10. Corporate Governance, Risk and Compliance

Introduction and Context

Insurance is a promise made today against uncertain future events. Because insurers collect premiums before claims arise, invest substantial funds, and affect the financial security of policyholders, their governance arrangements have consequences far beyond ordinary commercial performance. Weak governance may result in mis-selling, inadequate reserves, excessive risk-taking, delayed claims, misuse of policyholder assets, or failure to identify emerging threats. For this reason, insurance regulation increasingly treats corporate governance, enterprise risk management and compliance as interdependent elements of prudential supervision.

Corporate governance concerns the system through which an insurer is directed, controlled and held accountable. Risk management concerns the identification, assessment, treatment and monitoring of uncertainty that may affect the insurer’s objectives. Compliance concerns adherence to law, regulation, licence conditions, internal policies and ethical standards. These are not separate administrative activities. The board sets the institution’s direction and risk appetite; management implements controls and business plans; independent control functions challenge decisions; and supervisors assess whether the whole system protects policyholders and preserves financial soundness.

The chapter develops a governance architecture for an insurer. It explains board accountability, key control functions, enterprise risk management, actuarial oversight, compliance programmes, internal control, outsourcing, whistleblowing and the three-lines model. It also considers digital tools, emerging risks and the managerial choices involved in making governance effective rather than merely formal.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Explain the relationship between governance, risk management and regulatory compliance in insurance.

2. Design an appropriate board and committee structure for an insurer.

3. Distinguish the responsibilities of management, risk, compliance, actuarial, internal audit and the board.

4. Apply the three-lines model and enterprise risk management to insurance decisions.

5. Evaluate internal controls, outsourcing arrangements and whistleblowing systems.

6. Analyse a governance failure and recommend corrective action.

7. Assess the role of technology, data and emerging risks in regulatory compliance.

Why Governance Has Special Significance in Insurance

Insurance combines several characteristics that create distinctive governance demands. First, the product is intangible and often difficult for customers to evaluate. The quality of the promise depends on claims-paying capacity, wording, exclusions, reserving and service, rather than on an immediately observable product. Second, there is a substantial time gap between premium collection and claim payment. This creates opportunities for asset-liability mismatches and inappropriate investment behaviour. Third, insurance depends on models and estimates. Premium adequacy, technical provisions, catastrophe exposure, longevity and reinsurance recoverables are all subject to uncertainty.

The interests of shareholders, policyholders, employees, intermediaries, creditors, regulators and wider society may diverge. A board that focuses only on short-term profit may encourage underpricing, aggressive sales incentives or excessive investment risk. Effective governance therefore requires a fiduciary and prudential perspective: the insurer must remain able to meet obligations while conducting business fairly.

Governance also addresses conduct risk. An insurer can be solvent yet cause serious consumer harm through unsuitable products, misleading disclosures, unfair claims practices, conflicts of interest or improper use of customer data. Prudential and conduct governance must therefore operate together.

Core Concepts and Terminology

Corporate governance is the framework of relationships, authority, accountability and controls through which an organisation is directed. The board of directors is ultimately responsible for the insurer’s sound and prudent management, even when duties are delegated. Accountability cannot be outsourced.

Risk appetite is the aggregate level and types of risk an insurer is willing to accept in pursuit of its objectives. Risk limits translate broad appetite into measurable boundaries for business units, products, investments, concentrations and operational exposures. Risk capacity is the maximum risk an insurer can bear, considering capital, liquidity, legal obligations and operational resilience. Appetite should remain below capacity, leaving a safety margin.

Enterprise risk management (ERM) is an integrated process for identifying, assessing, responding to, monitoring and reporting risks across the organisation. It considers risks individually and in combination, including correlations and concentrations.

The Own Risk and Solvency Assessment (ORSA), where required by the applicable regulatory regime, is the insurer’s forward-looking assessment of its risks, solvency needs and ability to remain within its risk appetite under normal and stressed conditions. It is a management process, not merely a regulatory report.

