Governance, Regulation, Ethics and Risk Culture

Introduction

Insurance institutions manage promises that may be performed years after premiums are collected. Their financial strength, conduct, and legitimacy therefore depend not only on underwriting and investment decisions, but also on governance. Governance determines who has authority, how decisions are challenged, how risks are escalated, and how accountability is enforced. Regulation establishes minimum standards for solvency, market conduct, disclosure, and consumer protection. Ethics addresses what an organisation ought to do when legal compliance is insufficient. Risk culture connects these formal arrangements with everyday behaviour.

For insurers, governance failure can produce rapid financial deterioration, unfair customer outcomes, misstatement of liabilities, or loss of public confidence. Modern supervisory systems consequently combine rules, principles, risk-based supervision, enterprise risk management, and supervisory dialogue. Important instruments include board oversight, risk committees, the chief risk officer (CRO), internal control, internal and external audit, Own Risk and Solvency Assessment (ORSA), and public disclosure.

Learning objectives

After studying this chapter, the learner should be able to:

1. Explain the governance responsibilities of boards, executives, risk committees, and the CRO.
2. Distinguish internal control, risk management, compliance, internal audit, and external audit.
3. Analyse solvency regulation, ORSA, disclosure, and accountability.
4. Evaluate ethical conflicts involving customers, shareholders, employees, intermediaries, and regulators.
5. Assess the role of risk culture, incentives, data, and technology in insurance governance.
6. Apply these concepts to a practical insurance governance problem.

1. Governance as a system of accountability

Corporate governance is the system by which an organisation is directed, controlled, and held accountable. In insurance, it must reconcile several interests: policyholders seeking reliable protection, shareholders seeking sustainable returns, employees seeking fair treatment, intermediaries seeking workable products, regulators seeking stability, and society seeking responsible allocation of risk.

A useful governance model has four connected elements:

• Direction: purpose, strategy, risk appetite, and business plans.
• Control: policies, limits, segregation of duties, and internal controls.
• Challenge: independent questioning by directors, committees, risk, compliance, and audit functions.
• Accountability: reliable information, documentation, remuneration consequences, disclosure, and regulatory reporting.

Governance is not equivalent to administration. A board may receive extensive reports and still govern poorly if information is late, overly aggregated, or incapable of revealing emerging risks. Effective governance requires informed judgement, constructive challenge, and willingness to act on adverse information.

Agency, stakeholder, and stewardship perspectives

The agency perspective focuses on conflicts between owners and managers and between managers and policyholders. Managers may pursue growth, bonuses, or market share while transferring long-term risk to policyholders or creditors. Independent directors, remuneration controls, audit, and disclosure reduce these agency costs.

The stakeholder perspective recognises that insurance contracts create obligations to parties who may have limited bargaining power or financial knowledge. Consumer interests are therefore not merely a public-relations issue; they are central to the insurer’s business model.

The stewardship perspective views directors and executives as custodians of a social institution. It emphasises long-term resilience, professional duty, and trust rather than short-term extraction of value. No single perspective is sufficient. Good governance combines monitoring, stakeholder protection, and responsible leadership.

2. Board and executive responsibilities

The board is ultimately responsible for the sound and prudent management of the insurer, even when authority is delegated. Its principal responsibilities normally include:

• approving strategy and risk appetite;
• ensuring adequate capital, liquidity, and reinsurance;
• appointing, evaluating, and, where necessary, removing senior executives;
• approving the governance, control, and remuneration frameworks;
• overseeing material risks, stress testing, and recovery planning;
• ensuring accurate financial, regulatory, and public reporting;
• protecting policyholder interests and monitoring conduct;
• maintaining appropriate expertise, independence, diversity, and succession planning.

The board should not underwrite individual policies or manage routine operations. Its role is oversight, direction, and challenge. Delegation transfers authority for execution but does not eliminate accountability.

Senior management converts board-approved strategy into policies, processes, systems, and behaviour. The chief executive officer coordinates the organisation; the chief financial officer oversees financial reporting and capital analysis; the CRO coordinates enterprise-wide risk management; the chief compliance officer interprets legal and regulatory obligations; and the general counsel advises on legal exposure. Their responsibilities must be sufficiently independent to prevent commercial pressure from suppressing adverse information.

