11. Corporate Governance, Compliance and Enterprise Risk

Introduction and Context

Insurance is a promise whose performance may occur years after the premium is received. Policyholders therefore depend not only on the financial strength of an insurer but also on the quality of its governance, controls, professional judgment and regulatory discipline. A company may report adequate capital and still be vulnerable if its board does not understand underwriting risk, if incentives encourage excessive growth, if actuarial assumptions are weak, or if compliance concerns are ignored.

Corporate governance in insurance is consequently more than the formal division of authority between shareholders, directors and management. It is the system through which the insurer is directed, controlled and held accountable. It determines who may make decisions, what information must reach the board, how conflicts are managed, how risks are measured, and how failures are corrected. Compliance provides assurance that the insurer observes applicable law, regulations, licence conditions, supervisory directions and internal standards. Enterprise risk management connects these responsibilities by identifying the risks that could impair solvency, policyholder protection, operational continuity or public confidence.

The chapter adopts a general international perspective. Specific fit-and-proper tests, committee requirements, reporting forms and solvency rules differ across jurisdictions; students must therefore read this framework together with the legislation and supervisory standards applicable in the relevant country.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Explain the relationship between corporate governance, compliance and enterprise risk management in insurance.

2. Evaluate board and senior-management accountability, including fit-and-proper expectations.

3. Apply the three-lines model to insurance operations and control functions.

4. Design a risk-appetite, internal-control and regulatory-reporting framework.

5. Explain the roles of actuarial, audit, compliance and risk functions.

6. Analyse whistleblowing, ethical conduct, technology and emerging governance risks.

7. Recommend governance improvements in an applied insurance scenario.

Why Governance Has Special Significance in Insurance

Insurers manage a distinctive combination of uncertainty, long time horizons and information asymmetry. Policyholders usually cannot assess reserving methods, reinsurance structures, investment risks or claims-handling practices directly. The insurer must therefore act as a responsible fiduciary-like custodian of promises made to customers. Governance failures can remain hidden until a catastrophe, market shock, litigation event or mass lapse exposes them.

Several characteristics make insurance governance particularly demanding. First, liabilities are often estimated rather than immediately known. Claims reserves and technical provisions depend on data, models and assumptions. Secondly, premiums may be collected long before claims are paid, creating opportunities and responsibilities in investment management. Thirdly, solvency is affected by correlations among underwriting, market, credit, liquidity, operational and conduct risks. Finally, an insurer’s failure can harm policyholders who cannot easily replace protection after an adverse event.

Good governance must therefore protect policyholders while supporting sustainable value creation. It should not prevent all risk-taking; insurance necessarily involves risk-taking. Its purpose is to ensure that risks are understood, priced, authorised, monitored and supported by adequate capital and controls.

The Governance Architecture: Accountability from Board to Operation

The board has ultimate responsibility for the insurer’s strategy, financial soundness, risk profile and compliance culture. It may delegate tasks, but delegation does not eliminate accountability. Directors should approve the business strategy, risk appetite, capital plan, remuneration principles, major outsourcing arrangements and policies for conflicts of interest. They must also challenge management rather than merely receive and endorse reports.

A capable board normally combines insurance, actuarial, finance, investment, technology, legal, risk and consumer-protection expertise. Independence is important because directors must be able to question dominant executives and controlling shareholders. Board committees—such as audit, risk, remuneration and nomination committees—can improve scrutiny, but committees are aids to governance, not substitutes for collective board responsibility.

Senior management converts approved strategy into operations. The chief executive is responsible for implementation, while executives responsible for underwriting, claims, investments, finance, information security, actuarial work, compliance and risk must operate within clearly defined authorities. Accountability statements, delegated-authority matrices and documented escalation thresholds reduce ambiguity.

Fit-and-Proper Requirements

A fit-and-proper regime seeks to ensure that persons who direct or control an insurer are suitable for their responsibilities. Fitness commonly concerns competence, qualifications and relevant experience. Propriety concerns honesty, integrity, reputation, financial soundness and willingness to comply with legal and ethical duties. Supervisors may examine criminal or regulatory history, conflicts of interest, bankruptcy, previous failures of governance and the accuracy of information supplied in an appointment process.

