Corporate Governance, Ethics and Accountability

Introduction and Context

Corporate governance in insurance is the system through which an insurer is directed, controlled and held accountable. It allocates authority among the board, senior management, control functions, owners, policyholders, regulators and other stakeholders. In insurance, governance is not merely a company-law concern. It is a prudential requirement because insurers collect premiums today in exchange for promises that may be performed years or decades later. Policyholders therefore depend on the insurer’s financial strength, integrity, technical competence and continuity.

Weak governance can produce consequences that are both financial and social: mispricing, inadequate reserves, unfair claims practices, excessive risk-taking, concealment of solvency problems, market misconduct and eventual failure. The governance of an insurer must consequently protect not only shareholders but also policyholders and beneficiaries, whose interests are often less visible and less powerful.

Internationally, governance expectations are reflected in instruments such as the Insurance Core Principles of the International Association of Insurance Supervisors (IAIS), the OECD Principles of Corporate Governance, national insurance statutes, company law, listing rules, solvency regimes and professional standards for auditors and actuaries. These sources differ in legal force and detail. A sound governance system distinguishes between binding law, supervisory expectations, professional standards and voluntary codes.

This chapter examines governance arrangements for boards and senior management, fit-and-proper standards, fiduciary duties, conflicts of interest, remuneration, risk culture, whistleblowing, actuarial and audit functions, and the three-lines model. It also considers accountability in groups, technology-enabled insurance and emerging regulatory expectations.

Learning Objectives

By the end of this chapter, a student should be able to:

1. Explain why insurance governance differs from ordinary corporate governance.
2. Distinguish the responsibilities of the board, senior management and independent control functions.
3. Apply fit-and-proper, fiduciary-duty and conflicts-of-interest principles.
4. Evaluate remuneration, risk culture and whistleblowing arrangements.
5. Explain the actuarial, internal audit, compliance and risk-management functions.
6. Use the three-lines model to analyse accountability and control failures.
7. Critically assess governance arrangements in a practical insurance scenario.

1. The Governance Problem in Insurance

1.1 The promise-based nature of insurance

An insurer’s principal product is a contingent promise. The policyholder pays a premium, but the insurer may not pay a claim until a future event occurs. Life insurance, pensions and long-tail liability insurance may create obligations extending over decades. This time gap creates several governance problems:

• Information asymmetry: managers and specialists know more than policyholders about reserves, exclusions, investments and risk exposures.
• Agency problems: managers may pursue growth, bonuses or personal status rather than policyholder protection.
• Moral hazard: shareholders or managers may benefit from risk-taking while policyholders, guarantee schemes or taxpayers bear part of the loss.
• Technical complexity: underwriting, reserving, reinsurance, investments and capital management require specialised knowledge.
• Intergenerational effects: decisions about assumptions and reserves can transfer value between current and future policyholders.
• Systemic and group effects: a large insurer or insurance group can transmit stress through financial markets, intermediaries and policyholder confidence.

Governance therefore has both a control function and a stewardship function. Control seeks to prevent misconduct and unacceptable risk. Stewardship requires the organisation to preserve its capacity to meet legitimate claims and to treat customers fairly over time.

1.2 Governance objectives

A comprehensive governance system should promote:

1. prudent and sustainable business;
2. protection of policyholders and beneficiaries;
3. compliance with law and supervisory requirements;
4. reliable financial and non-financial reporting;
5. responsible treatment of customers and intermediaries;
6. effective challenge of management decisions;
7. resilience under stress; and
8. accountability for decisions and outcomes.

Governance is effective when responsibilities are clear, information is timely and reliable, challenge is genuine, decisions are documented, and failures lead to corrective action rather than concealment.

2. Governance Architecture: Board, Management and Control Functions

2.1 The board of directors

The board is ultimately responsible for the direction, oversight and long-term soundness of the insurer. Although it may delegate implementation, it cannot delegate away accountability. Typical board responsibilities include:

• approving strategy, risk appetite and business plans;
• ensuring adequate capital, liquidity and reinsurance;
• overseeing the system of governance and internal control;
• appointing, evaluating and, where necessary, removing senior executives;
• approving the remuneration framework;
• monitoring conduct, customer outcomes and financial performance;
• ensuring the integrity of financial and regulatory reporting;
• overseeing recovery, resolution and business-continuity planning; and
• maintaining effective communication with the regulator and stakeholders.

