3. Enterprise Risk Management in Insurance

Introduction and context

Insurance is a risk-taking business, but it cannot be managed safely by examining one risk at a time. An insurer may face underwriting losses while its investment portfolio is declining, or it may appear solvent on a balance sheet while suffering a severe liquidity strain. A cyber incident can interrupt claims operations, damage customer trust, trigger regulatory action and increase expenses simultaneously. These interactions demonstrate why insurance risk management must extend beyond isolated controls and become an enterprise-wide discipline.

Enterprise Risk Management (ERM) is the coordinated identification, assessment, treatment, monitoring and reporting of risks that may affect an insurer’s ability to achieve its strategic and financial objectives. It connects business strategy, capital, governance, risk appetite, performance and control. In insurance, ERM is especially important because liabilities are uncertain, products are long-term, capital is interdependent across business lines, and risk may emerge through correlations that are not visible in individual departments.

The central managerial question is not whether risk can be eliminated. It cannot. The question is which risks the insurer is prepared to accept, in what amount, over what time horizon and under what controls. ERM provides the framework for answering that question and for ensuring that decisions made by underwriting, investments, claims, finance, technology and distribution remain consistent with the insurer’s overall capacity and purpose.

Learning objectives

After studying this chapter, the learner should be able to:

1. Explain the meaning, scope and evolution of ERM in insurance.

2. Distinguish major insurance risks and analyse their interactions.

3. Formulate risk appetite, tolerances, limits and escalation arrangements.

4. Explain the role of governance, risk culture and the three lines model.

5. Describe the purpose, structure and process of an Own Risk and Solvency Assessment (ORSA).

6. Apply quantitative and qualitative tools to insurance risk decisions.

7. Evaluate technology, conduct, operational, reputational and emerging risks.

8. Recommend practical improvements to an insurer’s ERM framework.

From silo-based control to enterprise risk management

Traditional insurance management often divided responsibility among specialist functions. Underwriters managed underwriting risk, actuaries managed reserving risk, investment managers managed market risk and treasury managed liquidity. Specialisation remains necessary, but the silo approach can obscure concentration and correlation. A catastrophe may increase claims, reduce asset values, create reinsurance recoverables and generate urgent cash requirements at the same time. If each function assesses only its own exposure, the board may receive a fragmented and misleading picture.

ERM adopts a portfolio perspective. It asks how risks combine, whether diversification is reliable under stress, whether capital is adequate for the selected business strategy and whether controls operate across the entire value chain. It also recognises that some risks are difficult to quantify. Strategic failure, poor conduct or reputational damage may not have a stable probability distribution, yet they can materially affect capital, earnings and franchise value.

ERM should not be confused with compliance alone. Compliance is an important component, but ERM also concerns strategic choice, resource allocation, pricing, product design, capital planning and decision-making under uncertainty. Nor is ERM simply a risk register. A register records exposures; an effective ERM system changes behaviour and embeds risk information into managerial decisions.

The insurance risk universe

Underwriting and pricing risk

Underwriting risk is the possibility that actual claims, expenses or policyholder behaviour will differ adversely from expectations. It arises from inadequate pricing, inappropriate risk selection, excessive accumulation, coverage ambiguity, policy wording, catastrophe exposure and changes in the mix of business. Life insurers may face mortality, longevity, morbidity and lapse risks; general insurers may face frequency, severity, catastrophe and reserve deterioration risks.

Pricing risk occurs when premiums do not adequately compensate for expected claims, expenses, capital and uncertainty. A technically sound price may nevertheless be unsuitable if distribution incentives lead to adverse selection or if competitors cause the insurer to underprice. Underwriting controls therefore include authority limits, referral rules, accumulation monitoring, portfolio analytics, product governance and regular rate adequacy reviews.

