Circular Letter of the Financial Services Authority of the Republic of Indonesia Number 1/SEOJK.05/2021 Concerning the Assessment of the Health Level of Insurance Companies, Sharia Insurance Companies, Reinsurance Companies, and Sharia Reinsurance Companies

To:

Board of Directors of Insurance Companies;
Board of Directors of Sharia Insurance Companies;
Board of Directors of Reinsurance Companies; and
Board of Directors of Sharia Reinsurance Companies,
in their respective places.

COPY

CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 1 /SEOJK.05/2021

CONCERNING
ASSESSMENT OF THE HEALTH LEVEL OF INSURANCE COMPANIES, SHARIA INSURANCE COMPANIES, REINSURANCE COMPANIES, AND SHARIA REINSURANCE COMPANIES

In relation to the mandate of Article 7 paragraph (5), Article 8 paragraph (8), Article 9 paragraph (8), Article 10 paragraph (8), Article 12 paragraph (6), and Article 17 paragraph (5) of the Financial Services Authority Regulation Number 28/POJK.05/2020 concerning the Assessment of the Health Level of Non-Bank Financial Service Institutions (State Gazette of the Republic of Indonesia Year 2020 Number 120, Additional State Gazette of the Republic of Indonesia Number 6504), it is necessary to further regulate regarding the assessment of the health level of insurance companies, Sharia insurance companies, reinsurance companies, Sharia reinsurance companies, and Sharia units of insurance and reinsurance companies in this Circular Letter of the Financial Services Authority as follows:

I. GENERAL PROVISIONS
In this Circular Letter of the Financial Services Authority, the following terms are defined:

Company means an insurance company, a Sharia insurance company, a reinsurance company, or a Sharia reinsurance company.
Insurance Company means a general insurance company and a life insurance company as referred to in Law Number 40 of 2014 concerning Insurance.
Sharia Insurance Company means a Sharia general insurance company and a Sharia life insurance company as referred to in Law Number 40 of 2014 concerning Insurance.
Reinsurance Company means a company that conducts reinsurance business services against risks faced by Insurance Companies, guarantee companies, or other Reinsurance Companies.
Sharia Reinsurance Company means a company that conducts risk management business based on Sharia principles over risks faced by Sharia Insurance Companies, Sharia guarantee companies, or other Sharia Reinsurance Companies.
Sharia Principle means Islamic legal principles in insurance activities based on fatwas issued by institutions having authority in setting fatwas in the Sharia field as referred to in Law Number 40 of 2014 concerning Insurance.
Sharia Unit means a work unit at the Head Office of an Insurance Company or Reinsurance Company that functions as the head office of offices outside the head office conducting business based on Sharia Principles.
General Meeting of Shareholders, hereinafter abbreviated as GMS, is the general meeting of shareholders as referred to in laws concerning limited liability companies for Companies formed as limited liability company legal entities or equivalent to GMS for Companies formed as cooperative or joint venture legal entities.
Board of Directors is the corporate organ authorized and fully responsible for managing the company for the benefit of the company, in accordance with the purpose and objectives of the company and representing the company, both inside and outside court, according to the articles of association provisions for Companies formed as limited liability company legal entities or equivalent to the Board of Directors for Companies formed as cooperative and joint venture legal entities.
Board of Commissioners is the corporate organ tasked with conducting general and/or specific supervision according to the articles of association and providing advice to the Board of Directors for Companies formed as limited liability company legal entities or equivalent to the Board of Commissioners for Companies formed as cooperative and joint venture legal entities.
Sharia Supervisory Board, hereinafter abbreviated as SSAB, is a board that has the task and function of supervision and provides advice to the Board of Directors regarding the implementation of Company activities to ensure compliance with Sharia Principles.
Company Health Level is the result of the assessment of the Company's condition conducted against good corporate governance, risk profile, profitability, and capital adequacy.
Composite Rating is the final rating resulting from the Company Health Level assessment.
Subsidiary Company is a company owned and/or controlled directly or indirectly by the Company, both domestically and internationally.
Control is an action aimed at influencing the management and/or policies of a company in any manner, whether directly or indirectly.

II. GENERAL PRINCIPLES OF COMPANY HEALTH LEVEL ASSESSMENT

General principles in conducting assessments of the Company Health Level are as follows:
a. risk-oriented; b. proportionality;
c. materiality and significance; and
d. comprehensive and structured.
What is meant by risk-oriented as referred to in item 1 letter a includes, among others:
a. the Company Health Level assessment is based on the Company's risks and the impact caused on the Company's overall performance; b. the Company Health Level assessment is conducted by identifying internal and external factors that can increase risk or affect the Company's financial performance currently and in the future; and
c. the Company is able to detect the root causes of problems, both internal and external, earlier and take preventive and corrective steps effectively and efficiently.
What is meant by proportionality as referred to in item 1 letter b includes, among others:
a. the use of parameters or indicators in each factor of the Company Health Level assessment is done by considering the characteristics and complexity of the Company's business; b. the parameters or indicators for assessing the Company Health Level in this Circular Letter of the Financial Services Authority are minimum standards that must be used in assessing the Company Health Level; and
c. in addition to the parameters or indicators as referred to in letter b, the Company may use additional parameters or indicators according to the characteristics and complexity of the business in assessing the Company Health Level so as to reflect the Company's condition more accurately.
What is meant by materiality and significance as referred to in item 1 letter c includes, among others:
a. the Company needs to consider the materiality and significance of the factors for assessing the Company Health Level, namely good corporate governance, risk profile, profitability, and capital adequacy, as well as the significance of parameters or indicators for assessment in each factor in concluding the assessment results and establishing factor ratings; and b. the determination of materiality and significance is based on analysis supported by adequate data and information regarding the Company's risks and financial performance.
What is meant by comprehensive and structured as referred to in item 1 letter d includes, among others:
a. the assessment process is conducted thoroughly and systematically and is focused on the main problems of the Company; b. the analysis is conducted in an integrated manner, i.e., by considering the interrelationships between risks and between factors of the Company Health Level assessment as well as consolidated Subsidiary Companies; and
c. the analysis must be supported by relevant facts and ratios to show the level, trends, and severity of problems faced by the Company.

III. PROCEDURE FOR INDIVIDUAL COMPANY HEALTH LEVEL ASSESSMENT

The Company is required to conduct the Company Health Level assessment using a risk-based approach individually.
An Insurance Company or Reinsurance Company that has a Sharia Unit is required to conduct a health level assessment for the Sharia Unit using an individual approach.
The individual health level assessment of the Sharia Unit as referred to in item 2 is an inseparable part of the Company Health Level assessment of the Insurance Company or Reinsurance Company that owns the Sharia Unit.
The individual Company Health Level assessment as referred to in item 1 is conducted with an assessment scope covering the following factors:
a. good corporate governance; b. risk profile;
c. profitability; and
d. capital adequacy.
The individual health level assessment of the Sharia Unit as referred to in item 3 covers assessment of the risk profile factor as referred to in item 4 letter b.

IV. ASSESSMENT OF THE GOOD CORPORATE GOVERNANCE FACTOR

The assessment of the good corporate governance factor is an assessment of the implementation of good corporate governance principles by the Company.
Good corporate governance principles refer to Financial Services Authority Regulations regarding good corporate governance for insurance companies and their implementing regulations, while still considering the characteristics and complexity of the Company's business.
The establishment of the good corporate governance factor rating is conducted based on analysis of:
a. the application of good corporate governance principles for the Company; b. the adequacy of governance over the structure, processes, and results of the application of good corporate governance for the Company; and
c. other information related to good corporate governance for the Company based on relevant data and information.
The Company assesses the good corporate governance factor using its own self-assessment worksheet as contained in Table I.A Appendix I which is an inseparable part of this Circular Letter of the Financial Services Authority.
The Company establishes the good corporate governance factor rating in 5 (five) ranks, namely:
a. rank 1; b. rank 2;
c. rank 3;
d. rank 4; and e. rank 5, with the order of good corporate governance factor ranks for the Company where a smaller rank reflects better application of good corporate governance for the Company.
The establishment of the good corporate governance factor rating for the Company is conducted according to Table I.B Appendix I which is an inseparable part of this Circular Letter of the Financial Services Authority.

V. ASSESSMENT OF THE RISK PROFILE FACTOR

A. General

The risk profile factor assessment is an assessment of:
a. inherent risk; and b. the quality of risk management implementation, in the Company's operations.
Risks assessed consist of 9 (nine) types of risks, namely:
a. strategic risk; b. operational risk;
c. insurance risk;
d. credit risk; e. market risk; f. liquidity risk; g. legal risk; h. compliance risk; and
i. reputation risk.
In assessing the risk profile, the Company considers the scope of risk management implementation as regulated in Financial Services Authority Regulations regarding risk management implementation for non-bank financial service institutions.

B. Assessment of Inherent Risk

Inherent risk assessment is an assessment of risks attached to the Company's business activities, both quantifiable and unquantifiable, that have the potential to affect the Company's financial position.
The characteristics of the Company's inherent risk are determined by internal and external factors, including:
a. business strategy; b. business characteristics;
c. Company complexity;
d. insurance industry conditions; and e. macroeconomic conditions.
The assessment of inherent risk is conducted by considering quantitative and qualitative parameters or indicators.
The establishment of the inherent risk level for each type of risk refers to the general principles of Company Health Level assessment as referred to in Roman numeral II.
The establishment of the inherent risk level for each type of risk is categorized into ranks as follows:
b. rank 2 (low-medium);
c. rank 3 (medium);
d. rank 4 (medium-high); and e. rank 5 (high).

C. Assessment of Inherent Risk for Strategic Risk

Strategic risk is the risk due to the Company's imprecision in making and/or executing strategic decisions and failure to anticipate changes in the business environment.
Sources of strategic risk can be caused by, among others:
a. the Company sets strategies that are less aligned with the Company's vision and mission; b. the Company conducts strategic environment analysis that is not comprehensive;
c. there is inconsistency in strategic plans across strategic levels; and
d. failure to anticipate changes in the business environment such as technological changes, macroeconomic condition changes, market competition, and changes in relevant authority policies.
In assessing inherent risk for strategic risk, the parameters or indicators used are at least:
a. alignment of business strategy with the Company's vision and mission as well as business environment conditions; b. choice of business strategy level, namely: high-risk strategy and low-risk strategy;
c. the Company's strategic position in the insurance industry; and
d. achievement of the Company's business realization.
The Company assesses inherent risk for strategic risk using inherent risk parameters or indicators as contained in Table II.A.1 Appendix II which is an inseparable part of this Circular Letter of the Financial Services Authority.
The Company establishes the inherent risk level for strategic risk in 5 (five) ranks, namely:
b. rank 2 (low-medium);
c. rank 3 (medium);
d. rank 4 (medium-high); and e. rank 5 (high), using guidelines as contained in Table II.A.2 Appendix II which is an inseparable part of this Circular Letter of the Financial Services Authority.

D. Assessment of Inherent Risk for Operational Risk

Operational risk is the risk due to inadequacy and/or malfunction of internal processes, human error, system failure, and/or external events affecting the Company's operations.
Sources of operational risk can be caused by, among others:
a. weakness in human resources; b. weakness in internal processes;
c. inadequate systems and infrastructure; and
d. external events having adverse impacts on the Company.
In assessing inherent risk for operational risk, the parameters or indicators used are at least:
a. characteristics and complexity of the Company's business; b. human resources;
c. information technology and supporting infrastructure;
d. fraud risk; e. external events; and f. administrative systems.
The Company assesses inherent risk for operational risk using inherent risk parameters or indicators as contained in Table II.B.1 Appendix II which is an inseparable part of this Circular Letter of the Financial Services Authority.
The Company establishes the inherent risk level for operational risk in 5 (five) ranks, namely:
b. rank 2 (low-medium);
c. rank 3 (medium);
d. rank 4 (medium-high); and e. rank 5 (high), using guidelines as contained in Table II.B.2 Appendix II which is an inseparable part of this Circular Letter of the Financial Services Authority.

E. Assessment of Inherent Risk for Insurance Risk

Insurance risk is the risk of the Company's failure to fulfill obligations to policyholders, insured parties, and/or participants due to inadequacy of risk selection processes (underwriting), premium or contribution setting (pricing), use of reinsurance, and/or claim handling.
In assessing inherent risk for insurance risk, the parameters or indicators used are at least:
a. underwriting; b. premium or contribution setting;
c. reinsurance structure;
d. claims; e. level of significance of insurance risk to total business (proportion of insurance protection risk compared to investment proportion) for life insurance companies and Sharia life insurance companies; f. mix of insurance products and benefit types for life insurance companies and Sharia life insurance companies; g. monitoring of insurance product performance; h. product risk;
i. marketing channels;
j. liability risk; k. nature of insurance business for general insurance companies, Sharia general insurance companies, and reinsurance companies;
l. composition and diversification of business portfolio for general insurance companies, Sharia general insurance companies, and reinsurance companies; and
m. geographic region for general insurance companies, Sharia general insurance companies, and reinsurance companies.
The Company assesses inherent risk for insurance risk using inherent risk parameters or indicators as contained in Table II.C.1 Appendix II which is an inseparable part of this Circular Letter of the Financial Services Authority.
The Company establishes the inherent risk level for insurance risk in 5 (five) ranks, namely:
b. rank 2 (low-medium);
c. rank 3 (medium);
d. rank 4 (medium-high); and e. rank 5 (high), using guidelines as contained in Table II.C.2 Appendix II which is an inseparable part of this Circular Letter of the Financial Services Authority.

F. Assessment of Inherent Risk for Credit Risk

Credit risk is the risk due to the failure of other parties to fulfill obligations to the Company, including credit risk due to debtor or investment failure, including investment concentration risk, counterparty credit risk, and settlement risk.
Credit risk generally exists in all Company business processes whose performance depends on the performance of counterparties such as issuers of investment instruments, policyholders/insured/participants in premium/contribution payments, or reinsurers.
Investment concentration risk as referred to in item 1 is the risk arising from investments and/or reinsurance panels concentrated among others on certain parties, geographic regions, products, investment types, or specific fields of business, commonly known as investment concentration risk and accounted for in inherent risk assessment.
Counterparty credit risk as referred to in item 1 is the risk arising from the failure of counterparties to fulfill their obligations and arises from transaction types having specific characteristics, for example, transactions influenced by fair value or market value movements.
Settlement risk as referred to in item 1 is the risk arising from the failure to deliver cash and/or financial instruments on the agreed settlement date from sales and/or purchases of financial instruments.
In assessing inherent risk for credit risk, the parameters or indicators used are at least:
a. risk from receivables management; b. risk from investment placement concentration and counterparty rating where investments are placed; and
c. risk of reinsurer failure.
The Company assesses inherent risk for credit risk using inherent risk parameters or indicators as contained in Table II.D.1 Appendix II which is an inseparable part of this Circular Letter of the Financial Services Authority.
The Company establishes the inherent risk level for credit risk in 5 (five) ranks, namely:
b. rank 2 (low-medium);
c. rank 3 (medium);
d. rank 4 (medium-high); and e. rank 5 (high), using guidelines as contained in Table II.D.2 Appendix II which is an inseparable part of this Circular Letter of the Financial Services Authority.

G. Assessment of Inherent Risk for Market Risk

Market risk is the risk on asset positions, liabilities, equity, and/or derivative transactions due to overall changes in market conditions.
Market risk includes interest rate risk, exchange rate risk, and market price risk over the Company's assets, including traded assets, held-to-maturity assets, and available-for-sale assets.
Risk management implementation for market price risk over the Company's assets is applied by Companies conducting consolidation with Subsidiary Companies.
In assessing inherent risk for market risk, the parameters or indicators used are:
a. allocation and/or investment structure; b. investment objectives and strategies; and
c. valuation of investment assets.
The Company assesses inherent risk for market risk using inherent risk parameters or indicators as contained in Table II.E.1 Appendix II which is an inseparable part of this Circular Letter of the Financial Services Authority.
The Company establishes the inherent risk level for market risk in 5 (five) ranks, namely:
b. rank 2 (low-medium);
c. rank 3 (medium);
d. rank 4 (medium-high); and e. rank 5 (high), using guidelines as contained in Table II.E.2 Appendix II which is an inseparable part of this Circular Letter of the Financial Services Authority.

H. Assessment of Inherent Risk for Liquidity Risk

Liquidity risk is the risk due to the Company's inability to meet maturing liabilities from cash flow funding sources and/or from liquid assets that can be easily converted into cash, without disrupting the Company's activities and financial conditions.
Liquidity risk can also be caused by the Company's inability to liquidate assets without incurring material discounts due to the absence of active markets or severe market disruptions, called market liquidity risk.
In assessing inherent risk for liquidity risk, the parameters or indicators used are at least:
a. quantity, quality, diversification, and sale of assets and liabilities; b. risk of mismatch between the size and maturity of assets with the size and maturity of liabilities;
c. lock-up period risk, which is the risk against investments that cannot be liquidated within a certain period;
d. cash flow; e. short-term asset profile; and f. short-term liability profile.
The Company assesses inherent risk for liquidity risk using inherent risk parameters or indicators as contained in Table II.F.1 Appendix II which is an inseparable part of this Circular Letter of the Financial Services Authority.
The Company establishes the inherent risk level for liquidity risk in 5 (five) ranks, namely:

b. rank 2 (low-medium);
c. rank 3 (medium);
d. rank 4 (medium-high); and e. rank 5 (high), using the guidelines as set forth in Table II.F.2 of Appendix II, which is an integral part of this Financial Services Authority Circular.

I. Assessment of Inherent Risk regarding Legal Risk

Legal risk is risk arising from legal claims and/or weaknesses in legal aspects.
Legal risk may arise, among others, due to:
a. absence and/or changes in legislation; b. weaknesses in agreements, such as the failure to meet the validity requirements of contracts or imperfect collateral agreements, causing a transaction already conducted by the Company to be inconsistent with regulations; and/or
c. litigation processes arising from lawsuits by third parties against the Company or by the Company against third parties.
In assessing inherent risk regarding legal risk, the parameters or indicators used are:
a. absence or changes in legislation; b. agreement failure/agreement weaknesses; and
c. litigation or dispute resolution.
The Company assesses inherent risk for legal risk using the parameters or indicators of inherent risk as set forth in Table II.G.1 of Appendix II, which is an integral part of this Financial Services Authority Circular.
The Company establishes the level of inherent risk for legal risk in 5 (five) ranks, namely:
b. rank 2 (low-medium);
c. rank 3 (medium);
d. rank 4 (medium-high); and e. rank 5 (high), using the guidelines as set forth in Table II.G.2 of Appendix II, which is an integral part of this Financial Services Authority Circular.

J. Assessment of Inherent Risk regarding Compliance Risk

Compliance risk is risk resulting from the Company's failure to comply with and/or implement legislation and regulations applicable to the Company.
Sources of compliance risk arise, among others, from:
a. legal behavior, namely the Company's behavior or activities that deviate from or violate legislation; and b. organizational behavior, namely the Company's behavior or activities that deviate from or contradict generally applicable standards.
In assessing inherent risk regarding compliance risk, the parameters or indicators used are at least:
a. the type and significance of violations committed; b. the frequency of violations, including sanctions imposed or the Company's non-compliance track record;
c. violations of legislation, regulations applicable to the Company, or generally applicable business standards; and
d. follow-up on violations, including compliance with the follow-up plan (action plan) submitted to the OJK.
The Company assesses inherent risk for compliance risk using the parameters or indicators of inherent risk as set forth in Table II.H.1 of Appendix II, which is an integral part of this Financial Services Authority Circular.
The Company establishes the level of inherent risk for compliance risk in 5 (five) ranks, namely:
b. rank 2 (low-medium);
c. rank 3 (medium);
d. rank 4 (medium-high); and e. rank 5 (high), using the guidelines as set forth in Table II.H.2 of Appendix II, which is an integral part of this Financial Services Authority Circular.

K. Assessment of Inherent Risk regarding Reputational Risk

Reputational risk is risk resulting from a decrease in the level of trust of stakeholders derived from negative perceptions of the Company.
Reputational risk arises, among others, due to media reports and/or rumors regarding the Company that are negative, as well as the Company's less effective communication strategy.
In assessing inherent risk regarding reputational risk, the parameters or indicators used are:
a. the reputational influence of the Company's owners and the Company's group; b. violations of business ethics;
c. complexity of products and business cooperation;
d. implementation of branding strategy; e. materiality of complaints from policyholders, insured parties, and/or participants; and f. exposure to negative media coverage of the Company.
The Company assesses inherent risk for reputational risk using the parameters or indicators of inherent risk as set forth in Table II.I.1 of Appendix II, which is an integral part of this Financial Services Authority Circular.
The Company establishes the level of inherent risk for reputational risk in 5 (five) ranks, namely:
b. rank 2 (low-medium);
c. rank 3 (medium);
d. rank 4 (medium-high); and e. rank 5 (high), using the guidelines as set forth in Table II.I.2 of Appendix II, which is an integral part of this Financial Services Authority Circular.

L. Assessment of the Quality of Risk Management Implementation

The assessment of the quality of risk management implementation reflects an assessment of the adequacy of the risk control system, covering all pillars of risk management implementation as regulated in the Financial Services Authority Regulation regarding the implementation of risk management for non-bank financial service institutions.
The assessment of the quality of risk management implementation aims to evaluate the effectiveness of the Company's risk management implementation in accordance with principles regulated in the Financial Services Authority Regulation regarding the implementation of risk management for non-bank financial service institutions.
The Company's implementation of risk management varies significantly according to size, complexity, and the level of risk that the Company can tolerate.
The assessment of the quality of risk management implementation is an assessment of 4 (four) interrelated aspects, namely:
a. active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board (DPS); b. the adequacy of risk management policies, procedures, and risk limit setting;
c. the adequacy of risk identification, measurement, control, and monitoring processes, as well as the risk management information system; and
d. a comprehensive internal control system.
Active supervision by the Board of Directors, Board of Commissioners, and DPS as referred to in paragraph 4 letter a includes evaluation of:
a. the adequacy of active supervision by the Board of Directors, Board of Commissioners, and DPS; and b. the adequacy of the execution of authority and responsibilities of the Board of Directors, Board of Commissioners, and DPS.
The adequacy of risk management policies, procedures, and risk limit setting as referred to in paragraph 4 letter b includes evaluation of:
a. the formulation of the level of risk to be taken (risk appetite) and risk tolerance; b. risk management strategies aligned with the level of risk to be taken and risk tolerance;
c. the adequacy of risk management policies and procedures; and
d. the adequacy of risk limit setting.
The adequacy of risk identification, measurement, control, and monitoring processes, as well as the risk management information system, as referred to in paragraph 4 letter c includes evaluation of:
a. the adequacy of risk identification, measurement, control, and monitoring processes; b. the adequacy of the risk management information system; and
c. the adequacy of the quantity and quality of human resources supporting the effectiveness of the risk management process.
A comprehensive internal control system as referred to in paragraph 4 letter d includes evaluation of:
a. the adequacy of the internal control system; and b. the adequacy of review by independent parties within the Company, either by the risk management function or by the internal audit function.
Review by the risk management function as referred to in paragraph 8 letter b includes, among others, the methods, assumptions, and variables used to measure and set risk limits.
Review by the internal audit function as referred to in paragraph 8 letter b includes, among others, the reliability of the risk management framework and the implementation of risk management by business units and/or supporting units.
The level of quality of risk management implementation for each type of risk is categorized into 5 (five) ranks, namely:
a. rank 1 (strong); b. rank 2 (fairly strong);
c. rank 3 (fair);
d. rank 4 (fairly weak); and e. rank 5 (weak).
The establishment of the quality of risk management implementation is conducted for each type of risk, namely:
a. strategic risk, using the guidelines as set forth in Table II.A.3 of Appendix II, which is an integral part of this Financial Services Authority Circular; b. operational risk, using the guidelines as set forth in Table II.B.3 of Appendix II, which is an integral part of this Financial Services Authority Circular;
c. insurance risk, using the guidelines as set forth in Table II.C.3 of Appendix II, which is an integral part of this Financial Services Authority Circular;
d. credit risk, using the guidelines as set forth in Table II.D.3 of Appendix II, which is an integral part of this Financial Services Authority Circular; e. market risk, using the guidelines as set forth in Table II.E.3 of Appendix II, which is an integral part of this Financial Services Authority Circular; f. liquidity risk, using the guidelines as set forth in Table II.F.3 of Appendix II, which is an integral part of this Financial Services Authority Circular; g. legal risk, using the guidelines as set forth in Table II.G.3 of Appendix II, which is an integral part of this Financial Services Authority Circular; h. compliance risk, using the guidelines as set forth in Table II.H.3 of Appendix II, which is an integral part of this Financial Services Authority Circular; and
i. reputational risk, using the guidelines as set forth in Table II.I.3 of Appendix II, which is an integral part of this Financial Services Authority Circular.