The board should contain an appropriate balance of executive, non-executive and independent directors, subject to applicable law. Independence is substantive rather than merely formal. A director may be legally independent but practically unable to challenge a dominant controlling shareholder, chief executive or group parent.

Board committees commonly include audit, risk, remuneration, nomination and policyholder or conduct committees. Committees improve depth of review, but they do not replace collective board responsibility. Committee mandates should specify authority, membership, reporting duties and access to independent advice.

2.2 Senior management

Senior management converts board-approved strategy into operations. The chief executive officer is ordinarily responsible for day-to-day management, while executives lead underwriting, claims, investments, finance, operations, information technology, compliance and other activities.

Management must establish procedures, allocate resources, implement controls and provide accurate information to the board. It must not use delegation as a means of avoiding responsibility. A chief risk officer, appointed actuary or head of internal audit may have independent access to the board even while operating within the management structure.

The board sets the direction and supervises; management executes and reports. The distinction is not absolute: boards must understand material operations, and management must participate in strategy. The danger lies at either extreme—passive boards that rubber-stamp management or intrusive boards that assume operational responsibilities and weaken executive accountability.

2.3 The governing body and key functions

Insurance regulation increasingly expects clearly identified “key functions.” Their titles vary across jurisdictions, but they commonly include risk management, compliance, actuarial, internal audit and financial control. A key function should have:

• a documented mandate;
• adequate authority, resources and expertise;
• access to relevant information;
• sufficient independence from the activities it reviews;
• direct or unrestricted access to the board or a board committee; and
• protection from retaliation when raising concerns.

A small insurer may combine roles where permitted, but it must identify and manage resulting conflicts. For example, combining compliance and sales leadership may make effective challenge impossible.

Figure: Governance architecture linking management execution with independent challenge and board oversight.

3. Fit-and-Proper Standards

A fit-and-proper regime assesses whether persons who direct or control an insurer are suitable to perform their responsibilities. It normally covers competence, experience, integrity, reputation, financial soundness and independence of judgment.

3.1 Competence and experience

Competence is role-specific. A board member need not be an actuary, but the board collectively must understand insurance, finance, investments, governance, technology, conduct and regulation. A chief investment officer requires different expertise from a head of claims. Regulators may assess qualifications, relevant employment history, decision-making experience and knowledge of the insurer’s business model.

Collective competence is important because a board composed entirely of generalists may fail to challenge technical assumptions. Conversely, a board of narrow specialists may lack strategic, customer or governance perspective.

3.2 Integrity, reputation and financial soundness

Integrity assessment may consider honesty, past misconduct, regulatory sanctions, misleading statements, criminal convictions, bankruptcy, disqualification from directorship and patterns of non-compliance. The purpose is not to impose automatic punishment for every past difficulty; it is to assess present suitability, candour and learning. Concealing a relevant fact can itself be more serious than the original event.

Financial soundness is relevant because severe personal financial stress may create incentives for fraud, bribery or improper use of corporate assets. It should be assessed proportionately and consistently with privacy and equality obligations.

3.3 Ongoing assessment

Fit-and-proper status is not a one-time appointment test. It should be reviewed after material changes, such as a serious regulatory breach, a new business model, a conflict of interest, a health or capacity issue affecting performance, or a significant change in responsibilities. Firms should maintain documented assessments, references, declarations and escalation procedures.

4. Fiduciary Duties and Accountability

Fiduciary duties arise from the relationship of trust and confidence between decision-makers and the organisation or beneficiaries. Exact duties depend on applicable company and insurance law, but commonly include duties to:

• act honestly and in good faith;
• exercise powers for proper purposes;
• exercise due care, skill and diligence;
• avoid unauthorised conflicts and secret profits;
• protect confidential information;
• comply with law and the constitution of the company; and
• act in the interests of the company while respecting policyholder and stakeholder obligations imposed by regulation.

A director must make an informed decision, not merely rely uncritically on management. The business-judgment principle, where recognised, generally protects honest and informed decisions made for proper purposes, but it does not protect bad faith, undisclosed conflicts, fraud or deliberate disregard of obvious risks.

Accountability has several dimensions:

• Individual accountability: a named person is responsible for a decision or control.
• Collective accountability: the board is responsible for matters reserved to it.
• Functional accountability: control-function leaders are responsible for their mandates.
• Legal accountability: breaches may lead to civil, criminal, administrative or professional consequences.
• Stakeholder accountability: the insurer must explain material conduct and outcomes to policyholders, regulators and owners.