Fit-and-proper assessment is not a one-time recruitment exercise. It should continue throughout the appointment. A director may become unsuitable through undisclosed conflicts, persistent neglect of duties, misleading disclosures or inability to devote adequate time. The insurer should maintain succession plans, periodic declarations, conflict registers and training records. A technically brilliant executive who cannot challenge poor conduct is not necessarily fit for a control-sensitive role.

The Three-Lines Model in an Insurer

The three-lines model clarifies how responsibility for risk and control is distributed.

The first line consists of business and operational management. Underwriters, claims managers, distribution heads, investment teams and technology managers own the risks arising from their activities. They must identify risks, follow approved procedures, maintain records and correct deficiencies. Risk ownership cannot be transferred to the risk or compliance department merely because those departments provide advice.

The second line comprises specialist oversight functions, principally risk management and compliance, and in some organisations financial control, information security or actuarial oversight. These functions establish frameworks, advise management, monitor adherence, analyse exposures and escalate material concerns. They require sufficient independence, access to information and authority to challenge the first line.

The third line is internal audit. Internal audit provides independent, risk-based assurance on governance, risk management and internal controls. It should have direct access to the audit committee and should not design or operate controls that it later audits. External audit, while important, is not a replacement for internal audit or management’s own control responsibilities.

The model is useful only when roles are genuinely distinct. A small insurer may combine personnel, but it should preserve independence of judgment and avoid self-review. The board must periodically assess whether reporting lines, budgets and access arrangements permit effective challenge.

Compliance Management as a Management System

Compliance is often misunderstood as a legal checklist. A mature compliance function operates as a management system that translates external obligations into internal actions. Its activities include regulatory horizon scanning, obligation mapping, policy drafting, advice on products and distribution, training, monitoring, breach management and regulatory liaison.

An effective compliance framework begins with a regulatory inventory. Each obligation should be linked to an accountable owner, a control, evidence of performance, a testing frequency and an escalation route. For example, a requirement concerning product disclosure may be mapped to approved wording, staff training, system controls, sample testing and a customer-remediation procedure.

Compliance risk should be assessed according to the potential effect of non-compliance. Relevant consequences include customer harm, financial penalties, licence restrictions, litigation, remediation costs and reputational damage. Monitoring should be proportionate and risk-based. High-risk areas—such as sales incentives, claims repudiation, sanctions screening, market conduct, privacy and outsourcing—usually require more frequent testing than low-risk administrative matters.

A breach-management process should distinguish between isolated errors and systemic failures. It should record the event, contain immediate harm, determine root cause, assess whether notification is required, provide remediation and verify that corrective action is effective. Concealing a breach often creates a more serious governance failure than the original error.

Internal Control and Assurance

Internal control is the set of policies, procedures, behaviours and systems designed to provide reasonable—not absolute—assurance that objectives will be achieved. Controls address strategic, reporting, operational, compliance and safeguarding objectives. Typical controls include segregation of duties, approval limits, reconciliations, access restrictions, exception reports, independent valuations, data-quality checks and business-continuity arrangements.

A strong control environment begins with tone at the top. The board and executives should demonstrate that accurate reporting and fair customer treatment take priority over short-term volume. Risk assessment identifies threats; control activities respond to them; information and communication make control knowledge available; monitoring tests whether controls continue to work.

Controls may be preventive, detective or corrective. A system restriction preventing an unauthorised payment is preventive. A reconciliation identifying a payment error is detective. A customer-remediation plan is corrective. Overly complex controls can create workarounds, while weak controls may leave material exposures undetected. Management should therefore evaluate both design effectiveness and operating effectiveness.

Actuarial, Risk and Audit Functions

The actuarial function is central to insurance governance because pricing, reserving, capital modelling, reinsurance analysis and product design depend on actuarial judgment. The responsible actuarial professional should have access to reliable data, document assumptions, conduct experience analysis, assess uncertainty and communicate limitations. Independence is especially important when the actuary reviews assumptions developed by business units or evaluates reserve adequacy.

The actuarial function does not own every risk associated with an insurance product. It provides expert analysis and challenge, while management remains responsible for decisions. Boards should understand that a best estimate is not a guarantee and that model outputs are sensitive to assumptions, data quality and changes in claims behaviour.

The risk function develops the enterprise risk-management framework, aggregates exposures and evaluates whether the overall profile remains within appetite. It should assess stress scenarios, emerging risks, concentrations and correlations. The chief risk officer should have access to the board or risk committee and the authority to escalate matters without executive interference.