Internal control is the collection of policies, procedures, systems and behaviours designed to provide reasonable assurance regarding effective operations, reliable reporting, legal compliance and protection of assets. A control may be preventive, detective or corrective.

Compliance risk is the risk of legal or regulatory sanctions, financial loss or reputational damage arising from failure to comply with applicable requirements or standards. Conduct risk is the risk of unfair outcomes for customers or markets. Operational risk concerns loss arising from failed processes, people, systems or external events.

The control functions are specialist functions that provide independent or sufficiently objective oversight. They commonly include risk management, compliance, actuarial and internal audit. Independence, competence, authority, resources and direct access to the board are central to their effectiveness.

Building the Governance Architecture

Board accountability and composition

The board approves strategy, risk appetite, capital and major policies; appoints and oversees senior management; monitors financial and non-financial performance; and ensures that policyholder interests are appropriately considered. It should receive information that is timely, accurate, sufficiently detailed and capable of supporting challenge. A board that receives only aggregated financial results may fail to see deteriorating claims trends, complaints, cyber incidents or control weaknesses.

An effective board combines insurance, actuarial, financial, investment, technology, legal, consumer and risk expertise. Independence is valuable because independent directors can challenge dominant executives and reduce conflicts of interest. Independence, however, is not a substitute for knowledge. Directors require induction, continuing education and access to independent advice.

The chair leads the board and promotes constructive challenge. The chief executive is responsible for execution, not for eliminating challenge. The board should evaluate its own effectiveness, attendance, information quality, committee performance and succession arrangements. Related-party transactions, remuneration incentives and conflicts of interest require formal disclosure and management.

Committees and escalation

A board may establish audit, risk, remuneration, nomination, investment or policyholder-protection committees, depending on its scale and complexity. Committees prepare analysis and undertake detailed oversight, but the board retains collective responsibility. Committee mandates should define authority, membership, meeting frequency, reporting and escalation thresholds.

The risk committee reviews the risk profile, appetite, stress testing, emerging risks and material breaches. The audit committee oversees financial reporting, internal audit, external audit, control deficiencies and protected reporting channels. A remuneration committee should examine whether incentives reward sustainable performance or encourage mis-selling and excessive risk. Small insurers may combine committees, but combined structures must not weaken independence or overload members.

Senior management and control functions

Senior management translates board-approved strategy into business plans, budgets, procedures and controls. It owns risks arising from products, distribution, underwriting, claims, investments, technology and operations. Managers cannot transfer ownership of a risk to the risk function merely by reporting it.

The chief risk officer coordinates the risk framework and challenges risk-taking. The compliance officer interprets regulatory obligations, monitors compliance and advises on remediation. The appointed or chief actuary provides professional opinions on pricing, reserving, capital, reinsurance and relevant solvency matters. The head of internal audit provides independent assurance on governance, risk management and controls. These roles require appropriate status, access to information, protection from retaliation and direct communication with the board or relevant committee.

The Three-Lines Model

The three-lines model clarifies responsibilities without creating rigid organisational silos. The first line consists of business and operational management. It identifies and manages risks in daily activities, owns processes and operates controls. Underwriting authorities, claims approvals, segregation of duties and reconciliations are first-line responsibilities.

The second line consists principally of risk management and compliance, together with specialist oversight such as actuarial or information security risk where applicable. It establishes frameworks, monitors adherence, aggregates information, performs thematic reviews and challenges the first line. It should not become the owner of operational risks it is expected to challenge.

The third line is internal audit. It provides independent, risk-based assurance to the board and senior management on the adequacy and effectiveness of governance, risk management and internal controls. Internal audit should not design or operate controls that it later audits. External audit and the regulator are outside the three lines, although they interact with them and provide additional assurance.

