Governance, Enterprise Risk and Ethics

Introduction and context

Insurance is a promise about the future. Policyholders pay premiums today in exchange for an uncertain benefit that may be required years later. The insurer must therefore remain financially sound, operationally reliable, legally compliant and worthy of public trust over long periods. Governance, enterprise risk management and ethics provide the institutional framework for fulfilling that promise.

Governance concerns how an insurer is directed, controlled and held accountable. Enterprise risk management (ERM) concerns how the organisation identifies, measures, responds to and monitors risks in an integrated manner. Ethics concerns the standards of conduct used when law, incentives or information asymmetry do not provide complete guidance. These subjects are strategically connected: weak governance can permit poor risk-taking; poor risk management can threaten solvency; unethical conduct can cause customer harm, regulatory sanctions and reputational damage.

The precise legal requirements differ across jurisdictions. Nevertheless, internationally accepted supervisory practice generally expects insurers to maintain effective boards, risk-management systems, internal controls, compliance arrangements, fair customer treatment, protection of confidential information and controls against financial crime.

Learning objectives

By the end of this chapter, a student should be able to:

1. Explain the role and responsibilities of an insurer’s board and senior management.
2. Distinguish governance, risk management, internal control, compliance and internal audit.
3. Apply an ERM framework to insurance risks and explain risk appetite.
4. Analyse conduct risk, conflicts of interest and professional ethical dilemmas.
5. Describe the purposes of data privacy and anti-money-laundering controls.
6. Evaluate an insurer’s control environment and propose practical improvements.

1. Insurance governance and the agency problem

Insurance governance is the system of relationships, structures, processes and controls through which an insurer is directed and supervised. It allocates authority among owners, the board, board committees, executives, control functions, employees, policyholders, regulators and other stakeholders.

A central theoretical issue is the agency problem. Shareholders appoint directors; directors oversee executives; executives manage assets and make underwriting, investment and claims decisions. Because these parties may have different objectives and different information, managers may take actions that benefit themselves but increase risks for policyholders or shareholders. In insurance, policyholders are especially vulnerable because they usually cannot observe reserving assumptions, reinsurance quality or claims practices directly.

Governance reduces agency problems through:

• clearly defined responsibilities and delegated authorities;
• competent and independent oversight;
• reliable information and reporting;
• performance measures that do not reward excessive short-term risk;
• internal controls and independent assurance; and
• accountability for misconduct or control failure.

Good governance is not simply the existence of committees. It requires informed challenge, evidence-based decisions, timely escalation and a culture in which employees can report concerns without retaliation.

The board’s strategic role

The board is ultimately accountable for the sound and prudent direction of the insurer, subject to applicable law. Its responsibilities commonly include:

• approving strategy, business plans and major transactions;
• setting risk appetite and overseeing its implementation;
• ensuring adequate capital, liquidity, reserves and reinsurance;
• appointing, evaluating and, when necessary, replacing senior executives;
• approving the remuneration framework;
• overseeing financial reporting and disclosures;
• ensuring effective internal control, compliance and risk management;
• monitoring conduct toward policyholders and other stakeholders; and
• maintaining constructive relations with supervisors.

The board should not perform management’s daily work. Its role is oversight, challenge and accountability. However, non-intervention does not mean passivity. A board that approves reports without understanding their assumptions is not exercising effective oversight.

A board should receive information that is accurate, timely, sufficiently detailed and decision-relevant. For example, a report showing that total premium income is increasing may be misleading if it omits deteriorating claims frequency, concentration in catastrophe-exposed regions, falling renewal rates or a weakening reinsurance programme.

Board committees and key control functions

Common committees include an audit committee, risk committee, remuneration committee and nomination or governance committee. Their names and legal requirements vary. Committees support the board; they do not remove the board’s collective responsibility.