A board should ask questions such as:

• What assumptions are most critical to solvency?
• Which risks are growing faster than our monitoring capability?
• What happens if claims inflation, lapse rates, or catastrophe frequency worsen simultaneously?
• Are incentives encouraging unsuitable sales or excessive risk-taking?
• Can management demonstrate that customer outcomes are fair?
• What information is not reaching the board?

3. Board committees and the three-lines model

Committees deepen oversight but cannot replace the board. Common committees include:

The three-lines model is a practical allocation of responsibilities:

1. First line—business and operations: owns risks, applies controls, and delivers products and services.
2. Second line—risk management and compliance: sets frameworks, advises, monitors, and challenges the first line.
3. Third line—internal audit: provides independent, risk-based assurance to the board.

External audit is not one of the three internal lines. It provides an independent opinion, principally on financial statements, under applicable auditing standards. Supervisors provide external oversight and do not assume management’s responsibilities.

A common failure is treating the second line as the owner of all risk. If business managers believe that “risk belongs to the CRO,” controls become detached from decisions. Conversely, if risk and compliance functions lack independence, challenge becomes symbolic. Effective practice combines first-line ownership with second-line challenge and third-line assurance.

4. The chief risk officer and enterprise risk management

The CRO leads the risk-management framework and normally has direct access to the chief executive and board risk committee. The CRO’s authority should include access to information, participation in strategic decisions, the ability to challenge business proposals, and a formal escalation route when risk appetite may be breached.

The CRO does not eliminate risk or make every business decision. The role is to identify, assess, aggregate, monitor, and communicate risk, while ensuring that decisions are made within approved tolerances. Key CRO activities include:

• maintaining the risk taxonomy and risk register;
• coordinating risk appetite statements and limits;
• reviewing capital, liquidity, reinsurance, model, operational, conduct, cyber, and climate risks;
• overseeing stress and scenario analysis;
• coordinating ORSA;
• reporting breaches and emerging risks;
• promoting consistent risk language and accountability.

Risk appetite expresses the amount and type of risk an insurer is willing to accept in pursuit of objectives. It should be translated into measurable limits, triggers, and escalation procedures. A statement such as “the company has low tolerance for conduct risk” is incomplete unless linked to indicators such as complaint rates, claim repudiation trends, remediation delays, and sales-quality measures.

5. Internal control, compliance, and audit

Internal control is the set of policies, procedures, organisational arrangements, and behaviours designed to provide reasonable—not absolute—assurance regarding:

• effective and efficient operations;
• reliable reporting;
• compliance with laws, regulations, and internal policies; and
• safeguarding of assets and policyholder information.

Controls may be preventive, detective, or corrective. Examples include underwriting authority limits, dual approval of payments, reconciliations, access controls, claims sampling, segregation of duties, exception reporting, and business-continuity testing.

Control design should address the risk’s cause, event, and consequence. A control that merely produces a report without a responsible reviewer is not an effective control. Controls should also be proportionate: excessive manual approval can create delay and encourage circumvention, while weak automation can allow large-scale errors.

Compliance identifies obligations, interprets them, advises management, monitors adherence, and supports remediation. Internal audit independently evaluates governance, risk management, and controls. Its independence requires reporting access to the audit committee and freedom from operational responsibility. External audit tests financial-statement assertions and expresses an opinion; it does not guarantee solvency or detect every fraud.

A mature control environment includes issue ownership, root-cause analysis, deadlines, validation of remediation, and consequences for repeated failures. “No findings” may indicate good control, but it may also indicate weak testing or suppressed escalation.

6. Solvency regulation and ORSA

Solvency regulation protects policyholders by requiring insurers to maintain sufficient financial resources relative to the risks they undertake. It generally combines quantitative requirements—capital, technical provisions, eligible assets, and liquidity—with qualitative requirements—governance, risk management, supervision, and disclosure.

