Resolution SBS No. 37-2008: Regulation on Integrated Risk Management

1
Lima, January 10, 2008
S.B.S. Resolution
No. 37-2008
The Superintendent of Banking, Insurance and
Private Pension Fund Administrators:
CONSIDERING:
That, paragraph 2 of Article 134 of the General Law of the Financial System and the Insurance System and the Organic Law of the Superintendence of Banking and Insurance, Law No. 26702 and its amendments, hereinafter General Law, provides as a means of protection for savers, to supervise that companies in the financial system are properly organized, as well as managed by qualified personnel; That, the International Association of Insurance Supervisors – IAIS – provides in Basic Insurance Principle 18 “Risk Assessment and Management” that the supervisory authority requires insurers to recognize the range of risks they face and to evaluate and manage them effectively; That, pursuant to paragraph e) of Article 57 of the Single Text of the Law on the Private Administration of Pension Funds, approved by Supreme Decree No. 054-97-EF, it is the attribute and obligation of the Superintendence to audit AFPs in compliance with the legal provisions and administrative directives governing them, which is why it is convenient to include them within the scope of application of Integrated Risk Management; That, in accordance with Article 290 of the General Law, it is a requirement for the expansion of operations of companies in the financial system, to have adequate internal controls for new operations; That, it is the objective of this Superintendence to promote that supervised companies have an Integrated Risk Management appropriate to their size and the complexity of their operations and services; That, said Integrated Risk Management must be designed to have an appropriate internal environment, develop adequate determination of objectives, implement timely identification, evaluation, treatment and control of risks, as well as prepare relevant reports and carry out adequate monitoring; That, it is necessary to review the criteria provided for in the Regulation of the Internal Control System in order to make it compatible with international best practices for the development of an Integrated Risk Management, taking as reference, among other documents, the Integrated Framework for Corporate Risk Management, published by the

2
Committee of Sponsoring Organizations of the Treadway Commission (COSO); and to extend it to the set of supervised companies under a single reference framework; Being in accordance with the opinion of the Adjunct Superintendencies of Banking and Microfinance, Insurance, Private Pension Fund Administrators, Risks, Legal Advice, as well as the Economic Studies Management; and, In exercise of the powers conferred by paragraph 7 of Article 349 of the General Law; RESOLVES:
Article First.- Approve the Regulation on Integrated Risk Management, which forms part of this Resolution.
Article Second.- This Resolution enters into force from the day following its publication in the Official Newspaper El Peruano, granting for its compliance an adaptation period until December 31, 2008, from which date Resolution SBS No. 1040-99, as well as all those provisions that oppose it in total or in part, will be void.
Article Third.- Incorporate Procedure No. 110 “Special Authorizations on Integrated Risk Management” of the Single Text of Administrative Procedures – TUPA of the Superintendence of Banking, Insurance and AFP approved by Resolution SBS No. 131-2002, according to the text attached to this Resolution.
Register, communicate and publish,
FELIPE TAM FOX
Superintendent of Banking, Insurance and
Private Pension Fund Administrators