Important control functions normally include:

• Risk management: coordinates risk identification, assessment, monitoring and reporting.
• Compliance: advises on legal and regulatory obligations and monitors adherence.
• Actuarial function: provides professional opinions on technical provisions, pricing or solvency matters, depending on the jurisdiction.
• Internal audit: independently evaluates governance, risk management and controls.
• Finance: maintains accounting records, reporting processes and financial control.

Independence is essential. A risk officer who is rewarded solely for sales growth may be unable to challenge aggressive underwriting. Internal audit should have direct access to the audit committee and should not audit activities for which it has operational responsibility.

2. Internal control and the three lines model

Internal control is the process designed to provide reasonable—not absolute—assurance that an organisation will achieve objectives relating to operations, reporting and compliance. Controls may be preventive, detective or corrective.

Examples in insurance include:

• underwriting authority limits and referral rules;
• segregation of duties between policy issuance, premium collection and claims payment;
• reconciliations between policy, billing and general-ledger systems;
• independent review of reserving assumptions;
• access controls over customer records;
• approval of payments by authorised personnel;
• complaint monitoring; and
• disaster-recovery and business-continuity procedures.

A control can fail because it is badly designed or because it is not operated consistently. A monthly reconciliation is poorly designed if discrepancies are not investigated; it is poorly operated if staff merely sign a checklist without performing the reconciliation.

The three lines model clarifies accountability:

The model is not a substitute for judgement. The first line remains responsible for risks even when a second-line function gives advice. Internal audit should assess the effectiveness of both the first and second lines without becoming their manager.

Control evaluation

Control evaluation asks four questions:

1. What objective is the control intended to protect?
2. What risk event could prevent that objective?
3. Is the control appropriately designed to prevent or detect the event?
4. Is there evidence that the control operated effectively during the relevant period?

A useful distinction is between inherent risk, the exposure before controls, and residual risk, the exposure remaining after controls. Residual risk should be compared with the organisation’s risk appetite. A control does not necessarily eliminate risk; it changes its likelihood, impact or detectability.

3. Enterprise risk management in insurance

ERM is an integrated process for identifying, assessing, responding to and monitoring risks across the insurer. It differs from a collection of independent risk registers because it considers interactions and concentrations. A catastrophe may simultaneously create underwriting losses, liquidity pressure, operational disruption, reputational damage and regulatory scrutiny.

Principal insurance risk categories

Risks can be measured using qualitative assessments, scenario analysis, stress testing, statistical models and capital metrics. No model removes uncertainty. Model outputs depend on data quality, assumptions, parameter choices and the stability of historical relationships.

Risk appetite and limits

Risk appetite is the amount and type of risk an insurer is willing to accept in pursuit of its objectives. It is translated into limits and triggers, such as:

• maximum exposure to a geographic catastrophe zone;
• minimum liquidity holdings;
• maximum counterparty concentration;
• tolerance for unresolved complaints;
• limits on high-risk investments; and
• maximum volatility in solvency or capital ratios.

Risk appetite should be expressed in terms that decision-makers can use. A statement such as “the company has a low tolerance for operational risk” is incomplete unless supported by measurable indicators, escalation thresholds and named responsibility.

The risk-management cycle

The ERM cycle consists of:

1. Identification: determine events, causes and affected objectives.
2. Assessment: estimate likelihood, impact, velocity and interdependence.
3. Response: avoid, reduce, transfer, accept or exploit risk where appropriate.
4. Monitoring: track indicators, limits, incidents and emerging trends.
5. Reporting and escalation: communicate material exposures to management and the board.
6. Review: test assumptions and improve the framework.

Risk transfer through reinsurance does not eliminate risk. It replaces some underwriting exposure with counterparty, basis, concentration and collateral risks. Similarly, outsourcing may transfer operational activity but normally does not transfer the insurer’s regulatory accountability.

Stress testing and scenario analysis

Stress testing examines whether the insurer can withstand specified adverse conditions. A scenario may combine, for example, an extreme weather event, a fall in asset values, reinsurer delay and increased claims inflation. Scenario analysis is particularly useful for risks that are difficult to estimate from historical frequency alone.