A simplified solvency ratio is:

Eligible own funds are resources recognised by the applicable regime. The solvency capital requirement is the capital needed to absorb defined adverse outcomes over a specified risk horizon and confidence standard. The ratio is meaningful only within the relevant jurisdiction and regulatory definitions; it is not directly comparable across regimes without adjustment.

Technical provisions generally represent the insurer’s best estimate of future obligations plus an appropriate risk margin or equivalent adjustment. Assumptions may include mortality, morbidity, claims frequency, severity, inflation, expenses, discount rates, lapses, recoveries, and catastrophe exposure. Governance must ensure that assumptions are documented, validated, and challenged.

ORSA is the insurer’s own forward-looking assessment of its risks, capital needs, and solvency position. It is broader than a compliance calculation. ORSA should connect:

1. business strategy and strategic planning;
2. risk appetite and material risks;
3. current and projected capital resources;
4. stress and scenario testing;
5. management actions; and
6. board approval and supervisory communication.

A simplified capital projection can be represented as:

This is a conceptual planning identity, not a regulatory valuation formula. It assumes that all material changes are captured and that the accounting or economic basis is consistently defined. The term adverse impact may include unexpected claims, asset losses, reserve strengthening, operational losses, or changes in regulatory valuation.

A credible ORSA asks not merely whether the insurer meets a capital ratio today, but whether it can remain viable under plausible adverse conditions. Scenarios might combine catastrophe losses, inflation, market spread widening, reinsurance default, cyber disruption, and customer lapses. The analysis should identify decision triggers—for example, reducing dividends, purchasing reinsurance, raising capital, revising underwriting, or activating a recovery plan.

7. Disclosure and accountability

Disclosure supports market discipline and trust. Insurers may be required to publish financial statements, solvency information, governance information, risk exposures, remuneration information, and conduct data. Good disclosure is understandable, balanced, timely, and decision-useful. It should explain material assumptions, uncertainty, sensitivity, and limitations rather than present only favourable indicators.

Accountability operates through several mechanisms:

• board minutes and documented decisions;
• regulatory returns and supervisory review;
• financial-statement audit;
• internal audit findings;
• whistleblowing and speak-up channels;
• customer complaints and remediation;
• remuneration adjustment and personal responsibility regimes;
• enforcement, sanctions, and litigation.

Disclosure can fail through omission, excessive aggregation, technical language, inconsistent metrics, or selective presentation. Green claims and artificial-intelligence claims require particular care: an insurer should not describe a process as sustainable, unbiased, or explainable without evidence and defined criteria.

8. Ethics and conflicts of interest

Legality is a floor, not the entire content of ethical conduct. Ethical insurance practice requires honesty, fairness, competence, confidentiality, respect for human dignity, and responsibility for foreseeable consequences.

Typical conflicts include:

• selling a product that is profitable but unsuitable for the customer;
• setting claims targets that discourage legitimate payments;
• using opaque pricing factors that create unjustified discrimination;
• accepting gifts or commissions from intermediaries;
• delaying a difficult reserve decision to protect reported earnings;
• investing premiums in activities inconsistent with stated sustainability commitments;
• using personal data beyond the customer’s reasonable expectations;
• allowing an algorithm to reproduce historical bias.

A conflict-of-interest framework should identify, prevent, disclose, manage, and record conflicts. Disclosure alone may be inadequate where customers cannot realistically understand or avoid the conflict. Controls may include independent review, recusal, commission redesign, product approval, customer testing, data minimisation, and post-sale monitoring.

Ethical analysis benefits from multiple tests:

• Duties: What obligations apply regardless of outcome?
• Consequences: Who benefits and who bears foreseeable harm?
• Rights: Are privacy, autonomy, dignity, and fair treatment respected?
• Justice: Are burdens and benefits distributed fairly?
• Virtue: Does the decision reflect honesty, courage, prudence, and responsibility?

9. Risk culture

Risk culture is the shared values, attitudes, capabilities, and behaviours that shape how an organisation identifies, discusses, and responds to risk. It is visible in what leaders reward, tolerate, investigate, and escalate—not in policy documents alone.

