Halden reportsOperations
Halden report · OperationsDo our policies hold together?
Largely: Halden's 12 policies link 34 principles to the same risks and controls, but the delegated authority policy is overdue for review.
CoVi · PoliciesFictitious
Policy log
Halden's policy log and system of governance, built by Context Visualised.
- 12Policies in the framework
- 34Principles, each linked to risks and controls
- 1Review overdue
- 3 of 12Actions overdue
Needs attention first
Sorted by what needs attention: overdue reviews, failed controls, red KRIs and overdue actions. Every principle links to the same risks, controls, KRIs and actions used across the other dashboards.
BoardStrategy, business plan and risk appetite
- Audit committee
- Risk & capital
- RemNom
- Executive committee
Underwriting & claims
Capital & finance
Operations
Conduct & compliance
- 1st lineBusiness owns risks and runs controls
- 2nd lineRisk and compliance set and challenge
- 3rd lineInternal audit assures
Principles → risks · controls · KRIs · actionsStandards, procedures and one set of data underneath
Read it like a house. The board sets direction and appetite, and the risk management policy holds everything together. Committees carry it into four pillars of policies, the three lines of defence hold it up, and every policy rests on principles linked to the same risks, controls, KRIs and actions. Select any policy to open it. The dot shows review status and a red border shows a failed control or an overdue action.
Each policy carries a pill with its review status in words, and the border shows health: red where a control has failed or an action is overdue. Policies sort by what needs attention first.
Source: policy register, control library, risk appetite KRIs and action log at 30 Sep 2026.
Policy · Underwriting & claims
Delegated authority policy
Sets how coverholders are approved, given authority, monitored and audited.
- Owner
- Head of Delegated Authority
- Approved by
- Underwriting committee
- Version
- 3.2 · reviewed 18 Sep 2025
- Next review
- 30 Sep 2026
Review overdue
✕ 1 failed control2 overdue actionsKRIs: 1 outside, 1 approaching
Principles · open one to see what it links to
Risks
- OR-06.3Weak coverholder oversight9 · Medium
- OR-07.2Bribery and corruption4 · Low
Controls
- C-150Third-party due diligenceEffective
- C-141DA oversight committeeEffective
Actions
- ACT-050 · due 31 Oct 2026Refresh the delegated authority policy for the 2027 planHead of Delegated AuthorityOpen
Risks
- OR-06.1Coverholder binding outside authority16 · High
- OR-04.3Licensing breaches4 · Low
Controls
- C-138Bordereaux validationPartial
- C-124Territory controls in the policy systemEffective
Indicators
- Out-of-authority binding23Outside
Actions
- ACT-038 · due 31 Oct 2026Remediate Ridgeway Underwriting breaches (INC-031)Head of Delegated AuthorityOpen
- ACT-033 · due 30 Sep 2026Move Ridgeway Underwriting onto the current wordingHead of Delegated AuthorityOverdue
Risks
- OR-06.1Coverholder binding outside authority16 · High
- OR-09.1Poor customer outcomes6 · Low
Controls
- C-137Coverholder audits✕ Ineffective
- C-155Consumer Duty MIEffective
Indicators
- Key controls fully effective84%Approaching
Actions
- ACT-035 · due 30 Sep 2026Clear the coverholder audit backlog (6 overdue)Head of Delegated AuthorityOverdue
Risks
- IR-02.2Reserving data quality6 · Low
- OR-08.1Poor quality underwriting data9 · Medium
Controls
- C-015Bordereaux data validationEffective
- C-151Data quality rulesEffective
Actions
- ACT-036 · due 15 Oct 2026Chase late binder bordereaux (INC-033)Head of Delegated AuthorityOpen
Policy · Underwriting & claims
Underwriting policy
Sets how we select, price and accept risk within the approved plan and appetite.
