Governance, Ethics and the Future of Solvency Management

Introduction

Solvency management is no longer a narrow exercise in calculating capital ratios. It is a governance system through which an insurer identifies risk, allocates capital, protects policyholders, satisfies regulators and sustains confidence in the financial system. The global financial crisis, major catastrophes, pandemic losses, cyber incidents and climate-related events have demonstrated that technically adequate capital can still coexist with weak governance and poor ethical judgment.

A modern solvency framework therefore links four elements: risk measurement, capital adequacy, decision rights and accountability. The board must understand the insurer’s risk profile; management must operate within approved limits; actuarial, risk, compliance and audit functions must challenge decisions; and regulators must receive reliable information. At the same time, capital decisions must consider fairness to policyholders, employees, investors and wider society.

This chapter examines governance and ethics in solvency management, the three-lines model, actuarial and audit responsibilities, regulatory reporting, consumer fairness, ethical capital allocation, and emerging risks including climate change, cyber risk, pandemics and systemic interconnectedness.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Evaluate the board’s responsibilities for solvency and enterprise risk oversight.
2. Explain the three-lines model and distinguish the responsibilities of management, risk and compliance functions, and internal audit.
3. Assess the contribution and independence of actuarial, audit and supervisory functions.
4. Interpret regulatory reporting and solvency indicators critically.
5. Apply ethical principles to capital allocation, pricing, claims and consumer treatment.
6. Analyse climate, cyber, pandemic and systemic risks in solvency assessments.
7. Evaluate emerging solvency standards and propose sound governance practices.

1. Solvency as a Governance Outcome

An insurer is solvent when it can meet its obligations as they fall due and has sufficient economic resources to absorb adverse experience. Solvency is therefore both a balance-sheet condition and a behavioural outcome. Poor underwriting, excessive growth, weak reserving, inadequate reinsurance or misleading reporting may gradually undermine solvency even when reported capital initially appears comfortable.

A simplified solvency ratio is:

Eligible own funds are capital resources recognised by the applicable regulatory regime. The Solvency Capital Requirement (SCR) is the capital needed to withstand a prescribed adverse event or confidence-level loss over a specified horizon. The ratio is dimensionless because both numerator and denominator are monetary amounts. Its interpretation depends on the regulatory regime, valuation basis, diversification treatment and quality of capital.

A ratio above the regulatory minimum does not automatically prove soundness. The capital may be concentrated in instruments of low loss-absorbing quality, assumptions may be optimistic, or risks may be missing from the model. Boards should therefore consider the risk appetite statement, stress tests, liquidity, capital quality, data reliability and management actions alongside the ratio.

Economic, Regulatory and Internal Capital

Regulatory capital is determined under supervisory rules. Economic capital is the insurer’s own estimate of capital required for its actual risk profile, often based on a selected probability of ruin or solvency standard. Internal capital may be used for pricing, performance measurement, business planning and risk-adjusted remuneration.

These measures can differ because of:

• different valuation bases;
• different confidence levels and time horizons;
• recognition or exclusion of diversification benefits;
• different treatment of future management actions;
• differing views about liquidity and group support.

A mature insurer reconciles these measures rather than treating one as universally superior.

2. Board Oversight and Accountability

The board has ultimate responsibility for the insurer’s strategy, risk appetite, capital adequacy and control environment. It does not calculate every reserve or approve every policy, but it must ensure that competent systems and independent challenge exist.

Core board responsibilities

The board should:

1. Approve the business strategy and risk appetite.
2. Ensure that capital planning is integrated with strategy and dividends.
3. Review the Own Risk and Solvency Assessment (ORSA) or equivalent process.
4. Challenge material assumptions in reserves, internal models and stress tests.
5. Monitor risk concentrations, reinsurance dependence and liquidity.
6. Confirm that senior executives have suitable competence and integrity.
7. Oversee regulatory reporting and disclosure controls.
8. Establish escalation procedures for breaches and emerging risks.
9. Ensure that remuneration does not encourage imprudent risk-taking.
10. Consider policyholder interests and long-term sustainability.

