Enterprise Risk Management and Risk Strategy

Introduction and Context

Enterprise risk management (ERM) is the coordinated process through which an organisation identifies, assesses, responds to, monitors and communicates risks in pursuit of its objectives. It is not merely a control function or a catalogue of hazards. Properly designed ERM connects strategy, governance, capital, performance measurement and decision-making.

For insurers, this connection is especially important. An insurer accepts risks from policyholders, transforms them through underwriting and diversification, invests premiums, manages claims and relies on capital to absorb adverse outcomes. A decision that improves one risk category may worsen another. For example, increasing investment in higher-yield assets may improve expected returns but increase market, liquidity and solvency risk. Similarly, expanding into a new insurance line may generate growth while creating reserving, operational, conduct and catastrophe exposures.

The central managerial challenge is therefore integration. Risk appetite must be translated into measurable tolerances and limits; limits must influence capital allocation and business plans; performance systems must reward risk-adjusted value rather than volume alone; and dashboards must reveal interdependencies rather than presenting isolated risk indicators.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the purpose, principles and architecture of ERM.
2. Distinguish risk appetite, tolerance, capacity, limits and risk targets.
3. Link strategy, risk assessment, capital allocation and performance measurement.
4. Construct and interpret risk maps, dashboards and portfolio views.
5. Analyse diversification, concentration and risk interdependencies.
6. Evaluate governance, regulatory, ethical and technological issues in ERM.
7. Apply ERM principles to an integrated insurance-management case.

1. The Strategic Meaning of Enterprise Risk Management

Traditional risk management often developed in functional silos. The underwriting department managed insurance risk, the investment department managed market risk, the information-technology department managed cyber risk and the finance department managed capital. This arrangement can leave important connections invisible.

ERM adopts an enterprise-wide perspective. It asks five strategic questions:

• What objectives is the organisation pursuing?
• What events could prevent, delay or improve achievement of those objectives?
• How much uncertainty is acceptable in pursuing them?
• What resources, controls and capital are required?
• How will management know whether the risk-return position remains appropriate?

Risk is not synonymous with loss. In strategic management, risk is the effect of uncertainty on objectives. That effect may be negative, positive or both. Nevertheless, insurance governance generally places particular emphasis on downside protection because policyholder obligations and regulatory capital requirements must be met even under adverse conditions.

ERM creates value in three principal ways. First, it protects value by reducing avoidable losses and improving resilience. Second, it enables value by allowing the organisation to take informed risks that support growth. Third, it preserves value by allocating scarce capital to activities whose risk-adjusted returns justify their exposure.

A useful distinction is between risk management and ERM. Risk management may refer to the treatment of a particular exposure. ERM is the organisational system that coordinates such treatments and ensures that aggregate exposure is consistent with strategy and capacity.

2. ERM Architecture

A robust ERM architecture normally contains the following mutually reinforcing components:

1. Governance and accountability: board oversight, senior-management ownership, independent risk functions and clear escalation routes.
2. Strategy and objective setting: explicit strategic, financial, operational and stakeholder objectives.
3. Risk identification and classification: systematic identification of internal and external uncertainties.
4. Risk assessment: analysis of likelihood, impact, velocity, persistence, correlation and control effectiveness.
5. Risk response: avoidance, reduction, transfer, acceptance, exploitation or sharing.
6. Risk appetite and limits: translation of strategic preference into measurable boundaries.
7. Capital and liquidity management: ensuring resources are adequate for expected and unexpected outcomes.
8. Monitoring and reporting: dashboards, indicators, scenario analysis and escalation.
9. Assurance and review: independent validation, internal audit and continuous improvement.

These elements should operate as a cycle rather than a one-time project. Strategy changes risk exposure; exposure changes capital needs; capital constraints affect strategy; monitoring identifies deviations; and learning improves future decisions.

Figure: ERM as an integrated decision cycle linking strategy, risk, capital, controls and performance review.

3. Risk Appetite, Tolerance, Capacity and Limits

These terms are related but should not be used interchangeably.

Capacity is constrained by capital, liquidity, earnings, reputation, regulatory requirements, operational capability and stakeholder confidence. Appetite should normally be below capacity, leaving a buffer for estimation error, stress and emerging risk.