Good governance records the reasoning behind major decisions, including information considered, dissenting views, assumptions, conditions and follow-up actions. Minutes should not be a verbatim transcript, but they must provide a reliable accountability trail.

5. Conflicts of Interest and Related-Party Transactions

A conflict exists when a person’s personal, professional or external interests may interfere with objective performance. Conflicts may be actual, potential or perceived. Examples include a director owning shares in a broker seeking an insurer contract, a senior executive receiving incentives from a reinsurer, or a group company purchasing services from another entity at an unfair price.

A robust conflict framework follows four steps:

1. Identify: require periodic and event-driven declarations.
2. Assess: evaluate materiality, likelihood and effect on judgment.
3. Manage: use recusal, independent review, information barriers, revised reporting lines or competitive procurement.
4. Record and monitor: maintain a register and verify that controls remain effective.

Disclosure alone does not always cure a conflict. A conflicted director may need to leave the meeting, abstain from voting and avoid access to sensitive papers. Related-party transactions should be on arm’s-length terms, supported by evidence and approved by disinterested directors where required. The regulator may require notification or prior approval.

6. Remuneration and Incentive Governance

Remuneration is a governance issue because it shapes behaviour. A scheme that rewards premium growth without regard to claims quality, capital, conduct or persistency can encourage harmful business. A balanced framework should:

• align rewards with sustainable performance;
• include risk-adjusted and conduct-related measures;
• defer a meaningful portion of variable remuneration where risks emerge over time;
• permit malus, clawback or reduction for misconduct and later losses, subject to law;
• prevent control-function independence from being compromised; and
• disclose material policies appropriately.

For example, an underwriter’s incentive might consider profitable and compliant portfolio performance rather than gross premium alone. A claims manager’s targets should not encourage unjustified claim rejection or delay. Control-function remuneration should ordinarily be determined in a way that reduces dependence on the business units being reviewed.

Remuneration committees should examine unintended consequences. Quantitative targets may be easy to measure but can distort conduct if they dominate qualitative judgment. “Balanced scorecards” are useful only when qualitative criteria are specific, evidenced and genuinely capable of reducing awards.

7. Risk Culture and Ethical Climate

Risk culture is the shared pattern of values, behaviours and practices concerning risk identification, discussion, escalation and response. It is visible in what leaders pay attention to, reward, tolerate and investigate—not merely in a written risk policy.

A healthy risk culture has:

• clear statements of purpose and customer responsibility;
• psychologically safe challenge and escalation;
• transparent discussion of uncertainty and model limitations;
• consistent consequences for misconduct, regardless of rank;
• learning from near misses and operational incidents;
• realistic reporting rather than target-driven optimism; and
• alignment between stated values and actual incentives.

Boards can assess risk culture through employee surveys, turnover, speak-up data, complaint trends, audit findings, breach reports, remuneration outcomes and evidence of challenge in meeting records. No single metric proves culture. A low number of reported incidents may indicate either excellent control or fear of speaking up.

Ethics is broader than legal compliance. An action can be technically lawful yet unfair, deceptive or inconsistent with the insurer’s obligations to vulnerable customers. Ethical governance asks whether decisions are honest, proportionate, explainable and consistent with the legitimate expectations created by the insurance relationship.

8. Whistleblowing and Speaking Up

Whistleblowing arrangements enable employees, contractors, agents and sometimes customers to report suspected misconduct, fraud, breaches or threats to policyholders. Effective arrangements include:

• confidential and, where lawful, anonymous reporting channels;
• multiple routes, including an independent channel outside the line manager;
• prompt triage and risk-based investigation;
• protection against retaliation;
• access to independent legal or compliance advice;
• escalation of serious matters to the board and regulator where required; and
• feedback to the reporter within confidentiality limits.

The board should receive thematic reports, not only case-by-case information. Important indicators include reporting volume, substantiation rates, investigation duration, retaliation allegations and repeat issues. A whistleblowing system fails if reporters are praised in policy but penalised in practice.

9. Actuarial, Audit, Compliance and Risk Functions

9.1 The actuarial function

The actuarial function provides technical analysis concerning pricing, reserving, capital, risk modelling, reinsurance and, in life business, assumptions about mortality, morbidity, longevity, lapses and expenses. Its responsibilities vary by jurisdiction but may include assessing technical provisions, opinions on underwriting policy and reinsurance adequacy, and informing the board about material uncertainty.

