The Risk Management Process and Standards

Introduction

Risk management is the disciplined coordination of activities used to direct and control an organisation with regard to risk. In insurance management, it is not limited to purchasing insurance. It includes understanding uncertainty, protecting solvency and reputation, allocating capital, designing controls, meeting regulatory obligations, and creating sustainable value.

This chapter integrates three influential frameworks:

• ISO 31000:2018, which presents principles, a framework and a process for managing risk;
• COSO Enterprise Risk Management—Integrating with Strategy and Performance (2017), which connects risk with governance, strategy and performance; and
• The IIA Three Lines Model (2020), which clarifies organisational roles and accountability for risk management and control.

These frameworks are complementary rather than interchangeable. ISO 31000 explains how risk management should be designed and conducted. COSO ERM emphasises the relationship between risk, strategy and performance. The Three Lines Model explains who should perform, oversee and independently assure risk-related work.

Learning objectives

By the end of this chapter, students should be able to:

1. Explain the purpose and vocabulary of the risk management process.
2. Establish internal and external context for a risk assessment.
3. Identify, analyse and evaluate risks using qualitative and quantitative methods.
4. Select and implement proportionate risk treatments.
5. Design monitoring, review, recording and reporting arrangements.
6. Compare ISO 31000, COSO ERM and the Three Lines Model.
7. Apply the integrated approach to an insurance-management case.
8. Critically assess limitations, governance issues and emerging technology risks.

1. Risk management as an organisational discipline

Risk is the effect of uncertainty on objectives. An effect may be positive, negative or both. This definition is broader than the traditional insurance view of risk as the possibility of loss. For example, a new digital underwriting platform may create cyber exposure but also improve pricing accuracy and customer service.

Risk management is the coordinated set of activities that directs and controls an organisation regarding risk. It should be embedded in governance, strategy, planning, operations, reporting, culture and decision-making. A separate risk department cannot own every risk; ownership remains with the managers responsible for objectives and processes.

Important distinctions include:

• Inherent risk: exposure before considering controls or treatments.
• Residual risk: exposure remaining after controls and treatments.
• Risk appetite: the amount and type of risk an organisation is willing to pursue or retain in achieving its objectives.
• Risk tolerance: the acceptable variation around a particular objective or risk limit.
• Risk capacity: the maximum risk an organisation can absorb while remaining viable and compliant.
• Risk owner: the person accountable for managing a particular risk.
• Control owner: the person accountable for designing or operating a control.
• Emerging risk: a new or changing risk whose effects, probability or speed of development are not yet well understood.

Risk appetite, tolerance and capacity must not be treated as synonyms. A financially strong insurer may have high capacity but a deliberately low appetite for conduct risk. Conversely, an organisation may have a high strategic appetite for innovation but a very low tolerance for regulatory breaches.

2. The integrated architecture of the principal standards

ISO 31000

ISO 31000:2018 is guidance rather than a certifiable management-system standard. Its principles state that risk management should be integrated, structured and comprehensive, customised, inclusive, dynamic, based on the best available information, and attentive to human and cultural factors. It should also support continual improvement and create and protect value.

Its framework links leadership and commitment, integration, design, implementation, evaluation and improvement. Its process includes communication and consultation, scope/context/criteria, risk assessment, risk treatment, monitoring and review, and recording and reporting.

COSO ERM

COSO ERM 2017 organises enterprise risk management around five interrelated components:

1. Governance and culture;
2. Strategy and objective-setting;
3. Performance;
4. Review and revision; and
5. Information, communication and reporting.

COSO treats risk as inseparable from strategy. It asks whether the organisation understands the risks of the strategy it has chosen, and whether the strategy is compatible with its risk appetite and capacity. COSO also recognises a portfolio view: individual risks can interact, offset one another or become concentrated.

The Three Lines Model

The Three Lines Model clarifies responsibilities:

• Governing body: oversees governance, risk management, control, ethics and assurance; it is not itself one of the three lines.
• First line—management: delivers products and services, owns risks, and operates controls.
• Second line—risk, compliance and specialist functions: provide expertise, support, monitoring, challenge and escalation. They may set methods and policies but do not replace management ownership.
• Third line—internal audit: provides independent and objective assurance and advice on governance, risk management and control.
• External assurance providers: regulators, external auditors and other independent parties provide additional assurance but are outside the three internal lines.

The model is not a rigid organisational chart. In smaller insurers, one person may perform several roles, but conflicts of interest and loss of independence must be addressed.

Figure: The risk process operates within governance and is supported by differentiated lines of responsibility.