M. Establishment of Risk Profile Factor Rank

The establishment of the risk profile factor rank is conducted through the following stages:
a. establishing the risk level for each risk; b. establishing the composite inherent risk level and composite risk management implementation quality; and
c. establishing the risk profile factor rank.
The establishment of the risk level as referred to in paragraph 1 letter a is determined based on the assessment of the inherent risk level and risk management implementation quality for each type of risk as referred to in letters B through L.
After the Company establishes the inherent risk level and risk management implementation quality, the Company establishes the risk level for each type of risk, consisting of 9 (nine) types, namely:
a. strategic risk; b. operational risk;
c. insurance risk;
d. credit risk; e. market risk; f. liquidity risk; g. legal risk; h. compliance risk; and
i. reputational risk,
using the guidelines as set forth in Table II.J of Appendix II, which is an integral part of this Financial Services Authority Circular.
In the event that the Company has a Subsidiary Company, the Company considers the impact of the Subsidiary Company's risk on the Company's risk profile by considering the significance and materiality of the Subsidiary Company and/or the significance of issues within the Subsidiary Company.
The establishment of the composite inherent risk level and composite risk management implementation quality as referred to in paragraph 2 is conducted by considering the significance of each risk to the overall risk profile.
The Company establishes the risk profile factor rank as referred to in paragraph 1 letter c, which results from the combination of inherent and structured risks and risk management implementation quality, by considering the significance of each risk to the overall risk profile.
The risk profile factor rank is the final conclusion regarding the Company's risk after considering mitigation conducted through the implementation of risk management.
The establishment of the risk profile rank as referred to in paragraph 6 and paragraph 7 uses the format as set forth in Table II.K of Appendix II, which is an integral part of this Financial Services Authority Circular.
The establishment of the risk profile factor rank consists of 5 (five) ranks, namely:
a. rank 1; b. rank 2;
c. rank 3;
d. rank 4; and e. rank 5, with a smaller rank order reflecting a lower level of risk faced by the Company.
The establishment of the risk profile factor rank is conducted in accordance with the guidelines as set forth in Table II.L of Appendix II, which is an integral part of this Financial Services Authority Circular.

N. Assessment of Risk Profile Factor for Sharia Units

Regulations regarding the assessment of the risk profile factor for Companies as referred to in letters A through M mutatis mutandis apply to the assessment of the risk profile factor for Sharia Units.
Companies that have Sharia Units must conduct the assessment of the risk profile factor for Sharia Units in accordance with Sharia Principles using:
a. parameters or indicators of inherent risk, guidelines for establishing the inherent risk level, and guidelines for establishing the quality of risk management implementation with the following formats:

strategic risk, using Table II.A.1, Table II.A.2, and Table II.A.3;
operational risk, using Table II.B.1, Table II.B.2, and Table II.B.3;
insurance risk, using Table II.C.1, Table II.C.2, and Table II.C.3;
credit risk, using Table II.D.1, Table II.D.2, and Table II.D.3;
market risk, using Table II.E.1, Table II.E.2, and Table II.E.3;
liquidity risk, using Table II.F.1, Table II.F.2, and Table II.F.3;
legal risk, using Table II.G.1, Table II.G.2, and Table II.G.3;
compliance risk, using Table II.H.1, Table II.H.2, and Table II.H.3; and
reputational risk, using Table II.I.1, Table II.I.2, and Table II.I.3;
b. guidelines for establishing the risk level for each type of risk, using Table II.J;
c. format for establishing composite risk profile using Table II.K; and
d. guidelines for establishing the risk profile factor rank, using Table II.L, as set forth in Appendix II, which is an integral part of this Financial Services Authority Circular.

VI. ASSESSMENT OF PROFITABILITY FACTOR

The assessment of the profitability factor must at least include assessment of:
a. the Company's performance in generating profit (profitability); b. sources supporting profitability; and
c. the stability of components supporting profitability.
The assessment is conducted by considering the level, trend, structure, and stability of profitability, and comparing the Company's performance with that of an equivalent peer group through both quantitative and qualitative aspect analysis.
In determining the equivalent peer group, the Company must consider the business scale, characteristics, and/or complexity of the Company's business, as well as the availability of data and information owned.
The Company assesses the profitability factor using parameters or indicators as set forth in Table III.A of Appendix III, which is an integral part of this Financial Services Authority Circular.
The establishment of the profitability factor rank is based on a comprehensive and structured analysis of the parameters or indicators of profitability as referred to in paragraph 4, considering the significance of each parameter or indicator and considering other issues affecting the Company's profitability.
The Company establishes the profitability factor rank in 5 (five) ranks, namely:
a. rank 1; b. rank 2;
c. rank 3;
d. rank 4; and e. rank 5, with a smaller profitability factor rank order reflecting better profitability conditions.
The establishment of the profitability factor rank is conducted in accordance with Table III.B of Appendix III, which is an integral part of this Financial Services Authority Circular.

VII. ASSESSMENT OF CAPITAL FACTOR

The assessment of the capital factor must at least include assessment of:
a. the level of capital adequacy; and b. capital management.
In conducting the assessment, the Company must consider the level, trend, structure, and stability of capital by considering the performance of an equivalent peer group and the adequacy of the Company's capital management.
The assessment is conducted using both quantitative and qualitative parameters or indicators.
In determining the equivalent peer group, the Company must consider the business scale, characteristics, and/or complexity of the Company's business, as well as the availability of data and information owned.
Parameters or indicators in assessing capital include:
a. capital adequacy; and b. capital management.
The Company assesses the capital factor using parameters or indicators as set forth in Table IV.A of Appendix IV, which is an integral part of this Financial Services Authority Circular.
The capital factor is established based on a comprehensive and structured analysis of the parameters or indicators of capital as referred to in paragraph 6, considering the materiality and significance of each parameter or indicator and considering other issues affecting the Company's capital.
The Company establishes the capital factor rank in 5 (five) ranks, namely:
a. rank 1; b. rank 2;
c. rank 3;
d. rank 4; and e. rank 5, with a smaller capital factor rank order reflecting better capital conditions for the Company.
The establishment of the capital factor rank is conducted in accordance with Table IV.B of Appendix IV, which is an integral part of this Financial Services Authority Circular.

VIII. ASSESSMENT OF COMPOSITE HEALTH LEVEL RANK

The Company's Health Level is established based on a comprehensive and structured analysis of the rank of each factor and by considering the general principles of assessing the Company's Health Level as referred to in Roman numeral II.
In conducting comprehensive analysis, the Company must consider the ability to face significant changes in external conditions.
The Company establishes Composite Rank in 5 (five) Composite Ranks, namely:
a. Composite Rank 1 (CR-1); b. Composite Rank 2 (CR-2);
c. Composite Rank 3 (CR-3);
d. Composite Rank 4 (CR-4); and e. Composite Rank 5 (CR-5), with a smaller Composite Rank order reflecting a healthier Company.
The establishment of the Composite Rank of the Company's Health Level is conducted in accordance with the guidelines as set forth in Appendix V, which is an integral part of this Financial Services Authority Circular.

IX. PROCEDURE FOR ASSESSING THE COMPANY'S HEALTH LEVEL ON A CONSOLIDATED BASIS

In the event that the Company controls a Subsidiary Company, in addition to conducting the assessment of the Company's Health Level using a risk-based approach individually as referred to in Roman numeral III paragraph 1, the Company must conduct the assessment of the Company's Health Level using a risk-based approach on a consolidated basis.
The assessment of the Company's Health Level as referred to in paragraph 1 is conducted with an assessment scope covering the following factors:
a. good corporate governance; b. risk profile;
c. profitability; and
d. capital.
In conducting consolidated assessment, the Company considers:
a. the significance and materiality of the Subsidiary Company's share in the consolidated Company; and/or b. issues within the Subsidiary Company regarding good corporate governance, risk profile, profitability, and capital that have a significant impact on the consolidated Company.
The establishment of the significance and materiality of the Subsidiary Company's share in the consolidated Company as referred to in paragraph 3 letter a can be determined through:
a. comparison of the Subsidiary Company's total assets to the consolidated Company's total assets; or b. the significance of specific positions in the Subsidiary Company that affect the performance of the consolidated Company, such as risk profile, profitability, and capital.
The establishment of the significance of issues within the Subsidiary Company as referred to in paragraph 3 letter b, among others, considers issues existing in the Subsidiary Company and their impact on the performance or condition of the consolidated Company, for example:
a. issues related to the Subsidiary Company's business that can impact the consolidated Company's reputational risk, credit risk, or liquidity risk; b. issues in risk governance; and/or
c. weaknesses in the implementation of the Subsidiary Company's risk management.
For Companies conducting the assessment of the Company's Health Level on a consolidated basis:
a. the mechanism for establishing the rank of each assessment factor and establishing the Composite Rank of the Company's Health Level on a consolidated basis; and b. the categorization of the rank of each assessment factor and Composite Rank on a consolidated basis, must refer to the mechanism for establishing and categorizing the rank of the Company on an individual basis.
Parameters or indicators used in assessing the Company's Health Level on an individual basis can be used by the Company when assessing the Company's Health Level on a consolidated basis.
The use of parameters or indicators as referred to in paragraph 7 can be supplemented with other parameters or indicators as long as they are relevant to the business scale, characteristics, and complexity of the Company's business on a consolidated basis.
In assessing the Company's Health Level on a consolidated basis, the mechanism for establishing the rank and category rank of each assessment factor and establishing the Composite Rank of the Company's Health Level on a consolidated basis refers to the procedure for assessing the Company's Health Level on an individual basis as referred to in Roman numeral III through Roman numeral VIII.
The establishment of the rank of the good corporate governance factor for the Company on a consolidated basis is conducted by considering the following provisions:
a. the significance and materiality of the Subsidiary Company's share in the consolidated Company; and

b. issues related to the implementation of good corporate governance principles at Subsidiary Companies that significantly affect the implementation of good corporate governance principles for the Company on a consolidated basis.

The governance assessment factors for Subsidiary Companies used to assess the implementation of good corporate governance principles for the Company on a consolidated basis are determined by considering the business characteristics of the Subsidiary Company and supported by adequate data and information.
The determination of the good corporate governance rating for the Company on a consolidated basis is carried out by considering the impact of the implementation of governance at the Subsidiary Company.
The determination of the risk profile factor on a consolidated basis is carried out by considering the following provisions:
a. the significance and materiality of the Subsidiary Company's share to the Company on a consolidated basis; and b. risk profile issues at the Subsidiary Company that significantly affect the risk profile on a consolidated basis.
The determination of the risk profile factor on a consolidated basis is carried out in the following stages:
a. the determination of inherent risk level, quality of risk management implementation, and risk level of the Company on a consolidated basis is carried out by calculating the impact caused by the risk of the Subsidiary Company on the risk profile of the Company on a consolidated basis; and b. the determination of the risk profile rating of the Company on a consolidated basis is carried out by calculating the impact of all risks of the Subsidiary Company on the risk profile of the Company on a consolidated basis.
The determination of the profitability factor rating on a consolidated basis is carried out based on a comprehensive and structured analysis of specific profitability parameters or indicators resulting from consolidated financial reports and other financial information, by considering the following provisions:
a. the significance and materiality of the Subsidiary Company's share to the Company on a consolidated basis; and b. profitability issues at the Subsidiary Company that significantly affect profitability on a consolidated basis.
Assessment is carried out by referring to specific parameters or indicators applicable to the Company on an individual basis, provided they are supported by adequate data or information.
In carrying out the assessment, the Company may add parameters or indicators that are relevant to the scale, characteristics, and complexity of the Subsidiary Company.
The determination of the capital factor rating on a consolidated basis is carried out based on a comprehensive and structured analysis of specific capital parameters or indicators resulting from consolidated financial reports and other financial information, by considering the following provisions:
a. the significance and materiality of the Subsidiary Company's share to the Company on a consolidated basis; and b. capital issues at the Subsidiary Company that significantly affect capital on a consolidated basis.
Assessment is carried out by referring to specific parameters or indicators applicable to the Company on an individual basis, provided they are supported by adequate data or information.
In carrying out the assessment, the Company may add parameters or indicators that are relevant to the scale, characteristics, and complexity of the Subsidiary Company.

X. REPORTING

The Company is required to conduct a self-assessment of the Company's Health Level.
The self-assessment of the Company's Health Level as referred to in item 1 is carried out at least annually for the position at the end of December.
In addition to conducting the self-assessment as referred to in item 1, the Company is required to update the self-assessment of the Company's Health Level when necessary.
The Company updates the self-assessment of the Company's Health Level as referred to in item 3, among other things, in the event of:
a. deterioration of the Company's financial condition; b. the existence of external and internal factors that can significantly affect the Company's Health Level; or
c. other conditions that, in the opinion of the Financial Services Authority (Otoritas Jasa Keuangan) and/or the Company, require an update of the Company's Health Level assessment.
The results of the self-assessment of the Company's Health Level and Sharia Unit are submitted using the report format as referred to in Appendix VI, which is an integral part of this Financial Services Authority Circular.
The Company submits the results of the self-assessment of the Company's Health Level to the Financial Services Authority as follows:
a. no later than February 15 for the assessment of the Company's Health Level position at the end of December; or b. no later than 30 (thirty) working days from the date of updating the self-assessment of the Company's Health Level.
If the submission deadline for the results of the self-assessment of the Company's Health Level as referred to in item 6 letter a falls on a holiday, the results of the self-assessment of the Company's Health Level are submitted on the next working day.
The Company must submit the results of the self-assessment of the Company's Health Level to the Financial Services Authority online through the Financial Services Authority's data communication network system.
In the event that the Financial Services Authority's data communication network system as referred to in item 8 is not yet available or experiences technical difficulties, the submission is made to the Financial Services Authority offline by:
a. direct handover; or b. sending through a courier service company.
In the event of technical difficulties as referred to in item 9, the Financial Services Authority announces this through the Financial Services Authority's website.
The submission of reports offline as referred to in item 9 must be submitted in electronic data form using media such as a compact disc or other electronic data storage media.
The submission of reports as referred to in item 11 must be accompanied by a cover letter in printed form signed by the Board of Directors.
Reports on the results of the self-assessment of the Company's Health Level and/or updates to the self-assessment of the Company's Health Level offline as referred to in item 9 are submitted to:
a. for Insurance Companies and Reinsurance Companies:
Head of Executive Supervisor for Insurance Companies, Pension Funds, Financing Institutions, and Other Financial Service Institutions Financial Services Authority u.p. Director of Insurance Supervision and BPJS Kesehatan Wisma Mulia 2 Building, 12th Floor Jalan Jenderal Gatot Subroto Kav 40 Jakarta 12710; b. for Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units:
Head of Executive Supervisor for Insurance Companies, Pension Funds, Financing Institutions, and Other Financial Service Institutions Financial Services Authority u.p. Director of Sharia IKNB Wisma Mulia 2 Building, 15th Floor Jalan Jenderal Gatot Subroto Kav 40 Jakarta 12710.

This copy is consistent with the original
Legal Director 1
Legal Department signed
Mufli Asmawidjaja

In the event of a change in the address of the Financial Services Authority's Office for the submission of reports as referred to in item 13, the Financial Services Authority will convey notification regarding the address change via letter or announcement.
The Company is deemed to have submitted the report on the results of the self-assessment of the Company's Health Level and/or updates to the self-assessment of the Company's Health Level with the following provisions:
a. for online submission through the Financial Services Authority's data communication network system, proven by a receipt from the Financial Services Authority's data communication network system; or b. for offline submission, proven by a receipt from the Financial Services Authority.

XI. CLOSING

This Financial Services Authority Circular takes effect on the date of determination.

Determined in Jakarta on January 15, 2021
HEAD OF EXECUTIVE SUPERVISOR
FOR INSURANCE COMPANIES, PENSION FUNDS,
FINANCING INSTITUTIONS, AND
OTHER FINANCIAL SERVICE INSTITUTIONS
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA, signed
RISWINANDI

APPENDIX I
FINANCIAL SERVICES AUTHORITY CIRCULAR
REPUBLIC OF INDONESIA
NUMBER 1 /SEOJK.05/2021
CONCERNING
ASSESSMENT OF THE HEALTH LEVEL OF INSURANCE COMPANIES, REINSURANCE COMPANIES, SHARIA INSURANCE COMPANIES, AND SHARIA REINSURANCE COMPANIES

ASSESSMENT OF GOOD CORPORATE GOVERNANCE FACTORS HEALTH LEVEL OF INSURANCE COMPANIES, REINSURANCE COMPANIES, SHARIA INSURANCE COMPANIES, AND SHARIA REINSURANCE COMPANIES

Table I.A : Self-Assessment Work Paper for Good Corporate Governance Factors
Table I.B : Guidelines for Determining the Rating of Good Corporate Governance Factors

Table I.A: Self-Assessment Work Paper (Self Assessment) for Good Corporate Governance Factors for the Company

Purpose

The assessment of governance structure aims to assess the adequacy of the structure and infrastructure of good corporate governance for the Company so that the implementation process of good corporate governance principles produces outcomes that align with the expectations of the Company's stakeholders. Included in good corporate governance structure are the Board of Directors, Board of Commissioners, Sharia Supervisory Board (DPS), committees, and work units within the Company. Included in good corporate governance infrastructure are, among others, the Company's policies and procedures, management information systems, and the main duties and functions of each organizational structure.
The assessment of governance process aims to assess the effectiveness of the implementation process of good corporate governance principles supported by adequate structure and infrastructure of good corporate governance, thereby producing outcomes that align with the expectations of the Company's stakeholders.
The assessment of governance outcome aims to assess the quality of outcomes that meet the expectations of the Company's stakeholders as a result of the implementation process of good corporate governance principles, supported by adequate structure and infrastructure of good corporate governance.

Included in the implementation results (outcome) cover qualitative aspects, including:
a. adequacy of report transparency; b. compliance with statutory regulations;
c. improvement of human resource quality;
d. consumer protection; and/or e. objectivity in conducting assessment or audit.

Included in the implementation results (outcome) cover quantitative aspects, including:
a. Company performance such as solvency ratio, investment adequacy ratio, underwriting results, and capitalization; and/or b. improvement or decline in compliance with applicable statutory regulations and resolution of issues faced by the Company such as fraud, claim disputes, solvency achievement ratio not meeting regulations, or violations of statutory regulations in the insurance sector.

Instructions for Filling Out:

The Company conducts a self-assessment of the implementation of good corporate governance principles in the "analysis" column in Appendix I.
The parameters or indicators for assessing good corporate governance factors in Appendix I are minimum standards that must be used in conducting the assessment of good corporate governance factors.
The Company may add other parameters or indicators according to the characteristics and complexity of the Company's business.
Assessment is carried out per position and period for the last 12 (twelve) months for parameters or indicators that are quantitative.
In assessing good corporate governance factors for the Company on a consolidated basis, the Company may use parameters or indicators for assessing good corporate governance factors for the Company on an individual basis, adjusted to the scale, characteristics, and complexity of the Subsidiary Company's business.
In the event of changes to regulations governing criteria or indicators, the Company must adjust the criteria or indicators with applicable statutory regulations.
Implementation of the duties and responsibilities of the Board of Directors:
a. Governance structure
1) The Company has at least 3 (three) members of the Board of Directors.
2) The Company has 1 (one) member of the Board of Directors who oversees the compliance function, which cannot be held concurrently by the insurance technical function, finance function, or marketing function.
3) The citizenship of the Company's Board of Directors members meets the following provisions:
a) for Companies whose owners are all Indonesian citizens and/or Indonesian legal entities whose owners are all or majority Indonesian citizens, all members of the Company's Board of Directors must be Indonesian citizens; and b) for Companies that include direct participation by foreign parties, the Company's Board of Directors members may consist of Indonesian citizens and foreign citizens, or all Indonesian citizens.
4) All members of the Company's Board of Directors reside in Indonesia.
5) All members of the Company's Board of Directors have passed the competency and propriety test and have obtained an approval letter from the Financial Services Authority.
6) All members of the Company's Board of Directors have adequate and relevant knowledge and competence for their positions to carry out their duties and responsibilities and are able to implement the competencies they possess in the execution of their duties and responsibilities.
7) At least half of the number of members of the Company's Board of Directors have knowledge and experience in risk management according to the Company's field of business.
8) Board of Directors members overseeing the risk management function must possess expertise certificates in risk management.
9) The Company's Board of Directors does not hold concurrent positions in other Companies except as members of the Board of Commissioners in 1 (one) Company with a different field of business.
10) The Company's President Director does not hold a concurrent position as a member of the Board of Commissioners in a Subsidiary Company controlled by the relevant Company.
11) The Company's Compliance Director does not hold other concurrent functions, or the Board of Directors member overseeing the compliance function does not hold concurrent positions or oversee the insurance technical function, finance function, or marketing function.
12) The Company's Board of Directors has work guidelines and house rules that include regulations on work ethics, working hours, and meeting agendas (meeting agendas, quorum requirements, decision-making, and members' rights in the event of dissenting opinions).
13) The Company does not appoint Board of Directors members who are current or former employees or officials of the Financial Services Authority if the individual ceased working from the Financial Services Authority less than 1 (one) year ago.
14) The Company does not appoint Board of Directors members who have previously been members of the Board of Directors, Board of Commissioners, or DPS who were declared guilty or negligent causing:
a) a Company to be subject to business activity restriction sanctions within the last 3 (three) years prior to their appointment; b) a financial services company to have its business license revoked due to violations within the last 3 (three) years prior to their appointment; and/or c) a financial services company or non-financial services company to be declared bankrupt based on a final and binding court decision within the last 5 (five) years prior to their appointment.
15) Board of Directors members cultivate continuous learning to increase knowledge about the Company and recent developments related to the financial field or other fields supporting the execution of duties and responsibilities at all levels or organizational tiers.