Actuarial independence is essential. An actuary should disclose assumptions, data limitations, model changes, uncertainty and management judgment. The actuary does not guarantee that estimates will be correct; rather, the function provides disciplined analysis of uncertain future cash flows.

9.2 Internal audit

Internal audit provides independent, risk-based assurance on governance, risk management and controls. It should be structurally independent from the activities audited, report functionally to the audit committee or board, and have unrestricted access to records and personnel.

Internal audit is not management’s control owner. It evaluates whether controls are designed and operating effectively. Its plan should cover financial, operational, conduct, technology, cyber, model and outsourcing risks according to materiality. Follow-up is essential: an audit report without remediation verification is incomplete assurance.

9.3 Compliance

Compliance identifies and assesses legal and regulatory obligations, advises management, monitors adherence, supports training and reports material breaches. It should cover prudential, market-conduct, financial-crime, data-protection, consumer-protection and licensing requirements as relevant.

Compliance cannot guarantee that no breach will occur. Its value lies in systematic identification, preventive advice, monitoring and escalation.

9.4 Risk management

Risk management establishes the framework for identifying, measuring, monitoring, reporting and controlling risk. It supports the board’s risk appetite and may coordinate an own-risk and solvency assessment or equivalent enterprise-wide process. It should challenge business proposals, stress testing, concentration limits, emerging risks and model assumptions.

10. The Three-Lines Model

The three-lines model clarifies roles without creating three isolated silos.

The first line owns risks and controls; it cannot transfer ownership to compliance or internal audit. The second line sets frameworks, advises and challenges, but should not become the operational owner of the risks it monitors. The third line independently assesses the first two lines and reports to the board or audit committee.

The model is a framework, not a universal organisational chart. In small insurers, responsibilities may be combined, provided conflicts and independence risks are addressed. External audit, supervisors, actuaries and consultants may provide additional assurance, but they do not replace the board’s responsibility.

11. Group Governance, Outsourcing and Technology

Insurance groups create risks of contagion, intra-group transactions, double gearing, complexity and conflicting priorities between a parent and regulated subsidiary. Group governance should identify who controls strategy, capital, risk data, intra-group services and recovery planning. The subsidiary board must retain sufficient independence to meet local policyholder and regulatory obligations.

Outsourcing does not outsource accountability. Before outsourcing a material function, the insurer should assess the provider’s competence, resilience, financial condition, cyber controls, data practices, subcontracting and exit arrangements. Contracts should provide audit and access rights, service levels, incident notification and business-continuity obligations.

Artificial intelligence and advanced analytics create governance issues involving data quality, discrimination, explainability, cybersecurity, model drift and accountability. A board should know where automated systems influence pricing, underwriting, claims triage or fraud detection. Human review should be meaningful, especially for vulnerable customers and adverse decisions. Governance should include model inventories, validation, version control, monitoring and documented intervention thresholds.

12. Illustrative Case: Meridian General Insurance

Background

Meridian General Insurance, a fictional mid-sized property insurer, experienced rapid premium growth after introducing an automated pricing platform. The chief executive received a substantial bonus based largely on gross written premium. The board approved the strategy after a short presentation and received limited information about model uncertainty, complaints or claims development.

Problem

Two years later, claims inflation and adverse weather produced large losses. Internal audit discovered that:

• underwriting staff could override the model without recording reasons;
• the risk function had not independently reviewed the pricing assumptions;
• the appointed actuary had raised concerns about claims trends but these were summarised incompletely for the board;
• the remuneration plan rewarded growth and did not defer awards; and
• employees who questioned aggressive sales targets believed that managers would retaliate.

Analysis

The central failure was not simply a faulty model. It was a governance failure involving board information, risk ownership, incentive design, actuarial escalation and risk culture. The first line did not maintain adequate controls over overrides. The second line lacked authority and access. The board did not ask whether growth was sustainable or whether incentives encouraged poor underwriting. The whistleblowing environment weakened early warning.

Approach and solution

The board should require an independent review of the pricing platform, including data, assumptions, validation, override controls, fairness and performance by segment. It should establish documented risk appetite limits for growth, loss ratios, concentrations and model overrides. The actuarial and risk functions should report directly to the risk committee on material concerns, with unfiltered access to minutes.