A well-constructed appetite statement has four characteristics. It is linked to objectives, expressed in decision-useful terms, measurable where practicable and accompanied by authority and escalation rules. For an insurer, examples include:

• maintaining solvency capital above a specified internal buffer;
• limiting catastrophe exposure in a geographic zone;
• restricting asset concentration by issuer or sector;
• accepting only moderate earnings volatility over the planning horizon;
• maintaining sufficient liquidity to meet stressed claims and collateral calls; and
• having zero tolerance for deliberate regulatory breaches or fraudulent reporting.

Limits should be cascading. The board may set an aggregate capital or solvency limit; the chief risk officer may translate it into risk-category limits; business units may receive underwriting, investment, reinsurance and operational limits. Cascading is not simple division. Allocation must reflect diversification, correlation, management capability and strategic priority.

A limit is meaningful only when ownership, measurement frequency, data source, breach definition, escalation time and permitted remedial actions are specified. A limit without consequences is a descriptive statistic rather than a control.

4. Risk Identification and Classification

Risk taxonomies support completeness and accountability. A useful insurance taxonomy includes:

• Insurance risk: premium, reserving, catastrophe, longevity, mortality, morbidity and lapse risks.
• Market risk: interest-rate, equity, currency, spread and property-price risk.
• Credit risk: reinsurer default, intermediary failure, issuer default and counterparty deterioration.
• Liquidity risk: inability to meet obligations when due without unacceptable loss.
• Operational risk: failures of people, processes, systems or external events.
• Technology and cyber risk: disruption, compromise, data loss and model-system dependence.
• Legal and regulatory risk: non-compliance, litigation and changes in law.
• Conduct and reputational risk: unfair treatment, mis-selling, conflicts and loss of trust.
• Strategic and emerging risk: inappropriate business models, climate transition, geopolitical change, new competitors and technological disruption.

Taxonomies should not become rigid silos. A cyber incident can create operational loss, regulatory sanctions, customer remediation, liquidity pressure and reputational damage. The taxonomy provides ownership; the risk network provides integration.

Identification methods include workshops, interviews, process mapping, loss-data analysis, scenario analysis, external intelligence, key-risk-indicator review and reverse stress testing. Reverse stress testing begins with a failure outcome—such as breaching minimum solvency—and asks which combination of events could produce it.

5. Assessment: From Risk Maps to Portfolio Views

5.1 Risk maps

A risk map commonly plots likelihood against impact. It is useful for communication and prioritisation, but it is not a complete risk model. Qualitative ratings can conceal uncertainty, correlation and differences in time horizon. A risk map should therefore record the basis of rating, control effectiveness, velocity and trend.

A practical scoring convention may assign likelihood and impact scores from 1 to 5. A simple inherent score is:

where S_i is the inherent risk score for risk i, L_i is its likelihood score and I_i is its impact score. This is an ordinal prioritisation device, not a probability-based expected-loss calculation. Multiplying scores is appropriate only when the organisation clearly defines the scale and uses it consistently; it does not establish that a score of 12 represents twice the risk of a score of 6.

Residual risk reflects the effect of controls. It should not be calculated mechanically unless control effectiveness has a defensible measurement basis. A control may reduce likelihood, impact, or both, and may fail under stress.

5.2 Quantitative portfolio view

Where data and models permit, aggregate loss can be represented as:

where L is total portfolio loss and L_i is loss from exposure i. The distribution of L depends on the marginal distributions of the component losses and their dependence structure. If risks are correlated, simply adding standalone capital requirements may materially overstate or understate aggregate risk.

For two random loss variables, the variance of the aggregate is:

Here σ₁ and σ₂ are standard deviations and ρ₁₂ is the correlation coefficient. The formula assumes finite variances and a meaningful linear covariance relationship. Correlation is not causation and may be unstable during crises. It also cannot fully represent nonlinear dependence or tail co-movement.

For a portfolio of n risks, the matrix form is:

where w is the vector of exposure weights, Σ is the covariance matrix and σ_p² is portfolio variance. This is most useful for approximately linear exposures and well-estimated covariance structures. Insurance losses often require simulation, copulas, scenario analysis or internal models because distributions are skewed, heavy-tailed and dependent on common catastrophes.

5.3 Stress and scenario analysis

Stress testing examines the effect of specified adverse conditions. A scenario may combine an economic recession, equity fall, interest-rate movement, catastrophe, reinsurer downgrade and claims inflation. The purpose is not to predict the exact future but to assess vulnerability, management actions and recovery capacity.