Indicators of a healthy culture include:

• leaders discussing uncertainty without blame;
• staff understanding their risk responsibilities;
• challenge being welcomed and documented;
• bad news travelling quickly;
• incentives reflecting risk-adjusted and sustainable performance;
• near misses being analysed;
• customer outcomes influencing decisions;
• remediation being valued as much as sales growth.

Culture can be assessed through surveys, interviews, focus groups, conduct indicators, turnover, whistleblowing data, control breaches, audit findings, complaints, incentive outcomes, and observation of meetings. No single metric is reliable. Survey responses may reflect fear or social desirability, while low complaint numbers may indicate barriers to complaining rather than good service.

Remuneration is particularly influential. A sales bonus based solely on premium volume may encourage unsuitable sales, aggressive replacement, or concealment of exclusions. Balanced scorecards can include persistency, complaint quality, claims fairness, compliance, customer outcomes, and long-term profitability. Clawback or malus provisions may be appropriate where later losses or misconduct emerge.

10. Consumer protection and conduct governance

Consumer protection is increasingly integrated into prudential governance. Important principles include clear product information, suitability, fair pricing, accessible claims processes, protection of vulnerable customers, responsible use of intermediaries, and timely complaint handling.

Product governance should cover the product’s target market, distribution channels, foreseeable misuse, exclusions, value, monitoring, and review. A product can be contractually valid yet unfair in practice if exclusions are obscure, claims processes are excessively burdensome, or the product provides little value relative to its price.

Conduct risk should be incorporated into the risk appetite, board reporting, ORSA where material, and incentive framework. Customer data should be accurate, relevant, secure, and used consistently with law and legitimate expectations.

11. ESG, climate, and emerging technology

Environmental, social, and governance issues affect both sides of an insurer’s balance sheet. Climate change may increase insured losses, alter asset values, affect reinsurance availability, and create transition risks. Social issues include affordability, inclusion, labour practices, and community resilience. Governance includes anti-corruption, board oversight, data responsibility, and transparent reporting.

Insurers should distinguish physical risk, transition risk, liability risk, and reputational risk. Scenario analysis can examine alternative temperature, policy, technology, and loss pathways, but long-horizon projections are uncertain. Results should not be treated as precise forecasts.

Artificial intelligence can improve underwriting, fraud detection, claims triage, and customer service. It can also create discrimination, opacity, cyber vulnerability, model drift, and unclear accountability. Governance should require documented purpose, data lineage, validation, performance monitoring, human oversight, explainability appropriate to the decision, security, and a means of appeal. Responsibility remains with the insurer even when a vendor supplies the model.

12. Illustrative case: Meridian Assurance

Background

Meridian Assurance, a fictional regional insurer, expanded rapidly through digitally distributed motor and health products. Its board celebrated growth, while the risk committee received monthly dashboards dominated by premium volume and claims ratios.

Problem

Complaints increased, claim settlements slowed, and an algorithm produced lower prices in affluent postal areas than in comparable lower-income areas. The CRO had raised concerns about data quality and model fairness, but the concerns were presented as technical matters without a clear escalation decision. The remuneration plan rewarded new business and did not adjust bonuses for later complaints or cancellations.

Analysis

The governance problem was systemic. The first line owned aggressive growth but did not adequately own conduct risk. The second line lacked authority to stop deployment. The board had information, but not sufficiently integrated information linking growth, customer outcomes, model risk, and capital effects. Internal audit had reviewed access controls but had not examined product value or algorithmic outcomes.

Approach and solution

The board created a temporary conduct and technology committee, required an independent model validation, paused the affected pricing feature, and commissioned a customer-outcome review. Meridian refunded incorrectly charged customers, revised its target-market assessment, strengthened data governance, and introduced an appeal route involving human review. The remuneration committee added complaint persistence, claims fairness, and remediation measures to performance assessment. The CRO received direct access to the board chair and a formal risk veto for material model deployments pending committee review.

Outcome

The insurer experienced short-term revenue reduction and remediation cost but improved complaint resolution, model consistency, and supervisory confidence. The board also incorporated conduct and model-risk scenarios into its ORSA and recovery planning.