Variable remuneration should be recalibrated to include profitability, claims quality, customer outcomes, capital usage and conduct. A portion should be deferred and subject to reduction if later experience reveals material deficiencies. The company should introduce confidential reporting channels, non-retaliation controls and board-level thematic reporting.

Outcome

In this illustrative case, Meridian slows new business in high-risk segments, strengthens model governance, documents underwriting overrides and commissions a claims-reserving review. The board records dissenting views and monitors remediation quarterly. Although short-term growth declines, the insurer improves pricing discipline, transparency and resilience.

Learning points

1. Growth is not a substitute for sustainable underwriting.
2. Technical functions must be able to escalate concerns independently.
3. Incentives can create or amplify control failures.
4. Automated decisions remain the responsibility of accountable people.
5. Board information must be complete, timely and decision-useful.

13. Challenges and Limitations

Governance frameworks face practical limitations. Formal independence may not overcome a dominant shareholder. Excessive committees can diffuse responsibility. Compliance metrics may measure activity rather than effectiveness. Risk culture surveys may be distorted by fear or low participation. Internal audit may lack specialist technology or actuarial expertise. Small insurers may struggle to segregate duties economically.

There is also a danger of “governance theatre”: extensive policies, training and declarations that do not change decisions. Regulators and boards should therefore examine outcomes, behaviours and evidence of challenge, not merely documentation. Proportionality is important, but it must not become an excuse for eliminating essential independence or expertise.

14. Best-Practice Governance Framework

A mature insurer should be able to demonstrate that it has:

• a board with appropriate independence, competence and time commitment;
• a clear allocation of reserved matters and delegated authority;
• current fit-and-proper assessments for directors and key function holders;
• a documented risk appetite linked to strategy and capital;
• independent actuarial, risk, compliance and internal audit access;
• transparent conflict, related-party and remuneration controls;
• incentives aligned with long-term policyholder outcomes;
• credible whistleblowing and non-retaliation arrangements;
• reliable management information and escalation thresholds;
• effective oversight of groups, outsourcing, data and AI;
• tested recovery, continuity and crisis-communication plans; and
• regular evaluation of board, committee and control-function effectiveness.

Chapter Summary

Insurance governance protects the continuity and integrity of promises made to policyholders. Because insurance involves long-term liabilities, information asymmetry and technical uncertainty, governance must extend beyond shareholder oversight to prudential soundness and fair customer outcomes. The board retains ultimate responsibility for strategy, risk appetite, capital, internal control and accountability, while senior management implements approved direction.

Fit-and-proper standards require continuing assessment of competence, integrity, reputation, financial soundness and independence. Fiduciary duties demand good faith, proper purpose, care, diligence and avoidance of unauthorised conflicts. Remuneration should reward sustainable, risk-adjusted performance rather than short-term growth. Risk culture is demonstrated by conduct, challenge, escalation and consequences, not merely by written values.

Actuarial, risk, compliance and internal audit functions provide technical expertise, monitoring and assurance. The three-lines model clarifies that business units own risk, second-line functions challenge and monitor, and internal audit provides independent assurance. Whistleblowing, group governance, outsourcing controls and responsible technology governance strengthen accountability. Effective governance is ultimately judged by decisions, behaviours and policyholder outcomes.

Key Terms

Accountability: The obligation to explain decisions, accept responsibility and face consequences where appropriate.

Actuarial function: A specialist function analysing insurance liabilities, pricing, capital and related uncertainty.

Board of directors: The governing body responsible for strategic direction and oversight.

Business judgment: A decision-making principle that may protect honest, informed decisions made for proper purposes.

Conflict of interest: A situation in which personal or external interests may impair objective judgment.

Control function: An independent or specialist function supporting risk control, compliance, actuarial oversight or assurance.

Fiduciary duty: A duty arising from trust and confidence, requiring loyalty, good faith and proper conduct.

Fit and proper: A continuing standard of competence, integrity, reputation, financial soundness and suitability.

Internal audit: An independent assurance function evaluating governance, risk management and controls.

Policyholder protection: The regulatory and governance objective of safeguarding insured persons and beneficiaries.

Risk appetite: The level and types of risk an insurer is willing to accept in pursuing its objectives.

Risk culture: Shared values and behaviours concerning risk, challenge, escalation and control.

Senior management: Executives responsible for implementing strategy and managing operations.

Three-lines model: A framework separating risk ownership, risk challenge and independent assurance.

Whistleblowing: Reporting suspected wrongdoing, misconduct or serious control failure through protected channels.