Reserving and claims risk

Reserving risk is the risk that technical provisions will be insufficient to meet future claims and associated expenses. It includes uncertainty concerning reported but unsettled claims, incurred but not reported claims, claims inflation, legal interpretation, social inflation, settlement patterns and claims handling practices. Reserve estimates are not merely accounting figures; they influence solvency, pricing, reinsurance purchases, dividends and strategic capacity.

Actuarial models provide estimates, but management must also consider model uncertainty, data limitations and adverse development. Independent review, claims triangles, back-testing, scenario analysis and explicit management margins can improve the quality of reserving decisions. A reserve that is adequate under ordinary inflation may be inadequate under a prolonged inflationary or litigation environment.

Market and investment risk

Market risk is the possibility of loss caused by movements in interest rates, equity prices, property values, foreign exchange rates, credit spreads or other market variables. Insurers face a distinctive asset-liability problem: assets generate investment returns while liabilities may have long and uncertain durations. An asset portfolio that appears profitable in isolation may be unsuitable if it does not match liability cash flows or if it introduces excessive volatility in solvency capital.

Asset-liability management (ALM) links investment strategy to liability characteristics. Duration matching, cash-flow matching, immunisation, limits on concentration and stress testing are common techniques. Market risk must also consider basis risk, reinvestment risk and the possibility that hedges become ineffective during stressed markets.

Credit and counterparty risk

Credit risk is the possibility that a borrower, issuer, reinsurer, broker, derivative counterparty or other obligor fails to perform. Reinsurance creates important counterparty exposure: a cedant may report a recoverable as an asset, but its economic value depends on the reinsurer’s ability and willingness to pay. Collateral, security arrangements, diversification, credit assessment, exposure limits and ageing analysis help manage this risk.

Credit risk is not limited to default. Downgrade risk may increase collateral requirements or reduce the value of investments. Wrong-way risk arises when exposure to a counterparty increases precisely when that counterparty’s financial condition deteriorates.

Liquidity risk

Liquidity risk is the inability to meet obligations when due without unacceptable losses. An insurer may be solvent but illiquid. Large catastrophe claims, policy surrenders, collateral calls, premium delays, operational disruption or restricted asset markets can create a liquidity event. Liquidity management therefore requires cash-flow forecasting, liquid asset buffers, contingent funding plans, stress scenarios and clear escalation procedures.

The liquidity profile of liabilities matters. A portfolio with stable long-term premiums may require less immediate liquidity than a portfolio exposed to mass lapses or frequent claims. Liquidity stress testing should include severe but plausible combinations, such as high claims, falling asset prices and reduced reinsurance recoveries.

Operational and technology risk

Operational risk results from inadequate or failed processes, people, systems or external events. Examples include incorrect policy administration, claims leakage, fraud, outsourcing failure, human error, poor data quality and business interruption. Technology risk includes cyberattack, system availability failure, unauthorised access, data corruption, algorithmic error and dependence on critical vendors.

Controls should be proportionate to the importance of the process. Business continuity plans, access controls, segregation of duties, incident response, disaster recovery testing, vendor due diligence and staff training are central safeguards. Operational risk is often difficult to quantify reliably, making indicators, incident reporting and scenario analysis particularly valuable.

Strategic risk

Strategic risk is the possibility that an insurer’s choices, implementation or response to external change undermine its objectives. Entering a new market, acquiring a portfolio, launching a digital product or relying heavily on one distribution channel may create strategic exposure. Strategic risk also arises from failing to adapt to climate change, technological change, demographic shifts or regulatory developments.

A strategy becomes risk-aware when its assumptions are explicit and challenged. Business plans should identify dependencies, downside scenarios, capital implications and early-warning indicators. Boards should distinguish a deliberate risk choice from an unmanaged risk created by weak execution.

Conduct, legal and reputational risk

Conduct risk concerns unfair treatment of customers or other stakeholders. Mis-selling, inappropriate claims settlement, opaque exclusions, unfair pricing practices, conflicts of interest and poor complaints handling can create financial and regulatory consequences. Legal risk includes litigation, unenforceable wording, privacy breaches and non-compliance with applicable requirements.

