The insurance industry faces a host of issues: complex risks, rising demand, new systemic risks, and changing expectations from stakeholders. The key areas of focus for the industry at present are Enterprise Risk Management, Climate Risk & ESG and Cyber Insurance. Compliance people and lawyers will need strong knowledge of these to meet regulators' expectations. The following points will drive risk management in insurance over the coming years. We'll also look at emerging risks and, as part of that, provide practical recommendations and next steps compliance people can take to address them.
Enterprise Risk Management in the Insurance Sector
Enterprise Risk Management is about governing more efficiently and effectively. Regulators (IAIS, EIOPA, and national authorities) have made it clear that ERM should be embedded in strategic planning and business decision-making. It is now firmly established as a key element of strategic supervision, enabling the board to ensure that risk appetite is properly aligned with the decisions being taken. Insurers are required to have board-approved risk appetite statements, to carry out forward-looking Own Risk and Solvency Assessments (ORSA) and to perform scenario testing for market, credit, operational and emerging risks (IAIS 2019).
A good example is how European insurers use ORSA stress testing. One medium-sized insurer looked at aggregation risk in group interest rates and ran a solvency stress test. As a result, management changed their risk limits and reinsurance. That's a case in point for how ERM can drive strategy, solvency, and risk management. Best practice in this area is to have an integrated risk register, early warning systems, and product governance and investment decisions properly aligned with risk measures. In compliance, ERM can also improve accountability in the two- or three-lines-of-defence model for conduct risk. One compliance team at an insurer took a fairly simple approach to using an ERM framework to address a regulatory finding. They mapped the identified compliance gaps to the appropriate risk owners, updated the risk register, and improved the quality and timeliness of reporting to the board. In another instance, a compliance team used an ERM approach to improve the documentation and tracking of their regulatory obligations, which enabled them to demonstrate to supervisors that remedial action had been taken and ultimately reduced the likelihood of a repeat finding.
Climate Risks and ESG Issues
Climate-related risks and ESG issues were once a concern for insurance supervisors but are now central to global supervision and corporate governance. Insurers are being advised by supervisors, industry groups and a range of global initiatives (including the Network for Greening the Financial System, the Task Force on Climate-related Financial Statements and the UNEP Finance Initiative) to assess and disclose climate-related risks in their underwriting, investment and business activities. These risks include both physical and transition risks (the risks associated with decarbonisation, carbon pricing, changing behaviours, and financial market fluctuations, etc.) (IPCC, 2023).
Recent events point to the nature and extent of these problems. The increasing incidence of wildfires in the US and Australia has triggered a re-examination of the terms and appropriateness of insurance cover and catastrophe models. Transition risk is another factor forcing a rethink of insurance investments, particularly those exposed to carbon assets (OECD, 2022).
ESG factors also cover governance, ethics, social responsibility and behaviour. Insurers now use ESG in investment, product, supplier, and client decision-making. The regulatory climate around climate disclosures is focused on the TCFD Climate Disclosure and the EU's SFDR. Better climate and ESG governance will involve scenario planning, incorporating climate factors into ERM and better management of emissions data. There are several practical things that a compliance team can do to improve ESG governance: update internal ESG policies and codes of conduct to reflect the current regulatory environment and best practice; improve the disclosure process by establishing a consistent data collection and reporting process that is in line with the major regulatory rules; and provide regular ESG training for staff. These steps will help improve ESG governance across the organisation.
Cyber insurance
Cyber insurance is protection against risk in cyberspace. It's now one of the key issues for insurers in both their operations and their underwriting. This is because of the increasing dependence on digital networks and the frequency of cyber attacks (ransomware, breaches, supply chain incidents, etc.). ENISA (2023) and NIST (2022) both point to a rise in attacks on critical infrastructure, cloud, and other key services. This risk presents both a challenge and an opportunity for the insurer.
The cyber market continues to expand. Best-in-class underwriting, however, remains difficult to get right given the factors involved (lack of historical claims experience to draw on, aggregation risks, a rapidly changing risk profile, etc.). The Colonial Pipeline cyber incident has shown clearly that a cyber incident can create systemic risk and that the insurance industry as a whole needs to review its business interruption coverage, exclusions, and accumulation risks. To address variability, insurers need strict adherence to a minimum security standard as a prerequisite for a cyber policy. In that respect, cyber insurers are increasingly turning to security service providers to enable real-time risk assessment. For the compliance function, this means internal controls must be reviewed and updated regularly, you must actively participate in assessing the minimum security requirements, and you must work closely with underwriting to review policy wording for clarity and compliance alignment. You also need to ensure your incident response processes and reporting systems are up to date to meet regulatory expectations.
Cyber resilience
Insurers are also expected to be highly resilient in the cyber space. That means complying with NIST cybersecurity policies, managing technology risk at the board level, having incident reporting processes in place, and having resilience in place (NIST 2022). Legal will be looking at issues of attribution, war exclusions and privacy. In terms of compliance, cyber risk sits alongside financial crime, data governance, and vendor management, so there is a clear need for an integrated governance framework.
Consolidating ERM, Climate/ESG, and Cyber Risk within an Integrated Governance Structure
Insurance supervisors now advocate a more integrated approach to risk management, bringing ERM, ESG, and Cyber Resilience together. This entails aligning risk appetite with Strategic Sustainability Plans, incorporating climate and cyber risks into the ORSA framework, and ensuring data governance is in place across all risk types. A practical starting point for the compliance function would be to establish a cross-functional risk committee with representatives from risk, compliance, legal, IT and sustainability. This committee would lead the unification process, facilitate knowledge sharing, and ensure key risks are reviewed in a coordinated way. The committee would also need to develop a roadmap to align internal policies and reporting with global standards. This level of integration is an important step in the right direction. It will result in a more effective risk management process, better ability to manage business-relevant risks, and greater compliance with global standards (Solvency II, IAIS Core Principles, IFRS/ISSB Sustainability Standards).
For those in compliance and legal roles, the merging of these areas is especially important for several reasons:
This will help the organisation manage new risks such as climate disasters, cyber attacks, and financial crime arising from operational weaknesses. Ultimately, a single governance approach will benefit all of these.
Conclusion
Enterprise Risk Management, Climate/ESG and Cyber Insurance are now at the heart of the regulatory environment in the insurance industry. As challenges become more complex, all stakeholders must cooperate. These are all areas where there is an opportunity to improve and update the regulations. The focus should be on risk management, scenario planning, and clear reporting to be better placed to deal with uncertainty.