3. Establishing scope, context and criteria

Risk assessment is meaningful only when the decision, objectives and boundaries are clear. Establishing context should address four questions.

Purpose and scope

Specify the activity under review: for example, motor claims settlement, reinsurance purchasing, investment management, product launch or enterprise strategy. Define organisational boundaries, time horizon, geographic scope, interfaces and exclusions. A vague scope produces an unmanageable list of risks.

Internal context

Relevant internal factors include strategy, objectives, governance, structure, culture, competence, information systems, capital position, contracts, processes and existing controls. In an insurer, the legal entity, branch, product line and risk-bearing capacity must be distinguished.

External context

External factors include economic conditions, inflation, interest rates, legislation, regulation, litigation, climate, technology, competitors, intermediaries, customers, suppliers and social expectations. Scenario analysis is particularly important where historical data do not represent future conditions.

Risk criteria

Risk criteria define how significance will be judged. They may include financial loss, solvency impact, liquidity, customer harm, regulatory breach, operational disruption, reputation, environmental effects and strategic delay. Criteria should specify measurement scales, time horizons and escalation thresholds.

A board-approved risk appetite statement should be translated into operational limits. For instance, “low appetite for customer harm” should become measurable quality indicators, complaint thresholds, conduct controls and escalation rules.

4. Risk identification

Risk identification seeks to find, recognise and describe risks that may help or hinder objectives. It should consider causes, events, consequences, sources, existing controls and affected stakeholders. A useful formulation is:

Cause → event → consequence

For example: inadequate access controls (cause) → unauthorised alteration of policy data (event) → incorrect claims decisions, customer harm and regulatory action (consequences).

Useful methods include structured interviews, workshops, process mapping, checklists, historical-loss analysis, legal review, business-impact analysis, horizon scanning, scenario analysis, SWOT analysis, bow-tie analysis and specialist judgment. Workshops should include operational staff, actuarial, underwriting, claims, information security, compliance and customer representatives where relevant.

Identification should avoid two errors. Risk inflation lists every conceivable event without prioritisation. Risk blindness overlooks low-frequency, high-impact, interconnected or slowly developing risks. Good registers describe uncertainty in relation to objectives, not merely negative events.

A practical risk-register structure is:

5. Risk analysis

Risk analysis develops an understanding of the nature and level of risk. It considers likelihood, consequences, velocity, duration, persistence, interdependence and control effectiveness. The chosen method should reflect the decision’s materiality and the quality of available information.

Qualitative analysis

A risk matrix often combines a likelihood category with an impact category. A five-by-five matrix is convenient, but its colours are not objective truth. Categories must be defined. For example, “possible” might mean an event could occur once in a specified five-year period, while “major impact” might mean a defined capital, customer or regulatory threshold is exceeded.

Multiplying ordinal scores can create false precision. A score of 4 is not necessarily twice as risky as a score of 2. Matrix results should therefore be supplemented by narrative reasoning, uncertainty and expert challenge.

Semi-quantitative analysis

Where scales are calibrated, an organisation may use a priority score. If L is a likelihood score and I is an impact score, a simple ranking may be:

Here S is a prioritisation score, while L and I are defined ordinal or calibrated scores. This equation is appropriate only as a transparent ranking aid; it does not estimate probability or monetary loss unless the scales have those meanings.

Quantitative analysis

For a discrete set of mutually exclusive scenarios, expected loss can be estimated as:

where pᵢ is the probability of scenario i, Lᵢ is its loss in monetary units, and EL is expected loss in the same monetary units. Probabilities must satisfy 0 ≤ pᵢ ≤ 1 and, for an exhaustive set, ∑ᵢ pᵢ = 1. Expected loss is an average over repeated or comparable situations; it is not a forecast of the exact loss in one period and does not capture volatility, tail risk or dependencies.

Illustration. Suppose annual cyber scenarios are mutually exclusive and exhaustive: no incident with probability 0.90 and loss 0; moderate incident with probability 0.08 and loss $200,000; severe incident with probability 0.02 and loss $2,000,000. Then:

EL = (0.90 × 0) + (0.08 × 200,000) + (0.02 × 2,000,000) = 16,000 + 40,000 = $56,000.

The result supports comparison of treatments, but management must also consider uncertainty in the probabilities, reputational damage, legal duties and the possibility that cyber events are correlated with supplier or technology failures.

Other methods include sensitivity analysis, stress testing, Monte Carlo simulation, value-at-risk and tail value-at-risk. These require suitable data, defensible distributions, model governance and validation. In insurance, catastrophe and capital models should be treated as decision tools, not substitutes for judgment.