The model is most effective when responsibilities are documented through a responsibility matrix. For example, the product manager may own product risk, compliance may assess regulatory suitability, actuarial may review pricing assumptions, risk may assess aggregation and internal audit may later test the entire process. Ambiguous responsibility is a frequent cause of control failure.

Enterprise Risk Management in Practice

ERM begins with the organisation’s objectives and risk universe. An insurer’s risk universe may include underwriting, reserving, catastrophe, market, credit, liquidity, operational, technology, cyber, legal, conduct, model, strategic, reputational and climate risks. Risks should be assessed using both quantitative and qualitative information. A heat map can communicate prioritisation, but it should not replace analysis of capital, cash flow, dependencies or scenario impacts.

Risk identification must include emerging risks and interconnections. A severe flood, for example, may create underwriting losses, reinsurance disputes, liquidity pressure, operational disruption, reputational damage and regulatory scrutiny simultaneously. Aggregation and concentration analysis is therefore essential.

Risk assessment commonly considers likelihood, impact, velocity, persistence and control effectiveness. Responses include avoidance, reduction, transfer, acceptance and exploitation where an opportunity is involved. Insurance, reinsurance and derivatives may transfer financial consequences, but they do not remove the need to understand the underlying exposure. A risk register should record the owner, causes, consequences, controls, indicators, appetite position, treatment plan and review date.

Risk monitoring uses key risk indicators (KRIs), key performance indicators, limit reports, incidents, complaints, claims development, capital ratios, liquidity forecasts and audit findings. Escalation rules should specify when a breach must be reported, who must act and how quickly. A limit breach is not necessarily evidence of failure if it is promptly identified and managed; concealment or repeated tolerance of breaches is more serious.

Stress testing and scenario analysis explore adverse but plausible conditions. Scenarios may combine high inflation, increased claims severity, falling asset values, reinsurer default and operational disruption. Reverse stress testing asks what circumstances could threaten viability and whether early-warning indicators exist. Results should influence capital planning, reinsurance, product design, liquidity buffers and contingency plans.

Actuarial Oversight and Prudential Judgement

Actuarial work is central to insurance governance because many obligations cannot be observed directly. Actuaries estimate claims liabilities, assess premium adequacy, analyse experience, evaluate assumptions and support capital assessment. Their responsibility is not to guarantee that estimates are correct; it is to apply professional judgement, appropriate methods and transparent communication of uncertainty.

Governance should ensure that actuarial assumptions are challenged and documented. Important assumptions may include mortality, morbidity, lapse, inflation, claims frequency, claims severity, discount rates, expenses, catastrophe patterns and policyholder behaviour. Management pressure to reduce reserves or present favourable results creates a serious professional and governance risk.

Actuarial opinions should explain methods, data limitations, uncertainty, sensitivity and material changes. The actuary should have access to the board or audit/risk committee and should escalate concerns where management rejects a professionally justified position. Actuarial oversight also extends to reinsurance recoverability, contract boundaries, product profitability and the consistency of pricing with risk appetite.

Compliance Programmes and Internal Control

A compliance programme begins with a regulatory obligations inventory. Requirements should be mapped to accountable owners, processes, controls, evidence and reporting channels. The inventory may cover licensing, solvency, capital, reporting, market conduct, product approval, sales practices, anti-money-laundering obligations, data protection, sanctions, outsourcing and corporate law.

Compliance risk assessment prioritises obligations according to customer impact, regulatory significance, likelihood of breach, control maturity and speed of harm. Monitoring may include file reviews, call sampling, transaction testing, complaints analysis, regulatory-return validation and thematic reviews. Training is necessary but insufficient. Competence must be reinforced through system controls, supervision, incentives and consequences.

A sound compliance issue-management process records the issue, root cause, affected customers, legal requirement, interim protection, responsible owner, corrective action, deadline, validation and closure approval. Remediation should address customer redress where appropriate, not merely repair a document or procedure. Senior management and the board should receive trend reports rather than isolated statistics.