3
REGULATION OF THE
INTEGRATED RISK MANAGEMENT
CHAPTER I
GENERAL PROVISIONS
Article 1st.- Scope 1
This Regulation shall apply to the companies indicated in Articles 16 and 17 of the General Law, hereinafter companies.
It shall also apply to Private Pension Fund Administrators (AFP), Municipal Savings and Credit Caisses (CMAC), the Popular Credit Municipal Caisses, the Guarantee Fund for Small Industry Loans (FOGAPI), the National Bank, the Agricultural Bank, the Development Financial Corporation (COFIDE), the MIVIVIENDA S.A. Fund, the Benefit Distributions and Caisses under the control of the Superintendence, the Peruvian Federation of Municipal Savings and Credit Caisses (FEPCMAC) and the Fund of Municipal Savings and Credit Caisses (FOCMAC), insofar as they do not conflict with the specific regulations governing the action of these companies.
Article 2nd.- Definitions
For the application of this Standard, the following definitions shall be considered:
a) Risk Appetite.- The level of risk that the company is willing to assume in its search for profitability and value. b) Head Office.- Refers to the main company or the one that exercises control in a financial or mixed conglomerate. c) Internal Control.- A process, carried out by the Board of Directors, Management and staff, designed to provide reasonable assurance in achieving objectives related to the effectiveness and efficiency of operations, reliability of financial information, and compliance with applicable laws and regulations. d) Board of Directors.- Any reference to the Board of Directors shall be understood to also refer to any equivalent body. e) Independent Director 2 .- Is one who is selected for his professional prestige and who is not linked to the management of the company, to the economic group of the same, nor to the main shareholders of the company. The link is defined in the Special Standards on link and economic group, approved by Resolution SBS No. 445-
2000. The main shareholders are those natural or legal persons who have ownership of five percent (5%) or more of the shares of the company.
The independent director of a company may be an independent director of other companies in its economic group. f) Event.- An event or series of events that can be internal or external to the company, originating from the same cause, that occur during the same period of time. g) Impact.- The consequence or consequences of an event, expressed either in qualitative or quantitative terms. It is usually expressed in monetary terms, as financial losses. It is also called severity.

1 Article substituted by Resolution SBS No. 6422-2015 of 28/10/2015 2 Literal modified by Resolution SBS No. 3281-2010 of 19/04/2010.

4 h) Risk management manuals.- Documents containing the functions, responsibilities, policies, methodologies and procedures established for the identification, evaluation, treatment, control, reporting and monitoring of the company's risks. i) Organization and functions manuals.- Documents that detail the organic structure of the company, the objectives and functions of its units, as well as the obligations and responsibilities of its staff. j) Policies and procedures manuals.- Documents containing functions, responsibilities, policies, methodologies and procedures established by the company for the performance of the activities of each of the units it has, including those corresponding to risk management. k) Probability.- The possibility of the occurrence of an event which is usually approximated by a statistical distribution. In the absence of sufficient information, or where it is not possible to obtain it, it can be approximated by qualitative methods. l) Process.- Set of organized and repeatable activities, tasks and procedures that produce an expected result. m) Risk.- The condition in which there is the possibility that an event occurs and negatively impacts the objectives of the company. n) Reasonable Security.- Refers to the level of security that a company can have in achieving its objectives, considering that it is always possible that deviations or significant financial impacts occur that are not prevented or detected, given the inherent uncertainty of the future. ñ) Outsourcing.- Management modality by which a company hires a third party to develop a process that could be performed by the contracting company. o) Superintendence.- Superintendence of Banking, Insurance and Private Pension Fund Administrators. p) Risk Tolerance.- The level of variation that the company is willing to assume in case of deviation from the established business objectives. r) Compliance Policy and Procedures: Document approved by the Board of Directors in which the company's compliance function is established. 3 s) New Product: Product launched for the first time by the company. In this standard, a “new product” is also considered when a change is made to an existing product that modifies its risk profile. 4 t) Product: Goods and/or services provided by companies to their clients and users. 5
CHAPTER II
INTEGRATED RISK MANAGEMENT
Article 3rd.- Integrated Risk Management
Integrated Risk Management is a process, carried out by the Board of Directors, Management and staff applied throughout the company and in the definition of its strategy, designed to identify potential

3 Literal incorporated by Resolution SBS No. 8754-2011 of 03-08-2011 with an adaptation period of 180 days from its entry into force.
4 Literal incorporated by Resolution SBS No. 7068-2012 of 26-09-2012 with an adaptation period of 180 days from its publication.
5 Literal incorporated by Resolution SBS No. 7068-2012 of 26-09-2012 with an adaptation period of 180 days from its publication.