b. Governance process
1) The Board of Directors has formed:
a) an investment committee; b) a committee or work unit for insurance product development; c) a work unit or employee implementing the compliance function; d) a work unit or employee implementing the investment management function; e) a work unit or official responsible for implementing Anti-Money Laundering and Counter-Financing of Terrorism (APU and PPT); and f) a work unit or risk management function.
2) Replacement and/or appointment of Board of Directors members is decided by the General Meeting of Shareholders.
3) Board of Directors members do not grant general power of attorney to other parties that results in the transfer of duties and functions of the Board of Directors.
4) The Board of Directors is fully responsible for the implementation of Company management.
5) The Board of Directors manages the Company according to its authority and responsibilities as regulated in the Company's Articles of Association and applicable statutory regulations.
6) The Board of Directors carries out its duties and responsibilities independently from shareholders.
7) The Board of Directors has implemented good corporate governance principles, namely:
a) openness; b) accountability; c) responsibility; d) independence; e) equality and fairness; and in every business activity of the Company at all levels or organizational tiers.
8) The Board of Directors has implemented fraud control functions and applied anti-fraud strategies.
9) The Board of Directors has followed up on audit findings and recommendations from internal audit work units, external auditors, results of DPS supervision, results of Financial Services Authority supervision, and results of other authority supervision.
10) The Board of Directors has provided complete, accurate, up-to-date, and timely data and information to the Board of Commissioners and DPS.
11) Board of Directors meeting decisions have been made based on deliberation for consensus or majority vote in the event consensus cannot be reached.
12) Every decision taken by the Board of Directors can be implemented and is in accordance with applicable policies, guidelines, and house rules.
13) The Board of Directors has established policies and strategic decisions through Board of Directors meeting mechanisms.
14) The Board of Directors does not utilize the Company for personal, family, and/or other parties' interests that can harm or reduce the Company's profits.
15) The Board of Directors does not take and/or receive personal benefits from the Company other than remuneration and other facilities determined by the General Meeting of Shareholders.
16) The Board of Directors does not conduct transactions with conflicts of interest with the Company's business activities.
17) The Board of Directors does not fulfill requests from shareholders or is not influenced by shareholders who intervene in the execution of the Board of Directors' duties, other than those established in the General Meeting of Shareholders and/or that could disrupt operational activities thereby reducing profits and/or causing losses to the Company.

c. Governance outcome
1) The Board of Directors has accounted for the implementation of their duties to shareholders through the General Meeting of Shareholders.
2) The Board of Directors' accountability for the implementation of their duties is accepted by shareholders through the General Meeting of Shareholders.
3) The Board of Directors has disclosed the Company's strategic policies in human resources to Company employees through media easily accessible to employees.
4) The Board of Directors has communicated to employees regarding the Company's business direction in achieving the Company's vision and mission.
5) Board of Directors meeting results have been recorded in meeting minutes and documented well, including clear disclosure of dissenting opinions that occurred in the Board of Directors meeting, accompanied by the reasons for the differing opinions.
6) In the report on the implementation of good corporate governance, all Board of Directors members have at least disclosed:
a) share ownership reaching 5% (five percent) or more in the relevant Company and other companies located domestically and internationally; b) financial relationships and family relationships with other Board of Directors members, Board of Commissioners members, DPS members, and/or shareholders of the Company or business group where the respective Board of Directors member serves;
7) Improvement of knowledge, expertise, and abilities of Board of Directors members in Company management, demonstrated among others by improved Company performance, resolution of issues faced by the Company, and achievement of results according to stakeholder expectations.
8) Improvement of knowledge, expertise, and abilities of all Company employees at all levels or organizational tiers, demonstrated among others by improved individual performance according to duties and responsibilities.
9) Improvement of a continuous learning culture to increase knowledge about the Company and recent developments related to the financial field and/or other fields supporting the execution of duties and responsibilities at all levels or organizational tiers, demonstrated among others by increased employee participation in Company certification and/or education or training for individual quality development.
10) Company operational activities are not disrupted and/or the Board of Directors does not provide unfair benefits to shareholders that impact reduced Company profits and/or cause Company losses, due to shareholder intervention in the composition and/or execution of the Board of Directors' duties.
Implementation of the duties and responsibilities of the Board of Commissioners
a. Governance structure
1) The Company has at least 3 (three) members of the Board of Commissioners.
2) The Company has independent commissioners comprising at least half of the number of Board of Commissioners members.
3) The citizenship of the Company's Board of Commissioners members meets the following provisions:
a) for Companies whose owners are all Indonesian citizens and/or Indonesian legal entities whose owners are all or majority Indonesian citizens, all members of the Company's Board of Commissioners must be Indonesian citizens; and b) for Companies that include direct participation by foreign parties, the Company's Board of Commissioners members may consist of Indonesian citizens and foreign citizens, or all Indonesian citizens.
4) The Company's independent commissioners are Indonesian citizens.
5) At least half of the number of members of the Company's Board of Commissioners must reside in Indonesia.
6) The Company's independent commissioners reside in Indonesia.
7) Members of the Company's Board of Commissioners have passed the competency and propriety assessment and have obtained an approval letter from the Financial Services Authority.
8) Board of Commissioners members have adequate and relevant competence for their positions to carry out their duties and responsibilities and are able to implement the competencies they possess in the execution of their duties and responsibilities.
9) Board of Commissioners members must possess expertise certificates in risk management.
10) Independent commissioners understand statutory regulations in the insurance sector and other relevant statutory regulations.
11) Independent commissioners have good knowledge regarding the Company's financial condition.

Independent Commissioners possess good knowledge regarding the interests of policyholders, insured parties, participants, and/or other parties entitled to benefits.
Members of the Board of Commissioners do not hold concurrent positions as members of the Board of Commissioners, members of the Board of Directors, or members of the Sharia Supervisory Board (DPS) at other companies with the same business field.
Independent Commissioners do not hold concurrent positions as commissioners at companies with the same business field.
Independent Commissioners do not have Affiliation relationships with members of the Board of Directors, other members of the Board of Commissioners, members of the DPS, and/or shareholders or equivalent parties at the Company.
Independent Commissioners have never been members of the Board of Directors, members of the Board of Commissioners, members of the DPS, or Officials 1 (one) level below the Board of Directors at the same Company or other companies having an affiliation relationship with such Company within the last 6 (six) months.
The Company does not appoint members of the Board of Commissioners who are current or former employees or officials of the Financial Services Authority (Otoritas Jasa Keuangan) if the individual ceased working at the Financial Services Authority for less than 6 (six) months.
The Company does not appoint members of the Board of Commissioners who have previously been members of the Board of Directors, members of the Board of Commissioners, or members of the DPS who were found guilty or negligent causing:
a) a Company to be subject to business activity restriction sanctions within the last 3 (three) years prior to their appointment; b) a company in the financial services sector to have its business license revoked due to violations within the last 3 (three) years prior to their appointment; and/or c) a company in the financial services sector or non-financial services sector declared bankrupt based on a final and binding court decision within the last 5 (five) years prior to their appointment.
The Board of Commissioners has established working guidelines and regulations, including work ethics, working hours, and meetings (meeting agendas, quorum requirements, decision-making, and member rights in the event of dissenting opinions).

b. Governance Process

The Board of Commissioners has formed an Audit Committee and a Risk Monitoring Committee and ensured that the formed committees have effectively carried out their duties.
The replacement and/or appointment of the Company's Board of Commissioners is carried out by the General Meeting of Shareholders (RUPS) and is clearly stated in a notarial deed containing the RUPS decision regarding such replacement and/or appointment.
The Board of Commissioners has carried out its duties independently;
The Board of Commissioners has carried out its duties to ensure the implementation of good corporate governance principles in every business activity of the Company at all levels and organizational hierarchies.
The Board of Commissioners has carried out supervision over the implementation of the duties and responsibilities of the Board of Directors periodically or at any time, and has provided advice to the Board of Directors.
In carrying out supervisory duties, the Board of Commissioners has directed, monitored, and evaluated the implementation of the Company's strategic policies.
The Board of Commissioners has ensured that the Board of Directors has followed up on audit findings and recommendations from units specializing in the Company's internal audit, external auditors, results of DPS supervision, results of Financial Services Authority supervision, and/or results of supervision by other authorities.
The Board of Commissioners has carried out its duties and responsibilities to supervise the Board of Directors in maintaining the balance of interests of all parties, particularly the interests of policyholders, insured parties, participants, and/or parties entitled to benefits.
The Board of Commissioners does not interfere and/or participate in decision-making regarding the Company's operational activities that are the responsibility of the Board of Directors, except in cases fulfilling the interests of policyholders, insured parties, participants, and/or parties entitled to benefits, and other matters stipulated in the Company's Articles of Association and/or statutory regulations in carrying out supervisory functions.
The Board of Commissioners has guaranteed effective, precise, and rapid decision-making and can act independently, having no interests that can interfere with its ability to carry out its duties independently and critically.
The Board of Commissioners has prepared Board of Commissioners activity reports, which are part of the good corporate governance implementation report.
Independent Commissioners have prepared annual reports regarding the implementation of their duties concerning the protection of the interests of policyholders, insured parties, participants, and/or parties entitled to benefits, both regarding services and claim settlements, including reports on disputes currently being resolved at mediation bodies, arbitration bodies, or judicial bodies, which are part of the Good Corporate Governance Implementation Report.
Board of Commissioners meetings have been held periodically at least 1 (one) time in 1 (one) month.
Board of Commissioners meetings in a 1 (one) year period have been conducted with the following provisions:
a) At least 4 (four) meetings, including those inviting the Board of Directors; and b) At least 1 (one) meeting, including those inviting external auditors.
Board of Commissioners meetings have been attended by all members of the Board of Commissioners physically at least 4 (four) times in 1 (one) year.
Decision-making in Board of Commissioners meetings is based on deliberation for consensus or majority vote in the event consensus is not reached.
The Board of Commissioners does not conduct transactions having conflicts of interest with the Company's activities where the Board of Commissioners members serve.
The Board of Commissioners does not utilize their positions at the Company where Board of Commissioners members serve for personal, family, and/or other parties' interests that can harm or reduce the profits of the Company where Board of Commissioners members serve.
The Board of Commissioners does not take and/or receive personal benefits from the Company other than remuneration and other facilities established by the General Meeting of Shareholders.

c. Governance Outcome

Board of Commissioners meeting results have been recorded in meeting minutes and well-documented, including clearly stated differences of opinion (dissenting opinions).
Board of Commissioners meeting results have been distributed to all members of the Board of Commissioners and related parties.
Board of Commissioners meeting results are recommendations and/or directives that can be implemented by the RUPS and/or Board of Directors.
In the good corporate governance implementation report, Board of Commissioners members have at least disclosed:
a) their share ownership reaching 5% (five percent) or more at the Insurance Company where such Board of Commissioners member serves and/or at other companies located domestically and abroad; and b) financial relationships and family relationships with other Board of Commissioners members, members of the Board of Directors, and/or shareholders where such Board of Commissioners member serves, to the Company where such Board of Commissioners member serves and are stated in the good corporate governance implementation report;
Enhancement of knowledge, skills, and abilities of Board of Commissioners members in Company supervision, demonstrated by, among others, improved Company performance, resolution of Company problems, and achievement of results according to Stakeholder (stakeholders) expectations.
Enhancement of a continuous learning culture to increase knowledge about the Company and recent developments related to financial fields or other fields supporting the implementation of duties and responsibilities of Board of Commissioners members.

Implementation of Duties and Responsibilities of the Sharia Supervisory Board (DPS) for Sharia Insurance Companies and UUS.

a. Governance Structure

The number of DPS members consists of 1 (one) Sharia expert or more:
a) who are appointed by the RUPS as referred to in the POJK regarding the assessment of competence and propriety of principal parties; b) based on recommendations from the National Sharia Council of the Indonesian Ulema Council (Dewan Syariah Nasional Majelis Ulama Indonesia). c) who are clearly stated in a notarial deed.
At least half of the number of DPS members must reside in Indonesia.
DPS members do not hold concurrent positions as members of the Board of Directors or Board of Commissioners at the same Company.
DPS members do not hold concurrent positions as members of the Board of Directors, members of the Board of Commissioners, or members of the DPS at more than 4 (four) other financial institutions.
DPS members have never been members of the Board of Directors, members of the Board of Commissioners, or members of the DPS who were found guilty or negligent causing:
a) a Company to be subject to business activity restriction sanctions within the last 3 (three) years prior to their appointment; b) a company in the financial services sector to have its business license revoked due to violations within the last 3 (three) years prior to their appointment; and/or c) a company in the financial services sector or non-financial services sector declared bankrupt based on a final and binding court decision within the last 5 (five) years prior to their appointment.
DPS has passed the competence and propriety assessment.

b. Governance Process

DPS carries out duties and responsibilities in accordance with good corporate governance principles.
In carrying out supervisory duties, DPS has provided advice and suggestions to the Board of Directors to ensure business activities comply with Sharia principles, including activities in managing assets and liabilities, including Tabarru' funds, Tanahud funds, company funds, and participant investment funds, marketed Sharia insurance products, and marketing practices.
DPS has provided sufficient time to carry out their duties and responsibilities optimally.
DPS has held meetings periodically with a frequency of at least 6 (six) times in 1 (one) year.
Decision-making in DPS meetings has been based on deliberation for consensus and is a joint decision of the DPS.
DPS does not conduct transactions having Conflicts of Interest with Company activities;
DPS does not utilize their position for personal, family, and/or other parties' interests that can reduce assets or reduce Company profits.
DPS does not take and/or receive personal benefits from the Company other than remuneration and other facilities established by the RUPS.
In carrying out their duties, DPS coordinates with committee members, Company employees, and professional experts whose organizational structure is within the Board of Directors or under the Board of Commissioners.
DPS receives information from the Board of Directors regarding the Company completely and in a timely manner.

c. Governance Outcome

(1) DPS meeting results are recorded in meeting minutes and well-documented, including clear disclosure of dissenting opinions.

(2) DPS has submitted the Sharia Supervisory Board Supervision Results Report through good corporate governance reports and other reporting in accordance with statutory regulations.

(3) In the good corporate governance implementation report, all DPS members have at least disclosed:
a) concurrent positions as Sharia Supervisory Boards at other Sharia financial institutions. b) remuneration and other facilities

(4) Enhancement of knowledge, skills, and abilities of Sharia Supervisory Board members in supervising the conformity of Company activities with Sharia principles, demonstrated by, among others, improved Company performance through a decrease in violations of Sharia principles and resolution of problems related to violations of Sharia principles.

Implementation of Duties and Responsibilities of Shareholders or Equivalent Parties

a. Governance Structure

Controlling shareholders or equivalent parties possess adequate integrity and financial feasibility.
In the case of controllers who are not shareholders or equivalent parties, they possess adequate integrity and financial reputation.
Controllers have been approved in the competence assessment process by the Financial Services Authority.

b. Governance Process

Shareholders or equivalent parties have a commitment to carry out necessary efforts if the Company faces financial difficulties.
Shareholders or equivalent parties must have a commitment to the development of the Company's operations.
Shareholders or equivalent parties through the RUPS strive to ensure the Company is operated based on healthy business practices.

c. Governance Outcome

Shareholders or equivalent parties do not interfere in Company operational activities that are the responsibility of the Board of Directors in accordance with the Company's Articles of Association and statutory regulations, except in carrying out rights and obligations as the RUPS.
Shareholders or equivalent parties serving as members of the Board of Directors, members of the Board of Commissioners, or members of the DPS at the same Company must prioritize the interests of the Company and policyholders, insured parties, participants, and/or parties entitled to benefits over their interests as shareholders or equivalent parties.
Shareholders or equivalent parties do not influence or order the Board of Directors, Board of Commissioners, officials, and/or employees of the Company to provide undue benefits.
Shareholders or equivalent parties do not influence or order the Board of Directors, Board of Commissioners, officials, and/or employees of the Company to perform acts violating prudential principles in the financial services sector and/or good corporate management principles.
Shareholders or equivalent parties do not influence or order the Board of Directors, Board of Commissioners, officials, and/or employees of the Company to perform acts violating Sharia principles in the Sharia financial services sector.
Shareholders or equivalent parties do not intervene in the implementation of duties of the Board of Directors and Board of Commissioners causing the Company to experience difficulties, endangering the Company's business continuity, and/or the financial services industry.
Shareholders or equivalent parties demonstrate seriousness and/or take necessary steps to support the Company's strategic plan, reflected in the owners' commitment and efforts to strengthen the Company's capital.

Implementation of Duties and Responsibilities of Committees and Work Units or Functions in the Company

I. Implementation of Duties and Responsibilities of Work Units or Functions in the Company (Under the Board of Directors)

a. Governance Structure

Investment Committee
a) Members of the Investment Committee are:
(1) for Life Insurance Companies and Sharia Life Insurance Companies, at least consisting of:
(a) Board of Directors members overseeing the investment management function; and (b) company actuaries (2) for General Insurance Companies, Sharia General Insurance Companies, Reinsurance Companies, and Sharia Reinsurance Companies, at least consisting of:
(a) Board of Directors members overseeing the investment management function; and (b) company actuaries or company experts b) Members of the Investment Committee have adequate integrity, morality, and expertise.
Insurance Product Development Committee or Work Unit for Insurance Companies and Sharia Insurance Companies
a) The Insurance Product Development Committee ideally consists of:
(1) Directors overseeing the Technical function; (2) Employees performing technical functions; and (3) Employees performing marketing functions. b) The Insurance Product Development Committee or Work Unit is responsible to Board of Directors members overseeing the insurance product development function.
Work Units or Employees Performing Investment Management Functions
a) The Company has work units or employees performing investment management functions, evidenced by the Appointment Letter/Board of Directors Decision and descriptions of duties, authorities, and responsibilities. b) The structure and membership of work units correspond to the complexity of the Company's business and investment portfolio.
Work Units or Officials Responsible for the Implementation of AML and CFT (Anti-Money Laundering and Counter-Terrorism Financing)
a) Special Work Unit
At least consisting of 1 (one) person acting as the leader and 1 (one) person acting as the executor; or b) Appointment of Responsible Officials There are officials appointed as responsible for the implementation of the AML and CFT program. c) Members of the Special Work Unit or appointed officials responsible for the implementation of the AML and CFT program must have adequate integrity, morality, and expertise.
Risk Management Work Units or Functions
a) Risk management work units or functions correspond to the size and complexity of the business, as well as the inherent risk in the Company. b) Risk management work units or functions are independent of business and operational work units (risk-taking units) and of work units performing internal control functions. c) Risk management work units or functions are directly responsible to the President Director or to Directors specifically assigned.
Financial Literacy and Financial Inclusion Functions or Units
a) The Company has formed functions or units to carry out activities to increase Financial Literacy and Financial Inclusion. b) Financial Literacy and Financial Inclusion functions or units are not attached to risk management, internal audit, legal, and compliance functions or units.

b. Governance Process

Investment Committee
The Investment Committee assists the Board of Directors in formulating investment policies and supervising the implementation of established investment policies.
Insurance Product Development Committee or Work Unit
a) The Insurance Product Development Committee or Work Unit formulates strategic plans for insurance product development and marketing as part of the Company's business activity strategic plan. b) The Insurance Product Development Committee or Work Unit evaluates the suitability of new insurance products to be marketed with the strategic plan for insurance product development and marketing. c) The Insurance Product Development Committee or Work Unit evaluates insurance product performance and proposes changes or cessation of marketing.
Work Units or Employees Performing Investment Management Functions
a) Work Units or Employees performing Investment Management functions carry out analysis functions and execute, monitor, and report investment management. b) Work Units or Employees performing Investment Management functions apply internal control systems and procedures to ensure that investments are conducted in accordance with investment policies and strategies and do not violate statutory regulations.
Work Units or Officials Responsible for the Implementation of AML and CFT
a) Work Units or Officials Responsible for the Implementation of AML and CFT periodically analyze risk assessments regarding Money Laundering crimes and/or Terrorism Financing crimes related to Customers (Policyholders and/or Insured parties), countries or geographical areas, products, services, transactions, or distribution networks (delivery channels). b) Work Units or Officials Responsible for the Implementation of AML and CFT formulate, update, and propose policies and procedures for implementing the AML and CFT program that have been prepared to manage and mitigate risks based on risk assessments, for subsequent approval by the Board of Directors. c) Work Units or Officials Responsible for the Implementation of AML and CFT ensure there are systems that can effectively identify, analyze, monitor, and provide reports on the characteristics of transactions conducted by Customers. d) Work Units or Officials Responsible for the Implementation of AML and CFT ensure that formulated policies and procedures are in accordance with changes and developments including, among others, products, services, and technology in the insurance sector, company activities and complexity, company transaction volume, and money laundering and/or terrorism financing modus operandi. e) Work Units or Officials Responsible for the Implementation of AML and CFT ensure that forms related to customers accommodate the data required in the implementation of the AML and CFT program. f) Work Units or Officials Responsible for the Implementation of AML and CFT monitor Customer accounts and the implementation of Customer transactions. g) Work Units or Officials Responsible for the Implementation of AML and CFT evaluate the results of monitoring and analysis of Customer transactions to ensure the existence or non-existence of Suspicious Financial Transactions, Cash Financial Transactions, and/or financial transactions transferring funds from and to foreign countries. h) Work Units or Officials Responsible for the Implementation of AML and CFT account for the results of monitoring and evaluation. i) Work Units or Officials Responsible for the Implementation of AML and CFT ensure the updating of Customer data and profiles as well as Customer transaction data and profiles. j) Work Units or Officials Responsible for the Implementation of AML and CFT ensure that business activities posing high risks for Money Laundering crimes and/or Terrorism Financing crimes are effectively identified in accordance with company policies and procedures and applicable statutory regulations. k) Work Units or Officials Responsible for the Implementation of AML and CFT ensure there are good communication mechanisms from each related work unit to themselves by maintaining information confidentiality and observing anti-tipping-off regulations. l) Work Units or Officials Responsible for the Implementation of AML and CFT conduct supervision regarding the implementation of the AML and CFT program for related
work units. m) Work Units or Officials Responsible for the Implementation of AML and CFT ensure the identification of high-risk areas related to the implementation of the AML and CFT program by referring to statutory regulations and adequate information sources. n) Work Units or Officials Responsible for the Implementation of AML and CFT receive, analyze, and formulate reports on Suspicious Financial Transactions and/or cash financial transactions submitted by work units. o) Work Units or Officials Responsible for the Implementation of AML and CFT formulate reports on Suspicious Financial Transactions, Cash Financial Transactions, and/or financial transactions transferring funds from and to foreign countries. p) Work Units or Officials Responsible for the Implementation of AML and CFT ensure all activities within

implementation of the AML/CFT program is carried out well.

q) The Work Unit or Official Responsible for the Implementation of AML/CFT monitors, analyzes, and recommends training needs regarding the implementation of the AML/CFT program for officials and/or employees of the Company.

Work Unit or Risk Management Function

a) The Work Unit or Risk Management Function identifies Risks, including Inherent Risks in the Company's business activities; b) The Work Unit or Risk Management Function prepares Risk measurement methods; c) The Work Unit or Risk Management Function monitors the implementation of the Risk Management strategy approved by the Board of Directors; d) The Work Unit or Risk Management Function monitors the overall (composite) Risk position, by each type of Risk, by each type of functional activity, and by each type of transaction that is material to equity, and conducts stress testing; e) The Work Unit or Risk Management Function periodically reviews the Risk Management process; f) The Work Unit or Risk Management Function assesses proposals for new activities and/or products; g) The Work Unit or Risk Management Function evaluates the accuracy of models and validity of data used to measure Risks, for Companies using models for internal purposes (internal model); h) The Work Unit or Risk Management Function provides recommendations to business and operational work units (risk-taking units) and/or to the Risk Management Committee, according to their authority; and i) The Work Unit or Risk Management Function prepares and submits Risk Profile reports to the Chief Director or a Director assigned specifically and to the Risk Management Committee periodically.