Learning points

1. Growth is not evidence of sound governance.
2. A technically accurate model may still produce unfair outcomes.
3. Risk culture is revealed by escalation and response, not by policy wording.
4. Accountability must extend to vendors, algorithms, and incentive systems.
5. Consumer outcomes and solvency are interconnected: misconduct can create financial, legal, and reputational losses.

Challenges and limitations

Governance frameworks have limitations. Independent directors may lack specialist knowledge. Committees may create diffusion of responsibility. Risk appetite can become a static document rather than a decision tool. Solvency ratios may obscure liquidity stress, model uncertainty, or correlated risks. ORSA scenarios can be too mild, too numerous, or disconnected from actual management actions. Audits are based on sampling and reasonable assurance. Culture metrics are imperfect and can be manipulated. Regulation may also encourage compliance formality rather than genuine ethical judgement.

These limitations require professional scepticism. Boards should seek diverse evidence, challenge assumptions, compare quantitative indicators with qualitative information, and test whether policies influence actual decisions.

Best-practice framework

An insurer seeking stronger governance should:

1. establish clear board accountability and committee mandates;
2. align strategy, risk appetite, capital, liquidity, and remuneration;
3. preserve CRO, compliance, and internal-audit independence;
4. maintain reliable data, documented models, and transparent assumptions;
5. use ORSA as a strategic decision process rather than a filing exercise;
6. integrate consumer outcomes and ESG risks into enterprise risk management;
7. test controls, scenarios, recovery actions, and business continuity;
8. protect whistleblowers and reward responsible challenge;
9. monitor culture through multiple evidence sources;
10. ensure that accountability covers outsourced activities and technology providers.

Chapter Summary

Insurance governance is a system of direction, control, challenge, and accountability. Boards retain ultimate responsibility for strategy, risk appetite, solvency, conduct, reporting, and policyholder protection, while executives implement approved decisions. Risk and compliance functions provide independent challenge; internal audit provides assurance; external audit provides an opinion on financial statements.

Solvency regulation combines financial requirements with governance and supervisory expectations. ORSA adds a forward-looking assessment linking strategy, risks, capital, stress scenarios, and management actions. Disclosure supports transparency, but its value depends on clarity and balanced presentation. Ethical governance requires more than legal compliance: it requires fair treatment, responsible use of data, sound incentives, and attention to foreseeable harm. Risk culture is demonstrated through behaviour, escalation, remuneration, and response to bad news. Consumer protection, ESG, climate risk, and artificial intelligence now form essential parts of strategic insurance governance.

Key Terms

Governance: The system by which an organisation is directed, controlled, and held accountable.

Risk appetite: The amount and type of risk an organisation is willing to accept.

Board accountability: The ultimate responsibility of directors for sound and prudent oversight.

Risk committee: A board committee overseeing enterprise risks, limits, scenarios, and risk appetite.

Chief risk officer: Executive responsible for coordinating the risk-management framework and challenging risk decisions.

Three-lines model: Allocation of risk responsibilities among business operations, risk/compliance, and internal audit.

Internal control: Processes providing reasonable assurance over operations, reporting, compliance, and asset protection.

Compliance: Identification, interpretation, monitoring, and management of legal and regulatory obligations.

Internal audit: Independent assurance on governance, risk management, and controls.

External audit: Independent examination supporting an opinion on financial statements.

Solvency: The capacity to meet obligations as they fall due and remain financially viable.

Eligible own funds: Capital resources recognised under the applicable solvency regime.

Solvency capital requirement: Regulatory capital needed for specified adverse risks under a defined regime.

ORSA: Own Risk and Solvency Assessment, a forward-looking internal assessment of risks and capital needs.

Conduct risk: Risk of poor outcomes or harm arising from an insurer’s products, processes, or behaviour.

Risk culture: Shared values and behaviours influencing how risk is understood and managed.

Conflict of interest: A situation in which competing interests may impair impartial judgement.

ESG: Environmental, social, and governance considerations affecting strategy, risk, and responsibility.

Model risk: Risk of adverse outcomes arising from incorrect, inappropriate, or poorly governed models.

Policyholder protection: Measures designed to preserve fair treatment and the capacity to meet insurance promises.