5 events that may affect it, manage them according to their risk appetite and provide reasonable security in achieving their objectives.
Integrated Risk Management considers the following categories of objectives:
a) Strategy.- Are high-level objectives, linked to the corporate vision and mission. b) Operations.- Are objectives linked to the effective and efficient use of resources. c) Information.- Are objectives linked to the reliability of the information provided. d) Compliance.- Are objectives linked to compliance with applicable laws and regulations. Companies must carry out an integrated risk management appropriate to their size and the complexity of their operations and services.
Article 4th.- Components
Integrated Risk Management can be decomposed into components, which are present to varying degrees, depending on whether the entire company, a line of business, a process or an organizational unit is analyzed. The company may have its own decomposition, which adapts to its organization, but it must consider the main elements described below:
a) Internal Environment.- Which comprises, among others, ethical values, technical and moral suitability of its officials; the organizational structure; and the conditions for the assignment of authority and responsibilities. b) Establishment of objectives.- Process by which business objectives are determined, which must be aligned with the company's vision and mission, and be compatible with risk tolerance and the degree of accepted risk exposure. c) Risk Identification.- Process by which internal and external risks that may have a negative impact on the company's objectives are identified. Among other aspects, it considers the possible interdependence between events, as well as the influencing factors that determine them. d) Risk Evaluation.- Process by which the risk of a company, activity, set of activities, area, portfolio, product or service is evaluated; through qualitative, quantitative techniques or a combination of both. e) Treatment.- Process by which it is opted to accept the risk, decrease the probability of occurrence, decrease the impact, transfer it totally or partially, avoid it, or a combination of the above measures, according to the defined risk tolerance level. f) Control Activities.- Process that seeks to ensure that policies, standards, limits and procedures for risk treatment are appropriately taken and/or executed. Control activities are preferably incorporated into business processes and support activities. It includes general controls as well as those applied to information systems, as well as related information technology. They seek the effectiveness and efficiency of the company's operations, the reliability of financial or operational, internal and external information, as well as compliance with the legal provisions applicable to it. g) Information and communication.- Process by which appropriate and timely information is generated and transmitted to management, management, staff, as well as external stakeholders such as customers, suppliers, shareholders and regulators, among them this Superintendence. This information is internal and external, and may include management, financial and operational information. h) Monitoring.- Process consisting of the evaluation of the proper functioning of Integrated Risk Management and the implementation of the modifications that are required. Monitoring must be carried out in the normal course of the company's activities, and

6 complemented by independent evaluations or a combination of both. It includes the reporting of deficiencies found and their correction.
Article 5th.- Types of risks
Risks can arise from various sources, internal or external, and can be grouped into various categories or types. Some risks may be associated with a particular activity, such as the investment process, which is exposed to credit, market, operational risks, among others. Below is a non-exhaustive list of the various types of risks to which a company is exposed:
a) Credit Risk 6
The possibility of losses due to the inability or lack of willingness of debtors, counterparties, or obligated third parties, to fulfill their contractual obligations registered inside or outside the balance sheet. b) Strategic Risk The possibility of losses due to high-level decisions associated with the creation of sustainable competitive advantages. It is related to failures or weaknesses in market analysis, trends and uncertainty of the environment, key competencies of the company and in the process of generation and innovation of value. c) Liquidity Risk The possibility of losses by failing to meet financing requirements and fund application arising from cash flow mismatches, as well as by not being able to quickly close open positions, in sufficient quantity and at a reasonable price. d) Market Risk The possibility of losses in positions inside and outside the balance sheet derived from fluctuations in market prices. e) Operational Risk The possibility of losses due to inadequate processes, personnel failures, information technology, or external events. This definition includes legal risk, but excludes strategic and reputational risk. f) Technical Risk 7 The possibility of losses or adverse modification of the value of commitments undertaken under insurance, reinsurance and co-insurance contracts. In the case of non-life insurance, fluctuations related to the frequency, severity, and settlement of claims are considered. For the case of life insurance, this may include the possibility of losses due to variations in the level, trend or volatility of mortality, longevity, disability, morbidity, renewal or surrender rates of insurance contracts, among other parameters and assumptions, as well as the execution expenses of said obligations. g) Reputational Risk The possibility of losses due to the decrease in confidence in the integrity of the institution that arises when the good name of the company is affected. Reputational risk can arise from other risks inherent in the activities of an organization.