A simple capital buffer can be represented as:

Available capital and required capital must be defined consistently under the applicable regulatory framework. The expression is not a universal solvency rule; it is a conceptual relationship. A positive buffer does not guarantee safety if assumptions are weak, assets are illiquid or risks are highly correlated.

4. Compliance and regulatory accountability

Compliance is the structured process of understanding obligations, translating them into controls, monitoring adherence and correcting deficiencies. Obligations arise from insurance legislation, prudential rules, consumer-protection requirements, privacy law, employment law, tax law, sanctions regimes, financial-crime legislation and contractual commitments.

An effective compliance programme normally contains:

• a legal and regulatory inventory;
• ownership of each obligation;
• documented policies and procedures;
• employee training proportionate to risk;
• monitoring and testing;
• breach reporting and remediation; and
• records demonstrating what was done.

Compliance should be risk-based rather than merely procedural. A completed training form is not evidence that employees understand fair claims handling. Monitoring should examine outcomes, such as complaint patterns, claim settlement times, cancellation rates and vulnerable-customer treatment.

Regulatory reporting also creates governance responsibilities. Management should verify data quality, reconcile reported figures to source systems and document material judgements. Deliberately misleading a regulator is a serious ethical and legal failure, even if the underlying business remains profitable.

5. Conduct risk, consumer protection and culture

Conduct risk is the risk that an insurer’s behaviour produces unfair or harmful outcomes for customers, markets or society. Insurance customers often face information asymmetry, complex exclusions and difficulty evaluating future claims service. Conduct therefore has strategic significance, not merely public-relations significance.

Conduct risks may arise in:

• product design that obscures exclusions or provides little value;
• incentives that encourage unsuitable sales;
• discriminatory or opaque pricing practices;
• claims processes that create unreasonable barriers;
• inadequate disclosure of renewal or cancellation terms;
• poor treatment of vulnerable customers; and
• misuse of personal data.

A customer-outcome approach asks whether customers receive understandable information, suitable products, fair value, accessible service and timely claims decisions. This is stronger than asking only whether a form was signed.

Culture is reflected in what leaders reward, tolerate and investigate. A written ethics code has little effect if employees who raise concerns are penalised while high-producing staff are excused for misconduct. Useful culture indicators include whistleblowing patterns, staff turnover, complaints, disciplinary consistency, customer research and remuneration outcomes.

6. Conflicts of interest and professional ethics

A conflict of interest exists when a person’s private interest, duty to another party or competing responsibility could improperly influence judgement. A conflict may be actual, potential or perceived. Perceived conflicts matter because trust can be damaged even when no improper action occurred.

Common insurance conflicts include:

• an intermediary receiving commission from an insurer while presenting itself as independent;
• an employee handling a claim involving a relative;
• an executive’s outside business seeking preferential procurement terms;
• an insurer prioritising shareholder returns over fair treatment of policyholders; and
• a claims assessor being rewarded for reducing settlement costs without balancing fairness and accuracy.

A sound conflict framework requires disclosure, recording, assessment, management and periodic review. Possible responses include recusal, independent review, reassignment, limits on gifts, transparent remuneration disclosure or prohibition of the activity. Disclosure alone is not sufficient where the conflict is too serious to manage.

Professional ethics requires more than technical competence. Core principles include integrity, objectivity, competence and due care, confidentiality, professional behaviour and accountability. An ethical professional asks:

• Is the action lawful?
• Is it consistent with the organisation’s stated values?
• Who may be harmed?
• Would the decision withstand independent scrutiny?
• Would I be comfortable explaining it to a policyholder, regulator or court?

These questions do not replace law or professional standards, but they help identify conduct that is technically permissible yet unfair or irresponsible.

7. Data privacy, cybersecurity and responsible technology

Insurers collect identity, financial, health, driving, property and behavioural data. Such information enables underwriting and claims management but creates substantial privacy and security responsibilities. Privacy principles commonly include lawfulness and transparency, purpose limitation, data minimisation, accuracy, retention limitation, security and accountability. The exact legal rights and duties depend on jurisdiction.