Internal controls should be proportionate and risk-based. Common insurance controls include authority limits, dual approvals, segregation of duties, reconciliations, access controls, data validation, claims review, reserve governance, investment mandates, complaint escalation and business continuity testing. Excessive controls may slow legitimate business and encourage workarounds; inadequate controls permit error or misconduct. The objective is reasonable assurance, not absolute certainty.

Outsourcing and Third-Party Risk

Insurers outsource functions for efficiency, specialist expertise or scale, including claims administration, cloud hosting, call centres, actuarial services and information processing. Outsourcing can improve capability but may introduce concentration, confidentiality, resilience, subcontracting and exit risks. The insurer remains accountable for regulatory obligations and policyholder outcomes.

Before outsourcing, management should assess criticality, provider competence, financial strength, information-security arrangements, location, subcontractors, conflicts, concentration and exit feasibility. Contracts should specify service levels, audit and access rights, incident notification, data ownership, business continuity, confidentiality, regulatory cooperation, subcontracting controls and termination assistance.

Ongoing oversight should include performance indicators, control attestations, independent assurance, incident monitoring and periodic reassessment. A service-level report is not a complete risk assessment. If a cloud provider fails, an insurer must know how it will continue claims payments, protect data and communicate with customers. Exit plans should be tested, not merely filed.

Whistleblowing and Ethical Culture

Whistleblowing systems enable employees, agents and other stakeholders to report suspected illegality, fraud, misconduct, retaliation or serious control failure. A credible system offers confidential or anonymous channels where legally permissible, multiple reporting routes, impartial investigation, protection against retaliation and timely feedback.

The board should monitor the operation of the system without compromising confidentiality. A low number of reports does not necessarily indicate a healthy culture; it may indicate fear, lack of awareness or lack of trust. Conversely, an increase in reports may reflect improved confidence rather than deteriorating conduct. Data should be interpreted alongside employee surveys, turnover, complaints, disciplinary cases and audit findings.

Ethical culture is shaped by what leaders reward, tolerate and investigate. Codes of conduct should address conflicts, customer treatment, use of information, gifts, incentives and speaking up. Retaliation against a good-faith reporter is itself a governance failure and may create legal and reputational consequences.

Governance, Technology and Data

Digital insurance creates new control requirements. Automated underwriting, artificial intelligence, application programming interfaces, cloud platforms and data analytics can improve speed and consistency, but may also reproduce bias, obscure decision logic, create cyber vulnerabilities or depend on inaccurate data.

Governance over models should cover purpose, ownership, data lineage, validation, performance monitoring, change approval, explainability and retirement. A model should not be treated as objective merely because it is mathematical. Human oversight is necessary where automated decisions may materially affect coverage, price, claims or customer access.

Cyber governance includes asset inventories, identity management, encryption, patching, detection, incident response, recovery testing and third-party controls. Boards need reporting that translates technical exposure into business consequences, such as interrupted claims service, data compromise or regulatory notification. Artificial intelligence also raises questions of privacy, fairness, accountability, intellectual property and professional judgement.

Illustrative Case: The Meridian General Insurance Failure

Background

Meridian General Insurance, a fictional mid-sized property insurer, expanded rapidly through digital distribution. Its board approved a growth strategy based on low prices and automated underwriting. The company outsourced cloud hosting and claims administration and relied heavily on catastrophe models.

Situation and problem

After two severe weather events, claims increased sharply. Management delayed strengthening reserves because it feared missing growth targets and breaching a debt covenant. The actuarial function raised concerns about claims inflation and data quality, but reported to the chief financial officer and had limited direct access to the board. Compliance monitoring focused on completion of annual training rather than product suitability or claims fairness. Internal audit had not reviewed the outsourced claims provider for three years.

At the same time, an algorithm systematically rejected some claims because historical training data contained inconsistent coding. Employees reported concerns through an internal channel, but the channel was managed by a business executive whose bonus depended on rapid claims settlement. Several employees subsequently stopped raising concerns.