Financial Literacy and Financial Inclusion Function or Unit

a) The Financial Literacy Function or Unit has:
(1) planned and carried out activities to enhance Financial Literacy; (2) monitored and evaluated the implementation of activities to enhance Financial Literacy carried out by the Company; and (3) provided input to business units conducting research and development of financial products and/or services to develop products and/or services that are appropriate for the needs and capabilities of Consumers and/or the public based on the results of monitoring and evaluation of activities to enhance Financial Literacy.

b) The Financial Inclusion Function or Unit has:
(1) planned and carried out activities to enhance Financial Inclusion; (2) monitored and evaluated activities to enhance Financial Inclusion carried out by the Company; (3) provided input to business units conducting research and development of financial products and/or services to develop products and/or services that are appropriate for the needs and capabilities of Consumers and/or the public; and (4) provided input to the Financial Literacy Function or Unit in preparing Financial Education materials related to financial products and/or services developed.

c. Governance Outcome

Preparation of complete meeting minutes for each meeting held by each Work Unit or function, including clear disclosure and good documentation of dissenting opinions.
Each Work Unit or function has carried out its functions in accordance with regulations, duties, authorities, and responsibilities, for example: providing recommendations to the Board of Directors as per duties.

II. Implementation of Duties and Responsibilities of Committees (Under the Board of Commissioners)

a. Governance Structure

Audit Committee
a) The Audit Committee members consist of at least 3 (three) people comprising:
(1) 1 (one) Chairman who also serves as a member, being an Independent Commissioner; (2) 1 (one) member with expertise in audit, finance, and/or accounting or Sharia accounting; (3) and 1 (one) member with expertise in law and/or insurance. b) One of the Audit Committee members is an outsider to the Company who does not have financial, managerial, shareholding, and/or family relationships with the Board of Commissioners, Board of Directors, and/or controlling shareholders, or other relationships that could affect their ability to act independently. c) Audit Committee members possess adequate integrity, morality, and expertise.
Risk Monitoring Committee
a) The Risk Monitoring Committee members consist of at least:
(1) 1 (one) Chairman who also serves as a member, being an Independent Commissioner; (2) 1 (one) member with expertise in risk management and/or actuarial science; and (3) 1 (one) member with expertise in finance, economics, and/or insurance. b) Risk Monitoring Committee members possess adequate integrity, morality, and expertise.
In the event the Company forms a Remuneration and Nomination Committee:
a) The Remuneration and Nomination Committee members consist of at least:
(1) 1 (one) Chairman who also serves as a member, being a Board of Commissioners member; (2) 1 (one) member from an Independent Commissioner or Independent Party with expertise in human resources; and (3) 1 (one) member from an Executive Official of the Company overseeing human resources or 1 (one) employee representative. b) The Board of Commissioners members referred to in letter a) number (1) are Board of Commissioners members other than Independent Commissioners. c) Executive Officials of the Company overseeing human resources or employee representatives who are members of the Committee must have knowledge of the Company's remuneration, nomination, and succession plan systems.
In the event the Company forms a Corporate Governance Policy Committee:
a) The Corporate Governance Policy Committee members consist of at least:
(1) 1 (one) Chairman who also serves as a member, being a Board of Commissioners member; (2) 1 (one) member from an Independent Commissioner or Independent Party with knowledge and/or experience in corporate governance and/or law; and (3) 1 (one) Executive Official of the Company overseeing compliance, corporate governance, and/or law.
Concurrent positions of independent parties on other Committees and/or other Companies must consider competence, independence criteria, confidentiality, code of ethics, and the implementation of duties and responsibilities.
All independent party members of the Committee do not have financial, managerial, ownership, and/or family relationships with the Board of Directors, Board of Commissioners, and/or controlling shareholders or relationships with the Company that could affect their ability to act independently.

b. Governance Process

Audit Committee
In order to provide recommendations to the Board of Commissioners:
a) The Audit Committee has monitored and evaluated the planning and implementation of audits and monitored the follow-up of audit results to assess the adequacy of internal controls, including the adequacy of the financial reporting process. b) The Audit Committee has reviewed:
(1) the implementation of duties and audit results carried out by work units specializing in internal audit and external auditors; (2) the compliance of audit implementation by public accounting firms with audit standards; (3) the compliance of financial reports with applicable financial accounting standards in Indonesia and regulations in the insurance field; and (4) the follow-up implementation by the Board of Directors on findings from work units specializing in internal audit, public accountants, and the supervision results of the Financial Services Authority (OJK) and/or other supervisory authorities. c) The Audit Committee has provided recommendations for the appointment of public accountants and public accounting firms in accordance with applicable regulations to the General Meeting of Shareholders (GMS) through the Board of Commissioners.
Risk Monitoring Committee
In order to provide recommendations to the Board of Commissioners, the Risk Monitoring Committee has:
a) monitored the implementation of risk management formulated by the Board of Directors and assessed the risk tolerance that can be taken by the Company; b) periodically evaluated the implementation of risk management; c) monitored and evaluated the implementation of duties by the Work Unit or Risk Management Function; and d) periodically evaluated the Risk Monitoring Committee Charter in accordance with developments in legislation.
Remuneration and Nomination Committee
The Remuneration and Nomination Committee has:
a) periodically evaluated the implementation of remuneration policies and submitted evaluation results and recommendations to the Board of Commissioners regarding:
(1) remuneration structure and amount;
(2) remuneration policies for the Board of Directors and Board of Commissioners to be submitted to the GMS; and (3) remuneration policies for employees as a whole to be submitted to the Board of Directors; b) ensured that remuneration policies comply with legislation and periodically evaluated the Committee Charter in accordance with developments in legislation; c) formulated and provided recommendations regarding the system and procedures for assessment, selection, and/or replacement of Board of Directors members, Board of Commissioners members, and Executive Officials of the Company to the Board of Commissioners; d) provided recommendations regarding candidates for Board of Directors and/or Board of Commissioners members to the Board of Commissioners to be submitted to the GMS; e) provided recommendations for candidate Independent Parties who can become Committee members to the Board of Commissioners.
Corporate Governance Policy Committee
The Corporate Governance Policy Committee assists the Board of Commissioners to:
a) assess the Good Corporate Governance policies formulated by the Board of Directors; b) assess the consistency of the implementation of Good Corporate Governance, including those related to business ethics and Corporate Social Responsibility; and c) periodically evaluate the Corporate Governance Policy Committee Charter in accordance with developments in legislation.
Committee meetings are held according to the Company's needs.
Meeting decisions are taken based on deliberation for consensus or majority vote in the event consensus is not reached.

c. Governance Outcome

Preparation of complete meeting minutes for each meeting held by each Committee, including clear disclosure and good documentation of dissenting opinions.
Each Committee has carried out its functions in accordance with regulations, duties, authorities, and responsibilities, for example: providing recommendations to the Board of Commissioners as per duties.

Implementation of the Company's Compliance Function

a. Governance Structure

Compliance Director or Board of Directors Member overseeing the compliance function, who does not concurrently hold the insurance technical function, finance function, or marketing function.
Appointment, dismissal, and/or resignation of the Compliance Director or Board of Directors Member overseeing the compliance function in accordance with the Company's Articles of Association and OJK regulations.
The Company has a work unit or employees who carry out the compliance function and are responsible to the Compliance Director or Board of Directors Member overseeing the compliance function.
The Company provides quality resources to the work unit or employees carrying out the compliance function to complete their tasks effectively.

b. Governance Process

The Director overseeing the compliance function has duties and responsibilities including:
a) ensuring the Company's compliance with legislation, by:
(1) establishing necessary steps considering the principle of prudence; (2) monitoring and ensuring that the Company's business activities do not deviate from regulations; (3) monitoring and ensuring the Company's compliance with all agreements and commitments made by the Company to the Financial Services Authority (OJK) and competent authorities; (4) preparing gap analysis in the event of new legislation; (5) adjusting all SOPs or business activities related to the issuance of new legislation; b) submitting periodic reports on the implementation of duties and responsibilities to the Chief Director, with copies to the Board of Commissioners or competent parties according to the Company's organizational structure; c) formulating strategies to foster a culture of compliance within the Company; d) proposing compliance policies or compliance principles to be established by the Board of Directors; e) establishing the compliance system and procedures to be used to formulate the Company's internal regulations and guidelines; f) ensuring that all policies, regulations, systems, procedures, and business activities carried out by the Company comply with legislation; g) minimizing the Company's compliance risk; h) taking preventive measures to ensure that policies and/or decisions taken by branch office management do not deviate from OJK regulations and legislation; i) carrying out other tasks related to the compliance function.
The appointment of work units or employees carrying out the compliance function must comply with applicable regulations.
The Board of Directors has:
a) approved the Company's compliance policy in the form of a formal document on the effective compliance function; b) been responsible for communicating all policies, guidelines, systems, and procedures to all relevant organizational levels; c) been responsible for creating an effective compliance function as part of the Company's overall compliance policy.
The work unit specializing in the compliance function has duties and responsibilities including:
a) establishing steps to support the creation of a compliance culture in all business activities of the Company at every organizational level; b) identifying, measuring, monitoring, and controlling compliance risks; c) assessing and evaluating the effectiveness, adequacy, and suitability of the Company's policies, regulations, systems, and procedures with legislation; d) conducting reviews and/or recommending updates and improvements to the Company's policies, regulations, systems, and procedures to ensure compliance with legislation; e) making efforts to ensure that the Company's policies, regulations, systems, procedures, and business activities comply with legislation; f) carrying out other tasks related to the compliance function.

c. Governance Outcome

The Company has succeeded in reducing the level of violations against regulations.
The Company has succeeded in building a compliance culture in decision-making and in the Company's operational activities.

Implementation of the Internal Audit Function

a. Governance Structure

The Company has an internal audit work unit.
The internal audit work unit is led by an internal auditor who reports directly to the Chief Director or equivalent and the Board of Commissioners through the Audit Committee.
The appointment and dismissal of internal auditors are conducted in accordance with OJK regulations and other applicable regulations.
The Company has standards for the implementation of the internal audit function consisting of:
Internal Audit Charter;
Internal audit guidelines/manuals which include audit processes and mechanisms and audit work plans.
The Company provides quality resources to the work unit or employees carrying out the internal audit function to complete their tasks effectively.

b. Governance Process

The Board of Directors is responsible for:
a) creating an internal control structure and ensuring the implementation of the Company's internal audit function at every management level; and b) following up on internal audit findings in accordance with the policies and directives of the Board of Commissioners.
The Company implements the internal audit function effectively across all aspects and elements of activities that are directly estimated to affect the interests of the Company and stakeholders.
The Company periodically reviews the effectiveness of the internal audit work unit's implementation and its compliance with internal audit function implementation standards by external parties (e.g., every 3 years).
The internal audit work unit's examination plan, adequacy of examination scope, and depth of examination are adequate.
In the event of deviations in the realization of the internal audit work unit's examination plan, the internal auditor must immediately report it to the Chief Director and the Audit Committee, accompanied by adequate reasons and recommendations for improvement, if necessary.
The Company plans and realizes the continuous improvement of the skills of the internal audit work unit's human resources periodically and sustainably.
The work unit specializing in internal audit has carried out independent supervision functions with adequate scope of duties in accordance with the plan, implementation, and monitoring of audit results.
The work unit specializing in internal audit has carried out duties covering at least the assessment of:
a) the adequacy of the Company's internal control system; b) the effectiveness of the Company's internal control system; and c) performance quality.
The internal audit work unit has reported all examination findings in accordance with applicable regulations.
The internal audit work unit has monitored, analyzed, and reported on the development of improvement follow-up actions carried out by the auditee.
The internal audit work unit has prepared and updated work guidelines and systems and procedures for carrying out tasks for internal auditors periodically in accordance with applicable regulations and legislation.

c. Governance Outcome

Findings from the internal audit work unit's examinations have been followed up, and no recurring findings have occurred.
The internal audit work unit acts objectively in conducting audits.
The internal audit function has been implemented adequately, considering among others:
a) audit programs cover all work units, with implementation considering the risk level of each work unit; b) audit programs and scope are adequate in accordance with generally accepted internal audit principles, including the fulfillment of independence, objectivity, and no restrictions in the scope and coverage of internal audits; and c) the fulfillment of the number and quality of internal auditors.

Implementation of the External Audit Function

a. Governance Structure

Assignment of audits to External Auditors (Public Accountants and Public Accounting Firms) must at least meet the following aspects:
a) Capacity and quality of the appointed Public Accounting Firm (reasons for nomination); b) Legality of the work agreement (including the amount of honorarium or remuneration); c) Scope of audit; d) Professional standards of public accountants; and e) Communication between OJK and the appointed Public Accounting Firm.
External Auditors are appointed by the GMS from candidates for external auditors proposed by the Board of Commissioners based on the Audit Committee's recommendation.

b. Governance Process

In the implementation of financial report audits, the Company appoints Public Accountants and Public Accounting Firms registered with OJK.
The appointment of the same Public Accountant and Public Accounting Firm by the Company must comply with applicable legislation.
The appointment of public accountants and public accounting firms must first obtain GMS approval based on the recommendation of the Audit Committee through the Board of Commissioners.
The appointed public accountants and public accounting firms are able to work independently, meet professional standards of public accountants, and adhere to work agreements and audit scopes established.
Public accountants have communicated with the Financial Services Authority (OJK) regarding the condition of the audited Company in preparation for and implementation of the audit.
Public accountants have conducted audits independently and professionally.
Public Accountants have reported audit results and Management Letters to OJK.

c. Governance Outcome

Audit results and management letters have described significant Company problems and were submitted on time to OJK by the appointed Public Accounting Firm.
The scope of audit results is at least in accordance with the audit scope as regulated in applicable regulations.
Auditors act objectively in conducting audits.

Implementation of Risk Management including Internal Control Systems and Implementation of Information Technology Governance

a. Governance Structure

The Company has an adequate organizational structure to support the implementation of good risk management and internal control, namely the Risk Management Work Unit.
The Company has adequate risk management policies and procedures and the establishment of risk limits.
The Company has an information system organizational structure, information system usage guidelines equipped with instructions and work orders for each function, and data security management guidelines and incident management guidelines (disaster recovery plan).

b. Governance Process

The Board of Directors has clear duties and responsibilities, including:

a) formulate risk management policies including written and comprehensive risk management strategies and frameworks, including the establishment of overall risk limits and limits per risk type, taking into account the level of risk taken and the established risk tolerance. Subsequently, after obtaining approval from the Board of Commissioners, the Board of Directors establishes the aforementioned risk management policies, strategies, and frameworks; b) formulate, establish, and update procedures and tools for identifying, measuring, monitoring, and controlling risks; c) formulate and establish approval mechanisms for transactions, including those exceeding limits and authority for each job level; d) evaluate and/or update risk management policies, strategies, and frameworks at least once (1) in one (1) year or more frequently if there are changes in factors affecting the Company's business activities, risk exposure, and/or risk profile significantly; e) establish an organizational structure including clear authorities and responsibilities at each job level related to the implementation of risk management; f) be responsible for the implementation of risk management policies, strategies, and frameworks approved by the Board of Commissioners and evaluate and provide guidance based on reports submitted by the work units specializing in risk management, including reports regarding the risk profile; g) ensure that all material risks and the impacts arising from such risks have been followed up on and have submitted accountability reports to the Board of Commissioners periodically. The aforementioned reports include, among others, reports on the development and issues related to material risks accompanied by improvement steps that have been, are being, and will be taken; h) ensure the implementation of improvement steps for problems or deviations in the Company's business activities found by the Internal Audit Work Unit; i) develop a risk management culture including risk awareness at all levels of the organization, including adequate communication to all levels of the organization regarding the importance of effective internal controls; j) ensure sufficient financial support and infrastructure to manage and control risks; k) Ensure that the risk management function has been applied independently, reflected among others by the separation of functions between the Risk Management Work Unit which performs risk identification, measurement, monitoring, and control with work units that carry out other operational activities.

The Board of Commissioners has clear tasks and responsibilities, including:
a) approve risk management policies including risk management strategies and frameworks established in accordance with the level of risk taken (risk appetite) and risk tolerance (risk tolerance); b) evaluate risk management policies and risk management strategies at least once (1) in one (1) year or more frequently if there are changes in factors affecting the Company's business activities significantly; and c) evaluate the accountability of the Board of Directors and provide guidance for improvements regarding the implementation of risk management policies periodically. Evaluations are conducted to ensure that the Board of Directors manages the Company's activities and risks effectively.
The Company has implemented comprehensive and reliable risk management, internal control systems, and information technology governance.

c. Governance outcome

The Company implements risk management effectively, adjusted to the objectives, policies, size, and complexity of the business as well as the Company's capabilities.
The Company has reliable, up-to-date, and verifiable data.
The Board of Directors and Board of Commissioners are able to conduct active supervision over the implementation of risk management policies and strategies.

Handling Conflicts of Interest
a. Governance structure
The Company has policies, systems, and procedures for resolving:

conflicts of interest binding every shareholder, Board of Directors, Board of Commissioners, and Company employees;
administration, documentation, and disclosure of the aforementioned conflicts of interest in meeting minutes.

b. Governance process
In the event of a conflict of interest, members of the Board of Directors, members of the Board of Commissioners, and officials one level below the directors do not take actions that can harm or reduce the Company's profits.

c. Governance outcome

Conflicts of interest that can harm the Company or reduce the Company's profits have been disclosed in every decision and have been well documented.
The Company's operational activities are free from intervention by owners or related parties or other parties that can cause conflicts of interest that can harm the Company or reduce the Company's profits.
The Company successfully resolves conflicts of interest that occur.

Transparency of Financial and Non-Financial Conditions
a. Governance structure

The Company has policies and procedures regarding the implementation of transparency of financial and non-financial conditions.
The Company prepares a report on the implementation of good corporate governance at the end of each fiscal year with a scope in accordance with regulations.
Complete, accurate, and timely internal reporting is available, supported by adequate management information systems.
There is a reliable information system supported by competent human resources and adequate information system security (security system).

b. Governance process

The Company has made financial and non-financial conditions transparent to stakeholders, including announcing public financial publication reports and reporting to the Financial Services Authority (OJK) or stakeholders in accordance with regulations.
The Company makes the Company's product information transparent in accordance with regulations governing insurance products and product marketing.
The Company makes the procedure for policyholder and/or insured complaints and dispute resolution transparent to customers in accordance with regulations governing consumer protection.
The Company prepares and presents reports with procedures, types, and scopes as regulated in OJK regulations regarding reporting and publication of financial reports and management aspects.
The Company has prepared a corporate governance implementation report with content and scope at least in accordance with regulations.
In the event that the corporate governance implementation report does not match the Company's actual conditions, the Company immediately submits a complete revision to OJK.
In the event of a difference in the corporate governance factor rating in the results of the self-assessment in the good corporate governance implementation report with the assessment results conducted by OJK, the Company immediately submits a complete revision of the self-assessment to OJK.

c. Governance outcome

The annual report has been submitted by the Company completely and on time to OJK and the Company's Shareholders.
The Company has announced a summary of the audited financial report on the Company's website and in a national Indonesian-language daily newspaper in accordance with regulations.
The Company has announced quarterly financial summaries on the Company's website at the latest 1 (one) month after the end of the respective quarter.
The corporate governance implementation report reflects the Company's actual conditions or in accordance with the results of the Company's self-assessment.

Company Strategic Plan
a. Governance structure

The Company's strategic plan has been prepared in the form of a business plan in accordance with the Company's vision and mission.
The Company's strategic plan is fully supported by Shareholders, reflected among others in the commitment and efforts of shareholders to strengthen the Company's capital.

b. Governance process

The Company has prepared the Company's Business Plan realistically, measurably (achievable) while considering the principle of prudence and responsiveness to internal and external changes.
The Company's business plan is approved by the Board of Commissioners.
The Board of Directors has communicated the Company's business plan to:
a) the Company's shareholders; and b) all levels of the organization within the Company.
The Board of Directors has effectively implemented the Company's business plan.
In the preparation and submission of the business plan, reference was made to OJK regulations on Business Plans, and the Company has considered:
a) external factors and internal factors that can affect the Company's business continuity; b) the principle of prudence; c) the implementation of risk management; and d) sound business practices and best practice standards.
The Board of Commissioners has conducted supervision over the implementation of the Company's business plan.
Shareholders demonstrate and/or take necessary steps to support the Company's strategic plan, reflected among others in the commitment and efforts of Shareholders to strengthen the Company's capital.

c. Governance outcome

The Company's business plan is prepared by the Board of Directors and approved by the Board of Commissioners.
The Company's business plan and its realization have been communicated by the Board of Directors to controlling shareholders and all levels of the organization within the Company.
The Company's business plan describes the Company's sustainable growth.
The Company's growth provides economic and non-economic benefits to Stakeholders.
The Company's strategic plan is prepared based on a comprehensive study considering business opportunities and the Company's strengths while identifying weaknesses and threats (Strength, Weakness, Opportunity, Threat/SWOT Analysis).
The Company's strategic plan must be supported by adequate infrastructure preparation, including human resources, information technology, office networks, as well as policies and procedures.
There is no intervention by Shareholders in the distribution of the Company's finances without considering efforts to accumulate capital to support the Company's strategic plan.
Shareholders are able to overcome worsening capital conditions or the Company's capital being less than the amount stipulated in accordance with OJK regulations regarding minimum equity.

Conclusion:
Based on the analysis of all the aforementioned assessment criteria or indicators, it is concluded that:
A. Governance structure

Strengths of the Company's governance structure aspect are.....
Weaknesses of the Company's governance structure aspect are.....
B. Governance process
Strengths of the Company's governance process aspect are.....
Weaknesses of the Company's governance process aspect are.....
C. Governance outcome
Strengths of the Company's governance outcome aspect are.....
Weaknesses of the Company's governance outcome aspect are.....

Table I.B: Guidelines for Determining the Rating of Good Corporate Governance Factors
Rating Definition
1 Reflects that the Company's Management has implemented good corporate governance which is generally very good. This is reflected in the very adequate fulfillment of good corporate governance principles. In the event there are weaknesses in the implementation of good corporate governance principles, then generally such weaknesses are not significant and can be immediately improved by the Company's management. 2 Reflects that the Company's Management has implemented good corporate governance which is generally good. This is reflected in the adequate fulfillment of good corporate governance principles. In the event there are weaknesses in the implementation of good corporate governance principles, then generally such weaknesses are less significant and can be resolved with normal actions by the Company's management. 3 Reflects that the Company's Management has implemented good corporate governance which is generally quite good. This is reflected in the quite adequate fulfillment of good corporate governance principles. In the event there are weaknesses in the implementation of good corporate governance principles, then generally such weaknesses are quite significant and require considerable attention from the Company's management. 4 Reflects that the Company's Management has implemented good corporate governance which is generally less good. This is reflected in the less adequate fulfillment of good corporate governance principles. In the event there are weaknesses in the implementation of good corporate governance principles, then generally such weaknesses are significant and require comprehensive improvement by the Company's management. 5 Reflects that the Company's Management has implemented good corporate governance which is generally not good. This is reflected in the inadequate fulfillment of good corporate governance principles. In the event there are weaknesses in the implementation of good corporate governance principles, then generally such weaknesses are very significant and difficult to be improved by the Company's management.