The board’s role is one of informed oversight, not passive approval. A board that receives technically complex reports but cannot question them effectively has not discharged its responsibility. The chair should promote constructive challenge, while committee structures should prevent important issues from being fragmented across committees.

Board committees

An audit committee usually oversees financial reporting, external audit, internal audit and control deficiencies. A risk committee may oversee enterprise risk, capital, stress testing, model governance and emerging risks. An actuarial or technical committee may review reserving and underwriting assumptions where the scale and complexity of the insurer justify it. Committee delegation does not remove the board’s accountability.

Effective board information is concise but decision-useful. It should distinguish actual results from forecasts, risk limits from risk appetite, model uncertainty from ordinary volatility, and known exposures from unquantified risks.

3. The Three-Lines Model

The three-lines model clarifies responsibility without creating artificial barriers between functions.

First line: management and operational control

Business units own the risks arising from underwriting, claims, investments, distribution, technology and operations. They design and operate day-to-day controls, monitor performance and escalate breaches. Risk ownership cannot be transferred to the risk department merely because that department produces reports.

Second line: risk, compliance and specialist oversight

The second line develops frameworks, advises management, monitors limits, challenges risk-taking and reports independently to senior management and the board. It commonly includes enterprise risk management, compliance, capital management, model risk and financial crime oversight.

The second line should be sufficiently independent from revenue-generating functions. However, it must remain close enough to the business to understand practical risks and avoid producing purely theoretical controls.

Third line: internal audit

Internal audit provides independent and objective assurance on governance, risk management and internal control. It evaluates whether the first and second lines are designed and operating effectively. Internal audit should report functionally to the audit committee and have unrestricted access to records and personnel.

Internal audit does not own risks, operate controls or approve management decisions. If it does so, its later assurance becomes compromised.

Complementarity and limitations

The three-lines model is a responsibility framework, not a guarantee of control. It can fail when lines overlap without clarity, when second-line staff lack authority, when internal audit lacks expertise, or when the board assumes that the existence of three lines proves effective governance. External audit and regulators are important independent actors, but they do not replace the three internal lines.

4. Actuarial, Audit and Model Governance

The actuarial function

The actuarial function typically contributes to technical provisions, underwriting policy, reinsurance arrangements, product design, capital modelling and solvency opinions. It should assess whether assumptions are reasonable, data are adequate and methods are appropriate for the liabilities being measured.

For a simplified insurance liability, the present value of expected future cash flows can be represented as:

Here, E(Cₜ) is the expected net cash flow at time t, rₜ is the discount rate applicable to that period, and n is the final projection period. The formula assumes that expected cash flows and discount rates are appropriately estimated and that the liability is valued on a specified basis. It does not by itself capture all risk margins, options, guarantees or non-financial uncertainty.

Actuarial independence is especially important where actuaries are pressured to reduce reserves to meet earnings or capital targets. The actuary should document assumptions, sensitivity, uncertainty and the effect of alternative methods. Professional judgment remains necessary because historical data may not represent a changing risk environment.

Internal and external audit

Internal audit evaluates controls and governance. External audit provides an opinion on financial statements under applicable auditing standards. Neither function guarantees future solvency. An unqualified financial statement opinion means that the statements are fairly presented according to the relevant reporting framework; it is not a certificate that the insurer will survive a catastrophe.

Model governance

Internal models can improve risk sensitivity but may create model risk. A sound model governance framework includes:

• documented purpose, scope and limitations;
• data-quality controls and lineage;
• independent validation;
• performance monitoring and back-testing where possible;
• change controls and version management;
• clear approval authority;
• controls against inappropriate model overrides;
• communication of uncertainty to decision-makers.

Models should support judgment, not conceal it. A model that is sophisticated but poorly understood may be more dangerous than a transparent simplified model.

5. Regulatory Reporting and Supervisory Communication

Regulatory reporting transforms internal information into standardized evidence for supervisory comparison. Typical submissions include balance-sheet data, technical provisions, eligible own funds, capital requirements, risk concentrations, governance information and material incidents.