6 Literal modified by Resolution SBS No. 3780-2011 of 31/03/2011.
7 Literal modified by Resolution SBS No. 3863-2016 of 13/07/2016.

7
Article 6th.- Questionable Practices
The company shall establish appropriate internal systems that facilitate the timely reporting and investigation of illegal, fraudulent activities, identified by any worker of the company or by any person who interacts with it. Such activities shall be reported to the internal audit unit, for which the company will implement procedures that allow maintaining the confidentiality of the whistleblower. In the event that the facts are significant, the internal audit unit must inform the Audit Committee and the Superintendence.
Article 7th.- Relationship of Integrated Risk Management and Internal Control
Integrated Risk Management includes internal control of which it is an integral part. Integrated Risk Management expands and develops the concepts of internal control in a broader and more solid way, with greater emphasis on risk.
The reliability objective of financial information of internal control is mainly referred to the reliability of financial statements. In Integrated Risk Management, this objective is expanded to include all reports and reports generated by companies, both internal and external. Among them those used by Management and Senior Management, those sent to third parties, information delivered to regulators, as well as to shareholders and other stakeholder groups. The scope also incorporates non-financial information. According to what is indicated in Article 3, a new category of objectives referred to strategy, and the categories of objectives referred to operations, information and compliance must be aligned to the strategy. Integrated Risk Management is also applied in the selection of objectives.
Article 7-A.- Compliance Function 8
The compliance function has as its objective to ensure the proper compliance of the regulations applicable to the company, both internal and external.
Companies will determine the most appropriate and efficient way to implement the monitoring and evaluation of the compliance function according to their own needs and internal organization, ensuring that this function has sufficient assigned resources to perform an effective job. This does not necessarily imply the formation of an organizational unit but rather the appointment of a person in charge of this job, who must have managerial level to be designated by the Board of Directors of the company, from whom he will depend, and will report directly to him. The Superintendence may require that organizational units dedicated exclusively to the compliance function be constituted in companies, taking into account their size and the complexity of their activities. The persons in charge of carrying out the compliance function must be independent with respect to the activities of the business units and have solid knowledge of the regulations applicable to the company as well as its impact on its operations.

8 Article incorporated by Resolution SBS No. 8754-2011 of 03-08-2011, with an adaptation period of 180 days from its entry into force.

8
Responsibilities of the compliance function
The main responsibilities of the compliance function are:
a) Advise the Board of Directors on the effective management of compliance with regulations applicable to the company. b) Inform continuously and timely to the Board of Directors and Senior Management regarding the actions necessary for good regulatory compliance and existing gaps, as well as the main changes in the regulatory environment that may have an impact on the company's operations. c) Monitor regulatory compliance applicable to the entity. d) Report semi-annually to the Board of Directors and Senior Management on the progress of the implementation of regulatory adaptation measures. e) Orient company staff regarding the importance of regulatory compliance, and the responsibilities that arise in case of non-compliance. f) Ensure the existence of procedures and controls to guarantee that staff comply with adopted decisions and assigned functions. g) Provide reasonable security to the Board of Directors and Senior Management that policies and procedures related to regulatory compliance achieve that the company meets regulatory requirements. h) Propose for approval by the Board of Directors before December 31 of each year, an annual compliance program that exposes the planned activities and their implementation and recommendations; said program must be available to this Superintendence i) Propose to the Board of Directors corrective measures in case of failures in the application of the Compliance Function. The Board of Directors of the company must approve the Compliance Policy and Procedures, which will consist of a formal document in which a permanent and effective compliance function is established in the company. This document must contain the basic principles to be followed by Senior Management and staff and explain the main processes that will allow preventing, identifying and mitigating regulatory non-compliance at all levels of the organization. Relationship of the compliance function with the anti-money laundering and terrorist financing prevention function as well as with the user attention system function The compliance function incorporates the evaluation and monitoring of compliance with all regulations applicable to the supervised company. However, the evaluation and monitoring of what is provided for in matters of anti-money laundering and terrorist financing prevention as well as the user attention system will be the responsibility of the Compliance Officer and the User Attention Officer, respectively, who must be different from the person in charge of the compliance function. Compliance function implemented at the corporate level The compliance function can be implemented at the corporate level, which must be previously evaluated by the company taking into account for this the compatibility with what is stipulated in the Complementary Standards for the Prevention of Money Laundering and Terrorist Financing as well as the Regulation of Transparency of Information and Provisions applicable to contracting with users of the
Financial System, issued by this Superintendence. The development of the compliance function at the corporate level shall