Internal audit evaluates whether governance, risk management and controls are appropriately designed and operating effectively. Its annual plan should be risk-based rather than simply rotational. Areas commonly requiring attention include underwriting authority, claims leakage, reserving governance, investment limits, cyber resilience, outsourcing, distribution conduct and regulatory reporting.

Risk Appetite and Enterprise Risk Management

Risk appetite is the amount and type of risk an insurer is willing to accept in pursuing its objectives. It is broader than a list of limits. It expresses strategic choices and should be translated into measurable tolerances. A board may accept moderate underwriting volatility but have very low tolerance for regulatory breaches, mis-selling, data loss or inability to pay claims.

A practical risk-appetite statement normally connects:

• strategic objectives and business plans;
• qualitative principles, such as fair treatment of customers;
• quantitative limits, such as capital, liquidity, concentration and catastrophe exposures;
• early-warning indicators and escalation thresholds; and
• responsibilities for monitoring and corrective action.

Risk capacity is the maximum risk the insurer can bear, considering capital, liquidity, operational capability and legal constraints. Appetite must remain below capacity, with a buffer for uncertainty. Risk limits should be cascaded from enterprise level to portfolios, products, legal entities and individual authorities.

Enterprise risk management is a continuous cycle: identify risks, assess likelihood and impact, select responses, implement controls, monitor indicators, report exposures and revise decisions. Responses may include avoidance, reduction, transfer through reinsurance or hedging, acceptance within appetite, and contingency planning. A risk register alone is not enterprise risk management; it becomes meaningful when it influences capital allocation, pricing, product approval and strategic decisions.

Stress testing and scenario analysis are particularly valuable. Management may consider a severe catastrophe, inflation in repair costs, a cyber incident, a reinsurer default, rapid interest-rate change, mass lapse or simultaneous operational disruption. Scenarios should challenge assumptions and identify management actions, not merely produce a numerical loss estimate.

Whistleblowing, Ethics and Conduct

A whistleblowing framework enables employees and other stakeholders to report suspected wrongdoing confidentially and, where permitted, anonymously. It should provide multiple reporting channels, protect persons from retaliation, define investigation responsibilities and establish escalation to the board or regulator when appropriate.

Whistleblowing is not a substitute for ordinary management reporting. Its value lies in revealing misconduct that normal channels fail to address, such as manipulation of claims statistics, pressure to mis-sell products, suppression of actuarial concerns or falsification of regulatory returns. Investigations should be impartial, documented and proportionate. The organisation should communicate outcomes where legally possible and analyse themes for systemic improvement.

Ethical governance also concerns remuneration. Sales incentives based solely on volume may encourage unsuitable advice or concealment of cancellations. Balanced incentives should include persistency, complaint outcomes, claims quality, compliance behaviour and long-term profitability. Conflicts involving related parties, intermediaries, reinsurance arrangements and investments must be disclosed and controlled.

Regulatory Reporting and Information Quality

Regulatory reporting allows supervisors to assess solvency, governance, market conduct and emerging threats. Reports may cover capital and solvency, technical provisions, investments, liquidity, reinsurance, complaints, operational incidents, ownership and governance changes. Accuracy, completeness, timeliness and consistency are essential.

The board should not regard regulatory returns as an accounting department’s technical responsibility alone. Senior management must understand material judgments and controls over reported data. A reporting framework should identify data owners, source systems, validation rules, reconciliations, approval levels, change controls and evidence of review. Where estimates are uncertain, assumptions and limitations should be documented.

Poor reporting may arise from fragmented systems, manual spreadsheets, unclear definitions or pressure to present favourable results. The appropriate response is not merely to correct the submitted figure but to investigate root causes, notify the supervisor where required and strengthen the reporting control environment.

Technology, Data and Emerging Governance Risks

Digital distribution, automated underwriting, cloud services, artificial intelligence and advanced analytics can improve efficiency and access to insurance. They also create governance issues concerning explainability, data quality, privacy, discrimination, cyber security and third-party dependency.

Boards need not become software engineers, but they must understand material technology risks and assign clear accountability. An algorithm used for pricing or claims triage should be subject to validation, performance monitoring, bias assessment, access controls and human escalation. Data used in actuarial or regulatory models should have documented provenance and quality checks. Outsourcing does not outsource accountability; the insurer remains responsible for services affecting policyholders and regulatory obligations.