Reputational risk is the potential loss of trust and stakeholder support. It is often an outcome of other risks rather than an independent event. A conduct failure can lead to customer complaints, media attention, regulatory scrutiny, lost business and higher funding costs. Reputation cannot be protected solely through public relations; it is built through consistent decisions, transparent communication and responsible behaviour.

Risk architecture: appetite, tolerance, limits and indicators

Risk appetite is the aggregate level and type of risk an insurer is willing to assume in pursuit of its objectives. It is a strategic statement approved by the board. Risk tolerance describes acceptable variation around objectives, while risk limits translate appetite into operational boundaries for portfolios, products, counterparties, investments and processes. These concepts should be aligned rather than treated as interchangeable.

For example, a board may approve an appetite for moderate catastrophe exposure consistent with maintaining a specified solvency buffer. Management may then set limits for gross and net catastrophe concentration, geographic accumulation, reinsurance counterparty exposure and capital usage. A limit breach should trigger investigation and escalation; it should not be treated as merely a reporting issue.

Risk indicators provide early warning. They may include loss ratios, reserve deterioration, lapse rates, concentration measures, solvency coverage, liquidity days, overdue recoverables, system availability, complaints and staff turnover. Indicators must have defined thresholds, owners, reporting frequency and management actions. A dashboard with many indicators but no decision rules is not an effective control.

Risk appetite statements should be understandable, measurable where possible and connected to capital and strategy. They commonly address solvency, earnings volatility, liquidity, customer outcomes, operational resilience, investment concentration and reputation. Appetite is not static: it should be reconsidered when the business model, economic conditions, capital position or external environment changes.

Governance, culture and accountability

The board retains ultimate responsibility for risk governance. It approves strategy and risk appetite, challenges management, ensures adequate resources and monitors whether the risk profile remains within approved boundaries. Senior management implements the framework and integrates risk considerations into planning and daily decisions.

A widely used governance arrangement is the three lines model. The first line consists of business and operational management, which owns risks and operates controls. The second line includes risk management, compliance and related oversight functions, which establish frameworks, challenge decisions and monitor exposures. The third line is internal audit, which provides independent assurance on governance, risk management and controls. Actuarial, legal, finance and security functions may have specialised responsibilities across these lines.

Independence is essential, but risk management should not become detached from business reality. Effective challenge is informed, timely and constructive. The chief risk officer should have access to the board and sufficient authority to escalate material concerns. Remuneration should avoid rewarding volume or short-term profit without considering claims development, customer outcomes and risk-adjusted performance.

Risk culture is reflected in what the organisation rewards, tolerates and discusses. A healthy culture encourages staff to report near misses, question unrealistic assumptions, admit uncertainty and escalate concerns without fear of retaliation. Culture can be assessed through surveys, conduct indicators, turnover, audit findings, whistleblowing data and the quality of management responses to bad news.

Quantification and decision tools

Insurance ERM combines quantitative and qualitative methods. Capital models may use deterministic scenarios, factor-based methods, stochastic simulation or internal models. Common risk measures include Value at Risk (VaR), which estimates a loss threshold at a selected confidence level, and Tail Value at Risk (TVaR), which measures the average loss beyond that threshold. Tail measures are often more informative for insurance because severe outcomes may be concentrated beyond ordinary percentiles.

Correlation assumptions require caution. Historical correlations may fail during crises, and diversification benefits may disappear when risks become linked. Stress testing addresses this problem by examining specified adverse conditions, such as a catastrophe combined with market decline and reinsurer downgrade. Reverse stress testing starts with an unacceptable outcome, such as breaching the minimum solvency position, and asks which combination of events could cause it.