This copy is in accordance with the original
Legal Director 1
Legal Department signed
Mufli Asmawidjaja

Established in Jakarta on January 15, 2021
EXECUTIVE HEAD OF SUPERVISOR
OF INSURANCE, PENSION FUNDS,
FINANCING INSTITUTIONS, AND
OTHER FINANCIAL SERVICE INSTITUTIONS
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA, signed
RISWINANDI

APPENDIX II
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 1 /SEOJK.05/2021 REGARDING ASSESSMENT OF THE HEALTH LEVEL OF INSURANCE COMPANIES, REINSURANCE COMPANIES, SHARIA INSURANCE COMPANIES AND SHARIA REINSURANCE COMPANIES

ASSESSMENT OF RISK PROFILE FACTORS
HEALTH LEVEL ASSESSMENT OF INSURANCE COMPANIES, REINSURANCE COMPANIES, SHARIA INSURANCE COMPANIES AND SHARIA REINSURANCE COMPANIES Strategic Risk Assessment
Table II.A.1: Parameters or Indicators for Assessing Inherent Risk for Strategic Risk
Table II.A.2: Guidelines for Determining Inherent Risk Level for Strategic Risk
Table II.A.3: Guidelines for Determining the Quality of Risk Management Implementation for Strategic Risk
Operational Risk Assessment
Table II.B.1: Parameters or Indicators for Assessing Inherent Risk for Operational Risk
Table II.B.2: Guidelines for Determining Inherent Risk Level for Operational Risk
Table II.B.3: Guidelines for Determining the Quality of Risk Management Implementation for Operational Risk
Insurance Risk Assessment
Table II.C.1: Parameters or Indicators for Assessing Inherent Risk for Insurance Risk
Table II.C.2: Guidelines for Determining Inherent Risk Level for Insurance Risk
Table II.C.3: Guidelines for Determining the Quality of Risk Management Implementation for Insurance Risk
Credit Risk Assessment
Table II.D.1: Parameters or Indicators for Assessing Inherent Risk for Credit Risk
Table II.D.2: Guidelines for Determining Inherent Risk Level for Credit Risk
Table II.D.3: Guidelines for Determining the Quality of Risk Management Implementation for Credit Risk
Market Risk Assessment
Table II.E.1: Parameters or Indicators for Assessing Inherent Risk for Market Risk
Table II.E.2: Guidelines for Determining Inherent Risk Level for Market Risk
Table II.E.3: Guidelines for Determining the Quality of Risk Management Implementation for Market Risk
Liquidity Risk Assessment
Table II.F.1: Parameters or Indicators for Assessing Inherent Risk for Liquidity Risk
Table II.F.2: Guidelines for Determining Inherent Risk Level for Liquidity Risk
Table II.F.3: Guidelines for Determining the Quality of Risk Management Implementation for Liquidity Risk
Legal Risk Assessment
Table II.G.1: Parameters or Indicators for Assessing Inherent Risk for Legal Risk
Table II.G.2: Guidelines for Determining Inherent Risk Level for Legal Risk
Table II.G.3: Guidelines for Determining the Quality of Risk Management Implementation for Legal Risk
Compliance Risk Assessment
Table II.H.1: Parameters or Indicators for Assessing Inherent Risk for Compliance Risk
Table II.H.2: Guidelines for Determining Inherent Risk Level for Compliance Risk
Table II.H.3: Guidelines for Determining the Quality of Risk Management Implementation for Compliance Risk
Reputational Risk Assessment
Table II.I.1: Parameters or Indicators for Assessing Inherent Risk for Reputational Risk
Table II.I.2: Guidelines for Determining Inherent Risk Level for Reputational Risk
Table II.I.3: Guidelines for Determining the Quality of Risk Management Implementation for Reputational Risk
Table II.J: Format for Risk Assessment Analysis 225
Table II.K: Format for Determining Composite Risk Profile 226
Table II.L: Guidelines for Determining the Rating of Risk Profile Factors

Filling Instructions:

The Company conducts the assessment of the Company's Health Level and Sharia Unit using an individual risk-based approach with an assessment scope covering risk profile factors in accordance with Appendix II.
The parameters or indicators for assessing risk profile factors in Appendix II are minimum standards that must be used in conducting risk profile factor assessments.
The Company may add other parameters or indicators in accordance with the characteristics and complexity of the Company's business.
Assessments are conducted per position and period for the last 12 (twelve) months for parameters or indicators that are quantitative.
For certain parameters or indicators, assessments may be conducted by considering trends for at least a period of 3 (three) years.
In assessing the Company's Health Level on a consolidated basis, the Company may use the Company's individual risk profile factor assessment parameters or indicators, adjusted to the scale, characteristics, and complexity of the Subsidiary Company's business.

Table II.A.1: Parameters or Indicators for Assessing Inherent Risk for Strategic Risk
No Parameter Indicator Description
I Quantitative
A. FOR INSURANCE COMPANIES AND REINSURANCE COMPANIES

Ratio of realization to target
a. Gross Premium current period gross premium x 100% projected current period gross premium Clear. b. Claims current period net claim expense x100% projected current period net claim expense Clear.
c. Underwriting Result
current period underwriting result x 100% projected current period underwriting result Clear. d. Investment Result current period investment result x 100% projected current period investment result Clear. e. Business Profit Clear.

No Parameter Indicator Description profit after tax current period x 100% projected current period business profit
2. Realization of new product development against target
Comparison of realization to target:
realization of new product development new product development plan Clear.
3. Realization of office network development against target
Comparison of realization to target:
realization of office network development office network development plan Clear.
4. Growth of new policy premiums
gross premium of new policy n – gross premium of new policy n-1 gross premium of new policy n-1 Premiums that grow from new policies indicate growth in the number of policyholders/insured. This also indicates that Insurance Companies and Reinsurance Companies not only increase premiums from policyholders/insured who continue coverage but also premiums from new policyholders/insured. The smaller the ratio of premiums from new policies, the greater the strategic risk of Insurance Companies and Reinsurance Companies.

Ratio of profit growth from main business
insurance profit n – insurance profit n-1 insurance profit n-1 Profit growth will increase the value of Insurance Companies and Reinsurance Companies, especially for shareholders' interests. Profit growth will also better support the achievement of strategic objectives of Insurance Companies and Reinsurance Companies. A continuously worsening profit growth ratio indicates that the strategic risk of Insurance Companies and Reinsurance Companies will increase.

B. FOR SHARIA INSURANCE COMPANIES, SHARIA REINSURANCE COMPANIES, AND SHARIA UNITS

Comparison of realization to target
a. Gross Contribution
Gross contribution TW to-n (combined)
(projected gross contribution of company funds current period + projected gross contribution of tabarru' funds current period + projected gross contribution of participant investment funds current period) Achievement of targets indicates one of the success tools of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units in setting targets at the beginning of the year. Risk will arise if one or more than targets in this ratio have high deviation between achievement and target or the target is not achieved. b. Claims (gross claims TW to-n (tabarru' funds) + withdrawal of participant investment funds due participant investment funds current period + withdrawal of participant investment funds not yet due participant investment funds current period) (projected gross claims tabarru' funds current period + projected withdrawal of participant investment funds due participant investment funds current period + projected withdrawal of participant investment funds not yet due participant investment funds current period)

c. Underwriting Surplus/Deficit
current period underwriting surplus (deficit) projected current period underwriting surplus (deficit)

d. Investment Result total investment result TW to-n (G=combined) (projected gross contribution of company funds current period + projected gross contribution of tabarru' funds current period + projected gross contribution of participant investment funds current period)

e. Business Profit of Company Funds profit after tax of company funds current period projected business profit of company funds current period

Realization of new product development against target
Comparison of realization to target:
number of new products target product development Target products and new office networks indicate that Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units...

No Parameter Indicator Description
3. Realization of office network development against target
Comparison of realization against target:
number of new office networks
/ target office networks
Further developing the market so that it is expected that penetration in the form of more product variations and a wider office network will increase the achievement of strategic objectives for Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units.

Growth of new gross policy contribution
New gross policy contribution n – new gross policy contribution n-1 / new gross policy contribution n-1 Growth in contributions from new policies indicates growth in the number of policyholders/participants of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units. This also indicates that Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units not only increase contributions from policyholders/participants who continue coverage but also from new policyholders/participants. The smaller the ratio of contributions from new policies, the greater the strategic risk of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units.

No Parameter Indicator Description
5. Ratio of profit growth from company funds from core business company funds
[Profit (loss) from company fund insurance business in Period n – Profit (loss) from company fund insurance business in Period n-1] / Profit (loss) from company fund insurance business in Period n-1 Profit growth will increase the company's value, especially for shareholders' interests. Profit growth will also better support the achievement of strategic objectives for Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units. A continuously worsening profit growth ratio indicates that the strategic risk of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units will increase.

II. Qualitative

Alignment of business strategy with the Company's vision and mission and business environment conditions
a. Stages or mechanisms for strategic plan formulation by the Board of Directors.
In formulating a strategic plan, the Company needs to consider various aspects so that the formulated plan can be achieved as expected. In addition, strategic plan formulation also requires consistency while still paying attention to changes that occur. The existence of clear stages and mechanisms in formulating strategy will reduce the risk of formulating plans that do not match the Company's internal and external conditions. Therefore, the absence of stages and mechanisms for formulating strategic plans will increase the Company's strategic risk.

No Parameter Indicator Description b. Board of Directors' understanding of the Company's overall strategic plan.
As the main party responsible for the strategic plan, the Company's Board of Directors is required to understand the entire strategic plan that has been established. To know the sustainability and achievability of the formulated strategic plan, the Board of Directors must conduct joint evaluations with Company officials so that if the strategic plan is indicated to be unachievable, the Board of Directors can immediately take action so that the Company's strategic risk does not become higher.

No Parameter Indicator Description
c. The Company's process in formulating business strategy and changes in business strategy carried out (if any).
After the Company has formal stages and mechanisms in formulating a strategic plan, in practice, the Company must ensure that the process in establishing the strategic plan has followed the formal reference. The process carried out must also be depicted in formal Company documents, for example: meeting minutes and other internal documents that show the process has been carried out. This also applies if there are changes to the Company's strategic plan. If the strategy establishment process is not written down formally, the strategic risk will be even greater, especially if the Company does not carry out the process contained in the established internal regulations.

d. Alternative strategy (contingent/emergent strategy) in the event of changes in the business environment that have been anticipated.
In establishing the Company's strategic plan, it is also necessary to prepare alternative strategies to mitigate risk if the strategic plan established at the beginning has a high risk of not being achieved. This anticipation is carried out mainly for strategic plans that will directly affect the Company's operational activities. Examples include: for example, premium/contribution targets that based on the Board of Directors' evaluation will not be achieved.

e. Consideration of internal and external business factors in establishing the Company's strategic objectives.
Internal factors, including:

vision, mission, and business direction that the Company wants to achieve;
organizational culture, especially in establishing strategic objectives which require changes in organizational structure and adjustment of business processes;
organizational capability factors which include, among others: human resources, infrastructure, and management information systems; and
risk tolerance level, which is the Company's financial ability level to absorb risks that may arise.
External factors, including:
macroeconomic conditions (economic growth, relevant government policies, interest rate levels, or inflation);
technological development; and
level of business competition.

Choice of Business Strategy Level, namely: high-risk strategy and low-risk strategy
The Company's choice of strategy whether it tends to use high-risk strategy or low-risk strategy.

Example of high-risk strategy in the event the Company plans to enter a new area, either in the form of a new market share, offering new products/services, or attracting new policyholders/participants but not accompanied by readiness of human resources, infrastructure, facilities and infrastructure that support, and others.
Example of low-risk strategy in the event the Company carries out business activities in market shares and policyholders/participants that have been known previously (familiar market and customer) by the Company, or providing products that have risk characteristics that have long been marketed by the Company.

No Parameter Indicator Description
3) The higher the risk taken by the Company, the higher the strategic risk will be. In this condition, sufficient risk mitigation is needed so that the Company is avoided from failing to achieve its strategic risk.

Company's Strategic Position in the Insurance Industry
a. Market where the Company carries out business activities. These 5 factors indicate the Company's strategic position in the insurance industry. The Company must pay attention to these factors to know how large the strategic plan established by the Company will succeed or fail. The extent of the Company's success or failure in achieving objectives can be assessed based on the Company's position in the market and competitive advantages owned, both against peer groups and the insurance industry as a whole. b. Adequacy of analysis of competitive advantages owned by the Company compared to its competitors.
c. Efficiency in carrying out business activities.
d. Company's strategy in maintaining or increasing strategic position in the market, which will be carried out by the Company in business activities, operational coverage area or others. e. Company's readiness to face macroeconomic changes and their impact on Company conditions, including interest rate levels, inflation, and exchange rates.
Achievement of business realization a. Level of deviation in business plan achievement. The Company identifies factors causing deviation

No Parameter Indicator Description business plan intended so that it can conclude whether similar cause factors have the potential to disrupt the success of the Company's strategy currently and in the future. b. Trend of business plan deviation level. The Company's strategic risk profile has the potential to increase in the short term, so the assessment of the deviation level can be carried out without having to wait for the annual realization report of strategic achievement, for example, carried out quarterly.
c. Adequacy of documentation of factors causing business plan deviation.
The Company must formally document all causes of unachieved strategic plans. This document will subsequently become one of the information sources both when conducting evaluations and when formulating the next strategic plan.

Table II.A.2: Guidelines for Determining the Level of Inherent Risk for Strategic Risk
Ranking Definition Ranking
Rank 1
(Low)
Considering the business activities carried out by the Company, the possibility of losses and failures faced by the Company in fulfilling obligations to policyholders, policyholders/participants caused by strategic risk is classified as very low during a certain period in the future. Examples of Company characteristics included in rank 1 (low) include the following:
a. The Company continues existing strategies in accordance with business environment conditions with a high level of strategy success; b. The Company's strategy is classified as conservative or low risk;
c. The Company's business activities are classified as stable, marketed insurance products are not complex and are well diversified across several business lines;
d. The Company has stable competitive advantages and there are no threats from competitors; and e. The Company's business plan achievement is very adequate.
Rank 2
(Low
Moderate)
Considering the business activities carried out by the Company, the possibility of losses and failures faced by the Company in fulfilling obligations to policyholders, policyholders/participants caused by strategic risk is classified as low during a certain period in the future. Examples of Company characteristics included in rank 2 (low moderate) include the following:
a. The Company continues the same strategy or has several new strategies in accordance with business environment conditions but still within the Company's core business and competence; b. The Company's strategy is low risk but with an increasing trend;
c. The Company's business activities and/or marketed insurance products are classified as not complex and diversified;
d. The Company has competitive advantages and competitor threats are classified as minor; and e. The Company's business plan achievement is adequate.
Rank 3
(Moderate)
Considering the business activities carried out by the Company, the possibility of losses and failures faced by the Company in fulfilling obligations to policyholders, policyholders/participants caused by strategic risk is classified as moderate during a certain period in the future.

Ranking Definition Ranking
Examples of Company characteristics included in rank 3 (moderate) include the following:
a. The Company applies strategies to enter new businesses or markets in accordance with business environment conditions with a determinable level of success; b. The Company's strategy is classified as moderately risky;
c. The Company's business activities and/or marketed insurance products are generally diversified, but some are classified as complex;
d. The Company has moderate competitive advantages and there are threats from competitors; and e. The Company's business plan achievement is fairly adequate.
Rank 4
(Moderate
High)
Considering the business activities carried out by the Company, the possibility of losses and failures faced by the Company in fulfilling obligations to policyholders, policyholders/participants caused by strategic risk is classified as fairly high during a certain period in the future. Examples of Company characteristics included in rank 4 (moderate high) include the following:
a. The Company applies strategies to enter new businesses or markets in accordance with business environment conditions with an undeterminable level of success; b. The Company's strategy is classified as moderately risky but with an increasing trend;
c. Some of the Company's business activities and/or marketed insurance products are concentrated and classified as complex;
d. The Company lacks competitive advantages, or there are significant threats from competitors; and e. The Company's business plan achievement is less adequate.
Rank 5
(High)
Considering the business activities carried out by the Company, the possibility of losses and failures faced by the Company in fulfilling obligations to policyholders, policyholders/participants caused by strategic risk is classified as very high during a certain period in the future. Examples of Company characteristics included in rank 5 (high) include the following:
a. The majority of the Company's strategies shift to new areas that are not the Company's core business and competence; b. The Company's strategy is classified as high risk;

Ranking Definition Ranking
c. The Company's business activities and/or marketed insurance products are very concentrated and classified as complex;
d. The Company has no competitive advantages and there are very significant threats from competitors; and e. The Company's business plan achievement is inadequate.

Table II.A.3: Guidelines for Determining the Quality of Risk Management Implementation for Strategic Risk
Ranking Definition Ranking
Rank 1
(Strong)
The quality of risk management implementation for strategic risk is very adequate, there are minor weaknesses that are not significant so they can be ignored.
Examples of Company characteristics included in rank 1 (strong) include the following:
a. formulation of the level of risk to be taken (risk appetite) and risk tolerance (risk tolerance) is very adequate and has aligned with the Company's overall strategic objectives and business strategy; b. Board of Directors, Board of Commissioners and/or DPS have very adequate awareness and understanding regarding risk management for strategic risk, sources of strategic risk and the level of strategic risk at the Company;
c. risk management culture for strategic risk is very strong and has been internalized very well at all organizational levels;
d. performance of duties by the Board of Directors, Board of Commissioners, and/or DPS as a whole is very adequate; e. risk management function for strategic risk is independent, has clear duties and responsibilities, and has run very well; f. delegation of authority is controlled and monitored periodically, and has run very well; g. risk management strategy for strategic risk is very aligned with the level of risk to be taken and strategic risk tolerance; h. policies and procedures for setting limits for strategic risk are very adequate and available for all areas of risk management for strategic strategy, aligned with implementation, and well understood by employees;
i. risk management process for strategic risk is very adequate in identifying, measuring, monitoring, and controlling strategic risk;
j. risk management information system for strategic risk is very good so as to produce comprehensive and integrated strategic risk reports to the Board of Directors, Board of Commissioners, and/or DPS; k. human resources are very adequate in terms of quantity and quality in the risk management function for strategic risk;
l. internal control system is very effective in supporting the implementation of risk management for strategic risk;
m. implementation of independent review by internal audit work units and functions that conduct independent reviews is very adequate both in terms of methodology, frequency, and reporting to the Board of Directors, Board of Commissioners, and/or DPS; n. generally there are no significant weaknesses based on independent review results; and o. follow-up on independent reviews has been carried out very adequately. p. the compliance function for strategic risk has very clear duties and responsibilities and has run very well; and q. the Company's policies, regulations, systems, and procedures, and business activities are very in accordance with statutory regulations. Rank 2 (Quite Strong) The quality of risk management implementation for strategic risk is adequate. Although there are some minor weaknesses, they can be resolved in the short term (in normal business activities). Examples of Company characteristics included in rank 2 (quite strong) include the following:
a. formulation of the level of risk to be taken (risk appetite) and risk tolerance (risk tolerance) is adequate and has aligned with the Company's overall strategic objectives and business strategy; b. Board of Directors, Board of Commissioners and/or DPS have adequate awareness and understanding regarding risk management for strategic risk, sources of strategic risk, and the level of strategic risk at the Company;
c. risk management culture for strategic risk is strong and has been internalized well at all organizational levels;
d. performance of duties by the Board of Directors, Board of Commissioners and/or DPS is generally adequate, there are some weaknesses but not significant and can be repaired immediately; e. risk management function for strategic risk has clear duties and responsibilities and has run well. There are minor weaknesses, but they can be resolved in normal business activities; f. delegation of authority is controlled and monitored periodically and has run well; g. risk management strategy for strategic risk is aligned with the level of risk to be taken and strategic risk tolerance;

Ranking Definition Ranking h. policies and procedures for setting limits for strategic risk are adequate and available for all areas of risk management for strategic risk, aligned with implementation, and well understood by employees although there are minor weaknesses;
i. risk management process for strategic risk is adequate in identifying, measuring, monitoring, and controlling strategic risk;
j. risk management information system for strategic risk is good including strategic risk reporting to the Board of Directors, Board of Commissioners, and/or DPS although there are minor weaknesses but can be easily repaired; k. human resources are adequate both in terms of quantity and quality of competence in the risk management function for strategic risk;
l. internal control system is effective in supporting the implementation of risk management for strategic risk;
m. implementation of independent review by internal audit work units and functions that conduct independent reviews is adequate both in terms of methodology, frequency, and reporting to the Board of Directors and Board of Commissioners and/or DPS; n. there are weaknesses but not significant based on independent review results; o. follow-up on independent reviews has been carried out adequately; p. the compliance function for strategic risk has clear duties and responsibilities and has run well; and q. the Company's policies, regulations, systems, and procedures, and business activities are in accordance with statutory regulations. Rank 3 (Fair) The quality of risk management implementation for strategic risk is fairly adequate. Although minimum requirements are met, there are some weaknesses that require the Company's management attention. Examples of Company characteristics included in rank 3 (fair) include the following:
a. formulation of the level of risk to be taken (risk appetite) and risk tolerance (risk tolerance) is fairly adequate but not always aligned with the Company's overall strategic objectives and business strategy; b. Board of Directors, Board of Commissioners and/or DPS have fairly adequate awareness and understanding regarding risk management for strategic risk, sources of strategic risk, and the level of strategic risk at the Company;
c. risk management culture for strategic risk is fairly strong and has been internalized fairly well but not always implemented consistently;
d. performance of duties by the Board of Directors, Board of Commissioners, and/or DPS is generally fairly adequate, but there are weaknesses in some assessment aspects that need management attention; e. risk management function for strategic risk is fairly good, but there are some weaknesses that require management attention; f. delegation of authority is fairly good, but control and monitoring are not always carried out well; g. risk management strategy for strategic risk is fairly aligned with the level of risk to be taken and strategic risk tolerance; h. policies and procedures for setting limits for strategic risk are fairly adequate but not always consistent with implementation;
i. risk management process for strategic risk is fairly adequate in identifying, measuring, monitoring, and controlling strategic risk;
j. risk management information system for strategic risk meets minimum expectations but there are some weaknesses including reporting to the Board of Directors, Board of Commissioners and/or DPS that require management attention; k. human resources are fairly adequate both in terms of quantity and quality of competence in the risk management function for strategic risk;
l. internal control system is fairly effective in supporting the implementation of risk management for strategic risk;
m. implementation of independent review by internal audit work units and functions that conduct independent reviews is fairly adequate. There are some weaknesses in methodology, frequency, and/or reporting to the Board of Directors, Board of Commissioners and/or DPS that require management attention; n. there are fairly significant weaknesses based on independent review results that require management attention; o. follow-up on independent reviews has been carried out fairly adequately;

Rating Definition

p. compliance function for strategic risk has duties and responsibilities that are not clear and has not been running well; and q. policies, provisions, systems, and procedures, as well as business activities conducted by the Company are not sufficiently in accordance with the provisions of legislation.

Rating 4
(Weak)
The quality of strategic risk management implementation is inadequate (classified as weak). There are several fundamental weaknesses in various aspects of strategic risk management that require immediate corrective action.