Scenarios should be severe but plausible, supplemented by extreme or reverse stresses. They must identify assumptions, second-round effects, management actions and model limitations. A scenario in which all business units independently apply optimistic assumptions is not a credible enterprise stress test.

6. Capital Allocation and Risk-Adjusted Performance

Capital allocation translates risk information into resource decisions. An insurer may allocate economic capital to lines of business, legal entities, territories, products or distribution channels. The allocation should support solvency, pricing, limits, planning and performance evaluation.

A basic risk-adjusted return measure is:

where earnings should be defined consistently—often after expected losses and operating costs—and economic capital represents the capital required for unexpected loss at a chosen confidence level and horizon. RAROC is meaningful only when the numerator and denominator use compatible time horizons, risk definitions and valuation bases. It should not be compared across businesses if one uses accounting profit and another uses economic profit.

Expected loss can be separated conceptually from unexpected loss:

This is a conceptual relationship, not a universal regulatory formula. Regulatory capital and economic capital may differ because regulators prescribe standard methods, confidence levels, aggregation rules and eligible capital requirements.

Worked example: risk-adjusted portfolio choice

An insurer is comparing two portfolios over one year.

Assume earnings are revenue less claims and expenses. Portfolio A earnings are 6 million and Portfolio B earnings are 7 million. Therefore:

Portfolio B produces greater absolute earnings, but Portfolio A produces the higher return per unit of economic capital. The decision should not be made from RAROC alone. Management should also consider strategic growth, diversification, liquidity, customer obligations, model uncertainty and regulatory constraints.

Capital allocation is particularly difficult when diversification benefits are allocated. If the sum of standalone capital exceeds aggregate capital, an allocation method is required. Possible methods include proportional allocation, marginal contribution, Euler allocation and decision-based allocation. Each method embeds assumptions about fairness and use. Allocations should not be presented as objective facts when they are model-dependent.

7. Linking ERM to Strategy and Performance

The strategic planning process should include a risk assessment before commitments are finalised. A practical sequence is:

1. Define strategic objectives and success measures.
2. Identify uncertainties that could affect those objectives.
3. Establish appetite and capacity constraints.
4. Estimate capital, liquidity and capability requirements.
5. Compare strategic alternatives using risk-adjusted value.
6. Approve limits, triggers and management actions.
7. Monitor outcomes and revise assumptions.

Risk-adjusted performance measurement should discourage behaviour that increases volume while weakening resilience. Relevant measures may include risk-adjusted return, economic-value creation, loss-ratio stability, solvency-buffer consumption, concentration, customer outcomes, liquidity coverage and control effectiveness.

Balanced performance systems should include both lagging and leading indicators. A loss ratio is a lagging indicator; deteriorating underwriting quality, claims-handling delays or rising exception rates may be leading indicators. No single metric is sufficient. Metrics can be gamed, distorted by measurement changes or rendered misleading by a structural break.

A strategy map may connect objectives through causal hypotheses: profitable growth requires appropriate pricing and selection; these require data and skilled staff; operational reliability supports customer retention; and retained earnings strengthen capital. ERM tests whether the risks embedded in these hypotheses are understood and tolerable.

8. Dashboards, Escalation and Decision Rights

An executive risk dashboard should be concise but analytically meaningful. A useful design includes:

• exposure and trend;
• appetite, target, warning threshold and hard limit;
• actual-to-limit ratio;
• data date and data quality status;
• owner and accountable executive;
• scenario or stress result;
• required action and due date; and
• link to supporting analysis.

A dashboard should distinguish green, amber and red conditions, but colours must be supported by explicit definitions. An amber indicator should trigger investigation rather than automatic complacency. Trend, velocity and proximity to a limit may matter more than the current colour.

Decision rights are essential. The board approves appetite and oversees material breaches. Senior management implements strategy and manages aggregate exposure. The risk function challenges, aggregates and reports independently. Business owners manage risks in daily operations. Internal audit provides independent assurance over governance and controls. Actuarial, compliance, finance, security and data functions provide specialist support.

The three-lines model is useful when treated as a model of accountability rather than a justification for organisational separation. The first line owns and manages risk; the second line sets frameworks, challenges and monitors; the third line independently evaluates governance and control effectiveness.