Analysis

The failure was not caused by one defective model or one poor decision. It reflected interconnected weaknesses: excessive growth incentives, inadequate board information, weak actuarial independence, unclear ownership of outsourced controls, ineffective whistleblowing, insufficient data governance and failure to aggregate underwriting, operational and conduct risks. The board considered solvency as a financial ratio rather than as a forward-looking capacity under stress.

The three-lines model had also been misunderstood. Business managers did not own the quality of automated claims decisions; compliance performed checklist reviews rather than risk-based monitoring; and internal audit had insufficient coverage of the critical third party. The absence of a documented escalation threshold allowed management to treat reserve concerns as an operational disagreement.

Approach and solution

The board established an independent review and temporarily restricted growth in the affected product. It required an actuarial reserve review, customer-file testing and an assessment of rejected claims. Affected customers were contacted and redress was provided where decisions were unsupported. The claims algorithm was suspended for high-impact decisions until validation and human review were implemented.

Governance reforms included direct board access for the chief actuary, chief risk officer and compliance officer; a risk committee with defined escalation triggers; revised remuneration measures incorporating claims fairness and control quality; and a third-party oversight programme. The whistleblowing channel was moved to an independent provider, with anti-retaliation procedures and board-level reporting. Scenario testing combined catastrophe, inflation, reinsurer delay, cloud outage and liquidity pressure.

Outcome

Meridian’s short-term profits fell, but its claims decisions became more reliable, reserves more credible and governance information more useful. The company developed a risk appetite statement that included conduct and operational tolerances, not only capital measures. The case illustrates that governance investment may expose problems before it produces visible financial benefits; that exposure is evidence of better transparency, not necessarily worse management.

Learning points

The case demonstrates five principles: accountability remains with the insurer despite outsourcing; actuarial and control functions require independence; technology requires governance throughout its lifecycle; customer outcomes are part of risk management; and boards must challenge strategy using forward-looking scenarios rather than relying solely on historical performance.

Challenges, Limitations and Common Mistakes

A frequent mistake is treating governance as documentation. Policies, committee minutes and risk registers have little value if directors do not understand them or managers routinely override controls. Another mistake is confusing independence with isolation. Control functions must challenge business decisions but remain sufficiently connected to operations to understand real risks.

Risk appetite can become a collection of abstract statements. It is useful only when linked to limits, authorities, indicators and consequences. Similarly, compliance programmes can become training exercises that overlook incentives, customer outcomes and root causes. Internal audit may also provide false comfort when its plan excludes rapidly changing technology or critical suppliers.

Quantitative models have limitations arising from data gaps, parameter uncertainty, structural change and behavioural responses. Stress tests are not forecasts and should not be presented as precise predictions. Outsourcing may reduce direct control while increasing dependence on a provider. Whistleblowing systems can be misused, but the answer is fair investigation rather than discouraging reports.

Governance must also avoid groupthink. Boards should invite contrary evidence, examine assumptions, distinguish bad news from bad performance and ensure that challenge does not result in retaliation. Proportionality is important: a small insurer needs effective arrangements, but not necessarily the same number of committees as a large international group.

Current Developments and Best Practices

Contemporary supervision increasingly emphasises operational resilience, climate-related financial risk, cyber security, consumer outcomes, data governance, third-party concentration and artificial intelligence. Climate risk affects assets, liabilities, reinsurance, underwriting assumptions and physical operations. It should be integrated into existing governance and risk processes rather than treated only as a sustainability report.

Practical best practice includes:

• a board-approved strategy, risk appetite and responsibility matrix;
• timely reporting that combines financial, conduct, operational and customer indicators;
• direct and protected access for control functions to the board;
• documented escalation, breach and remediation procedures;
• independent validation of material models and actuarial assumptions;
• risk-based oversight of critical outsourcing and tested exit plans;
• scenario analysis covering interconnected and emerging risks;
• remuneration linked to sustainable outcomes, not only volume or short-term profit;
• protected whistleblowing and evidence of non-retaliation; and
• periodic evaluation of board, committee and control-function effectiveness.

