Risk management

(1) Insurance undertakings must have an effective risk management system that is well integrated into the organisational structure and decision-making processes of the undertaking, and that duly takes into account, through appropriate internal reporting, the information needs of the persons who actually direct the undertaking or hold other key functions. The risk management system must comprise the strategies, processes, and internal reporting procedures necessary to identify, assess, monitor, and manage risks to which the undertaking is or could be exposed, and to report meaningfully on those risks. It must enable continuous risk management, individually and on an aggregated basis, taking into account the interdependencies between risks. At the request of the supervisory authority, insurance undertakings must draw up a recovery plan (general recovery plan). The general recovery plan must describe scenarios that could lead to the undertaking being jeopardised, and set out the measures intended to address them.
(2) The strategies to be developed include, in particular, a risk strategy aligned with the management of the undertaking that takes into account the nature, scale, and complexity of the business conducted and the risks connected with it.
(3) Where insurance undertakings apply the matching adjustment under section 80 or the volatility adjustment under section 82, they must prepare a liquidity plan projecting the incoming and outgoing cash flows in relation to the assets and liabilities subject to those adjustments.
(4) Where the volatility adjustment under section 82 is applied, the written risk management policies under section 23(3) must include policies on the criteria for applying the volatility adjustment.
(5) The risk management system must cover all risks of the insurance undertaking and must in particular cover the following areas: 1. underwriting of insurance risks and the establishment of provisions, 2. asset-liability management, 3. investments, in particular derivatives and instruments of comparable complexity, 4. the management of liquidity risk and concentration risk, 5. the management of operational risks, and 6. reinsurance and other risk-mitigation techniques. The internal risk management policies must, at a minimum, set out requirements for the areas named.
(6) In respect of investment risk, insurance undertakings must demonstrate that they comply with the requirements of section 124.
(7) In respect of asset-liability management, insurance undertakings must regularly assess 1. the sensitivity of their technical provisions and eligible own funds to the assumptions underlying the extrapolation of the relevant risk-free interest rate term structure under section 7, point 21; 2. where the matching adjustment under section 80 is applied: a) the sensitivity of their technical provisions and eligible own funds to the assumptions underlying the calculation of the matching adjustment, including the calculation of the fundamental spread under section 81, point 2, and the potential effect of a forced sale of assets on their eligible own funds; b) the sensitivity of their technical provisions and eligible own funds to changes in the composition of the assigned portfolio of assets; c) the effect of a reduction of the matching adjustment to zero; 3. where the volatility adjustment under section 82 is applied: a) the sensitivity of their technical provisions and eligible own funds to the assumptions underlying the calculation of the volatility adjustment, and the potential effect of a forced sale of assets on their eligible own funds, b) the effect of a reduction of the volatility adjustment to zero. Insurance undertakings must submit the assessments named in the first sentence to the supervisory authority annually as part of the information to be submitted under section 43. Where a reduction of the matching adjustment or the volatility adjustment to zero would result in non-compliance with the Solvency Capital Requirement, the undertaking must further submit an analysis of the measures it could apply in such a situation to restore eligible own funds to the level required to comply with the Solvency Capital Requirement, or to reduce the risk profile so that compliance with the Solvency Capital Requirement is restored.
(8) Insurance undertakings must establish an independent risk management function that is structured in such a way as to materially promote the implementation of the risk management system. For insurance undertakings using an internal model, the risk management function additionally has the task of developing, implementing, testing, validating, and documenting the internal model, including subsequent changes. It also analyses the performance of the internal model and reports to the management board, in summarised form, on that analysis, provides suggestions for improving the model, and keeps it informed of corrective measures for identified weaknesses or deficiencies.