6. Risk evaluation

Evaluation compares analysed risk with established criteria to decide whether further action is required. Possible decisions are to:

• accept the risk within appetite;
• reject or avoid the activity;
• require treatment before proceeding;
• escalate to a higher authority; or
• undertake additional analysis because uncertainty is material.

Evaluation should consider both individual and aggregate exposure. Several risks may share a common cause, such as a cloud-service outage, inflation shock or regulatory change. A portfolio view may reveal concentration that is invisible in separate risk registers.

Evaluation also requires attention to opportunity. A control that eliminates all uncertainty may destroy beneficial innovation. The decision should balance expected benefits, downside exposure, resilience and stakeholder effects.

7. Risk treatment

Risk treatment selects and implements options for modifying risk. Common options are:

1. Avoid: discontinue or do not commence the activity.
2. Reduce likelihood: improve prevention, selection, maintenance, training or security.
3. Reduce consequences: introduce continuity plans, limits, segregation, backups or crisis response.
4. Share or transfer: use insurance, reinsurance, contracts, outsourcing or partnerships, while recognising that legal and reputational accountability may remain.
5. Retain: accept the exposure consciously, with authority and monitoring.
6. Pursue or increase: take additional risk to capture an opportunity within appetite.

Treatment selection should compare cost, effectiveness, feasibility, timing, secondary risks and residual exposure. Insurance transfers a defined financial consequence; it does not remove the underlying hazard, prevent customer harm or guarantee recovery. Contractual transfer may fail because of exclusions, counterparty insolvency, disputes or poor wording.

A treatment plan should identify the action, accountable owner, resources, target date, dependencies, expected residual risk and success measure. After implementation, residual risk must be reassessed. Controls may be designed appropriately but operate ineffectively; therefore design effectiveness and operating effectiveness should be distinguished.

8. Monitoring, review, recording and reporting

Risk management is cyclical. Monitoring asks whether assumptions, risks, controls, appetite and external conditions remain valid. Review asks whether the process itself remains suitable and effective.

Monitoring may be continuous or periodic. Key risk indicators (KRIs) should be linked to objectives and have thresholds, data owners and escalation actions. Examples include claims leakage, complaint frequency, solvency coverage, policy exceptions, system availability, overdue remediation and concentration by geography or catastrophe zone.

A useful indicator distinguishes:

• leading indicators, which signal developing exposure, such as staff turnover or control exceptions; and
• lagging indicators, which record outcomes, such as losses, complaints or regulatory penalties.

Reporting should be timely, decision-oriented and proportionate. A board report should explain trend, exposure against appetite, major assumptions, emerging risks, treatment progress, control failures and decisions required. Aggregated dashboards must not conceal uncertainty or give a misleading impression of precision.

Records should support accountability, auditability and organisational learning. They should show the information used, assumptions, judgments, approvals, treatment decisions and changes over time. Personal data and sensitive security information must be protected according to applicable law and policy.

9. Applying the Three Lines Model to the process

The risk process becomes effective only when responsibilities are explicit.

The second line must retain sufficient access, authority and expertise to challenge the first line. However, if it designs and operates the control that it later reviews, independence is weakened. Internal audit should not own risks, approve operational decisions or design controls that it will subsequently assure.

10. Detailed applied case: illustrative insurer cyber-risk assessment

Background

Harbour Mutual, a fictional mid-sized insurer, plans to migrate claims processing to a cloud platform. The project promises faster settlement and lower operating costs. It also creates dependence on a technology provider and increases exposure to data compromise, service interruption and model error.

Problem

The project team initially described the risk as “cyber risk: high.” The board found this inadequate because it did not identify affected objectives, controls, accountable owners or treatment decisions.

Analysis

The first line mapped the claims process and identified three scenarios:

1. unauthorised access to customer information;
2. cloud-service interruption during a catastrophe; and
3. incorrect automated claims triage caused by poor data or model configuration.

The second line established criteria covering customer harm, regulatory reporting, claims delay, financial loss and reputation. It challenged the team to consider concentration and correlated failure: a single provider outage could affect several products simultaneously.

The inherent assessment rated the interruption scenario as high because of severe potential consequences and limited tolerance for claims delay. Existing controls included multifactor authentication, encryption, backups, service-level agreements and incident response procedures. Review found that backup restoration had not been tested under peak catastrophe volumes and that the contract did not clearly provide timely access to forensic evidence.

Approach and solution

Harbour Mutual approved a treatment plan:

• conduct an independent security and resilience assessment of the provider;
• test restoration and manual claims procedures under a catastrophe scenario;
• revise contractual rights concerning notification, audit, data location, subcontracting and exit assistance;
• introduce access recertification and privileged-account monitoring;
• validate the claims model before deployment and monitor error rates by customer segment;
• establish KRI thresholds for service availability, unresolved vulnerabilities, restoration time and complaints;
• retain a documented fallback process and an alternative-provider feasibility study.