9 must be communicated to this regulatory body. In accordance with the aforementioned complementary rules on anti-money laundering and counter-terrorism financing, the Corporate Anti-Money Laundering Compliance Officer must have exclusive dedication, being prohibited from assuming the functions of the Corporate Regulatory Compliance Officer.

Internal Audit Unit
The activities carried out within the framework of the regulatory compliance function shall be subject to periodic review by the Internal Audit Unit, which shall not be subject to monitoring and evaluation by those in charge of the regulatory compliance function.

CHAPTER III
THE BOARD OF DIRECTORS AND MANAGEMENT

Article 8th.- Responsibility of the Board of Directors
The Board of Directors is responsible for establishing an integrated risk management system and for fostering an internal environment that facilitates its proper development. Among its specific responsibilities are:
a) Approve the general policies that guide the company's activities in the management of the various risks it faces. b) Select a management team with technical and moral suitability, who act prudently and appropriately in the development of their business and operations, as well as in the fulfillment of their responsibilities. c) Approve the resources necessary for the proper development of Integrated Risk Management, in order to have the appropriate infrastructure, methodology, and personnel. d) Establish an incentive system that promotes the proper functioning of an integrated risk management system and that does not favor the inappropriate taking of risks. e) Approve the organization and function manuals, policy and procedure manuals, and other company manuals. f) Approve general policies for the responsibilities under the company's charge, including:
f.1 The prudent administration, according to established agreements or applicable regulation, of assets held in deposit and custody, administered or invested on behalf of clients and third parties, avoiding conflicts of interest. f.2 Reasonably ensure that investment councils or similar bodies within its scope are presented with appropriate information, taking into account the client's risk tolerance and return expectations. g) Establish corporate objectives, evaluate and approve their business plans with due consideration of the associated risks. h) Know the main risks faced by the entity, establishing, when possible, adequate levels of tolerance and appetite for risk. i) Establish an adequate system of delegation of powers and segregation of functions throughout the organization. j) Reasonably ensure that the company's accounting equity is sufficient to face the risks to which it is exposed, for which it must know the capital needs and establish management policies that support the company's needs, complying with regulatory requirements appropriately. k) Obtain reasonable assurance that the company has an effective management of the risks to which it is exposed, and that the main risks are under control within the limits that have been established.

10 l) Ensure the proper performance of the regulatory compliance function, approve the company's Regulatory Compliance Policy and Procedures, and establish the mechanisms for periodic reporting of said function.

9
Article 9th.- Board of Directors Compliance Declaration
The Board of Directors is responsible for evaluating the proper functioning of the criteria defined in this regulation. Annually, the Board of Directors will sign a Compliance Declaration, which will contain at least the following, which the Superintendence may define additional minimum criteria by means of a general application multiple office:
a) That the Board of Directors knows the standards provided for in this regulation, as well as its responsibilities. b) That the company has an appropriate risk management for the complexity and size of the company, as well as the criteria indicated in this regulation, with the exception of possible deficiencies identified and communicated in the declaration. c) That the Board of Directors has taken note of the information from Management, from the reports of the Audit Committee, the Risk Committee, External Audit, and other information that the Board of Directors considers relevant, and that the corrective measures ordered are recorded in the corresponding minutes. This declaration will be signed within a period that will not exceed one hundred twenty (120) calendar days after the annual exercise, and must be available to this Superintendence.