Scenario analysis is particularly useful for strategic, operational and conduct risks. A scenario should identify assumptions, transmission channels, financial and non-financial effects, management actions and recovery time. Sensitivity analysis changes one or more assumptions to reveal which drivers most influence results.

Risk-adjusted performance measures connect risk to business decisions. A product may have attractive expected profit but consume disproportionate capital. Measures such as return on risk-adjusted capital can support comparison, although they should not replace judgement. Models are decision aids, not substitutes for governance.

ORSA: linking risk, capital and strategy

The Own Risk and Solvency Assessment is an insurer’s internal, forward-looking assessment of its risk profile, capital needs and solvency position. It is both a process and a report. Its value lies in integrating strategy, risk identification, capital assessment, stress testing, governance and management action.

A sound ORSA generally follows these steps:

1. Define business strategy, planning horizon and material risk exposures.

2. Assess the current risk profile, including risks not fully captured by regulatory capital formulas.

3. Determine the insurer’s own solvency needs, considering business mix, risk appetite, capital quality and diversification.

4. Project capital, earnings, liquidity and risk metrics under the business plan.

5. Conduct stress and scenario tests, including reverse stress testing where appropriate.

6. Identify management actions, contingency arrangements and capital alternatives.

7. Obtain board challenge and approval, document conclusions and communicate responsibilities.

8. Monitor changes and refresh the assessment when material events occur.

ORSA should not be prepared as a compliance document detached from planning. It should influence underwriting growth, reinsurance structure, asset allocation, dividend policy, product design and capital raising. It should explain why the insurer’s capital is adequate for its own risk profile, not merely why a regulatory ratio is above a threshold.

A useful ORSA report distinguishes current position from forward-looking position, includes limitations and uncertainty, and demonstrates the relationship between risk appetite and capital. It should also explain the credibility of management actions. For example, selling assets during a market crisis may be theoretically possible but commercially unrealistic if markets are illiquid.

Applying ERM across the insurance value chain

ERM becomes practical when embedded in decisions. During product development, the insurer should assess pricing assumptions, policy wording, customer suitability, operational capability, capital impact, reinsurance needs and conduct consequences. During underwriting, authority levels and accumulation controls should reflect portfolio capacity. During claims management, fraud controls must be balanced against fair treatment and timely settlement.

In investment management, ALM, credit standards, liquidity buffers and concentration limits should be connected to liability needs. In reinsurance, the insurer should evaluate attachment points, reinstatement terms, basis risk, counterparty quality, collateral and recoverability. In outsourcing, it should retain accountability for critical functions and monitor service levels, resilience and data protection.

The board and management should receive integrated reporting rather than separate technical reports only. A concise risk report may show the current profile, movement since the previous period, breaches, emerging risks, stress results, capital implications and required decisions.

Illustrative case study: Meridian General Insurance

Background

Meridian General Insurance is a fictional mid-sized insurer operating in property, motor and commercial liability lines. Its strategy is to expand rapidly through digital distribution and maintain a high investment return by holding a relatively large allocation to corporate bonds and equities.

Situation

Over two years, Meridian’s premium volume increased substantially. However, the risk function observed rising catastrophe concentration in coastal regions, slower claims settlement, declining reinsurance recoveries and increased complaints about digital policy exclusions. At the same time, interest rates rose, equity markets weakened and two important corporate bond issuers were downgraded. Meridian remained above its regulatory capital requirement, but its internal liquidity forecast showed that a severe catastrophe followed by delayed reinsurance payments could create a funding shortage.

Analysis

The problem was not one isolated failure. Rapid growth increased underwriting and operational risk. Ambiguous digital wording created conduct and legal exposure. Asset-liability mismatches increased market risk, while concentration in corporate bonds increased credit risk. Delayed recoveries linked the reinsurance programme to liquidity. The board’s appetite statement focused mainly on maintaining a capital ratio and did not set clear limits for catastrophe concentration, liquidity or customer complaints.