The first line owned implementation. The second line challenged risk ratings, monitored KRIs and reported exceptions. Internal audit reviewed governance, provider oversight, testing evidence and remediation closure. The board approved residual risk subject to specified thresholds and quarterly reporting.

Outcome

Testing showed that the original recovery-time assumption was unrealistic. Management added temporary staffing and a manual triage protocol. The project proceeded, but with phased implementation and a board condition that migration would stop if restoration tests failed or customer-impact thresholds were exceeded.

Learning points

The case demonstrates that a risk label is not a risk assessment. Effective practice connects objectives, causes, events, consequences, controls, ownership, treatment and assurance. It also shows that transfer through outsourcing does not transfer accountability, and that resilience must be tested rather than inferred from contractual promises.

11. Challenges, limitations and critical issues

Model and data limitations

Historical data may be incomplete, biased or irrelevant after structural change. Low-frequency events provide little empirical evidence. Quantitative models can create false confidence when assumptions are hidden. Scenario analysis and expert judgment are necessary complements, but they introduce their own biases.

Risk aggregation

Adding separate risk scores may double-count or omit dependencies. Correlation can change in stressed conditions. Organisations should document aggregation methods, concentration assumptions and diversification limits.

Risk culture

A technically sound framework fails when employees fear escalation, incentives reward volume without regard to quality, or senior leaders dismiss inconvenient information. Psychological safety, speak-up channels, consistent consequences and visible leadership are core controls.

Governance and regulatory expectations

Insurers generally face requirements concerning solvency, governance, outsourcing, operational resilience, market conduct, data protection, anti-money-laundering controls and reporting. Exact obligations vary by jurisdiction. Boards and senior management must understand their legal accountability rather than treating standards as substitutes for law.

Ethics and fairness

Risk decisions can distribute benefits and burdens unequally. Underwriting and claims analytics may discriminate through biased data or proxy variables. Explainability, human review, outcome testing, data minimisation and appeal mechanisms are important where automated decisions affect customers. Confidential information must be used only for legitimate, proportionate purposes.

Technology and artificial intelligence

Artificial intelligence can support horizon scanning, anomaly detection, document analysis and scenario generation. It can also introduce model drift, hallucinated outputs, cyber vulnerabilities, opaque decisions, privacy risks and accountability gaps. Human oversight, approved data sources, validation, access controls, audit logs, model inventories and clear escalation rules are essential. AI output should be treated as evidence to evaluate, not as an authoritative risk decision.

12. Best-practice implementation sequence

An organisation implementing the integrated approach should:

1. obtain governing-body sponsorship and define accountability;
2. map objectives, risk appetite, capacity and regulatory obligations;
3. establish common taxonomies, criteria, scales and reporting protocols;
4. train first-line owners and involve relevant stakeholders;
5. identify and assess risks using proportionate methods;
6. evaluate individual, aggregate and emerging exposures;
7. select treatments using cost, effectiveness and residual-risk analysis;
8. assign actions, deadlines, indicators and escalation thresholds;
9. monitor controls and test resilience, including adverse scenarios;
10. provide independent assurance and review lessons learned; and
11. improve the framework when strategy, technology, regulation or external conditions change.

The objective is not a risk-free organisation. It is an organisation capable of making informed choices, remaining within its capacity, responding to uncertainty and learning before small weaknesses become material failures.

Chapter Summary

The risk management process begins with objectives, scope, context and criteria. It then identifies risks, analyses their likelihood and consequences, evaluates them against appetite and tolerance, selects treatments, and monitors, records and reports results. The process is iterative rather than linear.

ISO 31000 provides a flexible process and principles for creating and protecting value. COSO ERM connects risk with governance, strategy and performance and encourages a portfolio view. The Three Lines Model allocates responsibility: management owns and manages risk, second-line functions support and challenge, and internal audit provides independent assurance under the oversight of the governing body.

Effective insurance risk management combines qualitative judgment, quantitative analysis, controls, resilience testing, ethical decision-making and clear accountability. Models and standards improve discipline but cannot replace professional judgment, reliable information, regulatory compliance or a healthy risk culture.

Key Terms

Risk: Effect of uncertainty on objectives.

Risk management: Coordinated activities that direct and control an organisation regarding risk.

Risk appetite: Amount and type of risk an organisation is willing to pursue or retain.

Risk tolerance: Acceptable variation around an objective or risk limit.