Emerging risks also include climate-related losses, geopolitical disruption, pandemic exposure, dependency on concentrated technology providers and the effect of social inflation on liability claims. Governance should combine horizon scanning with scenario analysis and timely board reporting.

Illustrative Case Study: Meridian General Insurance

Background

Meridian General Insurance, a fictional mid-sized non-life insurer, expanded rapidly through digital motor and small-business products. Its board approved a growth strategy based on automated pricing and outsourced claims administration.

Situation and Problem

After eighteen months, claims costs increased sharply. The chief underwriting officer attributed the deterioration to unusual weather, while the actuary warned that repair-cost inflation and data drift were being underestimated. The compliance team also found that sales incentives rewarded policy volume without adequate attention to cancellation rates. Internal audit discovered that access rights allowed one vendor employee to alter claims classifications and approve adjustments. Regulatory returns were prepared manually from several spreadsheets, producing inconsistent exposure figures.

The board initially asked management to reduce expenses. It soon became clear that the problem was not a single pricing error but a governance breakdown involving risk appetite, data quality, outsourcing, incentives and reporting.

Analysis

The risk appetite had stated a growth objective but had not set tolerances for loss ratio deterioration, vendor control failures or model performance. The first line owned pricing and claims but did not receive timely risk reports. The risk function lacked authority to challenge the automated model. The actuarial function had identified uncertainty but its report was not discussed adequately by the board. Compliance had detected incentive risk but corrective action was delayed.

The control environment also suffered from excessive reliance on manual reporting. The outsourced claims provider was monitored through service-level statistics that measured speed but not adjustment accuracy or customer outcomes.

Approach and Solution

The board established a special risk committee review and required management to:

1. suspend further expansion in the affected segment until pricing and reserving were reviewed;

2. commission an independent validation of the pricing model and claims data;

3. revise risk appetite with limits for loss ratios, model drift, outsourcing incidents and regulatory-reporting errors;

4. strengthen actuarial access to the board and require documented responses to material actuarial reservations;

5. redesign remuneration to include claims quality, persistency and conduct indicators;

6. remove inappropriate vendor access, introduce segregation of duties and perform targeted claims testing;

7. create a regulatory-reporting data inventory with reconciliations and executive certification; and

8. investigate whether customers or the regulator required notification and remediation.

Outcome

The review identified underpricing in selected customer segments, but also showed that the financial effect was manageable because capital remained above the supervisory minimum. The insurer corrected affected pricing, enhanced reserves, refunded certain customers where required and renegotiated vendor controls. The board adopted quarterly risk-appetite reporting and required internal audit follow-up on all high-risk findings.

Learning Points

The case demonstrates that enterprise risk is interconnected. A weak incentive can produce poor underwriting behaviour; poor data can distort actuarial analysis; weak outsourcing controls can create conduct and reporting risks. Governance is effective when information reaches the right decision-makers early enough to influence action.

Challenges and Common Governance Failures

Common failures include treating compliance as a veto function rather than a partner in risk-informed decisions; appointing directors without sufficient insurance knowledge; allowing executives to dominate the board; confusing risk reporting with risk management; relying on unfunded policies; failing to test controls; and accepting repeated exceptions as normal practice.

Other weaknesses arise when control functions are under-resourced, when internal audit lacks independence, when actuarial concerns are softened for commercial reasons, or when boards receive large volumes of data without clear indicators and conclusions. Metrics can also mislead: a low number of reported incidents may indicate under-reporting rather than low risk.

Governance has unavoidable limitations. No framework eliminates fraud, bad judgment, model error or external shocks. Independence may be difficult in small firms, and excessive documentation can burden operations without improving decisions. Proportionality is therefore essential, but proportionality must not become an excuse for weak policyholder protection.

Best-Practice Framework for Board and Senior Management

A mature insurer should maintain the following disciplines:

• a board with appropriate competence, independence, diversity of experience and continuing education;
• documented accountability for directors, executives, business owners and control functions;
• a current fit-and-proper and conflicts-of-interest process;
• a clearly articulated risk appetite linked to capital, strategy and limits;
• independent, adequately resourced actuarial, risk, compliance and internal-audit functions;
• integrated compliance obligations, control evidence and breach management;
• reliable data governance and controlled regulatory reporting;
• protected whistleblowing channels and non-retaliation standards;
• effective oversight of intermediaries, vendors, cloud providers and other third parties;
• scenario analysis covering solvency, liquidity, conduct, cyber and climate risks; and
• board dashboards that highlight trends, exceptions, uncertainty and required decisions rather than merely reporting activity.