Examples of characteristics of Companies included in Rating 4 (weak) include the following:
a. formulation of the level of risk to be taken (risk appetite) and risk tolerance is inadequate and not aligned with strategic objectives and overall business strategy; b. there are significant weaknesses in the awareness and understanding of the Board of Directors, Board of Commissioners and/or DPS regarding strategic risk management, sources of strategic risk, and the level of strategic risk in the Company;
c. strategic risk management culture is weak and has not been well internalized at every level of the organization;
d. the implementation of duties by the Board of Directors, Board of Commissioners and/or DPS is generally inadequate, but weaknesses in various aspects of assessment require immediate improvement; e. there are significant weaknesses in the strategic risk management function that require immediate improvement; f. delegation of authority is poor, not controlled and not monitored well; g. strategic risk management strategy is not aligned with the level of risk to be taken and strategic risk tolerance; h. there are significant weaknesses in policies, procedures, and setting of strategic risk limits;
i. the strategic risk management process is inadequate in identifying, measuring, monitoring, and controlling strategic risk;
j. there are significant weaknesses in the strategic risk management information system, including reporting to the Board of Directors, Board of Commissioners and/or DPS that require immediate improvement; k. human resources are inadequate in terms of quantity and competence in the strategic risk management function;
l. the internal control system is less effective in supporting the implementation of strategic risk management;
m. the implementation of independent review by the internal audit unit and functions conducting independent review is inadequate. There are weaknesses in methodology, frequency, and/or reporting to the Board of Directors, Board of Commissioners and/or DPS that require immediate improvement; n. there are significant weaknesses based on independent review results that require immediate corrective action; o. follow-up on independent review is inadequate; p. the compliance function for strategic risk has duties and responsibilities that are not clear and has been running poorly; and q. policies, provisions, systems, and procedures, as well as business activities conducted by the Company are not in accordance with the provisions of legislation.

Rating 5
(Very Weak)
The quality of strategic risk management implementation is inadequate (very weak). There are significant weaknesses in various aspects of strategic risk management whose resolution is beyond the capability of the Company's management.

Examples of characteristics of Companies included in Rating 5 (weak) include the following:
a. formulation of the level of risk to be taken (risk appetite) and risk tolerance is inadequate and there is no connection with strategic objectives and overall business strategy; b. awareness and understanding of the Board of Directors, Board of Commissioners and/or DPS regarding strategic risk management, sources of strategic risk, and the level of strategic risk in the Company is very weak;
c. strategic risk management culture is not strong or does not exist at all;
d. the implementation of duties by the Board of Directors, Board of Commissioners and/or DPS is inadequate. There are significant weaknesses in almost all aspects of assessment and the resolution is beyond the Company's capability; e. there are significant weaknesses in the strategic risk management function that require fundamental improvement; f. delegation of authority is very weak or non-existent; g. strategic risk management strategy is not aligned with the level of risk to be taken and strategic risk tolerance; h. there are very significant weaknesses in policies, procedures, and setting of limits for strategic risk;
i. the strategic risk management process is inadequate in identifying, measuring, monitoring, and controlling strategic risk;
j. there are fundamental weaknesses in the strategic risk management information system; k. human resources are inadequate in terms of quantity and competence in the strategic risk management function;
l. the internal control system is ineffective in supporting the implementation of strategic risk management;
m. the implementation of independent review by the internal audit unit and functions conducting independent review is inadequate. There are weaknesses in methodology, frequency, and/or reporting to the Board of Directors, Board of Commissioners and/or DPS that require fundamental improvement; n. there are very significant weaknesses based on independent review results whose corrective actions are beyond the capability of the Company's management; o. follow-up on independent review is inadequate or non-existent; p. the compliance function for strategic risk has duties and responsibilities that are not clear and has been running poorly; and q. policies, provisions, systems, and procedures, as well as business activities conducted by the Company are not in accordance with the provisions of legislation.

Table II.B.1: Parameters or Indicators for Assessing Inherent Risk for Operational Risk

No Parameter Indicator Description
I Quantitative
A. FOR INSURANCE COMPANIES AND REINSURANCE COMPANIES

Gross premium growth
[Current quarter gross premium - Previous year same quarter gross premium] / Previous year same quarter gross premium Positive premium growth can be interpreted as the Insurance Company and Reinsurance Company's ability to manage operations becoming lower. Risk will emerge if premiums grow negatively, thereby disrupting the ability of Insurance and Reinsurance Companies to meet obligations to policyholders and/or insureds, as well as for daily operational expenses of Insurance and Reinsurance Companies.
Ratio of premium receivables to gross premium
Current period premium receivables / Gross premium current period This ratio indicates the ability of Insurance and Reinsurance Companies to manage their premiums. A higher ratio indicates an increase in operational risk of Insurance and Reinsurance Companies. This can be caused, among other things, by high premium receivables and/or worsening gross premium growth.
Business expense growth
Business expense growth = (Total operational expenses) R4Q -1 / (Total operational expenses) (R4Q t-1) R4Q = sum of the last 4 quarters Expenses can indicate the level of activity and changes in the size and complexity of an entity's business. Any growth in expenses indicates that business activities are changing (strategy and planning) or high growth in policy acquisition costs may indicate new business growth. Risk can emerge from increasingly high business expenses.
Ratio of commission expenses to gross premium
Current period commission expenses / Gross premium current period Commission is part of the gross premium that becomes the right of agents/brokers or other Insurance and Reinsurance Companies in relation to the services provided in closing coverage, both directly and indirectly. The larger the ratio of commission expenses to gross premium, the greater the risk of reduced gross premium to support the operational activities of Insurance and Reinsurance Companies.
Ratio of operational costs incurred to affiliates compared to total operational costs
Operational costs incurred to affiliates / Total operational costs Increasing operational costs related to affiliates will increase the operational risk of Insurance and Reinsurance Companies.
Growth of operational risk (from Risk-Based Minimum Capital/MMBR)
[Operational risk period t) - (Operational risk period t-1] / Operational risk period t-1 Knowing the growth of operational risk in the solvency calculation. Risk will increase if operational risk increases compared to the operational risk of the previous year.
Number of internal and external fraud history
Number of fraud in the last 3 (three) year period Fraud assessment is conducted against the frequency or materiality of fraud that has occurred in previous assessment periods, including potential fraud that may arise from weaknesses in business aspects, human resources, information technology, and external events. The more/significant fraud that has been committed, the greater the operational risk of Insurance and Reinsurance Companies.
Number of system disturbance incidents causing transaction process failure
Number of information technology system disturbance incidents in the last 3 (three) year period Information technology systems are important infrastructure in the operational activities of Insurance and Reinsurance Companies. When information technology systems are disturbed, whether due to internal or external disturbances, operational risk will increase.
Employee turnover ratio
Employee turnover ratio = Number of employees leaving / Average number of employees Average number of employees = (Number of employees at the beginning of the year + Number of employees at the end of the year) / 2 The larger the turnover ratio, the greater the operational risk of Insurance and Reinsurance Companies. In addition to Insurance and Reinsurance Companies having to find replacements that have at least the same qualifications, Insurance and Reinsurance Companies also risk having to expend additional funds for the development of new employees outside of routine development that has been strategically established by Insurance and Reinsurance Companies.
Expense ratio (expense ratio)
Business expenses (expense) / Net premium earned To determine the level of efficiency of Insurance and Reinsurance Companies in conducting their business or the costs incurred. a) Business expenses are expenses incurred by Insurance and Reinsurance Companies in conducting their business, including marketing expenses, general and administrative expenses, management expenses, and other business expenses as stated in the financial performance report. b) Net premium income is calculated from premium income minus reinsurance premiums plus the decrease (increase) in Reserve for Unearned Premiums (CAPYBMP) as stated in the financial performance report.

B. FOR SHARIA INSURANCE COMPANIES, SHARIA REINSURANCE COMPANIES, AND SHARIA UNITS

Gross contribution growth
[Current quarter n gross contribution growth - Previous quarter n-1 gross contribution growth] / Previous quarter n-1 gross contribution growth Positive contribution growth can be interpreted as the ability of Sharia Insurance Companies, Sharia Reinsurance Companies, and/or Sharia Units to manage operations becoming lower. Risk will emerge if contributions grow negatively, thereby disrupting the ability of Sharia Insurance Companies, Sharia Reinsurance Companies and/or Sharia Units to meet obligations to participants (tabarru' funds) as well as for daily operational expenses of Sharia Insurance Companies, Sharia Reinsurance Companies and/or Sharia Units (company funds).
Ratio of contribution receivables to gross contribution
(Direct and indirect closing contribution receivables Quarter n (tabarru' funds) + Direct and indirect closing Ujrah receivables Quarter n (company funds) + Direct closing Ujrah receivables Quarter n (participant investment funds)) / Gross contribution Quarter n (combined) This ratio indicates the ability of Sharia Insurance Companies, Sharia Reinsurance Companies and/or Sharia Units to manage their contributions. A higher ratio indicates an increase in operational risk of Sharia Insurance Companies, Sharia Reinsurance Companies and/or Sharia Units. This can be caused, among other things, by high contribution receivables and/or worsening gross contribution growth.
Business expense growth
Business expense growth = (Total operational expenses) R4Q -1 / (Total operational expenses) (R4Q t-1) R4Q = sum of the last 4 quarters Expenses can indicate the level of activity and changes in the size and complexity of an entity's business. Any growth in expenses indicates that business activities are changing (strategy and planning) or high growth in policy acquisition costs may indicate new business growth. Risk can emerge from increasingly high business expenses.
Ratio of commission expenses to company fund contribution (ujrah)
Commission expenses / Company fund contribution (ujrah) current period Ujrah is the right of the company fund, the use of which is among other things to finance the operational activities of Sharia Insurance Companies, Sharia Reinsurance Companies and/or Sharia Units. Ujrah is also used to pay commission expenses. The larger the ratio of commission expenses to ujrah, the greater the risk of reduced ujrah to support the operational activities of Sharia Insurance Companies, Sharia Reinsurance Companies and/or Sharia Units.
Ratio of operational costs incurred to affiliates compared to total operational costs
Operational costs incurred to affiliates / Total company fund business expenses Increasing operational costs related to affiliates will increase the operational risk of Sharia Insurance Companies, Sharia Reinsurance Companies and/or Sharia Units.
Growth of Operational Risk (from DTMBR and MMBR)
a. Tabarru' Funds (DTMBR) = [Operational risk Quarter n - Operational risk Quarter n-1] / Operational risk Quarter n-1 b. Company Funds (MMBR) = [Operational risk Quarter n - Operational risk Quarter n-1] / Operational risk Quarter n-1 Knowing the growth of operational risk in the calculation of the solvency level of tabarru' funds (DTMBR) and company funds (MMBR). Risk will increase if operational risk increases compared to the operational risk of the previous year.
Number of internal and external fraud history
Number of fraud in the last 3 (three) year period Fraud assessment is conducted against the frequency or materiality of fraud that has occurred in previous assessment periods, including potential fraud that may arise from weaknesses in business aspects, human resources, information technology, and external events. The more/significant fraud that has been committed, the greater the operational risk of Sharia Insurance Companies, Sharia Reinsurance Companies and/or Sharia Units.
Number of information technology system disturbance incidents causing transaction process failure
Number of information technology system disturbance incidents in the last 3 (three) year period Information technology systems are important infrastructure in the operational activities of Sharia Insurance Companies, Sharia Reinsurance Companies and/or Sharia Units. When information technology systems are disturbed, whether due to internal or external disturbances, operational risk will increase.
Employee turnover ratio
Employee turnover ratio = Number of employees leaving / Average number of employees Average number of employees = (Number of employees at the beginning of the year + Number of employees at the end of the year) / 2 The larger the turnover ratio, the greater the operational risk of Sharia Insurance Companies, Sharia Reinsurance Companies and/or Sharia Units. In addition to Sharia Insurance Companies, Sharia Reinsurance Companies and/or Sharia Units having to find replacements that have at least the same qualifications, Sharia Insurance Companies, Sharia Reinsurance Companies and/or Sharia Units also risk having to expend additional funds for the development of new employees outside of routine development that has been strategically established by Sharia Insurance Companies, Sharia Reinsurance Companies and/or Sharia Units.
Expense ratio (expense ratio)
Business expenses (expense) / Net contribution earned To determine the level of efficiency of Sharia Insurance Companies, Sharia Reinsurance Companies and/or Sharia Units in conducting their business or the costs incurred. a) Business expenses are expenses incurred by Sharia Insurance Companies, Sharia Reinsurance Companies and/or Sharia Units in conducting their business, including marketing expenses, general and administrative expenses, management expenses, and other business expenses as stated in the financial performance report. b) Net contribution income is calculated from contribution income minus reinsurance contributions plus the decrease (increase) in Reserve for Unearned Premiums (CAPYBMP) as stated in the financial performance report.

B Qualitative

Characteristics and complexity of the Company's business
a. Business scale and Company organizational structure; High business complexity and the level of product diversity of the Company will increase the complexity and variation of work processes, both manual and automated, thereby potentially causing operational disturbances/losses. Large insurance, Sharia insurance, reinsurance, and/or Sharia reinsurance business scales require large resource support and good resource management so that Company operations can run well. Things to note are as follows:

Company size: number of assets and number of premiums/contributions or policyholders;
number of office networks and distribution channels;
number of Human Resources (HR);
number and type of Child Company businesses;
reporting structure; and
ownership structure.

b. Complexity of business processes and product/service diversity; High business complexity and the level of product diversity will cause complexity and variation of work processes, both manual and automated, thereby potentially causing operational disturbances or losses. Parameters that can be assessed for business process complexity and product diversity are:

number of business lines;
number of product distribution channels;
workflow and business units (especially main business lines and support activities);
operational control and security;
number, type and characteristics of insurance products/activities;
insurance product/activity features; and/or
frequency of issuance of new products and activities.

c. Corporate action and new business development
Things to note:

merger, acquisition, and strategic alliance;
expansion into new business segments or target markets;
divestiture of business units (spin off); and/or
relocation of headquarters.

d. Use of third-party services (outsourcing) Things to note:

use of outsourcing on critical activities and systems in Company operations;
credibility of outsourcing service providers;
certainty of data security as well as important and confidential information;
Company monitoring of service providers;
existence of contingency plans that are tested periodically; and/or
frequency and materiality of problems that have occurred with outsourcing service providers.

Human Resources (HR)
a. Implementation of human resource management Human resources (HR) is a key factor in the smoothness of Company business and operations, so ineffective HR management and HR weaknesses can cause disturbances in Company operations. Assessment can be conducted, among other things, based on:

recruitment and placement (person-to job fit) according to needs;
competitive remuneration and incentive structure;
training and development, namely:
a. budgeting and realization of education and training costs; and b. realization of education and training costs against employee and official costs;
career and succession planning policies; and/or
handling of Labor Dismissal (PHK) and labor union issues.

b. Failure due to human factors (human error) Failure due to human factors (human error) is a risk that arises from human errors due to incompetence, excessive task allocation, or other causes. In assessing inherent risk caused by human error, the Company needs to pay attention, among other things, to the following:

frequency of human errors in processing transactions or other main business activities of the Company compared to the scale and complexity of the Company; and
materiality of losses occurring due to human error.

Information technology and supporting infrastructure.
a. Information technology complexity. Information technology complexity is influenced by the number of applications and infrastructure components used in the operational activities of insurance, Sharia insurance, reinsurance and/or Sharia reinsurance. In addition, the level of diversity or complexity of insurance or Sharia insurance products also influences the complexity of information technology of insurance or Sharia insurance business because it requires higher technology-based transaction processing. Generally, the main business of the Company is operated on a core system. In addition, there are also some transactions run on surrounding systems, both integrated into the core system and standing alone. Of course, the more surrounding systems the Company has, the higher the Company's information technology complexity.

No Parameter Indicator Description

Example assessments can be conducted based on:

the number of applications and components of information technology infrastructure; and
the number and complexity of insurance or Sharia insurance products marketed using information technology systems.

b. Changes to information technology systems. Example assessments can be conducted based on:

the scope and scale of system changes;
the materiality and impact on business processes;
the number and type of system change requests; and/or
issues arising from system changes.

c. Vulnerability of information technology systems to information technology threats and attacks.
Threats and attacks on information technology can originate from external or internal sources within the Company. Information technology systems that are weak in terms of security will be more easily attacked, potentially causing risk of loss to the Company.

Example assessments can be conducted based on:

the diversity of information technology systems owned by the Company and the number of products marketed digitally; and
incident databases related to information technology systems.

d. Maturity of information technology systems
Information technology system maturity is a level of development of the information technology systems used by a Company. As the "age" of the Company's information technology systems increases, the systems have been tested in supporting business and have gained better understanding and experience in problem-solving related to information technology systems. Companies also need to pay attention to information technology systems that have been owned for a very long time (legacy systems with outdated versions) because such systems usually no longer receive vendor support, meaning the Company may experience significant difficulties if problems occur with the system or in terms of compatibility with technological developments.

Assessment can be conducted based on:

the Company's information technology strategy (e.g., strategy for using legacy systems); and
the maturity level of critical information technology systems.

e. Failure of information technology systems
Assessment can be conducted based on:

the frequency and materiality of information technology system failures occurring in the recent period; and
historical data of the Company's information technology failures that caused significant losses.

f. Reliability of supporting infrastructure
The Company's supporting infrastructure varies widely, including buildings and facilities, security systems, communication networks, and various other supporting facilities.

Fraud Risk
a. Internal fraud history
Fraud assessment is conducted on the frequency and materiality of internal fraud, such as:

potential fraud arising from weaknesses in business aspects, human resources, and information technology;
unreported transactions; and
unauthorized transactions carried out intentionally.

b. External fraud history
Fraud assessment is conducted on the frequency and materiality of external fraud, such as:

fictitious claims; and
theft and data forgery.

External Events
a. Frequency and materiality of external events (including: terrorism, criminality, pandemics, and natural disasters) Several aspects that can serve as assessment focus include:

the frequency of security disruptions at the Company's office locations; and/or
the frequency of natural disaster disruptions.

b. Company location and geographical conditions Several aspects that can serve as assessment focus include:

the frequency of security disruptions at the Company's office locations; and
the frequency of natural disaster disruptions.

Administrative Systems
a. Administrative systems and procedures
Administrative functions or back office are sources of loss from operational risk, particularly related to transaction processing errors (premiums or claim expenses) and internal fraud. The level of deviation from the Service Level Agreement (SLA) for administrative processes, for example in underwriting and claims, finance, investment, etc.

b. Level of errors/deviations in administrative procedures.
c. Level of deviation from Service Level Agreement (SLA) for administrative processes.
d. Level of interaction and dependency of the Company (specifically for Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units) Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units in their operational activities may interact with third parties such as information technology system consultants/vendors, legal consultants, actuaries, public accountants, and others. High dependency on specific third parties can increase operational risk if unexpected events occur, for example, high dependency on information technology system consultants/vendors.

Table II.B.2: Guidelines for Determining Inherent Risk Level for Operational Risk

Ranking Definition Ranking
Rank 1
(Low)
Considering the business activities conducted by the Company, the likelihood of losses and failures faced by the Company in meeting obligations to policyholders, insured persons/participants caused by operational risk is classified as very low during a certain period in the future. Example characteristics of Companies included in Rank 1 (low) include the following:
a. the Company's business activities have very simple characteristics such as: products are not varied, business mechanisms are very simple, transaction volume is low, business scale and organizational structure are not complex, there are no significant corporate actions, and the use of outsourcing services is very minimal; b. human resources are very adequate, both in terms of quantity and quality of human resources such as experts, HR in the underwriting division, HR in the claims division, Company actuaries, and historical data of losses due to human error are not significant;
c. use of third-party services with very good reputation, efficiency in work and cost in the use of third-party services, the process of selecting third-party services has met standard operating procedures (SOP) and applicable regulations, and there is periodic evaluation of the use of third-party services that is very comprehensive;
d. information technology is very mature and there are no significant changes in information technology systems, vulnerability of information technology to disruptions or attacks is very low, and supporting infrastructure is very reliable in supporting the Company's business; e. frequency and materiality of internal and external fraud are very low and losses caused are not significant compared to the Company's transaction volume/premium income; f. threat of business disruption due to external events is very low; and g. administrative procedures are very easy for administrative staff to understand. The level of errors or deviations in administrative procedures, and the level of deviation from the SLA for underwriting and claims administrative processes are very low.

Rank 2
(Low-Medium)
Considering the business activities conducted by the Company, the likelihood of losses faced by the Company from operational risk is low during a certain period in the future. Example characteristics of Companies included in Rank 2 (low-medium) include the following:
a. the Company's business activities have simple characteristics, such as: products are relatively less varied, business mechanisms are simple, transaction volume is relatively low, business scale and organizational structure are not very complex, corporate actions are not very significant, and the use of outsourcing services is minimal; b. human resources are adequate, both in terms of quantity and quality of human resources, such as: experts, HR in the underwriting division, HR in the claims division, Company actuaries are adequate, and historical data of losses due to human error is not very significant;
c. use of third-party services with good reputation, efficiency in work and cost in the use of third-party services, the process of selecting third-party services has met standard operating procedures (SOP) and applicable regulations, and there is periodic evaluation of the use of third-party services that is comprehensive;
d. information technology is relatively mature and there are no significant changes in information technology systems, vulnerability of information technology to disruptions or attacks is low, and supporting infrastructure is reliable in supporting the Company's business; e. frequency and materiality of internal and external fraud are low and losses caused are not very significant compared to the Company's transaction volume/premium income; f. threat of business disruption due to external events is low; and g. administrative procedures are easy for administrative staff to understand. The level of errors or deviations in administrative procedures is low, and the level of deviation from the SLA for underwriting and claims administrative processes is low.

Rank 3
(Medium)
Considering the business activities conducted by the Company, the likelihood of losses faced by the Company from operational risk is classified as fairly high during a certain period in the future. Example characteristics of Companies included in Rank 3 (medium) include the following:
a. the Company's business activities have fairly complex characteristics, such as: products are fairly varied, business mechanisms are fairly complex, transaction volume is fairly high, business scale and organizational structure are fairly complex, corporate actions are fairly significant, and the use of outsourcing services is fairly significant; b. human resources are fairly adequate, both in terms of quantity and quality of human resources, such as: experts, HR in the underwriting division, HR in the claims division, Company actuaries are fairly adequate, and historical data of losses due to human error is fairly significant;
c. use of third-party services with fairly good reputation, efficiency in work and cost in the use of third-party services, the process of selecting third-party services has met standard operating procedures (SOP) and applicable regulations, and there is periodic evaluation of the use of third-party services that is fairly comprehensive;
d. information technology is moving towards maturity and significant changes in information technology systems may occur, information technology is fairly vulnerable to disruptions or attacks, and supporting infrastructure is fairly reliable in supporting the Company's business; e. frequency and materiality of internal and external fraud are fairly high and losses caused are fairly significant compared to the Company's transaction volume/premium income; f. threat of business disruption due to external events is fairly high; and g. administrative procedures are fairly difficult for administrative staff to understand. The level of errors or deviations in administrative procedures is fairly high, and the level of deviation from the SLA for underwriting and claims administrative processes is fairly high.

