LibraryRisk Management FrameworkPolicies
Break each policy into principles you can test
Each principle has an owner, a test, and the controls that show it is met.
A policy is a set of principles
Each principle is a short commitment with an owner and a test, so the board can see whether it holds all year.
- A commitment you can test. Each principle says what the business promises, with one sentence of what good looks like that an auditor could check.
- An owner who runs it. Each principle belongs to the person who runs that part of the business, not to one owner for the whole document.
- Attestation that means something. The owner signs off against evidence the board can see all year, not once a year against a document.
"Every payment has two authorisers" can be checked. "Payments are handled properly" cannot.
- 1Your policiesThe documents the business keeps today
- 2PrinciplesEach commitment drawn out, with an owner and a test
- 3Evidence from the workThe controls the business already runs show each principle is met
Examples
Four example policies, opened into principles
Examples for a Lloyd's managing agent. Select a policy to see its principles.
- The principles are already there. Most policies are built around a set of principles.
- They get lost in the words. Background, definitions and process wrap around them, so nobody can say which lines the business must keep.
- We draw them out. Each example shows the principles, their owners and what good looks like.
POL-01
Underwriting policySets how risks are priced, written and kept inside the plan.Principles · 6 principles
POL-02
Claims policySets how claims are reserved, settled, paid and recovered.Principles · 7 principles
POL-03
Financial crime policySets how the firm prevents money laundering, terrorist financing, sanctions breaches, bribery, fraud, the facilitation of tax evasion and insider dealing.Principles · 6 principles
POL-04
Risk management policySets how the firm sets appetite, and owns, watches and reports its risks.Principles · 7 principles
Write a principle once, use it many times
One principle, one owner, one test.
- Written three times, it drifts three ways. Written once, a question about claims data gets one answer.
PR-06Claims data is complete and checked before use
Releasing soon
The board report
We are finishing the policies report for Halden, our fictitious Lloyd's managing agent. It will show the board each policy's principles, owners and review dates.
Follow Halden to hear when it is out.
Not ready to talk?
One email a month, plus an alert for each new report.
Check your inbox and confirm to start following Halden.You're following Halden.
The first "This month at Halden" arrives on the first Tuesday of the month.
PR-01
Every risk is written inside a signed authority
What good looks like
Each underwriter writes only within a signed authority, reviewed each year, and every breach is logged and escalated.
Owner
Chief Underwriting Officer
Also in
PR-02
Prices cover claims, costs and capital
What good looks like
Every risk has a technical price recorded before it is bound, and any risk written below it is signed off by a named senior underwriter.
Owner
Head of Pricing
Also in
PR-03
Large risks get a peer review first
What good looks like
Every risk above the referral limit is peer reviewed, and the review is recorded before the risk is bound.
Owner
Chief Underwriting Officer
Also in
PR-04
The portfolio stays inside its aggregate limits
What good looks like
Catastrophe and class aggregates are checked against appetite each month, and any breach goes to the underwriting committee.
Owner
Head of Exposure Management
Also in
PR-05
Wordings cover only what is intended
What good looks like
Every risk is written on an approved wording, and every non-standard wording is approved before the risk is bound.
Owner
Head of Product
Also in
PR-06
Claims data is complete and checked before use
What good looks like
Claims data is reconciled to the claims system and checked for gaps before it is used in pricing, reserving or reporting.
Owner
Head of Claims
Also in
PR-07
Every claim is settled inside a written authority
What good looks like
Each handler and claims administrator settles only within a written authority, and payments above it get a second sign-off.
Owner
Head of Claims
Also in
PR-08
Case reserves are set promptly and kept accurate
What good looks like
Each case reserve is set within the time the claims policy allows, and reviewed within the agreed time of new information arriving.
Owner
Head of Claims
Also in
PR-09
Large claims reach the large loss group early
What good looks like
Every claim expected to pass the large loss threshold is reported to the large loss claims group within the agreed time.
Owner
Head of Claims
Also in
PR-10
Claims are paid to the right party
What good looks like
Every payee's bank details are confirmed independently before the first payment is made.
Owner
Chief Financial Officer
Also in
PR-11
Customers get a fair claims outcome
What good looks like
Every declined or part-paid claim gets a clear written reason, and a sample is reviewed each quarter for fair outcomes.
Owner
Head of Compliance
Also in
PR-12
Reinsurance recoveries are collected in full
What good looks like
Every claim that reaches a reinsurance programme is notified to reinsurers, and the recovery is tracked until it is paid.
Owner
Head of Reinsurance
Also in
PR-13
Intermediaries pass anti-bribery checks before they act
What good looks like
Every intermediary acting for the firm passes anti-bribery due diligence before it acts, and is checked again each year.
Owner
Head of Compliance
Also in
PR-14
Every party is screened for sanctions
What good looks like
Every insured is screened against sanctions lists before cover is bound, and every claimant and payee before any payment is made.
Owner
Money Laundering Reporting Officer
Also in
PR-15
Money laundering and terrorist financing are spotted and reported
What good looks like
Every suspicion raised is logged by the Money Laundering Reporting Officer, with a recorded decision on whether to report it to the National Crime Agency.
Owner
Money Laundering Reporting Officer
Also in
PR-16
Fraud is caught before money leaves the firm
What good looks like
No payment is released until it has passed fraud checks and been approved by someone other than the person who set it up.
Owner
Chief Financial Officer
Also in
PR-17
No one acting for us helps anyone evade tax
What good looks like
Every partner acting for the firm is assessed for the risk that it facilitates tax evasion, and the assessment is reviewed each year.
Owner
Chief Financial Officer
Also in
PR-18
Inside information from the work is never traded on
What good looks like
Every personal trade by staff in a watch-listed company, such as a listed insured, broker or the parent group, is cleared by compliance before it is made.
Owner
Head of Compliance
Also in
PR-19
The board sets appetite, and each class carries it
What good looks like
Each class has limits in the business plan that add up to the appetite the board approves each year.
Owner
Chief Risk Officer
Also in
PR-20
Every risk has an owner in the business
What good looks like
Every risk on the register has a named owner in the business, who reviews it each quarter.
Owner
Chief Risk Officer
Also in
PR-21
Appetite breaches are escalated with an action
What good looks like
Every breach of an appetite limit reaches the executive risk committee, with an agreed action and an owner.
Owner
Chief Risk Officer
Also in
PR-22
Emerging risks are tracked like any other risk
What good looks like
Each emerging risk has an owner, indicators and a review date, and the executive risk committee reviews them each quarter.
Owner
Chief Risk Officer
Also in
PR-23
Capital stays above appetite after a bad year
What good looks like
Solvency coverage is tested against a 1-in-10 year loss each quarter, and stays above the level the board set.
Owner
Chief Financial Officer
Also in
PR-24
The board sees risk in the business reports
What good looks like
Board risk reporting runs on the business's own plan, performance and capital figures each quarter.
Owner
Chief Risk Officer
Also in
This is a template for a Lloyd's managing agent. The policies, principles and owners are examples to adapt, not a recommended set.