Reporting quality has three dimensions:

1. Accuracy: figures agree with underlying records and approved methods.
2. Completeness: relevant exposures and obligations are not omitted.
3. Timeliness: information reaches the supervisor within required deadlines.

A useful reporting control chain is: data capture → validation → actuarial and finance review → risk challenge → executive certification → board or committee oversight → submission → remediation of queries.

Regulatory reports can create perverse incentives if management focuses on the reporting date rather than the underlying risk. Temporary asset sales, delayed claims recognition or short-term reinsurance arrangements may improve a ratio without improving economic resilience. Supervisors increasingly examine the substance of transactions and the quality of governance behind reported numbers.

The ORSA is particularly important because it connects strategy and solvency. It should examine the insurer’s own risk profile, current and prospective capital position, stress scenarios, management actions and business plan. It should not be a compliance document prepared after decisions have already been made.

6. Consumer Fairness and Ethical Capital Decisions

Insurance involves information asymmetry and often significant vulnerability. Customers may not understand exclusions, renewal changes, claims procedures or the consequences of underinsurance. Ethical solvency management therefore extends beyond avoiding insolvency.

Fair treatment principles

Fair treatment requires that insurers:

• design products for an identifiable target market;
• communicate coverage, exclusions and limitations clearly;
• use pricing and underwriting factors that are relevant and defensible;
• handle claims consistently and promptly;
• provide accessible complaints and appeal mechanisms;
• protect personal data;
• avoid unfair discrimination and exploitative sales practices;
• consider the needs of vulnerable customers.

Capital preservation cannot justify arbitrary claims denial or excessive deterioration in service. Conversely, generous promises unsupported by capital are also unethical because they transfer risk to future policyholders, guaranty schemes or taxpayers.

Ethical capital allocation

Capital allocation affects product availability, premiums, dividends, reinsurance purchases, technology investment and claims capacity. A narrow shareholder-return objective may encourage underinvestment in resilience. A broader stewardship approach considers policyholder protection, intergenerational fairness and financial stability.

Risk-adjusted return measures can assist decision-making. A simplified return on risk-adjusted capital is:

Expected profit should be defined consistently, for example after expected claims, expenses, reinsurance cost and relevant taxes. Economic capital is the capital assigned to the activity under the chosen framework. RAROC is useful for comparison but should not be the sole decision rule because it may reward high-risk businesses, ignore conduct harm and depend heavily on model assumptions.

Ethical review should ask: Who benefits? Who bears downside risk? Are assumptions transparent? Does the decision remain defensible under stress? Does it protect customers who cannot easily switch providers?

7. Emerging Risks and the Future of Solvency Management

Climate risk

Climate risk has physical, transition and liability dimensions. Physical risk includes floods, heat, storms and wildfire. Transition risk arises from changes in technology, regulation, energy markets and consumer behaviour. Liability risk may arise from claims against organisations alleged to have contributed to environmental harm.

Climate risk affects underwriting, reserving, asset values, reinsurance, liquidity and operational continuity. Historical catastrophe data may be unreliable if hazard frequency and severity are changing. Insurers should use scenario analysis, geographic concentration mapping, catastrophe models, asset stress tests and forward-looking underwriting policies.

Climate scenarios should not be presented as precise forecasts. They are structured explorations of possible futures, usually involving assumptions about warming, policy response, economic activity and adaptation.

Cyber risk

Cyber risk can generate direct losses, business interruption, data-protection liabilities, systemic contagion and accumulation across apparently unrelated policies. A common weakness is to model cyber as an isolated operational event when a cloud provider, software vulnerability or payment network may affect many insureds simultaneously.

Solvency governance should include cyber underwriting standards, aggregation monitoring, incident response, third-party controls, data backups, access management and scenario testing. Boards should understand the difference between cyber insurance risk and the insurer’s own cyber resilience.

Pandemic risk

Pandemics challenge assumptions about dependence, correlation and policy wording. Mortality, morbidity, business interruption, event cancellation, credit, market and operational risks may intensify together. Policy interpretation, exclusions and government intervention can become major sources of uncertainty.

Pandemic scenarios should test claims, premium collection, asset liquidity, staffing, service continuity, reinsurance recoverability and legal disputes. Diversification benefits may be materially lower during a global shock.