Rank 4
(Medium-High)
Considering the business activities conducted by the Company, the likelihood of losses faced by the Company from operational risk is classified as high during a certain period in the future. Example characteristics of Companies included in Rank 4 (medium-high) include the following:
a. the Company's business activities have complex characteristics, such as: products are varied, business mechanisms are complex, transaction volume is high, business scale and organizational structure are complex, corporate actions are significant, and the use of outsourcing services is significant; b. human resources are less adequate, both in terms of quantity and quality of human resources such as: experts, HR in the underwriting division, HR in the claims division, Company actuaries are less adequate, and historical data of losses due to human error is significant;
c. use of third-party services with less good reputation, efficiency in work and cost in the use of third-party services, the process of selecting third-party services has met standard operating procedures (SOP) and applicable regulations, and there is periodic evaluation of the use of third-party services that is less comprehensive;
d. information technology is not yet mature and significant changes occur in information technology systems, information technology is vulnerable to disruptions or attacks, and supporting infrastructure is less reliable in supporting the Company's business; e. frequency and materiality of internal and external fraud are high and losses caused are significant compared to the Company's transaction volume or premium income; f. threat of business disruption due to external events is high; and g. administrative procedures are difficult for administrative staff to understand. The level of errors or deviations in administrative procedures is high, and the level of deviation from the SLA for underwriting and claims administrative processes is high.

Rank 5
(High)
Considering the business activities conducted by the Company, the likelihood of losses faced by the Company from operational risk is classified as very high during a certain period in the future. Example characteristics of Companies included in Rank 5 (high) include the following:
a. the Company's business activities have very complex characteristics, such as: products are very varied, business mechanisms are very complex, transaction volume is very high, business scale and organizational structure are very complex, corporate actions are significant, and the use of outsourcing services is very high; b. human resources are not adequate, both in terms of quantity and quality of human resources such as: experts, HR in the underwriting division, HR in the claims division, Company actuaries are not adequate, and historical data of losses due to human error is very significant;
c. use of third-party services with bad reputation, efficiency in work and cost in the use of third-party services, the process of selecting third-party services has met standard operating procedures (SOP) and applicable regulations, and there is periodic evaluation of the use of third-party services that is not comprehensive;
d. information technology is not yet mature and very significant changes occur in information technology systems, information technology is very vulnerable to disruptions or attacks, and supporting infrastructure is not reliable in supporting the Company's business;

e. frequency and materiality of internal and external fraud are very high and losses caused are very significant compared to the Company's transaction volume or premium income; f. threat of business disruption due to external events is very high; and g. administrative procedures are very difficult for administrative staff to understand. The level of errors or deviations in administrative procedures is very high, and the level of deviation from the SLA for underwriting and claims administrative processes is very high.

Table II.B.3: Guidelines for Determining Risk Management Implementation Quality for Operational Risk

Ranking Definition Ranking
Rank 1
(Strong)
The quality of risk management implementation for operational risk is very adequate, with minor weaknesses that are not significant and can be ignored.
Example characteristics of Companies included in Rank 1 (strong) include the following:
a. the formulation of the level of risk to be taken (risk appetite) and risk tolerance is very adequate and has aligned with the Company's overall strategic objectives and business strategy; b. the Board of Directors, Board of Commissioners, and/or Sharia Supervisory Board (DPS) have very adequate awareness and understanding regarding risk management for operational risk, sources of operational risk, and the level of operational risk in the Company;
c. the risk management culture for operational risk is very strong and has been internalized very well at all organizational levels;
d. the Board of Directors, Board of Commissioners, and/or DPS are very responsible in developing an organizational culture aware of operational risk and fostering commitment to managing operational risk in accordance with the Company's business strategy; e. the Board of Directors is very good at creating a culture of objective disclosure of operational risk across all organizational elements so that operational risk can be identified quickly and mitigated appropriately; f. the Board of Directors establishes reward policies including remuneration and punishment that are very effective and integrated into the performance evaluation system in order to support optimal implementation of risk management for operational risk; g. the Board of Directors can ensure very well that the execution of authorities and responsibilities delegated to service providers has been carried out well and responsibly; h. the execution of duties by the Board of Directors, Board of Commissioners, and/or DPS as a whole is very adequate;
i. the risk management function for operational risk is independent, has clear tasks and responsibilities, and has operated very well;
j. delegation of authority is controlled and monitored periodically, and has operated very well; k. the management strategy for operational risk is very aligned with the level of risk to be taken and operational risk tolerance;
l. policies, procedures, and the establishment of limits for operational risk are very adequate and available for all areas of risk management for operational risk, aligned with implementation, and well understood by employees;
m. the risk management process for operational risk is very adequate in identifying, measuring, monitoring, and controlling operational risk; n. data security management guidelines and incident management guidelines (disaster recovery plan) are very reliable and very tested; o. the risk management information system for operational risk is very good, producing comprehensive operational risk reports integrated with the Board of Directors, Board of Commissioners, and/or DPS; p. human resources are very adequate in terms of quantity and quality in the risk management function for operational risk; q. the internal control system is very effective in supporting the implementation of risk management for operational risk; r. independent review implementation by the internal audit unit and functions conducting independent review is very adequate in terms of methodology, frequency, and reporting to the Board of Directors, Board of Commissioners, and/or DPS; s. generally, there are no significant weaknesses based on independent review results; t. follow-up on independent reviews has been carried out very adequately; u. the compliance function for operational risk has very clear tasks and responsibilities and has operated very well; and
v. the Company's policies, regulations, systems, procedures, and business activities are very in accordance with statutory regulations.

Rank 2
(Fairly Strong)
The quality of risk management implementation for operational risk is adequate despite some minor weaknesses that can be resolved in normal business activities.
Example characteristics of Companies included in Rank 2 (fairly strong) include the following:
a. the formulation of the level of risk to be taken (risk appetite) and risk tolerance is adequate and has aligned with the Company's overall strategic objectives and business strategy; b. the Board of Directors, Board of Commissioners, and/or DPS have good awareness and understanding regarding risk management for operational risk, sources of operational risk, and the level of operational risk in the Company;
c. the risk management culture for operational risk is strong and has been internalized well at all organizational levels;
d. the Board of Directors, Board of Commissioners, and/or DPS are responsible in developing an organizational culture aware of operational risk and fostering commitment to managing operational risk in accordance with the Company's business strategy; e. the Board of Directors is good at creating a culture of objective disclosure of operational risk across all organizational elements so that operational risk can be identified quickly and mitigated appropriately; f. the Board of Directors establishes reward policies including remuneration and punishment that are effective and integrated into the performance evaluation system in order to support optimal implementation of risk management; g. the Board of Directors can ensure well that the execution of authorities and responsibilities delegated to service providers has been carried out well and responsibly; h. the execution of duties by the Board of Directors, Board of Commissioners, and/or DPS is generally adequate, with some weaknesses that are not significant and can be repaired immediately;
i. the risk management function for operational risk has clear tasks and responsibilities and has operated well, but there are minor weaknesses that can be resolved in normal business activities;
j. delegation of authority is controlled and monitored periodically and has operated well; k. the management strategy for operational risk is aligned with the level of risk to be taken and operational risk tolerance;
l. policies, procedures, and the establishment of limits for operational risk are adequate and available for all areas of risk management for operational risk, aligned with implementation, and well understood by employees despite minor weaknesses;

Rating Definition

m. Risk management process for operational risk is adequate in identifying, measuring, monitoring, and controlling operational risk;

n. Reliable and tested data security management guidelines and incident management guidelines (disaster recovery plan);

o. Risk management information system for operational risk is good, including reporting operational risk to the Board of Directors, Board of Commissioners, and/or Sharia Supervisory Board (DPS), but there are minor weaknesses that can be easily corrected;

p. Human resources are adequate in both quantity and quality in the operational risk management function;

q. Internal control system is effective in supporting the implementation of operational risk management;

r. Independent review implementation by the internal audit unit and functions conducting independent reviews is adequate in terms of methodology, frequency, and reporting to the Board of Directors, Board of Commissioners, and/or DPS;

s. There are weaknesses but not significant based on the results of independent reviews;

t. Follow-up on independent reviews has been adequately implemented.

u. The compliance function for operational risk has clear tasks and responsibilities and has been running well; and

v. Policies, provisions, systems, procedures, and business activities carried out by the Company are in accordance with the provisions of legislation.

Rating 3 (Sufficient)

The quality of operational risk management implementation is sufficiently adequate. Although minimum requirements are met, there are some weaknesses that require management attention.

Examples of Company characteristics included in Rating 3 (sufficient) are as follows:

a. Formulation of risk levels to be taken (risk appetite) and risk tolerance is sufficiently adequate but not always aligned with overall strategic objectives and business strategy;

b. The Board of Directors, Board of Commissioners, and/or DPS have sufficient awareness and understanding regarding operational risk management, sources of strategic risk, and levels of strategic risk in the Company;

c. Operational risk management culture is sufficiently strong and has been internalized sufficiently well but not always implemented consistently;

d. The Board of Directors, Board of Commissioners, and/or DPS are sufficiently responsible in developing an organizational culture aware of operational risk and fostering commitment to managing operational risk in accordance with the Company's business strategy;

e. The Board of Directors is sufficiently good in creating a culture of objective disclosure of operational risk across all organizational elements so that operational risk can be identified quickly and mitigated properly;

f. The Board of Directors establishes reward policies including remuneration and punishment that are sufficiently effective, integrated into the performance assessment system to support optimal risk management implementation;

g. The Board of Directors can ensure sufficiently well that the implementation of delegated authorities and responsibilities to service providers has been done well and responsibly;

h. Implementation of duties by the Board of Directors, Board of Commissioners, and/or DPS is generally sufficiently adequate, but there are weaknesses in some assessment aspects that need management attention;

i. The operational risk management function is sufficiently good, but there are some weaknesses including reporting to the Board of Directors, Board of Commissioners, and/or DPS that require management attention;

j. Delegation of authority is sufficiently good, but control and monitoring are not always implemented well;

k. Management strategy for operational risk is sufficiently aligned with the level of risk to be taken and operational risk tolerance;

l. Policies, procedures, and limit setting for operational risk are sufficiently adequate but not always consistent with implementation;

m. Risk management process for operational risk is sufficiently adequate in identifying, measuring, monitoring, and controlling operational risk;

n. Data security management guidelines and incident management guidelines (disaster recovery plan) are sufficiently reliable;

o. Operational risk management information system meets minimum expectations but there are some weaknesses including reporting to the Board of Directors, Board of Commissioners, and/or DPS that require management attention;

p. Human resources are sufficiently adequate in both quantity and quality in the operational risk management function;

q. Internal control system is sufficiently effective in supporting the implementation of operational risk management;

r. Independent review implementation by the internal audit unit and functions conducting independent reviews is sufficiently adequate, but there are some weaknesses in methodology, frequency, and/or reporting to the Board of Directors, Board of Commissioners, and/or DPS that require management attention;

s. There are weaknesses that are sufficiently significant based on the results of independent reviews that require management attention; and

t. Follow-up on independent reviews has been implemented sufficiently adequately.

u. The compliance function for operational risk has sufficiently clear tasks and responsibilities and has been running sufficiently well; and

v. Policies, provisions, systems, procedures, and business activities carried out by the Company are sufficiently in accordance with the provisions of legislation.

Rating 4 (Fairly Weak)

The quality of operational risk management implementation is less adequate, with significant weaknesses in various aspects of operational risk management that require immediate corrective action.

Examples of Company characteristics included in Rating 4 (fairly weak) are as follows:

a. Formulation of risk levels to be taken (risk appetite) and risk tolerance is less adequate and not aligned with strategic objectives and overall business strategy;

b. There are significant weaknesses in the awareness and understanding of the Board of Directors, Board of Commissioners, and/or DPS regarding operational risk management, sources of operational risk, and levels of operational risk in the Company;

c. Operational risk management culture is less strong and has not been internalized well at every level of the organization;

d. The Board of Directors, Board of Commissioners, and/or DPS are less responsible in developing an organizational culture aware of operational risk and fostering commitment to managing operational risk in accordance with the Company's business strategy;

e. The Board of Directors is less able to create a culture of objective disclosure of operational risk across all organizational elements so that operational risk can be identified quickly and mitigated properly;

f. The Board of Directors establishes reward policies including remuneration and punishment that are less effective, integrated into the performance assessment system to support optimal risk management implementation;

g. The Board of Directors is weak in ensuring sufficiently well that the implementation of delegated authorities and responsibilities to service providers has been done well and responsibly;

h. Implementation of duties by the Board of Directors, Board of Commissioners, and/or DPS is generally less adequate, with weaknesses in various assessment aspects that require immediate improvement;

i. There are significant weaknesses in the operational risk management function that require immediate improvement;

j. Delegation of authority is weak, not controlled and not monitored well;

k. Management strategy for operational risk is less aligned with the level of risk to be taken and operational risk tolerance;

l. There are significant weaknesses in policies, procedures, and limit setting for operational risk;

m. Risk management process for operational risk is less adequate in identifying, measuring, monitoring, and controlling operational risk;

n. Data security management guidelines and incident management guidelines (disaster recovery plan) are less reliable;

o. There are significant weaknesses in the operational risk management information system including reporting to the Board of Directors, Board of Commissioners, and/or DPS that require immediate improvement;

p. Human resources are less adequate in terms of quantity and quality in the operational risk management function;

q. Internal control system is less effective in supporting the implementation of operational risk management;

r. Independent review implementation by the internal audit unit and functions conducting independent reviews is less adequate, with weaknesses in methodology, frequency, and/or reporting to the Board of Directors, Board of Commissioners, and/or DPS that require immediate improvement;

s. There are significant weaknesses based on the results of independent reviews that require immediate corrective action;

t. Follow-up on independent reviews is less adequate;

w. The compliance function for operational risk has tasks and responsibilities that are sufficiently clear but has been running less well; and

u. Policies, provisions, systems, procedures, and business activities carried out by the Company are less in accordance with the provisions of legislation.

Rating 5 (Weak)

The quality of operational risk management implementation is inadequate, with significant weaknesses in various aspects of operational risk management whose resolution is beyond management's capability.

Examples of Company characteristics included in Rating 5 (weak) are as follows:

a. Awareness and understanding of the Board of Commissioners and Board of Directors regarding operational risk management is very weak;

b. Human resources are inadequate in both quantity and quality in the operational risk management function;

c. Operational risk management culture is not strong or does not exist at all;

d. The Board of Directors, Board of Commissioners, and/or DPS do not develop an organizational culture aware of operational risk and foster commitment to managing operational risk in accordance with the Company's business strategy;

e. The Board of Directors is unable to create a culture of objective disclosure of operational risk across all organizational elements so that operational risk can be identified quickly and mitigated properly;

f. The Board of Directors establishes reward policies including remuneration and punishment that are ineffective, integrated into the performance assessment system to support optimal risk management implementation;

g. The Board of Directors is very weak in ensuring sufficiently well that the implementation of delegated authorities and responsibilities to service providers has been done well and responsibly;

h. Implementation of duties by the Board of Commissioners and Board of Directors is inadequate, with significant weaknesses in almost all assessment aspects and resolution beyond the Company's capability;

i. There are significant weaknesses in the operational risk management function that require fundamental improvement;

j. Delegation of authority is very weak or non-existent;

k. Management strategy for operational risk is not aligned with risk appetite and operational risk tolerance;

l. There are very significant weaknesses in policies, procedures, and limit setting for operational risk;

m. Risk management process for operational risk is inadequate in identifying, measuring, monitoring, and controlling operational risk;

n. Data security management guidelines and incident management guidelines (disaster recovery plan) are not reliable;

o. There are fundamental weaknesses in the operational risk management information system including reporting to the Board of Commissioners and Board of Directors which is very inadequate;

p. Human resources are inadequate in terms of quantity and quality in the operational risk management function;

q. Internal control system is ineffective in supporting the implementation of operational risk management;

r. Independent review implementation by the internal audit unit/function and functions conducting independent reviews is inadequate, with weaknesses in methodology, frequency, and/or reporting to the Board of Directors, Board of Commissioners, and DPS that require fundamental improvement;

s. There are very significant weaknesses based on the results of independent reviews that require immediate corrective action; and

t. Follow-up on independent reviews is inadequate or non-existent.

u. The compliance function for operational risk has unclear tasks and responsibilities and has been running poorly; and

v. Policies, provisions, systems, procedures, and business activities carried out by the Company are not in accordance with the provisions of legislation.

Table II.C.1: Parameters or Indicators for Assessing Inherent Insurance Risk for Insurance Risk

No	Parameter	Indicator	Description
I.	Quantitative
A.	FOR INSURANCE COMPANIES AND REINSURANCE COMPANIES
1.	Net premium to equity ratio	$\frac{\text{Net Premium}}{\text{Equity}}$	The ability of own capital to dominate the main activities of Insurance and Reinsurance Companies. The larger the own capital or equity of the Insurance and Reinsurance Company, the more it should be able to generate optimal operational performance, marked by high incoming premiums. Insurance risk will be greater if large capital is unable to generate large premiums. This can be seen, among others, from the ratio becoming smaller due to premium decline.
2.	Claim to premium ratio	a. Gross claim to gross premium ratio: $\frac{\text{Gross Claim}}{\text{Gross Premium}}$<br>b. Net claim to net premium ratio: $\frac{\text{Net Claim}}{\text{Net Premium}}$	Analysis of the claim to premium ratio is intended to know the underwriting quality of Insurance and Reinsurance Companies in selecting risk and handling claims. Specifically for the net claim to net premium ratio, besides underwriting quality, this ratio also measures the effectiveness of reinsurance or retrocession support chosen by Insurance and Reinsurance Companies. High claim ratios, especially exceeding 100%, are very dangerous for the financial condition of Insurance and Reinsurance Companies because funds coming in from premiums are insufficient to pay arising claim obligations and finance operational costs. This can also be interpreted as the pricing set by Insurance and Reinsurance Companies being too low. The difference between the gross claim ratio and the net claim ratio indicates the quality of risk management owned by Insurance and Reinsurance Companies, specifically the accuracy of the reinsurance or retrocession method chosen. Ideally, the gross claim ratio equals the net claim ratio. A gross claim ratio larger than the net claim ratio indicates that the reinsurance or retrocession program run by Insurance and Reinsurance Companies is already effective and able to improve underwriting results. Conversely, a net premium ratio larger than the gross premium ratio indicates the ineffectiveness of the reinsurance or retrocession program of Insurance and Reinsurance Companies or that reinsurance or retrocession costs are too expensive.
3.	Technical reserve to net premium ratio	$\frac{\text{Technical Reserve}}{\text{Net Premium}}$	This ratio describes the portion of premiums designated as reserves. The larger the ratio shows that most premiums are for the long term. Risk will arise if the ratio becomes smaller and is not followed by an increase in other reserves, specifically unearned premium reserves.
4.	Lapse ratio	$\frac{\text{Number of policies ending before maturity}}{\text{Total policies}}$	The lapse ratio is the comparison of expired (cancelled) policies in one year with the number of policies still valid at the beginning of the year.
5.	Retention ratio	$1 - \text{Cession Ratio}$	This ratio measures how large the premium received by Insurance and Reinsurance Companies will be retained compared to premiums received in the same period. A decrease in the retention ratio can be interpreted as a decrease in premiums retained, thereby increasing the insurance risk of Insurance and Reinsurance Companies. This can also be interpreted as Insurance and Reinsurance Companies increasingly giving a portion of their received premiums for reinsurance or retrocession premiums.
6.	New business growth ratio	$\frac{\text{New business premium year n} - \text{New business premium year n-1}}{\text{New business premium year n-1}}$	Healthy new business growth is an important factor in the sustainability of Insurance and Reinsurance Companies' business. The lower the new business growth, the more exposed Insurance and Reinsurance Companies are to higher insurance risk because the ability of Insurance and Reinsurance Companies to obtain new business is assessed as less optimal.
7.	Technical reserve growth ratio	$\frac{\text{Technical reserve period t} - \text{Technical reserve period t-1}}{\text{Technical reserve period t-1}}$	Technical reserve growth can describe the development of business activities of Insurance and Reinsurance Companies. The smaller the ratio shows that the production of Insurance and Reinsurance Companies is lower, thereby causing insurance risk to become larger.
8.	Insurance risk growth (from MMBR)	$\frac{\text{Insurance risk growth t}}{\text{Insurance risk growth t-1}}$	Knowing the growth of insurance risk in solvency level calculations. Risk will increase if insurance risk increases compared to the previous year's insurance risk.
9.	Loss ratio from main business	$% \text{ Loss ratio from main business}$<br>$\text{Main business claim ratio} = \frac{\text{Net claim expense}}{\text{Net premium}}$	The main business of Insurance and Reinsurance Companies can be products or product lines that provide the most optimal revenue to Insurance and Reinsurance Companies. When claims paid from this main business are high, it will significantly affect the operations of Insurance and Reinsurance Companies. Therefore, the higher the loss ratio, the higher the insurance risk will be.
10.	Ratio of largest guaranteed return / average return of the last 3 years	$\frac{\text{Largest guaranteed return}}{\text{Average return of the last 3 years}}$	The higher this ratio, the higher the insurance risk will be.
11.	Ratio of premium adequacy and investment results to payments	$\frac{\text{Premium} + \text{Investment Results}}{\text{Claims Paid} + \text{Unit Redemption Claims} + \text{Marketing Expenses} + \text{Employee Expenses} + \text{Training Expenses} + \text{General Administrative Expenses} + \text{Other Claims and General Administrative Expenses}}$	This ratio describes the ability of premiums and investment results to cover occurring claims and marketing expenses, acquisition expenses, and other general administrative expenses. When the ratio is less than 100%, it can be interpreted that the premiums received and investment results cannot cover occurring claims and marketing expenses, acquisition expenses, and other general administrative expenses, thereby affecting the equity of Insurance and Reinsurance Companies.
B.	FOR SHARIA INSURANCE COMPANIES, SHARIA REINSURANCE COMPANIES, AND SHARIA UNITS
1.	Ratio of company fund contribution (ujrah) to equity	$\frac{\text{Net Company Fund Contribution}}{\text{Equity}}$	The ability of own capital to dominate the main activities of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units. The larger the own capital or equity of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units, the more it should be able to generate optimal operational performance, marked by high incoming contributions. Insurance risk will be greater if large capital is unable to generate large contributions. This can be seen, among others, from the ratio becoming smaller due to contribution decline.
2.	Gross claim to gross contribution ratio	a. Gross claim to gross contribution ratio: $\frac{\text{Gross Claim}}{\text{Gross Contribution (Tabarru' Fund)}}$<br>b. Net claim to net contribution ratio: $\frac{\text{Net Claim}}{\text{Net Contribution (Tabarru' Fund)}}$	Analysis of the claim to contribution ratio is intended to know the underwriting quality of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units in selecting risk and handling claims. Specifically for the net claim to net contribution ratio, besides underwriting quality, this ratio also measures the effectiveness of reinsurance or retrocession support chosen by Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units. High claim ratios, especially exceeding 100%, are very dangerous for the financial condition of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units because funds coming in from contributions are insufficient to pay arising claim obligations and finance operational costs. This can also be interpreted as the pricing set by Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units being too low. The difference between the gross claim ratio and the net claim ratio indicates the quality of risk management owned by Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units, specifically the accuracy of the reinsurance or retrocession method chosen. Ideally, the gross claim ratio equals the net claim ratio. A gross claim ratio larger than the net claim ratio indicates that the reinsurance or retrocession program run by Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units is already effective and able to improve underwriting results. Conversely, a net contribution ratio larger than the gross contribution ratio indicates the ineffectiveness of the reinsurance or retrocession program of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units or that reinsurance or retrocession costs are too expensive.
3.	Technical reserve to net contribution ratio	$\frac{\text{Contribution reserve year n (Tabarru' fund) + Reserve for contributions not yet income (PKYBMP) year n (Tabarru' fund)}}{\text{Net contribution year n (Tabarru' fund)}}$	This ratio describes the portion of contributions designated as reserves. The larger the ratio shows that most contributions are for the long term.