A privacy programme should address:

• the lawful basis and purpose for collecting information;
• clear customer notices and appropriate consent where required;
• access, correction and other individual rights;
• retention and secure deletion;
• vendor and cross-border data-transfer controls;
• encryption, authentication and access logging;
• breach detection, response and notification; and
• privacy impact assessment for high-risk processing.

Cybersecurity is an ERM issue because an attack can interrupt claims payments, expose sensitive records, create regulatory liability and damage trust. Controls should include least-privilege access, multi-factor authentication, patch management, backups, network monitoring, staff training and tested incident-response plans.

Artificial intelligence can assist fraud detection, pricing, underwriting, customer service and claims triage. However, it can reproduce bias, rely on poor data, obscure reasons for decisions or create unacceptable discrimination. Governance should require documented purpose, data-quality testing, human oversight, model validation, explainability proportionate to impact, monitoring for drift and a route for customers to challenge decisions. Efficiency is not a sufficient justification for an opaque or unfair automated decision.

8. Anti-money laundering and counter-terrorist financing

Money laundering involves disguising the criminal origin of assets. Terrorist financing involves providing or collecting funds for terrorist activity; funds may originate from either legal or illegal sources. Insurers are not equally exposed across all products, but life insurance, investment-linked products, annuities, intermediated business and high-value refunds may present heightened risks.

A risk-based AML/CFT programme generally includes:

1. enterprise-wide risk assessment;
2. customer identification and verification;
3. beneficial-owner identification for legal entities;
4. understanding the purpose and expected nature of the relationship;
5. enhanced due diligence for higher-risk customers, products or jurisdictions;
6. ongoing transaction and customer monitoring;
7. sanctions screening where legally required;
8. suspicious-activity escalation and reporting to the competent authority;
9. record keeping; and
10. independent testing and staff training.

The programme should avoid both extremes: treating every customer as inherently suspicious and accepting all customers without meaningful scrutiny. Suspicion is based on facts and circumstances, not on nationality or other unlawful stereotypes. Employees must follow applicable rules concerning confidentiality and tipping off, which generally prohibit alerting a customer that a suspicious-activity report may have been made.

9. Illustrative case: Meridian Life Assurance

Background. Meridian Life Assurance, a fictional insurer, grows rapidly through digital sales. Its board receives monthly reports focused on premium growth and expense ratios. Sales agents receive large commissions for policies cancelled within the first year, and the claims department is rewarded primarily for reducing settlement amounts. A vendor hosts customer health data on a cloud platform. Internal audit has not reviewed the vendor for three years.

Problem. Complaints increase about unsuitable policies, unclear exclusions and delays in medical claims. A cyber incident exposes customer records. At the same time, a politically exposed customer makes a large single premium payment through an intermediary, but the onboarding team cannot identify the beneficial source of funds.

Analysis. The board has allowed growth indicators to dominate customer and risk indicators. This reveals weak conduct governance and poor incentive design. The claims target creates a conflict between cost reduction and fair settlement. Vendor oversight is inadequate, creating privacy and operational risk. The unexplained payment indicates a need for enhanced due diligence and escalation under the AML framework. These risks are interconnected: a culture that discourages challenge can cause failures in sales, claims, cybersecurity and financial crime controls simultaneously.

Approach and solution. Meridian should immediately:

• establish a board risk and conduct dashboard containing complaints, cancellations, claims delays, vulnerable-customer outcomes, cyber incidents and AML alerts;
• suspend or review incentives that reward unsuitable sales or unfair claim reductions;
• require independent claims-quality reviews and root-cause analysis of complaints;
• perform a privacy and security assessment of the cloud vendor and revise contractual controls;
• investigate the payment, identify the beneficial owner and apply enhanced due diligence;
• give the compliance and risk functions direct escalation access to the board;
• conduct scenario tests covering a cyberattack, catastrophe claims and liquidity needs; and
• commission internal audit to assess remediation after implementation.

