Group s risk functions to ensure that the Group is not exceeding the risk appetite set by the Board; 6.12. Review reports on any material breaches of risk limits and the adequacy of proposed actions; 6.13. Keep under review the effectiveness of the Group s internal financial controls, internal controls and risk management systems; 6.14. Provide oversight to the risk management framework and ensure that all appropriate risks identified by the risk-management system act as inputs into the Internal Model; 6.15. Review and approve the statements to be included in the Company s annual report concerning internal controls and risk management; 6.16. Review and approve, as required, the public and private disclosure statements / reports required to discharge regulatory obligations as governed by the disclosure policy; 6.17. Consider and approve the remit of the Group Risk Management Function and ensure it has adequate resources and appropriate access to information to enable it to perform its function effectively and in accordance with the relevant professional standards. The Committee shall also ensure the function has adequate independence and is free from management or other restrictions.

6.18. Provide qualitative and quantitative advice to the Remuneration Committee to ensure executive remuneration policies encourage good risk management; 6.19. Instruct the Internal Audit function, where required, to carry out a review of activities which are within its terms of reference and oversee such investigation; 6.20. The Committee may form sub-committees from its membership to address specific aspects of its duties; 6.21. The Committee shall consider any other matters requested by the Board from time to time; 6.22. Provide oversight to, and monitor the performance of, the Executive Risk Committee within the context of the Group s strategy, Risk Appetite and the Executive Risk Committee s terms of reference through reviewing the periodic reporting from the Executive Risk Committee; and 6.23. Review the minutes from the Executive Risk Committee. These will also detail whether KRIs or constraints have been exceeded. 7. Duties With Respect to The Internal Model 7.1. Challenge and approve the Internal Model Validation Report setting out whether or not the data / methods / assumptions / outputs are reasonable; 7.2. Review, challenge and approve the Internal Model Report; 7.3. Use the Internal Model results to review and recommend changes to the risk appetite, tolerance and to confirm risk exposures against risk tolerances; 7.4. Ensure the Internal Model is widely used and plays an important role in the economic and solvency capital assessment and allocation processes, including ORSA; as well as risk management, capital management, financial management, strategic planning, risk mitigation and investment strategy. 8. Duties With Respect to The Chief Risk Officer 8.1. Act as a reporting line, alongside internal line management reporting, for the Chief Risk Officer in respect of risk management and the oversight process at the highest level; 8.2. Recommend to the Board the appointment and/or removal of the Chief Risk Officer; 8.3. Provide input into the Chief Risk Officer s annual performance appraisal; 8.4. Review promptly all reports on the Company from the Chief Risk Officer; 8.5. Review and monitor management s responsiveness to the findings and recommendations of the Chief Risk Officer;

8.6. Provide the Chief Risk Officer with the right of direct access to the Chairman of the Board and to the Board Risk Committee; and 8.7. Meet the Chief Risk Officer at least once a year, without management being present, to discuss his/her remit and any issues arising. 9. Duties - Key Responsibilities (Matters Delegated) 9.1. The Committee has delegated certain responsibilities to the Executive Risk Committee. Details of these accountabilities are summarised below and detailed within the Executive Risk Committee s terms of reference: Key: Delegation = Escalation = Board Board Risk Committee Executive Risk Committee 9.1.1. Propose the Group s risk appetite for approval by the Board Risk Committee; 9.1.2. Formulate and communicate the Group s risk strategy and oversee the implementation and maintenance of the risk appetite; 9.1.3. Approve policy and minimum standards and ensure these are consistent with the risk strategy and reflect internal risks and changes in the regulatory and economic environment; 9.1.4. Reinforce Management's control awareness and make appropriate recommendations to the Board Risk Committee on all significant matters relating to the Group's risk appetite; 9.1.5. Aid Board decision making by advising, using output from the Internal Model, on alternative strategies; 9.1.6. Manage the allocation of the Group Economic Capital Risk Budget; 9.1.7. Operate at the strategic level of the business and provide oversight to significant constant risks, issues and emerging risks affecting the Group (noting any material breaches or significant issues and monitoring their resolution); 9.1.8. Ensure that risks that are outside the appetite are identified and mitigated in an appropriate manner; 9.1.9. Oversee any risk mitigation programmes agreed with the regulatory supervisor;