Systemic and interconnected risk

Systemic risk is the possibility that distress in one institution, market or infrastructure affects the wider financial system. Insurers may contribute to systemic risk through common asset exposures, derivatives, securities lending, reinsurance chains, critical services or rapid asset sales. They may also be affected by banks, reinsurers, brokers, cloud providers and payment systems.

Systemic analysis requires network thinking. Important questions include:

• Which counterparties are critical?
• What happens if several entities fail together?
• Which assets are liquid only in normal markets?
• Can reinsurance recoveries be relied upon under stress?
• Are exposures hidden through common vendors or financial instruments?

8. Integrated Stress Testing and Scenario Governance

Stress testing evaluates the effect of adverse but plausible conditions. A scenario should identify assumptions, transmission channels, management actions and residual uncertainty. For example, a climate-cyber scenario might combine a severe storm, telecommunications failure, claims surge and investment-market disruption.

A simple capital projection can be expressed as:

Here, Capital₀ is opening capital, Profit₁ is profit before the specified stress losses, Dividends₁ are distributions, CapitalActions₁ includes approved capital raising or restructuring, and Losses₁ represents stress losses. This is an illustrative identity, not a complete solvency model. It excludes detailed tax, valuation, default, liquidity and regulatory effects unless those are incorporated into the terms.

Good scenario governance prevents management actions from becoming unrealistic rescue assumptions. A capital raise may be unavailable during a market crisis; a premium increase may be constrained by competition or regulation; and asset sales may crystallize losses. The board should distinguish actions that are already approved and operational from actions that are merely possible.

9. Illustrative Case: Meridian Mutual Insurance

The following is a fictional illustrative case.

Background

Meridian Mutual is a regional insurer writing property, motor and small-business cover. Its reported solvency ratio is 168%, well above a regulatory threshold of 100%. The board is considering a large dividend because recent profits have been strong.

Problem

The chief risk officer identifies three concerns. First, property exposure is concentrated in coastal regions where flood risk is increasing. Second, a common cloud provider supports claims and policy administration. Third, the internal model grants substantial diversification benefits between property, market and operational risks. Actuaries also report uncertainty in claims inflation and repair costs.

Analysis

The board commissions an integrated ORSA review. A severe flood scenario increases claims and reinsurance recoverables. Simultaneous cloud outage delays claims settlement and increases operating costs. Asset-market stress reduces the value of investment holdings. The revised analysis reduces the solvency ratio to 112% after realistic management actions. A more severe but plausible scenario produces a ratio below 100% and significant liquidity pressure.

The review also identifies governance weaknesses: the dividend proposal was based on the central forecast, the board had not received a vendor concentration report, and the model documentation did not explain the correlation assumptions clearly.

Approach and solution

The board defers the dividend and approves a resilience plan. Actions include:

• revising flood underwriting and geographic limits;
• purchasing targeted reinsurance while testing counterparty quality;
• establishing a second claims-processing capability;
• improving cloud-service exit and recovery arrangements;
• reducing reliance on optimistic diversification assumptions;
• strengthening model validation and board training;
• introducing customer communication standards for catastrophe claims;
• establishing capital triggers linked to forward-looking scenarios.

Outcome

The reported solvency ratio remains lower in the short term because the insurer holds more capital and recognises additional risk. However, liquidity resilience improves, the board receives clearer information, and the insurer is better positioned to continue paying claims after a major event. The decision also protects policyholders from the consequences of distributing capital that may be needed for recovery.

Learning points

1. A high solvency ratio can conceal concentration and model risk.
2. Operational and third-party risks can become solvency risks.
3. Diversification benefits require evidence and periodic validation.
4. Deferring a dividend may be economically and ethically rational.
5. ORSA is most useful when it changes strategy before a crisis.

10. Evolving Solvency Standards and Best Practice

Solvency regulation is moving toward risk-sensitive capital, total-balance-sheet assessment, stronger governance, supervisory reporting, recovery and resolution planning, and explicit treatment of climate and operational resilience. International frameworks increasingly combine quantitative requirements with qualitative governance standards.