Outcome. In this illustrative case, the proposed measures would not guarantee that further incidents could not occur. They would, however, improve accountability, make emerging harm visible, align incentives with customer outcomes and provide evidence of reasonable governance.

Learning points. Growth is not a substitute for control. A board must examine the quality and sustainability of business, not merely its volume. Conduct, privacy, AML and operational risks should be integrated into ERM because they can reinforce one another.

10. Challenges, limitations and best practices

Governance systems face several limitations. Boards may suffer from groupthink, lack relevant expertise or receive excessive information without clear priorities. Risk models may understate rare events and correlations. Compliance can become a “tick-box” exercise. Outsourcing may create opaque dependencies. Ethical codes may fail if remuneration and leadership behaviour send contradictory signals.

Best practice therefore includes:

• matching board skills to the insurer’s products and risk profile;
• annual evaluation of board and committee effectiveness;
• concise dashboards linked to risk appetite and thresholds;
• independent control functions with adequate resources;
• regular stress testing and challenge of model assumptions;
• remuneration linked to sustainable, fair outcomes rather than volume alone;
• protected whistleblowing channels;
• documented issue ownership, deadlines and escalation;
• independent testing of critical vendors and technology; and
• continuous learning from complaints, incidents, near misses and regulatory findings.

Governance should be proportionate, but proportionality does not mean exemption from responsibility. A small insurer may use simpler systems than a multinational group, yet it still needs clear accountability, reliable records, effective controls and fair treatment of customers.

Chapter Summary

Insurance governance allocates authority and accountability among the board, management, control functions and stakeholders. The board oversees strategy, risk appetite, capital, conduct, remuneration and control effectiveness while management performs daily operations. Internal control provides reasonable assurance over operations, reporting and compliance; the three lines model distinguishes risk ownership, oversight and independent assurance.

ERM integrates underwriting, market, credit, liquidity, operational, compliance, conduct, strategic and reputational risks. Risk appetite becomes useful only when translated into limits, indicators and escalation procedures. Compliance requires more than policies: it requires implementation, monitoring, evidence and remediation.

Ethical insurance practice protects policyholders from conflicts, mis-selling, unfair claims handling and misuse of information. Privacy and cybersecurity are strategic risks because insurers hold sensitive data. AML/CFT controls require a risk-based approach involving customer due diligence, beneficial-owner identification, monitoring and reporting. Effective governance is ultimately demonstrated by decisions, incentives, challenge and customer outcomes—not by the existence of documents alone.

Key Terms

Governance: The system by which an insurer is directed, controlled and held accountable.

Agency problem: A conflict arising when one party acts on behalf of another but has different interests or better information.

Board oversight: The board’s responsibility to guide, challenge and monitor management.

Risk appetite: The amount and type of risk an organisation is willing to accept.

Enterprise risk management: An integrated process for managing risks across the organisation.

Inherent risk: Exposure before considering controls.

Residual risk: Exposure remaining after controls are applied.

Internal control: Processes providing reasonable assurance over operations, reporting and compliance.

Compliance: Organised management of legal, regulatory and contractual obligations.

Internal audit: An independent assurance function evaluating governance, risk management and controls.

Conduct risk: Risk of unfair or harmful outcomes caused by organisational behaviour.

Conflict of interest: A situation in which competing interests may improperly influence judgement.

Professional ethics: Principles guiding responsible and trustworthy professional conduct.

Data minimisation: Collecting and using no more personal data than necessary for a legitimate purpose.

Cybersecurity: Protection of systems and information from unauthorised access, disruption or misuse.

Money laundering: Concealing the criminal origin of assets.

Beneficial owner: The natural person who ultimately owns or controls a customer or arrangement.

Enhanced due diligence: Additional investigation and monitoring applied to higher-risk relationships.

Whistleblowing: Reporting suspected wrongdoing through protected channels.

