Risk Management and Internal Controls in Corporate Failures: A Case Study Analysis

ICP 8: Risk Management and Internal Controls Conor Donaldson IAIS Head of Implementation Santo Domingo, Dominican Republic, 9 April

1.Case of HIH 2.Effective risk management why it matters 3.ICP 8 4.Conclusions 2

Case of HIH background information Founded by Ray Williams in 1968 Australia s 2nd largest non-life insurer Workers compensation, liability and indemnity In Australia, UK and California (USA) In late 1990s, asset of A$7 billion, revenue of A$4 billion and operating profit of Australian$ 60 million Bankrupt in 2001 Largest corporate failure in Australia *case based on the report of the HIH Royal Commission (www.hihroyalcom.gov.au) 3

Case of HIH areas of deficiency (1) Ray Williams dominant CEO with much discretion no limits on CEO s authority (investments, donations etc.) Powerless Board Lack of critical analysis or challenge of Williams as CEO No major involvement in the process of determining the scope of information presented to the Board Lack of strategy, Board of Directors did not understand business or strategy No real discussions of the strategy by the Board No involvement when entering or retreating from overseas *case based on the report of the HIH Royal Commission (www.hihroyalcom.gov.au) 4

Case of HIH areas of deficiency (2) Other Senior Management without accountability Performance review was not tied to remuneration process Reckless underwriting and fictitious financial reporting Very dependant on consulting actuary when setting the amount of reserve External auditor with conflicts of interest, lack of actuarial knowledge to monitor the sufficiency of reserves HIH Royal Commission (2003, xvii) 5

Case of HIH areas of deficiency (3) Why was there such serious under-reserving and why were the risks not properly priced? The answer here is that HIH was mismanaged. The factors contributing to the mismanagement of the group ... are many, varied, and complex. They are epitomized by a lack of attention to detail, a lack of accountability for performance, and a lack of integrity in the company s internal processes and systems. HIH Royal Commission (2003, xvii) 6

1.Case of HIH 2.Effective risk management why it matters 3.ICP 8 4.Conclusions 7

Effective Risk Management Why it matters Many financial losses occurred due to lack of proper risk governance, risk management and internal controls. Examples of weaknesses: Lack of adequate management oversight and accountability, Failure to develop a strong control culture Inadequate recognition and assessment of risks Absence or failure of key control structures and activities Inadequate communication of information between different levels of management, especially the upward communication of problems Inadequate or ineffective audit programs and monitoring activities 8

1.Case of HIH 2.Effective risk management why it matters 3.ICP 8 4.Conclusions 9

ICP 8: Risk Management and Internal Controls The Supervisor requires an insurer to have, as part of its overall corporate governance framework, effective systems of risk management and internal controls, including effective functions for risk management, compliance, actuarial matters and internal audit. General Observations: 1. The Supervisor sets requirements. 2. The ultimate responsibility lies with the Board and Senior Management 10

ICP 7 on Risk management and internal controls ICP 7 requires to a corporate governance framework Board of Directors responsibilities should include: Set strategies Define the roles of key functions. Oversee risk management and internal controls. Ensure reliable financial reporting Ensure adequate governance 11

Typical structure of the systems of risk management and internal controls Strategies setting out the approach of the insurer for dealing with specific areas of risk and legal and regulatory obligations. Policies defining the procedures and other requirements that members of the Board and employees need to follow. Processes for the implementation of the insurer s strategies and policies. Controls to ensure that such strategies, policies and processes are in fact in place, are being observed and are attaining their intended objectives. 12

ICP 8: Controls Effective systems of risk management and internal controls Risk Compliance function Actuarial function Internal audit function management function 13

Control functions - requirements Led by a person with seniority and expertise. The key control functions directly report to the Board Adequate resources, experience, skills and knowledge. In case of outsourcing: to retain at least the same degree of oversight. 14

1.Case of HIH 2.Effective risk management why it matters 3.ICP 8 4.Conclusions 15

Conclusions Effective risk management and internal controls are an integral part of corporate governance. The Board is ultimately responsible for ensuring effective systems of risk management and internal controls are established and implemented. As part of the effective risk management system, the control functions need necessary authority, independence and resources. The supervisor plays an important role by: establishing the requirements regarding risk management proactively assessing whether the applicable requirements are being met. 16

What is the IAIS doing? 5 Year Partnership with the International Actuarial Association (IAA) and Access to Insurance Initiative (A2ii) to support supervisory capacity building signed in November 2017 Assessment of ICPs 4, 5, 7 and 8 planned to launch in 2018 Updating core curriculum (with inclusion of new modules for actuarial topics) On-going support for regional trainings / seminars 17

Contact information Conor Donaldson Head of Implementation International Association of Insurance Supervisors Centralbahnplatz 2 c/o BIS tel: +41 61 280 8602 mobile: +41 76 350 8602 Skype: conordonaldson e-mail: conor.donaldson@bis.org 18