- Owner
- Chief Underwriting Officer
- Approved by
- Board
- Version
- 5.0 · reviewed 11 Jun 2026
- Next review
- 30 Jun 2027
Review current
KRIs: 2 approaching, 2 outside
Principles · open one to see what it links to
Risks
- SR-01.2Business plan deviation6 · Low
- IR-01.1Underwriting outside appetite or authority6 · Low
Controls
- C-073Monthly plan vs actual monitoringEffective
- C-001Underwriter authority lettersEffective
Indicators
- GWP against plan+6%Approaching
Risks
- IR-01.2Inadequate pricing8 · Medium
- IR-01.3Social inflation in US casualty12 · Medium
Controls
- C-003Pricing model governanceEffective
- C-004Rate adequacy monitoringEffective
- C-005Claims trends fed into pricingEffective
Indicators
- Risk-adjusted rate change−1.5%Approaching
- Large loss ratio to date18.1%Outside
Actions
- ACT-041 · due 30 Nov 2026Reprice US trucking accounts at renewalChief Underwriting OfficerOpen
Risks
- IR-05.2Large single-risk exposure6 · Low
Controls
- C-002Peer review of large risksEffective
- C-033Maximum line size guidelinesEffective
Risks
- IR-01.6Unintended policy coverage6 · Low
Controls
- C-011Wordings committeeEffective
- C-012Market cyber exclusions adoptedEffective
Indicators
- Wording exceptions not approved4Outside
Actions
- ACT-047 · due 15 Oct 2026Approve or remove 4 unapproved wording exceptionsHead of ProductOpen
Policy · Underwriting & claims
Claims management policy
Sets how claims are handled, authorised and overseen, including by third parties.
- Owner
- Head of Claims
- Approved by
- Underwriting committee
- Version
- 2.6 · reviewed 14 Apr 2026
- Next review
- 30 Apr 2027
Review current
✕ 1 failed controlKRIs: 1 outside, 1 approaching
Principles · open one to see what it links to
Risks
- OR-05.3Claims leakage6 · Low
- IR-02.1Long-tail casualty reserve inadequacy12 · Medium
Controls
- C-133Large claims committeeEffective
- C-134Fraud screeningEffective
Indicators
- Large loss ratio to date18.1%Outside
Risks
- OR-06.2Fronting partner claims handling failure16 · High
Controls
- C-139Claims authority agreement✕ Ineffective
- C-140Quarterly claims file auditsPartial
Actions
- ACT-029 · due 31 Oct 2026Agree claims service levels with the UAE fronting partner (INC-028)Head of ClaimsOpen
Risks
- OR-09.1Poor customer outcomes6 · Low
Controls
- C-156Complaints root cause analysisEffective
Indicators
- Complaints upheld22%Approaching
Policy · Operations
Outsourcing & third-party policy
Sets how outsourcers and fronting partners are approved, monitored and exited.
- Owner
- Chief Operating Officer
- Approved by
- Executive committee
- Version
- 2.2 · reviewed 20 Nov 2025
- Next review
- 30 Nov 2026
Review due in 59 days
1 overdue action
Principles · open one to see what it links to
Risks
- OR-06.4Fronting arrangement breakdown8 · Medium
- OR-06.5Critical outsourced service failure6 · Low
Controls
- C-143Fronting agreement SLAsEffective
- C-144Quarterly partner reviewsPartial
- C-145Outsourcing registerEffective
Actions
- ACT-029 · due 31 Oct 2026Agree claims service levels with the UAE fronting partner (INC-028)Head of ClaimsOpen
Risks
- OR-06.5Critical outsourced service failure6 · Low
Controls
- C-146Exit plans for material outsourcersEffective
Actions
- ACT-031 · due 30 Sep 2026Exit plan for the UAE fronting partnerChief Operating OfficerOverdue
Policy · Capital & finance
Investment policy
Sets how assets are invested to match liabilities safely.
- Owner
- Chief Financial Officer
- Approved by
- Risk & capital committee
- Version
- 2.4 · reviewed 22 Jan 2026
- Next review
- 31 Jan 2027
Review current
KRIs: 4 within
Principles · open one to see what it links to
Risks
- MR-01.2Asset-liability duration mismatch6 · Low
- MR-04.2AED peg risk3 · Low
Controls
- C-037ALM matching policyEffective
- C-038Duration monitoringEffective
- C-045AED exposure limitEffective
Indicators
- Overall duration gap−0.25 yrsWithin
- AED duration gap−0.4 yrsWithin
Risks
- MR-03.1Credit spread widening6 · Low
Controls
- C-041Credit quality limitsEffective
Indicators
- Sub-investment grade assets1.6%Within
Actions
- ACT-045 · due 15 Oct 2026Decide hold or sell on Tarn Capital (BB+)Chief Financial OfficerOpen
Risks
- MR-05.1Liquidity squeeze after a major loss8 · Medium
Controls
- C-047Liquidity stress testingEffective
- C-048Letter of credit facilityEffective
Indicators
- Liquid assets / 1-in-200 cash need185%Within
Policy · Overarching
Risk management policy
The overarching policy: how risks are identified, assessed, owned, reported and kept within the board's appetite.