Important developments include:

• greater use of stress and scenario analysis;
• capital requirements for insurance groups and systemic exposures;
• enhanced recovery planning and policyholder continuity arrangements;
• operational resilience and third-party risk oversight;
• sustainability and climate-related disclosures;
• stronger data governance and model-risk controls;
• supervisory attention to artificial intelligence and algorithmic fairness.

Artificial intelligence can improve claims triage, fraud detection and risk monitoring, but it may produce discriminatory outcomes, opaque decisions or excessive dependence on historical data. Governance should require explainability proportionate to impact, human review of adverse decisions, data-quality testing, cybersecurity and documented accountability. An AI system should not be allowed to override legal rights or ethical obligations merely because it improves a statistical performance measure.

Best practice is ultimately institutional rather than technological. It includes a capable and diverse board, clear accountability, independent challenge, reliable data, transparent models, credible stress testing, ethical incentives, robust escalation and a culture in which bad news can be reported without retaliation.

Challenges and Limitations

Solvency governance faces several persistent limitations. Risk models are dependent on data that may be sparse, biased or non-stationary. Extreme events are difficult to estimate because the most important observations are rare. Regulatory metrics may encourage optimization around rules rather than genuine resilience. Governance standards can become procedural checklists. Boards may suffer from information overload, while technical experts may struggle to communicate uncertainty.

No framework eliminates judgment. The objective is to make judgment visible, challengeable and accountable. Insurers should therefore document uncertainty, compare alternative assumptions, monitor outcomes and revise frameworks as evidence changes.

Chapter Summary

Solvency management is a governance outcome as much as a capital calculation. The board is accountable for strategy, risk appetite, capital adequacy, ORSA, reporting quality and policyholder protection. The three-lines model assigns risk ownership to management, oversight and challenge to risk and compliance functions, and independent assurance to internal audit.

Actuarial work supports reliable technical provisions, underwriting and capital assessment, but must remain independent and transparent about uncertainty. Audit and model governance strengthen confidence without guaranteeing future solvency. Regulatory reporting must be accurate, complete and timely, while ethical capital decisions must consider customers, vulnerable groups and the long-term consequences of distributions and risk transfer.

Climate, cyber, pandemic and systemic risks challenge historical data, diversification assumptions and conventional solvency models. Scenario analysis, operational resilience, concentration monitoring and credible management actions are therefore essential. Future standards will increasingly integrate quantitative capital, qualitative governance, sustainability, technology risk and recovery planning. Effective solvency management is characterised by informed challenge, transparent assumptions and responsible stewardship.

Key Terms

Solvency: The ability of an insurer to meet obligations as they fall due and absorb adverse losses.

Eligible Own Funds: Capital resources recognised for regulatory solvency purposes.

Solvency Capital Requirement: The prescribed capital amount intended to absorb defined adverse risk.

Economic Capital: Internally assessed capital required for an insurer’s actual risk profile.

Risk Appetite: The level and type of risk an organisation is willing to accept.

ORSA: Own Risk and Solvency Assessment linking risk, strategy and prospective capital.

Three-Lines Model: A framework separating operational ownership, oversight and independent assurance.

Actuarial Function: A specialist function assessing liabilities, underwriting, reinsurance and capital-related matters.

Model Risk: The risk that a model is incorrect, misused or poorly governed.

Technical Provisions: The recognised value of expected insurance obligations and associated risk adjustments.

Regulatory Reporting: Structured information submitted to supervisory authorities.

Consumer Fairness: Treatment that is transparent, appropriate, non-exploitative and responsive to customer needs.

RAROC: Return on risk-adjusted capital.

Climate Risk: Financial risk arising from physical, transition and liability effects of climate change.

Cyber Risk: Risk arising from attacks, failures or vulnerabilities in digital systems and data.

Pandemic Risk: Correlated health, economic, operational and insurance losses arising from widespread disease.

Systemic Risk: Risk that distress propagates across institutions, markets or critical infrastructure.

Stress Testing: Evaluation of financial effects under adverse but plausible scenarios.