9. Governance, Regulation and Ethics

Insurance ERM is shaped by prudential regulation, supervisory review, enterprise governance requirements and financial-reporting expectations. Regulatory regimes commonly require an assessment of solvency, risk profile, governance, own-risk-and-solvency assessment or an equivalent forward-looking process. Organisations must distinguish internal management information from regulatory reporting and ensure that both are supported by reliable data.

The board remains accountable for the risk strategy even when authority is delegated. Important governance practices include documented appetite approval, independent risk oversight, model validation, fit-and-proper responsibilities, breach escalation and evidence of challenge.

Ethical ERM extends beyond legal compliance. A product may be technically profitable but ethically problematic if pricing exploits vulnerable customers, exclusions are unclear or claims practices create unreasonable barriers. Risk decisions should consider policyholders, employees, intermediaries, investors, regulators and communities.

Conflicts can arise when remuneration rewards premium growth but not claims quality, customer outcomes or capital consumption. Incentive systems should therefore include deferred measures, clawback where appropriate, conduct indicators and risk-adjusted performance.

10. Technology, Data and Artificial Intelligence

Technology can improve ERM through real-time monitoring, automated control testing, catastrophe modelling, anomaly detection and natural-language analysis of emerging-risk information. Artificial intelligence may assist underwriting, fraud detection, claims triage and scenario construction.

However, technology introduces model, data, cyber, privacy and explainability risks. AI outputs can reproduce historical discrimination, rely on unstable relationships or create false confidence. Governance should address data lineage, access controls, validation, performance drift, human oversight, documentation, auditability and rights of review.

Automation should not eliminate accountability. A model recommendation is an input to a governed decision, not a transfer of responsibility to software. High-impact decisions involving coverage, claims or vulnerable customers require proportionate human review and a means of challenge.

11. Contemporary Developments and Critical Limitations

Climate change, geopolitical fragmentation, pandemics, supply-chain disruption, digital dependency and rapid technological change have increased attention to interconnected and non-stationary risks. Historical data may not adequately represent future conditions. Scenario analysis, expert judgement and horizon scanning are therefore increasingly important.

Several limitations deserve emphasis:

• Model risk: assumptions, parameter estimates and dependence structures may be wrong.
• Aggregation risk: risks classified separately may arise from a common driver.
• Risk myopia: organisations may focus on measurable risks and neglect emerging threats.
• False precision: numerical outputs can appear more certain than the evidence permits.
• Data latency: dashboards may describe yesterday while decisions concern tomorrow.
• Behavioural effects: limits can encourage risk-taking just below thresholds or concealment of breaches.
• Correlation breakdown: diversification may disappear under systemic stress.
• Governance overload: excessive reporting can reduce attention to material issues.

Good ERM is therefore not the elimination of uncertainty. It is disciplined uncertainty management supported by transparent assumptions, challenge, learning and timely action.

12. Illustrative Case: Meridian General Insurance

Background

Meridian General Insurance is a fictional mid-sized insurer offering motor, commercial property and health products. It has grown rapidly through brokers and has invested surplus assets in corporate bonds and equities. Its board has approved a strategy of 12% annual premium growth while maintaining a strong solvency position.

Problem

The risk dashboard reports each category separately. Underwriting reports catastrophe exposure, investments report market risk, finance reports solvency and operations report claims-processing incidents. No portfolio view exists. A severe storm could produce large property claims, equity-market losses, reinsurer collateral pressure and operational disruption at the same time. The annual plan also rewards gross premium growth without charging business units for capital consumption.

Analysis

The CRO conducts an enterprise assessment. The risk map identifies catastrophe, claims inflation, cyber disruption and liquidity as high-priority risks. Scenario analysis models a severe storm combined with equity decline, reinsurer downgrade and claims-system interruption. The scenario shows that Meridian remains above the regulatory minimum but falls below its internal solvency buffer and experiences a temporary liquidity deficit.

The analysis also finds that the property portfolio is concentrated in two coastal regions, while the investment portfolio is concentrated in issuers exposed to the same construction sector. Thus, underwriting and investment risks are not independent. A simple sum of standalone capital charges would fail to explain the common driver.