- Owner
- Chief Risk Officer
- Approved by
- Board
- Version
- 4.0 · reviewed 10 Sep 2026
- Next review
- 30 Sep 2027
Review current
KRIs: 1 approaching, 1 within
Principles · open one to see what it links to
Risks
- OR-05.4Inaccurate risk and board MI4 · Low
Controls
- C-136Risk report reviewEffective
- C-135MI data lineageEffective
Indicators
- Key controls fully effective84%Approaching
Risks
- SR-06.1Ineffective board oversight4 · Low
Controls
- C-097Board effectiveness reviewEffective
- C-098Committee terms of referenceEffective
Indicators
- Solvency coverage ratio152%Within
Risks
- IR-02.3Climate litigation6 · Low
- OR-08.2Uncontrolled AI in underwriting and claims9 · Medium
Controls
- C-018Emerging risk monitoringEffective
- C-153AI use policy and registerEffective
Policy · Underwriting & claims
Reserving policy
Sets how reserves are estimated, reviewed and signed off.
- Owner
- Chief Actuary
- Approved by
- Audit committee
- Version
- 4.0 · reviewed 19 Feb 2026
- Next review
- 28 Feb 2027
Review current
KRIs: 1 approaching
Principles · open one to see what it links to
Risks
- IR-02.1Long-tail casualty reserve inadequacy12 · Medium
Controls
- C-013Quarterly reserving committeeEffective
- C-014Independent actuarial reviewPartial
Indicators
- Casualty actual vs expected claims7%Approaching
Risks
- IR-02.2Reserving data quality6 · Low
- OR-06.2Fronting partner claims handling failure16 · High
Controls
- C-016Reserving data reconciliationEffective
- C-140Quarterly claims file auditsPartial
Actions
- ACT-029 · due 31 Oct 2026Agree claims service levels with the UAE fronting partner (INC-028)Head of ClaimsOpen
Risks
- IR-01.3Social inflation in US casualty12 · Medium
- IR-02.3Climate litigation6 · Low
Controls
- C-005Claims trends fed into pricingEffective
- C-018Emerging risk monitoringEffective
Policy · Capital & finance
Reinsurance & counterparty policy
Sets how outwards reinsurance is bought and which counterparties we accept.
- Owner
- Head of Reinsurance
- Approved by
- Risk & capital committee
- Version
- 3.0 · reviewed 20 May 2026
- Next review
- 31 May 2027
Review current
KRIs: 2 within
Principles · open one to see what it links to
Risks
- CR-01.2Reinsurance programme gaps8 · Medium
- IR-03.1Natural catastrophe accumulation8 · Medium
Controls
- C-054Programme modellingEffective
- C-053Contract certainty checksEffective
Indicators
- 1-in-200 net cat loss / capital24%Within
Risks
- CR-01.1Reinsurer default4 · Low
- CR-03.1Fronting partner insolvency8 · Medium
Controls
- C-051Minimum security ratingEffective
- C-052Counterparty limitsEffective
- C-065Fronting partner financial monitoringEffective
Indicators
- Recoverables from reinsurers below A-3%Within
Risks
- SR-04.1Intra-group reinsurance not at arm's length6 · Low
Controls
- C-091Independent pricing reviewEffective
- C-092Board approval of intra-group contractsEffective
Policy · Capital & finance
Capital management policy
Sets the capital we hold and how the capital model is governed.
- Owner
- Chief Financial Officer
- Approved by
- Risk & capital committee
- Version
- 3.1 · reviewed 12 Mar 2026
- Next review
- 31 Mar 2027
Review current
KRIs: 1 within, 1 approaching
Principles · open one to see what it links to
Risks
- SR-03.1Insufficient capital for the plan8 · Medium
Controls
- C-085Solvency monitoringEffective
- C-086Capital contingency planEffective
Indicators
- Solvency coverage ratio152%Within
- Coverage after 1-in-10 year loss128%Approaching
Risks
- SR-03.3Internal model misstates capital8 · Medium
Controls
- C-089Independent model validationEffective
- C-090Model change governanceEffective
Policy · Operations
Information security policy
Sets how systems and data are protected.