Operational Resilience: Ability to continue critical services during disruption.

Capital Quality: The loss-absorption capacity, permanence and reliability of capital instruments.

Review Questions

Short Answer Questions

1. Why is solvency management considered a governance outcome?
2. What are the principal responsibilities of the board in solvency oversight?
3. Distinguish the second and third lines of the three-lines model.
4. Why can a high solvency ratio fail to demonstrate strong resilience?
5. Identify three ways climate risk can affect an insurer.

Long Answer Questions

1. Explain how the three-lines model supports effective insurance governance and discuss its limitations.
2. Evaluate the role of the actuarial function in technical provisions, capital assessment and ethical decision-making.
3. Discuss the relationship between regulatory capital, economic capital and internal capital.
4. Explain why consumer fairness should be integrated into solvency management.
5. Analyse how climate, cyber and pandemic risks challenge traditional solvency models.

Analytical / Application Questions

1. An insurer has a solvency ratio of 155% but concentrated catastrophe exposure, weak cloud-provider controls and optimistic diversification assumptions. Propose a board-level action plan and justify the order of priorities.
2. A board is considering a large dividend after a profitable year. Stress testing shows that a severe but plausible scenario would reduce capital close to the regulatory minimum. Evaluate the ethical, financial and regulatory considerations.
3. Design an integrated scenario combining a cyber incident with a natural catastrophe. Identify transmission channels, affected governance functions, relevant management actions and indicators that should be reported to the board.

Multiple Choice Questions with Answers

Question 1

Which body has ultimate responsibility for an insurer’s strategy, risk appetite and capital adequacy?

A. The claims department

B. The board of directors

C. The external auditor

D. The reinsurance broker

Correct Answer: B. The board of directors

Question 2

In the three-lines model, which function provides independent assurance on governance, risk management and controls?

A. Business operations

B. Risk ownership

C. Internal audit

D. Distribution management

Correct Answer: C. Internal audit

Question 3

A solvency ratio is calculated as eligible own funds divided by which amount?

A. Gross written premium

B. Solvency Capital Requirement

C. Total claims paid

D. Investment income

Correct Answer: B. Solvency Capital Requirement

Question 4

What is a central actuarial responsibility in solvency management?

A. Approving all dividends

B. Operating the internal audit function

C. Assessing technical provisions and related assumptions

D. Setting monetary policy

Correct Answer: C. Assessing technical provisions and related assumptions

Question 5

Which statement best describes the ORSA?

A. It is only a historical claims report

B. It links the insurer’s own risks, strategy and prospective capital position

C. It replaces the board’s responsibilities

D. It is exclusively an external audit opinion

Correct Answer: B. It links the insurer’s own risks, strategy and prospective capital position

Question 6

Why can diversification benefits become unreliable during a pandemic?

A. All risks necessarily become zero

B. Previously separate risks may become highly correlated

C. Regulators remove all capital requirements

D. Premiums automatically increase enough to offset losses

Correct Answer: B. Previously separate risks may become highly correlated

Question 7

Which is an example of transition climate risk?

A. A flood damaging insured property

B. A change in regulation affecting carbon-intensive assets

C. A routine claims payment

D. A reduction in policy administration costs

Correct Answer: B. A change in regulation affecting carbon-intensive assets

Question 8

Using RAROC = Expected\ Profit ÷ Economic\ Capital, what is RAROC when expected profit is 12 million and economic capital is 60 million?

A. 5%

B. 12%

C. 20%

D. 72%

Correct Answer: C. 20%

Question 9

Which action best protects the independence of internal audit?

A. Allowing it to own operational controls

B. Making it report functionally to the audit committee

C. Making it responsible for sales targets

D. Allowing management to delete unfavourable findings

Correct Answer: B. Making it report functionally to the audit committee

Question 10

Why is a high reported solvency ratio not by itself conclusive evidence of resilience?

A. Ratios never use monetary values

B. It may conceal weak capital quality, concentration or model uncertainty

C. Solvency ratios measure only customer satisfaction

D. A high ratio always indicates excessive claims

Correct Answer: B. It may conceal weak capital quality, concentration or model uncertainty