Approach and solution

The board approves an ERM architecture with:

1. an appetite statement covering solvency buffer, liquidity, catastrophe concentration, market exposure and customer outcomes;
2. cascaded limits for property zones, reinsurer credit quality, issuer concentration and operational resilience;
3. a capital-allocation process that reports both earnings and economic-capital consumption;
4. a combined catastrophe-and-market stress scenario reviewed quarterly;
5. a dashboard showing actuals, thresholds, trends, data quality and management actions; and
6. remuneration measures including risk-adjusted return, claims quality and conduct indicators.

Meridian purchases additional catastrophe protection, reduces concentrated investments, pre-arranges contingent liquidity and improves claims-system recovery capability. It also establishes a risk committee that reviews interdependencies rather than receiving separate departmental reports.

Outcome

Growth is revised to 9% for the next planning cycle, but the portfolio becomes more resilient. The firm accepts lower short-term premium volume in exchange for a stronger internal solvency buffer, improved liquidity and more stable risk-adjusted earnings. The board can now compare strategic alternatives using a common risk and capital language.

Learning points

The case demonstrates that ERM is not a centralised veto over business. It is a method for clarifying trade-offs. Separate risks can share drivers, and a firm can satisfy regulatory minimums while breaching its own strategic tolerance. Capital, limits, scenarios and incentives must therefore be designed together.

Best-Practice Implementation Sequence

An organisation beginning or renewing ERM can proceed through the following sequence:

1. Obtain board and executive sponsorship.
2. Map objectives, legal entities, products and decision rights.
3. Establish a common taxonomy and materiality criteria.
4. Document capacity, appetite, tolerances, targets and limits.
5. Assess data quality, models and control effectiveness.
6. Build a portfolio view of concentrations and interdependencies.
7. Integrate capital and liquidity into planning and pricing.
8. Design dashboards around decisions rather than data availability.
9. Test severe scenarios and agree management actions in advance.
10. Review outcomes, near misses, assumptions and incentives continuously.

The implementation should be proportionate. A small insurer may use expert judgement and structured spreadsheets, whereas a complex group may require stochastic models, data platforms and legal-entity aggregation. Sophistication is valuable only when it improves decisions and remains understandable to those accountable for them.

Chapter Summary

Enterprise risk management integrates risk with strategy, capital, performance and governance. Its purpose is not simply to avoid losses but to enable informed risk-taking and protect organisational resilience. The architecture includes objective setting, risk identification, assessment, response, appetite, limits, capital, monitoring and assurance.

Risk capacity is the outer boundary of survival; appetite expresses the board’s preferred aggregate risk position; tolerance defines acceptable variation; limits translate these concepts into operational controls; and targets identify the desired operating range. Risk maps support prioritisation, while portfolio analysis, stress testing and scenario analysis reveal concentration and interdependence.

Capital allocation allows management to compare businesses using risk-adjusted measures such as RAROC, provided earnings and capital are consistently defined. Dashboards should combine exposure, limits, trends, stress results, data quality and actions. Governance requires clear ownership, independent challenge, board oversight and effective assurance. Ethical and technological considerations are integral, particularly where AI, customer outcomes and data quality influence decisions.

The central lesson is that ERM creates value when it becomes part of strategic choice rather than a separate reporting exercise. Its effectiveness depends on credible assumptions, reliable information, proportionate models, constructive challenge and timely management action.

Key Terms

Enterprise risk management: An integrated process for managing uncertainty across the organisation in pursuit of objectives.

Risk capacity: The maximum risk an organisation can absorb without threatening viability or obligations.

Risk appetite: The aggregate amount and type of risk an organisation is willing to accept.

Risk tolerance: The permitted variation around a risk target or appetite position.

Risk limit: A specified boundary for an exposure, activity or risk indicator.

Risk target: The desired operating level within approved boundaries.

Risk taxonomy: A structured classification of risk categories.

Risk map: A visual prioritisation of risks, commonly by likelihood and impact.

Residual risk: Risk remaining after controls and responses are considered.

Inherent risk: Exposure assessed before considering controls.

Concentration risk: Excessive exposure to a common issuer, geography, product, sector or driver.

Interdependency: A relationship in which risks influence or amplify one another.

Economic capital: Capital estimated to absorb unexpected loss at a selected confidence level and horizon.

Regulatory capital: Capital required under applicable prudential rules.

RAROC: Risk-adjusted return on capital, commonly earnings divided by economic capital.