9.1.10. Carry out forward looking, economic assessment of the Group s capital requirements based on its assessment of the risks to which it is exposed; 9.1.11. Review the Group s procedures for identifying, assessing, monitoring and managing operational risk exposures; 9.1.12. Review Group level Internal Model kernel assumptions and make recommendations to the Board Risk Committee; 9.1.13. Use the Internal Model results to allocate capital; 9.1.14. Ensure Internal Model results are being used by the subordinate Committees to make pricing decisions, develop reinsurance strategies and develop other risk-mitigation strategies. 9.1.15. Ensure that the Internal Model has been integrated into the Group s decision making processes and is used to enhance the management of the Group; 9.1.16. Provide oversight to the policy framework to ensure it serves its purpose as a key control; 9.1.17. Have regard to applicable regulatory obligations and liaise with the Audit Committee as necessary in respect of these matters; 9.1.18. Where necessary, instruct Internal Audit to carry out an audit/review and define parameters for such reviews; 9.1.19. Keep under constant review the effectiveness of the Group s risk management infrastructure; 9.1.20. Consider, and approve where necessary, information that is presented with financial statements relating to risk management policies and key risk exposures and ensure it is in accordance with statutory requirements and financial reporting standards; 9.1.21. Review the Group s insurance risk, credit risk, interest rate risk, liquidity risk, market risk and operational risk exposures in relation to the Board's risk appetite and the Group's capital adequacy; 9.1.22. Provide leadership, direction and support in relation to the ongoing development and implementation of the internal risk and control framework for Solvency II compliance; and 9.1.23. Review and sign off relevant sections of public and private disclosure reports and documents as required under the Group s disclosure policy. 10. Committee Inputs 10.1. Reports from the Executive Risk Committee that assess the nature and extent of risks facing the Group;

10.2. An annual risk report from the Chief Risk Officer detailing the Group s risk profile in respect of performance against risk appetite, risk trends and risk concentrations; 10.3. Internal Model Report aligning the Internal Model with business strategy requirements and to reflect key changes in the business environment; 10.4. A periodic report from the Audit Committee commenting on: The Company s procedures for detecting fraud; The Company s procedures for the prevention of bribery; and The Company s whistle blowing policy and procedures. 10.5. Quarterly updates on Controls and Risk Key Performance Indicators (KPIs); 10.6. Updates from the Chairman of the Executive Risk Committee identifying any specific items that should be noted by the Board Risk Committee; and 10.7. Minutes of meetings from the Executive Risk Committee 11. Committee Outputs 11.1. Minutes must be circulated promptly to members of the Committee, including decisions taken and actions agreed; 11.2. Minutes will also be submitted for noting to the Board; 11.3. The Committee Chairman shall report to the Board on the Committee s proceedings after each meeting on all matters within its duties and responsibilities. 11.4. The Committee shall make whatever recommendations to the Board it deems appropriate on any area within its remit where action or improvement is needed. 11.5. An annual report to the Board, presenting a profile of the Group s key risks and associated controls; 11.6. A report of the Committee s activities and the Group s risk management and strategy that will be included in the Company s annual report; and 11.7. The Chairman will arrange to communicate with subordinate committees on any matters arising from the Board Risk Committee. 12. Management Information (MI) Requirements 12.1. The Board Risk Committee will have certain MI requirements to effectively discharge its duties. Due to the nature of business this Committee is tasked to monitor, the MI requirements are expected to change over time and therefore these MI requirements will be kept in a separate document.

13. Annual Review 13.1. An Annual Review will take place each year. It will incorporate an evaluation of members' attendance over the preceding year, an evaluation of the Committee s performance against its terms of reference and an assessment of the ongoing appropriateness of the membership. 13.2. The outcome of the review and any revisions to the terms of reference will be presented to the Committee and sent to the Board for approval. 14. Relationships with Other Committees 14.1. This Committee is required to maintain close communication with the Audit Committee. The Chairman of Audit Committee will be responsible for liaison with the Audit Committee but issue-specific responsibility for such communication will be decided on a case to case basis. 15. Escalation of Issues 15.1. The Board Risk Committee will refer to Board: Any matters outside the scope of its mandate; Any significant Risk Appetite breach; and Any matters that it considers to be material concern and require Board s attention. 16. Other Matters 16.1. The Committee shall: have access to sufficient resources in order to carry out its duties, including access to the Company secretariat for assistance as required; be provided with appropriate and timely training, both in the form of an induction programme for new members and on an ongoing basis for all members. 17. Authority 17.1. The Committee is authorised by the Board to obtain, at the Company s expense, outside legal or other professional advice on any matters within its terms of reference. October 2015