Article 10th.- Responsibility of Management
The General Management is responsible for implementing Integrated Risk Management in accordance with the provisions of the Board of Directors, in addition to the responsibilities given by other regulations.
Management may constitute committees to fulfill its responsibilities.
The managers of the business or support organizational units, within their scope of action, are responsible for managing the risks related to the achievement of their units' objectives.
Among their specific responsibilities are:
a) Ensure consistency between operations and the defined risk tolerance levels applicable to their scope of action. b) Assume, before the immediate superior manager, the results of the risk management corresponding to their unit; and so on until reaching the general manager who has this responsibility before the Board of Directors.

CHAPTER IV
THE BOARD OF DIRECTORS' COMMITTEES

Article 11th.- Committees
The Board of Directors may constitute the committees it deems necessary in order to comply with the provisions contained in this regulation and the responsibilities indicated in Article 8° cited above.

9 Literal incorporated by SBS Resolution No. 8754-2011 of 03-08-2011 with an adaptation period of 180 days from its effective date.

11
For the case of multiple operation companies and insurance companies referred to in Article 16° of the General Law, as well as for AFPs, the constitution of an audit committee and a risk committee will be mandatory. In the case of those companies that are not obliged to constitute the committees and that, furthermore, decide not to do so, all functions attributed to the non-constituted committee(s) will be assumed by the Board of Directors.

Article 12°.- Regulations of the Committees
The Committees constituted by the Board of Directors must have a Regulation that will contain the policies and procedures necessary for the fulfillment of their functions. This regulation will establish, among other aspects, the criteria to avoid conflicts of interest, incompatibility of functions, the periodicity of their meetings, their scheduled activities, the information that must be sent, as well as the way in which it will report to the Board of Directors. The agreements adopted in the meetings must be recorded in a Minute Book.

SUB-CHAPTER I
RISK COMMITTEE

Article 13º.- Composition of the risk committee
The risk committee must be composed of at least one member of the Board of Directors, and will be organized as an integral committee, which must cover the decisions concerning the significant risks to which the company is exposed. The members of the Risk Committee must have the necessary knowledge and experience to properly fulfill their functions. The Board of Directors may create specialized risk committees it deems necessary, due to the size and complexity of the company's operations and services.

Article 14°.- Functions of the risk committee
The risk committee, by delegation of the Board of Directors and within the limits it sets, may assume the following functions:
a) Approve the policies and organization for Integrated Risk Management, as well as the modifications made to them. b) Define the level of tolerance and the degree of risk exposure that the company is willing to assume in the development of business. c) Decide on the necessary actions for the implementation of corrective actions required, in case there are deviations with respect to the risk tolerance levels and the assumed degrees of exposure. d) Approve the taking of exposures that involve significant variations in the company's risk profile or of the assets administered under the responsibility of the company. e) Evaluate the sufficiency of the company's capital to face its risks and alert about possible insufficiencies. f) Propose improvements in Integrated Risk Management.

12
SUB-CHAPTER II
AUDIT COMMITTEE

Article 15º.- Composition of the audit committee
The audit committee must be composed of members of the Board of Directors who do not perform management activities in the company. This committee will have a minimum of three (3) members, at least one of them being renewed every three (3) years. The members of the audit committee must have the necessary knowledge and experience to properly fulfill their functions. For the case of multiple operation companies and insurance companies referred to in Article 16° of the General Law; as well as for AFPs; the audit committee must be composed of at least one independent director.