Three lines model: A framework distinguishing operational risk ownership, oversight and independent assurance.

Review Questions

Short Answer Questions

1. What is the difference between inherent risk and residual risk?
2. Identify four responsibilities commonly held by an insurer’s board.
3. Why is internal audit expected to be independent?
4. Give two examples of conduct risk in insurance.
5. What is the purpose of identifying a beneficial owner?

Long Answer Questions

1. Explain how governance can reduce agency problems in an insurance company.
2. Describe the ERM cycle and show how risk appetite should influence decision-making.
3. Compare the responsibilities of the first, second and third lines in the three lines model.
4. Discuss the relationship between remuneration, organisational culture and conduct risk.
5. Explain the principal privacy, cybersecurity and AI-governance challenges facing insurers.

Analytical / Application Questions

1. An insurer’s premium income is rising, but complaints, early cancellations and claims delays are also increasing. Analyse the governance and conduct indicators the board should investigate and recommend corrective actions.
2. A life insurer discovers that a high-value policy was purchased through an intermediary whose beneficial owner cannot be verified. Design a proportionate AML/CFT response and identify escalation points.
3. An insurer outsources claims administration and suffers a data breach. Analyse the governance, operational, privacy and reputational risks, and propose a board-level remediation plan.

Multiple Choice Questions with Answers

Question 1

Which body has ultimate oversight responsibility for an insurer’s strategy and risk appetite?

A. The board of directors

B. The external auditor

C. The sales department

D. The claims administrator

Correct Answer: A. The board of directors

Question 2

Which function provides independent assurance over governance, risk management and controls?

A. Underwriting

B. Internal audit

C. Marketing

D. Policy administration

Correct Answer: B. Internal audit

Question 3

Residual risk is best described as risk that:

A. Exists before any controls are applied

B. Has been transferred entirely to a reinsurer

C. Remains after controls are applied

D. Cannot be reported to management

Correct Answer: C. Remains after controls are applied

Question 4

Which is an example of conduct risk?

A. A fair and timely claims settlement

B. A customer receiving clear policy information

C. A mis-selling incentive that encourages unsuitable policies

D. An accurately reconciled bank account

Correct Answer: C. A mis-selling incentive that encourages unsuitable policies

Question 5

What is the main purpose of risk appetite?

A. To specify the risks and amount of risk the insurer is willing to accept

B. To eliminate every possible risk

C. To replace internal controls

D. To determine employee leave entitlement

Correct Answer: A. To specify the risks and amount of risk the insurer is willing to accept

Question 6

Which action best addresses a serious conflict of interest?

A. Ignoring it if no loss has yet occurred

B. Disclosing it and, where necessary, removing the person from the decision

C. Hiding it from the customer and regulator

D. Increasing the person’s sales target

Correct Answer: B. Disclosing it and, where necessary, removing the person from the decision

Question 7

Which principle is most closely associated with privacy governance?

A. Collecting unlimited data for possible future use

B. Data minimisation for a legitimate purpose

C. Allowing all employees unrestricted access

D. Keeping data permanently regardless of need

Correct Answer: B. Data minimisation for a legitimate purpose

Question 8

Which information is especially relevant to AML customer due diligence for a company?

A. The beneficial owner

B. The office colour scheme

C. The employee holiday schedule

D. The insurer’s advertising slogan

Correct Answer: A. The beneficial owner

Question 9

In the three lines model, who primarily owns and manages underwriting risk?

A. The first line, such as underwriting management

B. The external regulator

C. The third line only

D. The board secretary alone

Correct Answer: A. The first line, such as underwriting management

Question 10

Why is outsourcing not necessarily a transfer of regulatory accountability?

A. Because vendors cannot perform any insurance activity

B. Because the insurer remains responsible for oversight of outsourced activities

C. Because outsourcing automatically eliminates operational risk

D. Because regulators supervise vendors instead of insurers

Correct Answer: B. Because the insurer remains responsible for oversight of outsourced activities