Current Developments and Strategic Implications

Supervisors increasingly expect insurers to demonstrate effectiveness, not merely the existence of policies. This has strengthened attention to operational resilience, consumer outcomes, climate risk, cyber governance, model risk and accountability for outsourced services. Data-driven supervision may also allow regulators to compare insurers more quickly and identify unusual patterns in complaints, claims or capital movements.

For senior managers, the strategic implication is that governance should be built into business design. Product approval, distribution, pricing, technology investment and acquisitions should include risk and compliance analysis from the beginning. Strong governance can support innovation by making risk boundaries explicit; weak governance converts innovation into uncontrolled experimentation. The most resilient insurers are those in which challenge is treated as a source of decision quality rather than disloyalty.

Chapter Summary

Corporate governance in insurance establishes how authority, accountability and oversight protect policyholders and support sustainable performance. The board remains ultimately responsible even when tasks are delegated. Fit-and-proper standards apply both at appointment and throughout service. The three-lines model distinguishes operational ownership, specialist oversight and independent internal audit. Compliance is a continuous management system involving obligation mapping, monitoring, breach response and regulatory engagement.

Actuarial, risk, compliance and audit functions provide different but complementary forms of expertise and assurance. Enterprise risk management links risk identification, appetite, limits, capital, controls, stress testing and strategic decisions. Whistleblowing, ethical remuneration, accurate regulatory reporting and technology governance are essential to an effective control environment. The Meridian case illustrates how weaknesses in data, incentives, outsourcing and board challenge can combine into a material enterprise risk. Governance cannot remove uncertainty, but it can ensure that risks are understood, escalated and managed responsibly.

Key Terms

Fit and proper: A continuing assessment of a person’s competence, integrity, reputation, financial soundness and suitability for an insurance role.

Corporate governance: The system by which an insurer is directed, controlled and held accountable.

Three-lines model: A framework distinguishing operational ownership, specialist oversight and independent assurance.

First line: Business and operational management that owns and manages risks arising from activities.

Second line: Risk, compliance and related oversight functions that advise, monitor and challenge management.

Third line: Internal audit, providing independent and objective assurance.

Compliance risk: The risk of legal, regulatory, ethical or internal-policy breach and resulting harm.

Internal control: Policies, procedures, systems and behaviours providing reasonable assurance over objectives.

Risk appetite: The type and amount of risk an insurer is willing to accept in pursuing objectives.

Risk capacity: The maximum risk an insurer can bear given capital, liquidity and operational constraints.

Enterprise risk management: An integrated process for identifying, assessing, responding to and monitoring risks.

Actuarial function: A professional function responsible for actuarial analysis such as pricing, reserving and capital assessment.

Regulatory reporting: Information submitted to supervisors concerning an insurer’s financial, operational and governance condition.

Whistleblowing: Reporting suspected wrongdoing through protected internal or external channels.

Operational resilience: The ability to continue important services and recover from disruption.

Model risk: The possibility that a model is unsuitable, incorrectly implemented or misinterpreted.

Segregation of duties: Separation of incompatible responsibilities to reduce error and fraud.

Stress testing: Analysis of the effect of adverse scenarios on an insurer’s financial or operational position.

Conduct risk: The risk that behaviour causes unfair outcomes or harm to customers or market integrity.

Outsourcing risk: Risk arising when a third party performs activities on which the insurer depends.

Review Questions

Short Answer Questions

1. Why is governance particularly important in insurance compared with many ordinary commercial businesses?

2. What are the principal elements of a fit-and-proper assessment?

3. Distinguish the first, second and third lines of the three-lines model.

4. What is the difference between risk appetite and risk capacity?

5. Why is regulatory-reporting data quality a board-level concern?

Long Answer Questions

1. Explain how the board, senior management and control functions should share accountability in an insurer.

2. Discuss the role of the actuarial, risk, compliance and internal-audit functions and explain why their independence matters.