Review Questions

Short Answer Questions

1. What are the four principal elements of an effective governance system?
2. Distinguish the responsibilities of the CRO and internal audit.
3. Why is ORSA more than a regulatory compliance exercise?
4. Identify three indicators of a healthy risk culture.
5. Why can a legally valid insurance product still create consumer-protection concerns?

Long Answer Questions

1. Explain the board’s responsibilities for strategy, solvency, conduct, and accountability.
2. Discuss the three-lines model and evaluate its strengths and limitations in an insurance company.
3. Explain how solvency regulation and ORSA complement each other.
4. Analyse the relationship between remuneration, ethical behaviour, and risk culture.
5. Discuss governance requirements for the responsible use of artificial intelligence in underwriting or claims.

Analytical / Application Questions

1. An insurer’s solvency ratio remains above the regulatory minimum, but complaints, lapse rates, and claim delays are rising. What information should the board request, and what actions might it consider?
2. A pricing model produces statistically accurate predictions but systematically disadvantages a protected customer group. Analyse the governance, ethical, regulatory, and operational response.
3. Design a risk-culture dashboard for a large insurer. Identify at least five indicators, explain their limitations, and show how management should avoid interpreting them mechanically.

Multiple Choice Questions with Answers

Question 1

Which body retains ultimate responsibility for the sound and prudent governance of an insurer?

A. The external auditor

B. The board of directors

C. The claims department

D. The reinsurance broker

Correct Answer: B. The board of directors

Question 2

Under the three-lines model, which function provides independent internal assurance?

A. Business operations

B. Risk ownership

C. Internal audit

D. Sales management

Correct Answer: C. Internal audit

Question 3

What is the primary purpose of ORSA?

A. To replace all financial audits

B. To assess future risks, capital needs, and solvency from the insurer’s own perspective

C. To calculate individual customer premiums

D. To eliminate the need for regulatory reporting

Correct Answer: B. To assess future risks, capital needs, and solvency from the insurer’s own perspective

Question 4

A solvency ratio is conceptually calculated as:

A. Claims incurred ÷ premiums earned

B. Eligible own funds ÷ solvency capital requirement × 100%

C. Assets ÷ number of policies

D. Premiums ÷ operating expenses

Correct Answer: B. Eligible own funds ÷ solvency capital requirement × 100%

Question 5

Which statement best describes the CRO’s role?

A. The CRO owns every operational risk personally

B. The CRO coordinates risk management and provides challenge while management retains decision responsibility

C. The CRO replaces the board risk committee

D. The CRO guarantees that no loss will occur

Correct Answer: B. The CRO coordinates risk management and provides challenge while management retains decision responsibility

Question 6

Which is an example of a preventive internal control?

A. A post-loss investigation

B. A customer complaint after settlement

C. A limit requiring dual approval before a large payment

D. An annual report describing a past error

Correct Answer: C. A limit requiring dual approval before a large payment

Question 7

Why may a low number of complaints fail to demonstrate good customer outcomes?

A. Complaints are always irrelevant to conduct risk

B. Customers may face barriers that prevent them from complaining

C. Complaints measure solvency directly

D. Regulators prohibit complaint analysis

Correct Answer: B. Customers may face barriers that prevent them from complaining

Question 8

Which practice most directly supports a healthy risk culture?

A. Rewarding only rapid premium growth

B. Discouraging escalation of bad news

C. Welcoming challenge and linking incentives to sustainable customer outcomes

D. Removing independent risk functions

Correct Answer: C. Welcoming challenge and linking incentives to sustainable customer outcomes

Question 9

What is a central ethical concern in using artificial intelligence for insurance pricing?

A. It always increases claim frequency

B. It may reproduce unfair bias or make decisions insufficiently explainable

C. It eliminates the need for data governance

D. It guarantees equal outcomes in every case

Correct Answer: B. It may reproduce unfair bias or make decisions insufficiently explainable

Question 10

Which statement about external audit is most accurate?

A. It guarantees the insurer’s solvency

B. It is one of the three internal lines

C. It provides an independent opinion principally on financial statements

D. It assumes management’s responsibility for internal controls

Correct Answer: C. It provides an independent opinion principally on financial statements