Remuneration governance: Oversight of pay and incentives to ensure they support sustainable and ethical performance.

Related-party transaction: A transaction involving a person or entity connected with the insurer.

Model governance: Controls over the development, validation, use, monitoring and change of analytical models.

Review Questions

Short Answer Questions

1. Why does the long-term promise structure of insurance create special governance risks?
2. Identify four responsibilities of an insurer’s board.
3. What is meant by a fit-and-proper standard?
4. Distinguish an actual conflict of interest from a perceived conflict.
5. State the respective roles of the three lines.

Long Answer Questions

1. Critically evaluate the relationship between board independence and effective insurance governance.
2. Explain how remuneration design can encourage or reduce insurance misconduct.
3. Discuss the role and independence of the actuarial, risk, compliance and internal audit functions.
4. Analyse the importance of fiduciary duties and accountability in protecting policyholders.
5. Examine how a board can assess and improve risk culture.

Analytical / Application Questions

1. An insurer rewards sales staff solely for premium volume and experiences rising complaints and cancellations. Using governance and remuneration principles, diagnose the problem and propose reforms.
2. A director owns a company that is invited to provide claims services to the insurer. Design a process for identifying, managing and documenting the conflict.
3. An automated underwriting model produces lower acceptance rates for a particular customer group, but management cannot explain why. Identify the governance, ethical and regulatory questions the board should ask.

Multiple Choice Questions with Answers

Question 1

Which body retains ultimate responsibility for an insurer’s strategy and oversight, even when responsibilities are delegated?

A. The external auditor

B. The board of directors

C. The sales department

D. The reinsurer

Correct Answer: B. The board of directors

Question 2

Which of the following is most characteristic of a fit-and-proper assessment?

A. Assessment of office decoration standards

B. Assessment of competence, integrity and reputation

C. Assessment of annual advertising expenditure only

D. Assessment of the number of policyholders only

Correct Answer: B. Assessment of competence, integrity and reputation

Question 3

Under the three-lines model, which function normally provides independent assurance?

A. Underwriting

B. Sales management

C. Internal audit

D. Claims administration

Correct Answer: C. Internal audit

Question 4

Why can disclosure alone be insufficient to manage a material conflict of interest?

A. Disclosure always invalidates a director’s appointment

B. The conflicted person may still influence the decision

C. Conflicts are relevant only to external auditors

D. Disclosure eliminates the need for records

Correct Answer: B. The conflicted person may still influence the decision

Question 5

Which remuneration design is most consistent with sound insurance governance?

A. Rewarding premium growth without regard to claims or conduct

B. Paying all incentives immediately regardless of later outcomes

C. Using sustainable, risk-adjusted and conduct-sensitive measures

D. Basing all executive pay on market share alone

Correct Answer: C. Using sustainable, risk-adjusted and conduct-sensitive measures

Question 6

What is the principal responsibility of the first line in the three-lines model?

A. Owning and managing risks in business activities

B. Providing independent assurance to the board

C. Replacing the board’s risk appetite

D. Investigating every matter for the regulator

Correct Answer: A. Owning and managing risks in business activities

Question 7

Which feature most supports effective whistleblowing?

A. A single reporting route through the alleged wrongdoer

B. Guaranteed punishment for reports that are not substantiated

C. Confidential channels and protection against retaliation

D. Prohibition on reports by contractors

Correct Answer: C. Confidential channels and protection against retaliation

Question 8

Why is actuarial independence important?

A. It ensures that all forecasts are always correct

B. It allows technical concerns and uncertainty to be reported objectively

C. It removes the board’s responsibility for reserves

D. It prevents any use of management judgment

Correct Answer: B. It allows technical concerns and uncertainty to be reported objectively

Question 9

Which statement about outsourcing is correct?

A. Outsourcing transfers the insurer’s regulatory accountability to the provider

B. The insurer remains accountable for outsourced activities

C. Outsourcing eliminates the need for continuity planning

D. Outsourced providers never require monitoring

Correct Answer: B. The insurer remains accountable for outsourced activities

Question 10

A low number of whistleblowing reports necessarily proves that an insurer has an excellent risk culture.

A. True, because low reports always indicate low misconduct

B. True, because culture can be measured by report volume alone

C. False, because low reporting may reflect fear of speaking up

D. False, because whistleblowing is unrelated to culture

Correct Answer: C. False, because low reporting may reflect fear of speaking up