Approach and strategy

Meridian established an enterprise risk committee chaired by the chief risk officer and required business owners to report integrated risk indicators. It revised the risk appetite statement to include catastrophe exposure, liquidity coverage, investment concentration, reinsurance recoverables and customer outcomes. Underwriting limits were reduced in high-accumulation zones, and pricing was reviewed using updated catastrophe assumptions.

The investment portfolio was rebalanced toward assets better matched to expected claim payments. Meridian introduced counterparty limits and collateral triggers for reinsurance arrangements. It conducted a combined stress test involving a major catastrophe, market decline, reinsurer delay and increased complaints. The product committee simplified digital exclusions and required a customer-outcome review before further expansion.

The ORSA was revised to project capital and liquidity over the business-planning horizon rather than reporting only the current ratio. Management actions were ranked by feasibility, timing and adverse side effects.

Outcome

The insurer accepted slower growth in the affected regions and reduced short-term investment returns, but improved the resilience of its capital and liquidity position. Reporting to the board became more decision-oriented, and complaints were incorporated into conduct risk monitoring. The case does not imply that all risks were eliminated; rather, Meridian aligned risk-taking with capacity and made trade-offs explicit.

Learning points

The case illustrates that ERM is an integration mechanism. Capital adequacy alone does not guarantee liquidity, customer fairness or operational resilience. Growth decisions must be tested against interconnected risks, and an ORSA is most valuable when it changes strategy rather than merely documenting it.

Challenges and common weaknesses

ERM frameworks may fail through poor data, weak ownership, excessive model complexity, inadequate challenge or a disconnect between stated appetite and actual incentives. Risk registers can become long lists with no prioritisation. Models may create false confidence when assumptions are poorly understood. Stress tests may be too mild, while management actions may be unrealistic or double-counted.

Other common weaknesses include treating reputational risk as a communications problem, ignoring non-financial risks, measuring risks only after losses occur, and allowing commercial pressure to override limits without documented authority. A limit framework also becomes ineffective when limits are too numerous, thresholds are unclear or breaches are routinely waived.

The remedy is not simply more policies. Insurers need reliable data, clear accountability, proportional controls, independent challenge, timely escalation and regular testing. The framework should be reviewed after major events and near misses, not only on an annual calendar.

Governance, ethics and regulation

Insurance ERM is shaped by supervisory expectations concerning governance, solvency, risk management, technical provisions, investments, outsourcing, consumer protection and operational resilience. Specific requirements vary by jurisdiction, but the underlying principle is consistent: the insurer must understand its risks, maintain appropriate financial resources and demonstrate responsible oversight.

Ethical risk management requires fair treatment of policyholders, transparent communication, responsible use of data and avoidance of conflicts of interest. Artificially complex products or sales incentives may generate short-term revenue while transferring unreasonable risk to customers. Confidentiality and privacy must be protected when analysing claims and behaviour. Regulatory compliance should be viewed as a minimum standard; professional judgement may require stronger action where formal rules do not fully address the situation.

Digital transformation, analytics and emerging risks

Data analytics can improve pricing, fraud detection, claims triage, catastrophe modelling and early-warning systems. Artificial intelligence may identify patterns that are difficult to detect manually, but it can also reproduce biased data, create opaque decisions, expose sensitive information or produce unstable outputs. Model governance should therefore include data lineage, validation, explainability, human oversight, performance monitoring and controls against unauthorised use.

Emerging risks include climate-related physical and transition risks, cyber accumulation, geopolitical disruption, pandemic-related exposure, supply-chain dependency, autonomous technologies and changes in social expectations. These risks may have limited historical data and may interact across insurance classes. Horizon scanning, expert judgement, scenario analysis and flexible risk appetite are particularly important.