Article 16°.- Functions of the audit committee
The audit committee's main purpose is to supervise that accounting and financial reporting processes are appropriate, as well as to evaluate the activities carried out by internal and external auditors.
Among its main functions are:
a) Supervise the proper functioning of the internal control system; b) Inform the Board of Directors about the existence of limitations in the reliability of accounting and financial processes; c) Supervise and keep the Board of Directors informed about the compliance with internal policies and procedures and about the detection of internal control and administration problems, as well as the corrective measures implemented based on the evaluations carried out by the internal audit unit, external auditors, and this Superintendence; d) Define the criteria for the selection and hiring of external auditors, evaluate their performance, and determine the complementary reports they require for the better performance of their functions or the fulfillment of legal requirements, except in those cases in which the audit committee of the parent company assumes the functions of defining the criteria for the selection and hiring of external auditors, as well as the evaluation of their performance; and, e) Define the criteria for the selection and hiring of the internal auditor and its main collaborators, set their remuneration and evaluate their performance, as well as their monetary incentive regime, unless these functions are assumed by the audit committee of the parent company.

CHAPTER V
RISK UNIT

Article 17º.- Risk Unit
Integrated Risk Management requires that companies organize themselves according to their complexity and business lines in which they operate. In this sense, companies may have a centralized unit or specialized units in the management of specific risks, according to the nature of the operations and the structure of the company, provided that when taken together, they allow the implementation of the criteria provided for in this regulation.

The Superintendence may require the creation of an integrated risk unit in companies that it considers complex, and when it is observed in the exercise of supervision actions that the criteria provided for in the current regulation are not met.
Whenever it is not required by current regulation, when there is no specialized risk unit, and in the absence of delegation by the Board of Directors, it will be understood that these functions have been assigned to the General Management.
The members of the Risk Unit must possess the experience and knowledge that allow them to properly fulfill their functions, for which a training plan must be established that will be presented to the board of directors annually.

Article 18º.- Functions of the Risk Unit
The Risk Unit must participate in the design and permanent adaptation of risk management manuals and other internal norms that have the object of defining the responsibilities of the business units and their officials in the control of the company's risks. The Risk Unit is in charge of supporting and assisting the other units of the company to carry out good risk management in their areas of responsibility, and for this it must be independent of the business units. The main responsibilities of the risk unit are the following:
a) Propose the appropriate policies, procedures, and methodologies for Integrated Risk Management in the company, including roles and responsibilities; b) Ensure competent Integrated Risk Management, promoting the alignment of the company's risk treatment measures with the risk tolerance levels and the development of appropriate controls; c) Guide the integration between risk management, business plans, and corporate management activities; d) Establish a common risk management language based on the definitions of this regulation and other applicable regulations; e) Estimate the equity requirements that allow covering the risks the company faces, as well as regulatory requirements, if applicable. Furthermore, alert about possible insufficiencies of effective equity to cover identified risks; and, f) Inform the general management and the risk committee about the relevant aspects of risk management for timely decision-making. g) Inform the general management and the risk committee about the risks associated with new products and important changes in the business environment, operational environment, or computer environment, prior to their launch or execution; as well as about the proposed or implemented treatment measures.

10
Article 19º.- Head of the Risk Unit
The Head of the Risk Unit must have appropriate academic training and relevant experience, who must coordinate permanently with management, the risk committee, the audit committee,

10 Literal incorporated by SBS Resolution No. 7068-2012 of 26-09-2012 with an adaptation period of 180 days from its publication.

14 the specialized committees, the business and support units, as well as with this Superintendence, regarding the Integrated Risk Management carried out by the company.
In addition, he is responsible for informing the Board of Directors, respective committees, and the corresponding decision-making areas, about the risks, the degree of accepted risk exposure, and the management thereof, in accordance with the policies and procedures established by the company. The mentioned criteria are applicable to the heads of specialized risk units, in case there is no centralized unit. The Head of the Risk Unit, in case the Risk Unit is centralized, must have managerial level.

Article 20º.- Annual Risk Report
The Risk Unit must prepare an annual risk report at the end of each exercise, which must include the activity plan for the following exercise. The presentation of said report will be carried out within ninety (90) calendar days after the closing of each year.

11
Subsequently, by Multiple Office, the Superintendence may define the minimum structure of the annual risk report, partial reports by risk, periodic situation reports, as well as their presentation by electronic means.