The strategic test of governance is not whether every risk is eliminated. It is whether the insurer can recognise uncertainty, make informed choices, respond quickly, protect policyholders and learn from failures.

Chapter Summary

Corporate governance, risk management and compliance form an integrated system for ensuring that an insurer is directed responsibly, remains financially sound and treats policyholders fairly. The board retains ultimate accountability for strategy, risk appetite, capital, culture and oversight, while management owns risks arising from daily operations. Risk, compliance, actuarial and internal audit functions provide distinct forms of challenge and assurance within the three-lines model.

Enterprise risk management links objectives, risk identification, appetite, controls, monitoring, stress testing and escalation. Actuarial oversight supports credible pricing, reserving and solvency assessment. Compliance programmes require obligations mapping, risk-based monitoring, issue remediation and customer redress where necessary. Outsourcing does not transfer accountability, and whistleblowing is effective only when reporting is protected and retaliation is prevented. Digital models and third parties create additional governance demands involving data, cyber security, explainability and resilience. Effective governance is demonstrated through informed challenge, reliable information, ethical culture and timely action—not through paperwork alone.

Key Terms

Corporate governance: The system by which an insurer is directed, controlled and held accountable.

Risk appetite: The types and aggregate level of risk an insurer is willing to accept.

Risk capacity: The maximum risk the insurer can bear without threatening its objectives or obligations.

Enterprise risk management: An integrated process for managing risks across the organisation.

ORSA: A forward-looking assessment of an insurer’s risks, solvency needs and resilience.

Internal control: Policies and procedures providing reasonable assurance over operations, reporting, assets and compliance.

Control function: A specialist function that provides independent or objective oversight and challenge.

Three-lines model: A framework distinguishing operational management, specialist oversight and independent internal audit.

Conduct risk: The risk of unfair outcomes for customers or markets.

Operational risk: Loss arising from failed people, processes, systems or external events.

Key risk indicator: A measure that signals changing exposure or control weakness.

Stress testing: Analysis of the effect of adverse but plausible conditions.

Reverse stress testing: Analysis of scenarios that could threaten viability.

Actuarial oversight: Professional review of pricing, reserving, capital and related insurance estimates.

Compliance risk: The risk of legal, regulatory, financial or reputational consequences from non-compliance.

Outsourcing: Use of an external provider to perform a function or service.

Whistleblowing: Reporting suspected wrongdoing or serious control failure through protected channels.

Model risk: The risk that a model is inappropriate, inaccurate, misused or poorly governed.

Operational resilience: The ability to continue critical services and recover from disruption.

Review Questions

Short Answer Questions

1. Why is board accountability especially important in insurance?

2. Distinguish risk appetite from risk capacity.

3. What is the role of the actuarial function in governance?

4. Identify the three lines and their principal responsibilities.

5. Why does outsourcing not remove an insurer’s regulatory accountability?

Long Answer Questions

1. Explain how an insurer can design an effective board and committee structure.

2. Discuss the role of ERM, stress testing and ORSA in strategic decision-making.

3. Explain how compliance monitoring and internal controls should be connected to customer outcomes.

4. Analyse the importance of independence, competence and access for key control functions.

5. Describe the governance requirements for outsourcing a critical claims or technology function.

Analytical / Application Questions

1. An insurer’s growth strategy produces rising complaints, falling underwriting margins and repeated risk-limit breaches. Using the three-lines model, allocate responsibilities and recommend board actions.

2. A claims algorithm rejects a higher proportion of claims from one customer segment, while the data scientist cannot explain the result. Design a governance and remediation response.