Risk capacity: Maximum risk an organisation can absorb while remaining viable.

Inherent risk: Risk before controls or treatments.

Residual risk: Risk remaining after controls or treatments.

Risk owner: Person accountable for managing a risk.

Control owner: Person accountable for a control’s design or operation.

Risk criteria: Reference points used to evaluate significance.

Risk identification: Process of finding and describing risks.

Risk analysis: Process of understanding risk characteristics and level.

Risk evaluation: Comparison of analysed risk with criteria.

Risk treatment: Selection and implementation of measures that modify risk.

Key risk indicator: Measure that signals changing exposure or control conditions.

Emerging risk: New or changing risk whose effects or likelihood are uncertain.

ISO 31000: International guidance on risk-management principles, framework and process.

COSO ERM: Framework linking enterprise risk management with strategy and performance.

Three Lines Model: Model distinguishing management ownership, second-line support and challenge, and independent internal-audit assurance.

Review Questions

Short Answer Questions

1. Distinguish risk appetite, risk tolerance and risk capacity.
2. What are the main stages of the ISO 31000 risk-management process?
3. Why should a risk statement identify cause, event and consequence?
4. Explain the difference between inherent and residual risk.
5. What is the role of the second line in the Three Lines Model?

Long Answer Questions

1. Compare ISO 31000 and COSO ERM in terms of purpose, structure and practical application in an insurance company.
2. Explain how an insurer should establish internal and external context before assessing a new product risk.
3. Discuss qualitative, semi-quantitative and quantitative approaches to risk analysis, including their limitations.
4. Analyse the principles that should guide the selection and implementation of risk treatments.
5. Explain how governance, culture and the Three Lines Model contribute to effective enterprise risk management.

Analytical / Application Questions

1. An insurer has a 0.05 probability of a $1,000,000 loss and a 0.15 probability of a $100,000 loss in mutually exclusive scenarios. Calculate expected loss and explain why the result should not be treated as a precise forecast.
2. Design a risk-register entry for an insurer that relies on one cloud provider for claims processing. Include the objective, cause, event, consequences, controls, treatment and KRIs.
3. A chief risk officer designs a control, operates it and later asks internal audit to approve it. Use the Three Lines Model to identify the governance problems and propose a better allocation of responsibilities.

Multiple Choice Questions with Answers

Question 1

Which statement best describes risk under ISO 31000?

A. The probability of a financial loss only

B. The effect of uncertainty on objectives

C. Any event that management dislikes

D. A control failure confirmed by audit

Correct Answer: B. The effect of uncertainty on objectives

Question 2

Which COSO ERM component most directly connects risk with strategic choices and objectives?

A. Strategy and objective-setting

B. External assurance

C. Claims settlement

D. Loss recording

Correct Answer: A. Strategy and objective-setting

Question 3

Who primarily owns and manages risks in the Three Lines Model?

A. Internal audit

B. External auditors

C. First-line management

D. The regulator

Correct Answer: C. First-line management

Question 4

Residual risk is the risk that remains:

A. Before objectives are established

B. After controls and treatments are considered

C. Only after an external audit

D. Only when insurance is unavailable

Correct Answer: B. After controls and treatments are considered

Question 5

If likelihood is scored as 4 and impact as 5, what is the simple prioritisation score using S = L × I?

A. 9

B. 10

C. 20

D. 45

Correct Answer: C. 20

Question 6

A risk owner is primarily accountable for:

A. Managing a particular risk

B. Independently auditing every department

C. Approving all regulatory laws

D. Replacing the governing body

Correct Answer: A. Managing a particular risk

Question 7

Which is an example of risk treatment by reducing consequences?

A. Discontinuing the product

B. Installing backups and a continuity plan

C. Ignoring a risk within appetite

D. Changing the risk taxonomy

Correct Answer: B. Installing backups and a continuity plan

Question 8

What is a major limitation of multiplying ordinal risk-matrix scores?

A. It always requires monetary data

B. It proves that risks are independent

C. It can create false precision

D. It cannot rank any risks

Correct Answer: C. It can create false precision

Question 9

What is the principal assurance role of internal audit in the Three Lines Model?

A. Owning operational risks

B. Operating first-line controls

C. Providing independent and objective assurance

D. Setting every business objective

Correct Answer: C. Providing independent and objective assurance

Question 10

For mutually exclusive scenarios, expected loss is calculated as:

A. The largest possible loss only

B. The sum of each probability multiplied by its scenario loss

C. The average of losses without probabilities

D. The probability of the worst event divided by its loss

Correct Answer: B. The sum of each probability multiplied by its scenario loss