Best-practice principles

An effective insurance ERM framework generally follows these principles:

• connect risk appetite directly to strategy, capital and incentives;
• assign clear ownership while preserving independent challenge;
• combine models with judgement, scenarios and qualitative intelligence;
• monitor concentration, correlation and accumulation rather than isolated exposures;
• integrate liquidity, conduct, operational and reputational risks with financial risks;
• use forward-looking ORSA analysis to support real decisions;
• maintain credible contingency and recovery plans;
• test controls, data, systems and management actions regularly; and
• encourage a culture in which uncertainty and bad news are reported promptly.

Chapter Summary

Enterprise Risk Management gives insurers an integrated method for managing uncertainty across underwriting, reserving, market, credit, liquidity, operational, strategic, conduct and reputational domains. Its purpose is not to eliminate risk but to ensure that risk-taking is deliberate, understood and supported by capital, liquidity, controls and governance. Risk appetite expresses the board’s strategic willingness to accept risk; tolerances, limits and indicators translate that appetite into operational discipline.

Effective ERM depends on clear accountability, independent challenge, sound data, appropriate quantitative tools and a healthy risk culture. Stress testing and scenario analysis are essential because correlations and extreme events may invalidate historical assumptions. ORSA links the insurer’s own risk profile to solvency needs, business planning and management actions. Technology and analytics can strengthen risk management but introduce model, cyber, privacy and bias risks. The strongest frameworks are dynamic, forward-looking and embedded in everyday decisions.

Key Terms

Risk appetite: The aggregate amount and type of risk an insurer is willing to accept in pursuit of its objectives.

Risk tolerance: The acceptable variation around a defined objective or risk appetite.

Risk limit: An operational boundary imposed on a specific exposure, activity or portfolio.

Enterprise Risk Management: An integrated process for identifying, assessing, treating, monitoring and reporting risks across an organisation.

Underwriting risk: The possibility that claims, expenses or policyholder behaviour will be worse than expected.

Reserving risk: The risk that provisions for future claims and expenses will be inadequate.

Asset-liability management: Coordinating assets and liabilities to manage cash flows, duration, market exposure and solvency.

Credit risk: The risk that an obligor or counterparty will fail to perform.

Liquidity risk: The risk of being unable to meet obligations when due without unacceptable loss.

Operational risk: Loss arising from failed processes, people, systems or external events.

Conduct risk: The risk of unfair outcomes or improper treatment of customers and stakeholders.

Reputational risk: The potential loss of trust, support or business resulting from adverse perceptions or events.

Risk culture: The shared behaviours, values and practices that influence how an organisation understands and responds to risk.

Three lines model: A governance arrangement distinguishing business ownership, risk oversight and independent assurance.

Value at Risk: A loss threshold estimated for a specified confidence level and time horizon.

Tail Value at Risk: The average loss beyond a specified loss threshold.

Stress testing: Assessing the effect of specified adverse scenarios on an insurer.

Reverse stress testing: Starting with an unacceptable outcome and identifying scenarios that could produce it.

ORSA: An insurer’s forward-looking internal assessment of its risks, capital needs and solvency position.

Accumulation risk: The possibility that exposures are concentrated so that one event causes correlated losses across policies or portfolios.

Review Questions

Short Answer Questions

1. Why is a silo-based approach insufficient for managing insurance risk?

2. Distinguish between risk appetite, risk tolerance and risk limits.

3. What is the relationship between liquidity risk and solvency risk?

4. Identify the three lines model and state the responsibility of each line.

5. What is the principal purpose of an ORSA?

Long Answer Questions

1. Explain the major financial and non-financial risks faced by an insurer and discuss their possible interactions.

2. Describe how a board can formulate and implement an effective risk appetite framework.

3. Explain the ORSA process and show how it should influence strategy, capital and reinsurance decisions.

4. Discuss the role of risk culture, governance and independent challenge in insurance ERM.

5. Evaluate the usefulness and limitations of models, stress testing and scenario analysis in managing insurance risks.

Analytical / Application Questions

1. An insurer has strong capital but a high proportion of short-term claims, illiquid assets and delayed reinsurance recoveries. Analyse its risk position and recommend actions.