3. A small insurer wants to combine its audit and risk committees and outsource internal audit. Evaluate the arrangement and specify safeguards needed to preserve effective oversight.

22. Multiple Choice Questions with Answers

Question 1

Which statement best describes the board’s accountability in an insurer?

A. The board is accountable only for financial reporting, while management owns all other risks.

B. The board may delegate accountability entirely to external service providers.

C. The board retains ultimate accountability for sound governance even when duties are delegated.

D. The board is responsible only when a regulatory breach has already occurred.

Correct Answer: C. The board retains ultimate accountability for sound governance even when duties are delegated.

Question 2

Under the three-lines model, who primarily owns risks arising from daily underwriting and claims operations?

A. The first line, consisting of business and operational management

B. The second line, consisting of compliance and risk oversight

C. The third line, consisting of internal audit

D. The external auditor

Correct Answer: A. The first line, consisting of business and operational management

Question 3

Which feature most clearly distinguishes ORSA from a purely historical solvency report?

A. It excludes stress testing to avoid subjective assumptions.

B. It is a forward-looking assessment of risks, solvency needs and resilience.

C. It is prepared only by the external auditor.

D. It measures only the previous year’s claims ratio.

Correct Answer: B. It is a forward-looking assessment of risks, solvency needs and resilience.

Question 4

An insurer’s compliance team discovers repeated mis-selling caused by sales incentives. What is the most appropriate response?

A. Provide another general training course and close the issue.

B. Ignore the issue if the insurer remains solvent.

C. Investigate root causes, protect affected customers and revise incentives and controls.

D. Transfer responsibility to the internal audit function.

Correct Answer: C. Investigate root causes, protect affected customers and revise incentives and controls.

Question 5

Why is actuarial independence important?

A. It allows actuaries to approve all marketing decisions without review.

B. It reduces the risk that professional estimates are distorted by short-term management pressure.

C. It eliminates uncertainty from pricing and reserving.

D. It means actuaries do not need to explain assumptions to the board.

Correct Answer: B. It reduces the risk that professional estimates are distorted by short-term management pressure.

Question 6

Which contractual provision is most important when outsourcing a critical claims function?

A. A requirement that the provider use the insurer’s preferred branding only

B. A prohibition on all performance measurement

C. Audit rights, incident notification, continuity obligations and regulatory access

D. An agreement that transfers all regulatory accountability to the provider

Correct Answer: C. Audit rights, incident notification, continuity obligations and regulatory access

Question 7

A low number of whistleblowing reports should be interpreted as evidence of a healthy culture only when it is supported by:

A. The absence of formal complaints alone

B. Evidence of awareness, trust, non-retaliation and other culture indicators

C. A reduction in internal audit activity

D. Management’s statement that employees are satisfied

Correct Answer: B. Evidence of awareness, trust, non-retaliation and other culture indicators

Question 8

What is the principal purpose of reverse stress testing?

A. To predict the exact date of the next catastrophe

B. To identify circumstances that could threaten viability and assess preparedness

C. To replace all routine risk monitoring

D. To calculate only expected annual claims

Correct Answer: B. To identify circumstances that could threaten viability and assess preparedness

Question 9

An insurer introduces an automated claims model trained on inconsistent historical data. Which governance control is most relevant initially?

A. Model validation, data-lineage review and human oversight of material decisions

B. Immediate removal of all claims staff

C. Increasing the model’s authority without testing

D. Treating the model as objective because it is mathematical

Correct Answer: A. Model validation, data-lineage review and human oversight of material decisions

Question 10

Which statement best reflects effective governance of risk appetite?

A. Risk appetite should be separate from limits and escalation procedures.

B. Risk appetite should be linked to measurable limits, indicators, authorities and consequences.

C. Risk appetite should focus exclusively on shareholder returns.

D. Risk appetite is needed only for investment risk.

Correct Answer: B. Risk appetite should be linked to measurable limits, indicators, authorities and consequences.