- Owner
- Chief Information Security Officer
- Approved by
- Operational resilience & IT
- Version
- 6.0 · reviewed 9 Jul 2026
- Next review
- 31 Jul 2027
Review current
KRIs: 1 within
Principles · open one to see what it links to
Risks
- OR-02.1Ransomware attack8 · Medium
Controls
- C-109Endpoint detection and responseEffective
- C-110Immutable backupsEffective
Indicators
- Critical vulnerabilities unpatched over 30 days1Within
Risks
- OR-02.3Privileged access misuse3 · Low
Controls
- C-113Privileged access managementEffective
- C-114Quarterly access recertificationEffective
Risks
- OR-02.2Third-party data breach6 · Low
Controls
- C-111Supplier security assessmentsEffective
Policy · Conduct & compliance
Financial crime & sanctions policy
Sets how we prevent sanctions breaches, bribery and money laundering.
- Owner
- Money Laundering Reporting Officer
- Approved by
- Board
- Version
- 5.1 · reviewed 13 Aug 2026
- Next review
- 31 Aug 2027
Review current
KRIs: 1 within
Principles · open one to see what it links to
Risks
- OR-07.1Sanctions breach8 · Medium
Controls
- C-147Sanctions screeningEffective
- C-148Sanctions clauses on all policiesEffective
Indicators
- Sanctions alerts open over 5 days0Within
Actions
- ACT-026 · due 10 Oct 2026Re-review sanctions alerts cleared without evidence (INC-026)Money Laundering Reporting OfficerOpen
Risks
- OR-07.2Bribery and corruption4 · Low
Controls
- C-149Gifts and hospitality registerEffective
- C-150Third-party due diligenceEffective
Policy · Conduct & compliance
Conduct & product governance policy
Sets how products are designed and reviewed so customers get good outcomes.
- Owner
- Head of Compliance
- Approved by
- Executive committee
- Version
- 3.0 · reviewed 4 Jun 2026
- Next review
- 30 Jun 2027
Review current
KRIs: 1 approaching
Principles · open one to see what it links to
Risks
- OR-09.2Products not delivering fair value4 · Low
Controls
- C-157Annual fair value assessmentsEffective
- C-158Product approval processEffective
Risks
- OR-09.1Poor customer outcomes6 · Low
Controls
- C-155Consumer Duty MIEffective
- C-156Complaints root cause analysisEffective
Indicators
- Complaints upheld22%Approaching
What it tells us
What it tells us this quarter
- 30 Sep
The delegated authority policy was due for review on 30 September 2026, and that review is overdue.
- 5 of 12
That policy carries 5 of the 12 open actions in the log, and 2 of the 3 overdue ones.
- 1
Its principle 3, to audit every coverholder once a year, holds the policy's one failed control: coverholder audits.
What we did
What we did about it
From Halden's action log.
- ACT-050
Refresh the delegated authority policy for the 2027 plan
- Owner
- Head of Delegated Authority
- Policy (approved by)
- Delegated authority · Underwriting committee
- Due
- 31 Oct 2026
- ACT-033
Move Ridgeway Underwriting onto the current wording
- Owner
- Head of Delegated Authority
- Policy (approved by)
- Delegated authority · Underwriting committee
- Due
- 30 Sep 2026 ⚠ overdue
- ACT-031
Exit plan for the UAE fronting partner
- Owner
- Chief Operating Officer
- Policy (approved by)
- Outsourcing & third-party · Executive committee
- Due
- 30 Sep 2026 ⚠ overdue
Actions are listed under the policy they sit in. The action log does not record a deciding committee.
Sources
Where the numbers come from
Owners, versions, review dates and approving committees come from the policy log. Each principle links to the same risk, control, KRI and action records the other reports use.
- Board datapolicy register, control library, risk appetite KRIs and action log at 30 Sep 2026
Follow the data
Related reports
One email a month: "This month at Halden". Email address only.
Halden is fictitious. Its numbers are illustrative.