2. A digital insurer is growing rapidly while complaints about exclusions and claims delays are increasing. Design an integrated ERM response covering conduct, operational, strategic and reputational risks.

3. Construct a combined stress scenario involving catastrophe, market decline, counterparty downgrade and cyber disruption. Explain the indicators, management actions and governance escalation that should form part of the insurer’s ORSA.

22. Multiple Choice Questions with Answers

Question 1

Which statement best describes the central purpose of insurance ERM?

A. To eliminate all uncertainty from insurance operations

B. To coordinate risk-taking with strategy, capital, controls and governance

C. To transfer every material risk to reinsurers

D. To replace specialised underwriting and actuarial functions

Correct Answer: B. To coordinate risk-taking with strategy, capital, controls and governance

Question 2

An insurer remains solvent but cannot pay urgent catastrophe claims without selling assets at a substantial loss. Which risk is most directly illustrated?

A. Liquidity risk

B. Longevity risk

C. Conduct risk

D. Model risk

Correct Answer: A. Liquidity risk

Question 3

Which action best translates board-level risk appetite into operational control?

A. Publishing a general statement that risk should be minimised

B. Setting accumulation and counterparty limits with escalation thresholds

C. Delegating all risk decisions to internal audit

D. Reviewing risks only after annual financial statements are issued

Correct Answer: B. Setting accumulation and counterparty limits with escalation thresholds

Question 4

Why is reinsurance recoverability relevant to liquidity management?

A. Recoveries are always received before claims are paid

B. Delayed or failed recoveries may create a cash-flow shortfall

C. Reinsurance eliminates the need for liquid assets

D. Recoveries affect only reputational risk

Correct Answer: B. Delayed or failed recoveries may create a cash-flow shortfall

Question 5

Which feature most clearly distinguishes ORSA from a purely regulatory capital calculation?

A. It considers only historical claims experience

B. It is forward-looking and links the insurer’s own risks to strategy and capital needs

C. It excludes risks that are difficult to quantify

D. It is prepared solely by the investment department

Correct Answer: B. It is forward-looking and links the insurer’s own risks to strategy and capital needs

Question 6

A catastrophe causes claims losses, falling asset prices, higher collateral requirements and delayed recoveries. What ERM concept does this example primarily demonstrate?

A. Risk interaction and accumulation

B. Complete diversification

C. Operational independence

D. Static risk appetite

Correct Answer: A. Risk interaction and accumulation

Question 7

Which practice is most consistent with the three lines model?

A. Internal audit owns daily underwriting controls

B. Business management owns risks, risk functions challenge and monitor, and internal audit provides assurance

C. The board delegates all oversight to external vendors

D. The compliance function replaces business accountability

Correct Answer: B. Business management owns risks, risk functions challenge and monitor, and internal audit provides assurance

Question 8

Why may Tail Value at Risk be useful for insurance risk analysis?

A. It ignores losses beyond a selected percentile

B. It estimates the average severity of losses beyond a specified threshold

C. It measures only ordinary expected claims

D. It eliminates the need for stress testing

Correct Answer: B. It estimates the average severity of losses beyond a specified threshold

Question 9

A pricing algorithm produces lower premiums for a group because its training data reflects historical discrimination. What is the principal ERM concern?

A. Only investment duration risk

B. Conduct, model and ethical risk

C. Only reinsurance reinstatement risk

D. Purely physical liquidity risk

Correct Answer: B. Conduct, model and ethical risk

Question 10

What is the defining starting point of reverse stress testing?

A. Selecting the most profitable product

B. Estimating the average historical claim

C. Identifying an unacceptable outcome and working backward to possible causes

D. Removing all management actions from a scenario

Correct Answer: C. Identifying an unacceptable outcome and working backward to possible causes