Stress testing: Assessment of outcomes under specified adverse conditions.

Reverse stress testing: Starting with a failure outcome and identifying events that could produce it.

Key risk indicator: A measure used to monitor exposure, conditions or control effectiveness.

Three-lines model: A governance model distinguishing operational ownership, risk oversight and independent assurance.

Model risk: The possibility that a model is unsuitable, incorrectly implemented or misinterpreted.

Review Questions

Short Answer Questions

1. Define enterprise risk management and distinguish it from managing a single functional risk.
2. Explain the difference between risk capacity, risk appetite and risk tolerance.
3. Why can a risk map not replace quantitative portfolio analysis?
4. What information should a meaningful risk-dashboard indicator contain?
5. State two ethical risks associated with the use of artificial intelligence in insurance.

Long Answer Questions

1. Explain how an insurer can translate board-approved risk appetite into cascaded operational limits.
2. Discuss the role of capital allocation in linking ERM with strategy and performance.
3. Compare risk maps, stress tests and portfolio models as ERM tools, including their limitations.
4. Analyse the governance responsibilities of the board, senior management, risk function, business owners and internal audit.
5. Explain why diversification benefits may disappear during systemic stress and how an insurer should respond.

Analytical / Application Questions

1. An insurer has strong earnings but a declining solvency buffer, rising catastrophe concentration and worsening claims inflation. Design a dashboard and escalation process for the board.
2. Two business lines have similar expected profits, but one consumes twice as much economic capital. Explain how management should compare them and identify factors that could make a simple RAROC comparison misleading.
3. Construct an integrated scenario involving a cyber incident, market loss and reinsurer downgrade. Identify direct effects, second-round effects, relevant limits, management actions and post-event lessons.

Multiple Choice Questions with Answers

Question 1

Which statement best describes risk capacity?

A. The desired day-to-day operating level of risk

B. The maximum risk the organisation can absorb without threatening viability

C. A limit assigned to one business unit

D. The amount of risk transferred to a reinsurer

Correct Answer: B. The maximum risk the organisation can absorb without threatening viability

Question 2

What is the primary purpose of a risk appetite statement?

A. To replace all operational controls

B. To express the board’s preferred aggregate risk posture in relation to strategy

C. To calculate historical claims frequency

D. To guarantee that no loss will occur

Correct Answer: B. To express the board’s preferred aggregate risk posture in relation to strategy

Question 3

If likelihood is rated 4 and impact is rated 3 on an explicitly defined ordinal risk map, the simple score is:

A. 1

B. 7

C. 12

D. 43

Correct Answer: C. 12

Question 4

In the expression Var(L₁ + L₂), which factor captures linear dependence between the two losses?

A. The expected revenue

B. The correlation coefficient

C. The risk appetite statement

D. The regulatory minimum

Correct Answer: B. The correlation coefficient

Question 5

A portfolio earns 8 million and uses 40 million of economic capital. Its RAROC is:

A. 5%

B. 20%

C. 32%

D. 48%

Correct Answer: B. 20%

Question 6

Which tool begins with a failure outcome and asks what combination of events could produce it?

A. Reverse stress testing

B. Routine reconciliation

C. Target setting

D. Proportional allocation

Correct Answer: A. Reverse stress testing

Question 7

Why may adding standalone capital requirements produce a misleading aggregate result?

A. All risks have identical distributions

B. Risk categories may be dependent or diversified

C. Capital has no relationship to risk

D. Standalone figures are always regulatory figures

Correct Answer: B. Risk categories may be dependent or diversified

Question 8

Which group primarily provides independent assurance over governance and controls in the three-lines model?

A. Business owners

B. The sales function

C. Internal audit

D. External customers

Correct Answer: C. Internal audit

Question 9

Which is a leading rather than a lagging indicator of claims risk?

A. Last year’s incurred claims

B. Final annual loss ratio

C. Rising claims-processing exceptions

D. Paid claims from a closed period

Correct Answer: C. Rising claims-processing exceptions

Question 10

Why is human oversight important when artificial intelligence is used in high-impact insurance decisions?

A. Models cannot process any data

B. It supports accountability, challenge, explainability and customer review

C. It guarantees that the model is unbiased

D. It eliminates the need for data governance

Correct Answer: B. It supports accountability, challenge, explainability and customer review