3. Describe how an insurer can design and implement an effective compliance-management system.

4. Analyse the relationship between risk appetite, capital, stress testing and strategic decision-making.

5. Discuss the governance challenges created by digital underwriting, artificial intelligence and outsourcing.

Analytical / Application Questions

1. An insurer repeatedly breaches underwriting limits, but management reports that overall profits remain strong. Using the three-lines model and risk-appetite principles, identify the governance failures and recommend action.

2. A whistleblower alleges that claims staff are delaying legitimate claims to improve quarterly results. Design an investigation, reporting and remediation response.

3. A board receives contradictory solvency figures from finance, actuarial and risk departments. Develop a structured approach to determine the cause, protect policyholders and improve regulatory reporting.

22. Multiple Choice Questions with Answers

Question 1

Which statement best describes the board’s responsibility in an insurer?

A. The board is responsible only for approving annual financial statements.

B. The board may delegate tasks, but retains ultimate accountability for strategy, soundness and governance.

C. The board becomes responsible only when a supervisor issues a warning.

D. The board can transfer all risk responsibility to the compliance function.

Correct Answer: B. The board may delegate tasks, but retains ultimate accountability for strategy, soundness and governance.

Question 2

Which activity belongs primarily to the first line of the three-lines model?

A. Independent testing of internal controls by internal audit

B. Setting supervisory reporting standards

C. Owning and managing risks arising from underwriting operations

D. Reviewing the independence of the audit committee

Correct Answer: C. Owning and managing risks arising from underwriting operations

Question 3

A fit-and-proper assessment is best understood as:

A. A one-time check of academic qualifications at recruitment

B. An assessment limited to a candidate’s technical insurance knowledge

C. A continuing assessment of competence, integrity, reputation and suitability

D. A financial-performance test applied only to directors

Correct Answer: C. A continuing assessment of competence, integrity, reputation and suitability

Question 4

Which feature most effectively converts a risk-appetite statement into an operational tool?

A. A general declaration that management should be cautious

B. Quantitative limits, indicators, escalation thresholds and assigned responsibilities

C. A list of all risks without prioritisation

D. A prohibition on all forms of underwriting volatility

Correct Answer: B. Quantitative limits, indicators, escalation thresholds and assigned responsibilities

Question 5

What is the principal reason internal audit should not design and operate the controls it later audits?

A. It would increase the insurer’s marketing expenses.

B. It would impair the independence of its assurance role.

C. It would prevent the actuarial function from setting reserves.

D. It would make regulatory reporting unnecessary.

Correct Answer: B. It would impair the independence of its assurance role.

Question 6

An insurer discovers that manual spreadsheets produced inconsistent regulatory returns. The most appropriate initial response is to:

A. Delete the inconsistent files and submit the most favourable figure.

B. Investigate root causes, assess notification duties and strengthen data controls.

C. Wait until the next annual audit before taking action.

D. Transfer reporting responsibility permanently to an external vendor.

Correct Answer: B. Investigate root causes, assess notification duties and strengthen data controls.

Question 7

Which situation most clearly illustrates a conflict between incentive design and conduct risk?

A. A claims team receives training on privacy requirements.

B. Sales staff are rewarded solely for policy volume despite high cancellation rates.

C. Internal audit performs a risk-based review of cyber controls.

D. The board receives quarterly capital reporting.

Correct Answer: B. Sales staff are rewarded solely for policy volume despite high cancellation rates.

Question 8

In the Meridian case, why was the problem treated as an enterprise-risk issue rather than merely a pricing issue?

A. Because pricing is never an actuarial responsibility

B. Because the insurer had no capital at all

C. Because data, incentives, outsourcing, reporting and board challenge interacted to amplify risk

D. Because all automated underwriting systems are prohibited

Correct Answer: C. Because data, incentives, outsourcing, reporting and board challenge interacted to amplify risk

Question 9

Which statement about outsourcing is correct?

A. Outsourcing transfers regulatory accountability to the service provider.

B. Outsourcing eliminates the need for internal controls.

C. The insurer remains accountable for material outsourced activities and must oversee them.

D. Outsourced activities need not be included in risk assessments.

Correct Answer: C. The insurer remains accountable for material outsourced activities and must oversee them.

Question 10

What is the main purpose of stress testing in enterprise risk management?

A. To guarantee that adverse events will not occur

B. To replace the insurer’s risk appetite

C. To explore the effect of adverse scenarios and identify management actions

D. To calculate only the previous year’s claims ratio

Correct Answer: C. To explore the effect of adverse scenarios and identify management actions