67. Management of insurance and financial risks in the group’s insurance business

The Group operates risk management programmes, including asset-liability matching (ALM) processes, hedging programmes (largely implemented through the use of derivatives) and insurance programmes (largely implemented through the use of quota share, excess of loss and stop loss reinsurance). The programmes operate in each country in which the Group is present and form an integral part of the Group’s overall risk management framework. In insurance companies, the objective of managing risk by seeking to maintain the level of risk within an accepted tolerance level is to:

• ensuring the financial stability and liquidity of the company;
• protect shareholder value;
• ensuring the provision of benefits and claims to customers;
• support the company in running an effective business.

The risk management objectives are achieved, in particular, by providing appropriate information on the risk, so that decisions are made in full awareness of the risks involved.

The risk management system in place is effective and includes the strategies, processes and reporting procedures necessary to identify, measure, monitor, manage and report on the risks to which the insurance company is or may be exposed, on a continuous basis, both at an individual and aggregate level. Companies ensure that the risk management system is effective and appropriately integrated into the organisational structure and decision-making processes, taking into account key function holders. The risk management system covers risks to be included in the calculation of the Solvency Capital Requirement and risks not covered by the Standard Formula.

Components of the risk management system include:

• organisation of corporate governance covering both organisational structure, reporting lines, key functions, internal control, oversight, communication and risk management culture;
• own assessment of risks and capital needs over the business planning horizon.

Insurance companies manage risks at three independent, complementary levels:

• the first level is made up of the company’s organisational structures responsible for product management, selling products and servicing customers, and of other structures
• which perform operational tasks that generate risk, which function based on internal regulations;
• the second level includes the activities of the units performing the risk management function, the actuarial function, the compliance function, as well as the functioning of the Company’s committees; the purpose of these structures is to identify, measure or assess, control, monitor and report the significant risks as well as the threats identified, in order to ensure that the activities performed at the first level are properly designed in the insurance company’s internal regulations and effectively mitigate risks, support the measurement, assessment and analysis of risks and the efficiency of operations;
• the third level is the activity of the internal audit unit and the Supervisory Board committee, which performs independent audits of the elements of the Company’s management system referred to in the above paragraphs. The internal audit operates separately from the first and second levels.