CHAPTER VI
OUTSOURCING

Article 21º.- Outsourcing
Companies and persons whose responsibilities have been determined in this regulation and other norms, assume full responsibility for the results of processes outsourced to third parties, and may be sanctioned for non-compliance. Likewise, they must ensure that confidentiality and secrecy are maintained regarding the information that could be provided to them. In any significant outsourcing, a formal analysis of the associated risks must be carried out and brought to the knowledge of the Board of Directors for approval. Significant outsourcing will be understood as that which, in case of failure or suspension of the service, can put the company at significant risk, by affecting its income, solvency, or operational continuity. The outsourcing of one or more functions of risk management will be considered significant for the purposes of this regulation. Companies must ensure that in cases of significant outsourcing, the contracts signed with the corresponding providers include clauses that facilitate an adequate review of the respective service by the companies, by the Internal Audit Unit, by the External Audit Firm, as well as by the Superintendence or the person it designates.

11 Paragraph modified by SBS Resolution No. 3281-2010 of 19/04/2010.

15
In the case of significant outsourcing of the internal audit service, it will be subject to what is established in the Internal Audit Regulation.

CHAPTER VII
ROLE OF INTERNAL AND EXTERNAL AUDIT

Article 22º.- Internal Audit Unit
Internal Audit plays an independent role from management, which supervises the adequacy of Integrated Risk Management, and must be subject to the specific provisions that regulate its activity in the Internal Audit Regulation.

Article 23º.- External Auditors
External Audit is independent of the company and has as its main function the evaluation of the reliability of financial information, and must be subject to the specific provisions that regulate its activity in the External Audit Regulation.

FINAL AND TRANSITIONAL PROVISIONS

First.- Special Authorizations
In justified cases, the company may request from the Superintendence, specific exemption from some of the regulatory requirements indicated in this Regulation, attaching the corresponding supporting documentation regarding any of the following requirements insofar as it is appropriate for the due evaluation of this Superintendence:
a) The company has a management system that, taken as a whole, substantially meets the minimum criteria indicated in this regulation. b) When the organization receives various services from its parent company, from the company that exercises direct or indirect control, or from the one that has direct responsibility for the operation, provided that taken together they equal or exceed the criteria provided for in the Regulation. c) When due to legal limitation, it is impossible to comply with part of the regulation. d) When required for standardization and common language purposes with its parent company, or with the company that exercises direct or indirect control or the one that has direct responsibility for the operation, in order to take advantage of methodological advantages, such as demonstrated knowledge and experience in the design and implementation of risk management in accordance with good practices, infrastructure, and methods and procedures that demonstrate a clear knowledge and management of the risks to which they are exposed. The functions of the audit committee may be assumed by the Parent Company, with prior express authorization of the Superintendence. For this, companies must request authorization indicating the way in which the provisions established in this Regulation will be fulfilled, an obligation that remains while the authorization is in force.

12
The corresponding Authorization Resolutions will be published in the Official Newspaper El Peruano.

12 Paragraph modified by SBS Resolution No. 3281-2010 of 19/04/2010.

16
This Superintendence may suspend at any time the special authorizations referred to in this norm, when in the exercise of its supervisory function it observes that the circumstances merit it, that the company has failed to comply with the obligations provided for, or that the authorization granted has not contributed to an improvement in its risk management practice, which it will communicate to the company by means of an office.

Second.- Transparency
The company must reveal in its Annual Report, at least a general description of the main characteristics of Integrated Risk Management.

Third.- Deadline and Adaptation Plan
Within a period that will not exceed ninety (90) calendar days from the publication of this Regulation, companies must send to this Superintendence an adaptation plan to the provisions contained in this regulation.
This plan must include a preliminary diagnosis of the existing situation in the company, the actions foreseen for total adaptation and the schedule for them, as well as the officials responsible for the compliance with said plan.

Fourth.- Board of Directors Declaration
The first declaration referred to in Article 9° will be enforceable, for the exercise corresponding to 2008, which will be available to this Superintendence within the 120 calendar days of 2009.