No Parameter Indicator Description length. Risk will arise if the ratio becomes smaller and is not followed by an increase in other provisions, especially unearned contribution provisions.
4. Lapse ratio number of policies ending before maturity
total policies
The lapse ratio is the comparison of expired (cancelled) policies in one year with the number of policies still in force at the beginning of the year.
5. Retention ratio tabarru' fund:
[net contribution] gross contribution company fund:
[net ujrah] gross ujrah
This ratio measures how large the contribution received by Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units will be retained itself compared to the contributions received in the same period. A decrease in retention ratio can be interpreted as a decrease in contributions retained itself, thereby increasing the insurance risk of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units. This can also be interpreted as Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units increasingly giving a portion of the contributions received for reinsurance or retrocession contributions.
6. New business growth ratio
tabarru' fund:
[tabarru' fund contribution from new business year n - tabarru' Tabarru' fund contribution from new business year n-1] Tabarru' fund contribution from new business year n-1 company fund:
[ujrah from new business year n - ujrah from new business year n-1] ujrah from new business year n-1 Healthy new business growth is an important factor in the sustainability of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units. The lower the new business growth, the more exposed Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units are to higher insurance risks because the ability of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units to obtain new business is assessed as less than optimal.
7. Technical provision growth ratio
tabarru' fund:
[technical provision of tabarru' fund year n - technical provision of tabarru' fund year n-1] technical provision of tabarru' fund year n-1 company fund:
[technical provision year n - technical provision year n-1] technical provision year n-1 Growth in technical provisions can describe the development of business activities of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units. The smaller the ratio indicates that the production of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units is lower, which will cause insurance risk to become larger.
8. Insurance risk growth
tabarru' fund:
[insurance risk year n - insurance risk tabarru' fund year n-1] insurance risk tabarru' fund year n-1 Knowing the growth of insurance risk in the calculation of the solvency level of Tabarru' Fund (Tabarru' Fund and Minimum Risk-Based Land Tabarru' Fund/DTMBR). Risk will increase if insurance risk increases compared to insurance risk

No Parameter Indicator Description previous year.
9. Loss ratio from
main business
% loss ratio from main business loss ratio from main business largest business line portfolio main business claim burden ratio = net claim burden net tabarru' fund contribution The main business of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units can be a product or product line that provides the most optimal revenue to Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units. When claims paid from this main business are high, it will significantly affect the operations of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units. Therefore, the higher the loss ratio, the higher the insurance risk will be.
10. Ratio of largest guaranteed return/average
return of the last 3 (three) years largest guaranteed return average return of the last 3 (three) years.
The higher this ratio, the higher the insurance risk will be.
11. Ratio of Contribution and Investment
Adequacy against
Claim Payments and
General Expenses
(gross contribution + investment return)
(paid claims + unit redemption claims + marketing burden + employee management burden + training burden + other general administrative expenses) or This ratio describes the ability of contributions and investment returns to cover claims that occur and marketing burdens, acquisition burdens, and other general administrative expenses. When the ratio is less than 100%, it can be interpreted that the contributions received and investment returns cannot cover the claims that occur and marketing burdens, acquisition burdens, and other general administrative expenses, thereby affecting the equity of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units.

II Qualitative
A. Life Insurance Companies, Sharia Life Insurance Companies, and Sharia Units

Underwriting a. underwriting infrastructure;
data/information quality; and outsourcing of underwriting functions Underwriting is a process carried out by life insurance companies, Sharia life insurance companies and Sharia Units to assess whether to accept or reject coverage for a risk, determine appropriate policy conditions, and set the premium/contribution to be charged. Life insurance companies, Sharia life insurance companies and Sharia Units must be supported by adequate underwriting infrastructure, for example, underwriter personnel, expert personnel, and reliable information systems.

No Parameter Indicator Description b. data/information quality In carrying out underwriting, life insurance companies, Sharia life insurance companies, and Sharia Units must be supported by reliable information systems that produce data/information quality that allows for good underwriting to be conducted.
c. outsourcing of underwriting functions If the underwriting function is outsourced to
a third party, then the delegation of authority must be regulated in a cooperation agreement between life insurance companies, Sharia life insurance companies, and Sharia Units with the underwriting service provider. In this case, there is a possibility of exposure to reputational risk and operational risk for life insurance companies, Sharia life insurance companies, and Sharia Units.
2. Premium/Contribution
Determination a. actuarial assumptions; b. claim estimates;
c. target profit rate;
d. investment goals and returns; e. guarantees provided; f. underwriting capability and standards; g. claim policy; h. investment return rate;
i. estimated sales volume and commission;
j. operational costs such as administrative costs, costs Premium/contribution determination must be carried out based on analysis and approval by the actuary of life insurance companies, Sharia life insurance companies, and Sharia Units, and will be influenced by several factors including business competition conditions, regulations on insurance business, tax provisions, and profitability targets. In the initial stage, premium/contribution determination is usually determined by considering consumer purchasing power

No Parameter Indicator Description management and legal costs; k. reinsurance strategy;
l. capital allocation and expected rate of return;
m. policy termination rate; n. tax provisions; o. inflation rate; and p. other factors such as system costs (IT), marketing costs and promotional costs. consumers, business competition conditions, and applicable regulations. Next, Life insurance companies, Sharia life insurance companies, and Sharia Units will formulate premium/contribution rates based on mortality or morbidity rates and other factors to accommodate assumptions regarding selection rates from the target market, underwriting provisions and claim rates. Life insurance companies, Sharia life insurance companies, and Sharia Units calculate claim estimates based on experience and specific exposure. If Life insurance companies, Sharia life insurance companies, and Sharia Units calculate claim estimates based on experience, then life insurance companies, Sharia life insurance companies, and Sharia Units may face limitations in historical data owned by Life insurance companies, Sharia life insurance companies, and Sharia Units which serve as the basis for calculation. For some life insurance companies, Sharia life insurance companies, and Sharia Units that have business lines that

No Parameter Indicator Description complex, life insurance companies, Sharia life insurance companies, and Sharia Units must distinguish premium/contribution determination based on specific business lines. Business lines with low risk levels will be charged low contribution rates, conversely, business lines with high risk levels will be charged high contribution rates. Premium/contribution determination can also be based on the risk level of the business, location, exposure level, and demographics. In relation to the long-term nature of life insurance business, investment strategy and investment return rates play an important role in the premium/contribution determination process. Therefore, the investment strategy of life insurance companies, Sharia life insurance companies, and Sharia Units must align with the product portfolio marketed and the assumed investment return rates used in premium/contribution determination.
3. Reinsurance Structure Types of reinsurance agreements can be categorized into treaty
and facultative, while treaty reinsurance programs can be conducted proportionally or non-proportionally.
Based on treaty reinsurance agreements,
Reinsurance Companies and Sharia Reinsurance Companies are obligated to accept - No Parameter Indicator Description every risk transferred by the ceding company to it, so there is certainty of reinsurance support for every risk assumed by life insurance companies , Sharia life insurance companies , and Sharia Units. As for facultative agreements, Reinsurance Companies and Sharia Reinsurance Companies have the right to evaluate and reject risks transferred by life insurance companies , Sharia life insurance companies , and Sharia Units to them. Facultative reinsurance agreements are usually used to cover risks not covered in treaty reinsurance agreements. According to proportional reinsurance programs, life insurance companies , Sharia life insurance companies and Sharia Units with Reinsurance Companies and Sharia Reinsurance Companies will share proportionally every risk/policy assumed by life insurance companies , Sharia life insurance companies and Sharia Units. Whereas in non-proportional reinsurance programs, life insurance companies , Sharia life insurance companies and Sharia Units will transfer the risks they assume if they exceed their own retention.

No Parameter Indicator Description
Units will transfer the risks they assume if they exceed their own retention.
4. Claims a. claim infrastructure; Claim handling is a process carried out by
life insurance companies,
Sharia life insurance companies, and Sharia Units to assess claim eligibility (eligibility), decide to accept or reject claims, determine the amount of claims to be paid, and carry out claim payments. Life insurance companies, Sharia life insurance companies, and Sharia Units must be supported by adequate claim infrastructure, for example, claim personnel, claim assessors, and reliable information systems. b. role and cooperation Reinsurance companies and Sharia Reinsurance Companies; and Claim handling is influenced by support from Reinsurance Companies and Sharia Reinsurance Companies.
c. outsourcing of claim functions If the claim handling function is outsourced
to a third party, then the delegation of authority must be regulated in a cooperation agreement between life insurance companies, Sharia life insurance companies, and Sharia Units with the claim handling service provider. In this case, there is a possibility of exposure to reputational risk and operational risk

No Parameter Indicator Description for life insurance companies, Sharia life insurance companies, and Sharia Units.
5. Significance level of
insurance risk against total business
Portion of insurance protection risk and portion of investment Performance of life insurance products that provide death and health benefits is very influenced by the underwriting process, product design, premium/contribution determination, liability valuation, use of reinsurance or Sharia reinsurance, distribution, and claim handling. Meanwhile, performance of products that provide investment/savings benefits is very influenced by the ability of life insurance companies, Sharia life insurance companies, and Sharia Units to manage investments, market conditions, and macroeconomic conditions.
6. Mix of insurance product risks and benefit types
a. types of risks assumed; b. benefit payment methods;
c. types of coverage sources; and
b. types of products.
Generally, the risk level of life insurance products can be assessed based on business lines, product types (traditional or non-traditional), types of risks assumed, benefit payment provisions (e.g., periodic or lump sum) and types of coverage sources (group or individual). There are 2 (two) types of life insurance products, namely traditional insurance products and non-traditional insurance products.

Traditional insurance products, among others,
include term life insurance, endowment insurance, and whole life insurance. Traditional insurance products generally have higher inherent risk levels because:
a. Term insurance premium/contribution rates remain fixed during the coverage period according to the insured's age at entry into coverage, regardless of claim experience. b. Whole life and endowment insurance products have a combination package of insurance and savings risks and promise benefit payments upon redemption and maturity. The dominant risk is asset and liability management.
Non-traditional insurance products are generally insurance products that provide morbidity/mortality benefits
whose contracts can be renewed every year (Yearly Renewable Term (YRT)).
This product is usually bundled with investment products. When the contract or policy is renewed, Life insurance companies, Sharia life insurance companies, and Sharia Units can adjust premium/contribution based on the insured's age at policy renewal and the mortality or morbidity experience rate of life insurance companies, Sharia life insurance companies, and Sharia Units, so this type of product has a lower inherent risk level.
Monitoring of insurance product performance
a. monitoring of each insurance product's performance Monitoring of each insurance product's performance is conducted at least by evaluating among others:

Embedded value of the insurance product in question;
Profit testing and asset share using assumptions at the time of monitoring; and
Analysis of new business value (impact of new business of an insurance product on solvency or capital.

No Parameter Indicator Description b. evaluation of monitoring of each insurance product's performance Evaluation of monitoring of insurance product performance is conducted periodically by the actuary of life insurance companies and Sharia life insurance companies in accordance with standards of practice and codes of ethics issued by the Indonesian Actuarial Association.
8. Risks to products a. product design:

business lines/types of products to be developed;
product risk assessment;
product modification;
policy wording; and
reinsurance support.
Product design is a process that is very important for the success of life insurance companies, life insurance Sharia companies, and Sharia Units because product design that does not meet policyholder needs can result in low competitiveness of life insurance companies, Sharia life insurance companies, and Sharia Units. In addition, in this process, projections are also carried out to determine premium/contribution formulations, underwriting procedures, and appropriate reinsurance support in accordance with the insurance benefits promised. In the product design development stage, among others, identification and risk assessment of launching new products or product modifications are carried out. Life insurance companies, Sharia life insurance companies, and Sharia Units must conduct continuous evaluations of this risk assessment after the product is offered to the market. b. traditional products (insurance products not linked to investment) or paydi (traditional products that provide investment benefits) In addition, risks in traditional or PAYDI products must also be considered:
pure traditional insurance products have low market risk exposure compared to other insurance products.
traditional products that provide investment benefits have relatively high market risk exposure compared to pure traditional insurance products.

Risks in marketing channels
Insurance products can be marketed directly by Life insurance companies, Sharia life insurance companies, and Sharia Units or through cooperation with other parties such as agents. Each type of marketing channel can cause risks if not mitigated by life insurance companies, life insurance companies, Sharia and Sharia Units. Risks related to marketing channels that must be considered include types of marketing channels and marketing systems and e-business.

No Parameter Indicator Description
10. Liability risk from the use of methods and assumptions in the formation
of technical reserves/provisions
The magnitude of the liability value of life insurance companies, Sharia life insurance companies, and Sharia Units in the form of reserves/provisions is very influenced by the determination of their actuarial assumptions. difference between incurred claim burden and estimated claim burden The risk of difference between incurred claim burden and estimated claim burden (hereinafter referred to as Insurance Liability Risk or RLA) arises from the possibility of claim experience occurring being worse than estimated claims and the calculation of reserves/provisions being too low. B. General Insurance Companies, Reinsurance Companies, Sharia General Insurance Companies, Sharia Reinsurance Companies, and Sharia Units

Underwriting a. underwriting infrastructure; It is a process carried out by
general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units to assess whether to accept or reject coverage for a risk, determine appropriate policy conditions, and set premium/contribution to be charged.

No Parameter Indicator Description
General insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units must be supported by adequate underwriting infrastructure, for example, underwriter personnel, expert personnel, and reliable information systems. b. data/information quality In carrying out underwriting, general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units must be supported by reliable information systems that produce data/information quality that allows for good underwriting to be conducted.
c. outsourcing of underwriting functions If the underwriting function is outsourced
to a third party, then the delegation of authority must be regulated in a cooperation agreement between general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units and the underwriting service provider. In this case, there is a possibility of exposure to risks reputational and operational risk for

No Parameter Indicator Description general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies and/or Sharia Units.
2. Premium/
Contribution Determination a. actuarial assumptions; b. claim estimates;
c. target profit rate;
d. investment goals and returns; e. guarantees provided; f. underwriting capability and standards; g. claim policy; h. investment return rate;
i. estimated sales volume and commission;
j. operational costs such as administrative costs, management and legal costs; k. reinsurance strategy;
l. capital allocation and expected rate of return;
m. policy termination rate; n. tax provisions; o. inflation rate, and p. other factors such as system costs (information technology), marketing costs and promotional costs.
Premium/contribution determination must be carried out based on analysis and approval by the actuary of general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units, and will be influenced by several factors including business competition conditions, regulations on insurance business, tax provisions, and targets profitability. In the initial stage, premium/contribution determination is usually determined by considering consumer purchasing power, business competition conditions, and regulations that are in effect. Next, general insurance companies, reinsurance companies, Sharia general insurance companies, reinsurance companies Sharia, and/or Sharia Units will formulate premium/contribution rates based on mortality or morbidity rates and other factors to accommodate assumptions regarding selection rates from the target market,

No Parameter Indicator Description underwriting provisions and claim rates.
General insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies , and/or Sharia Units calculate claim estimates based on experience and specific exposure. If general insurance companies reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies , and/or Sharia Units calculate claim estimates based on experience, then general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies , and/or Sharia Units may face limitations in historical data owned by general insurance companies, reinsurance companies, Sharia general insurance companies , Sharia reinsurance companies , and/or Sharia Units which serve as the basis for calculation. For some general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies , and/or Sharia Units that have business lines that are complex, general insurance companies, reinsurance companies,

No Parameter Indicator Description

Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units must distinguish the determination of premiums/contributions based on specific business lines. Business lines with low risk levels will be charged low premium/contribution rates, conversely, business lines with high risk levels will be charged high premium/contribution rates. The determination of premiums/contributions can also be based on the level of business risk, location, exposure level, and demographics.

Reinsurance Structure Types of reinsurance agreements can be categorized into treaty and facultative, while treaty reinsurance programs can be conducted proportionally or non-proportionally. Based on treaty reinsurance agreements, the reinsurer is obligated to accept every risk transferred to it by general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units, thereby providing certainty of reinsurance support for every risk assumed by general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units. In contrast, in facultative agreements, the reinsurer/retrocedant has the right to evaluate and reject risks transferred to it by general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units. Facultative reinsurance agreements are typically used to cover risks not yet covered in treaty reinsurance agreements.

According to proportional reinsurance programs, general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units, as well as reinsurers/retrocedants, will proportionally share every risk/policy assumed by general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units. Whereas in non-proportional reinsurance programs, general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units will transfer the risks they assume if they exceed their own retention.

Claims
a. Claims Infrastructure
Claims handling is a process conducted by general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units to assess claim eligibility, decide to accept or reject claims, determine the amount of claims to be paid, and carry out claim payments. General insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units must be supported by adequate claims infrastructure, such as claims personnel, claim assessors, and reliable information systems.

b. Role and Cooperation of Reinsurance Companies and Sharia Reinsurance Companies Claims handling is influenced by support from Reinsurance Companies and Sharia Reinsurance Companies.

c. Outsourcing of Claims Functions
If the claims handling function is outsourced to a third party, the delegation of authority must be regulated in a cooperation agreement between general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units and the claims handling service provider. In this case, there is a possibility of reputational risk exposure and operational risk exposure for general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units.

Monitoring of Insurance Product Performance
a. Monitoring the performance of each insurance product Monitoring of the performance of each insurance product is conducted at least by evaluating among others:

embedded value of the insurance product in question;
profit testing and asset share using assumptions at the time of monitoring; and
analysis of new business value (the impact of a product's new business on solvency or capital).

b. Evaluation of monitoring of the performance of each insurance product The evaluation of monitoring of insurance product performance is conducted periodically by the actuary of general insurance companies, reinsurance companies, Sharia general insurance companies, and Sharia reinsurance companies in accordance with practice standards and ethical codes issued by the Indonesian Actuarial Association.

Risks to Products
a. Product Design:

business lines/product types to be developed;
product risk assessment;
product modification;
policy wording; and
reinsurance support.

Product design is a process that greatly determines the success of general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units because product designs that do not meet policyholder needs can result in low competitiveness for general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units. In addition, projections are made in this process to determine premium/contribution formulations, underwriting procedures, and appropriate reinsurance or retrocession support in accordance with the promised insurance benefits. At the product design development stage, among others, identification and risk assessment of new product launches or product modifications are carried out. General insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units must conduct continuous evaluations of this risk assessment after the product is offered to the market.

b. Traditional products (insurance products not linked to investment) or PAYDI (traditional products providing investment benefits) Additionally, risks in traditional insurance products or PAYDI must be considered:

pure traditional insurance products have low market risk exposure compared to other insurance products.
insurance products providing investment benefits have relatively high market risk exposure compared to pure traditional insurance products.

Marketing Channels
Insurance products can be marketed directly by general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units or through cooperation with other parties such as agents. Each type of marketing channel can cause risk if not mitigated by general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units. Risks related to marketing channels that must be considered include the type of marketing channels and systems, and e-business.
Risk of Liability from the Use of Methods and Assumptions in Forming Technical Reserves
The magnitude of the liability of general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units in the form of technical reserves is greatly influenced by the determination of their actuarial assumptions.

Difference between incurred claim expenses and estimated claim expenses The risk of difference between incurred claim expenses and estimated claim expenses (hereinafter referred to as Insurance Liability Risk or RLA) arises from the possibility that incurred claim experience is worse than estimated claims and the calculation of technical reserves is too low.

Nature of Insurance Business
a. Short-tail and long-tail products
Short-tail products are insurance products whose claims are usually settled in a short period (generally less than one year). Long-tail products are insurance products whose settlement is usually in the long term (more than one year).

b. Short-term coverage and long-term coverage
Insurance products with short-term coverage are products with an insurance period of less than one year. Products with long-term coverage are products with an insurance period of more than one year, usually with premiums/contributions during the coverage period paid in a lump sum upfront.

c. Hazard level of the business assumed
Hazard is a condition that can increase or enlarge the likelihood of loss. The high or low level of hazard is determined by the business line covered.
The higher the benefits provided by a general insurance company, reinsurance company, Sharia general insurance company, Sharia reinsurance company, and/or Sharia Unit, the higher the hazard in the business tends to be. For example: health insurance products covering critical illness risks tend to have higher hazard than health insurance products providing basic health service benefits.

d. Use of third-party services for underwriting and claims processes If general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units use third-party services to perform some or all underwriting and/or claims handling functions, the following need to be considered:

cooperation agreements with third parties;
standard procedures regarding the use of third-party services; and
documentation of third-party performance evaluations.

Composition and Diversification of Business Portfolio
a. Business Diversification
General insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units can be experts in one or two specific insurance business lines or have a business portfolio spread across several business lines.

b. Market Segmentation
Market segmentation is the process of grouping the market into homogeneous consumer groups, where each part can be chosen as the marketing target for a product. Market segmentation grouping can be based on measurability, accessibility, and substantiality.

Geographic Area
For example, if general insurance companies, reinsurance companies, Sharia general insurance companies, Sharia reinsurance companies, and/or Sharia Units have insured parties concentrated in a specific area, it is too risky if something happens, such as a catastrophe, or a strike, etc. But if the geographic area is spread out, the risk will be lower.

Table II.C.2: Guidelines for Determining Inherent Risk Levels for Insurance Risk

Rating Level Definition

Rating Level 1 (Low)
Considering the business activities conducted by the Company, the potential losses faced by the Company from insurance risk are classified as low during a certain period in the future. Examples of characteristics of Companies included in Rating Level 1 (low) include the following:
a. The Company's coverage portfolio consists of products that provide insurance benefits in the form of lump-sum payments. b. The Company's coverage portfolio consists only of individual insurance products.
c. The Company consistently monitors the performance of each insurance product and conducts periodic evaluations of the monitoring of product performance.
d. The Company has a treaty reinsurance agreement for every risk it assumes with more than one reinsurer that (if possible) is not affiliated, and is supported by a facultative reinsurance agreement, and the scope of the reinsurance/retrocession agreement is in accordance with the risk profile. e. The Company designs products very well, starting from projections, design development, and continuous evaluation. f. The Company determines premiums/contributions based on analysis and approval by the Company's actuary and in line with the marketed product portfolio and assumed investment return rates. g. The Company has very adequate underwriting and claims infrastructure. h. If the Company uses third-party services to perform some or all underwriting and/or claims handling functions, the Company has cooperation agreements, standard procedures, and very good performance evaluation documentation.
i. Distribution networks vary, including direct marketing and through intermediaries, with little dependence on one channel or one group of intermediaries.
j. The Company's coverage portfolio is spread out very well (e.g., insured locations are evenly distributed across all regions). k. The Company's coverage portfolio is very well diversified (e.g., has varied business lines with a balanced composition).
l. The nature of the insurance products or the nature of the business is low risk.
m. The business portfolio is very well balanced in accordance with the hazard/risk level in the business assumed. n. The Company uses methods and assumptions in forming technical reserves that are very accurate so that there is no difference between incurred claim expenses and estimated claim expenses.

Rating Level 2 (Low-Medium)
Considering the business activities conducted by the Company, the potential losses faced by the Company from insurance risk are classified as low-medium during a certain period in the future. Examples of characteristics of Companies included in Rating Level 2 (low-medium) include the following:
a. The Company's coverage portfolio generally consists of products that provide insurance benefits in the form of lump-sum payments, but there are some products that provide benefits in the form of income stream payments/replacement. b. The Company's coverage portfolio may consist of several group insurance products.
c. The Company has not conducted monitoring of the performance of each insurance product and periodic evaluation of the monitoring of product performance.
d. The Company has a treaty reinsurance agreement for every risk it assumed with more than one reinsurer that (if possible) is not affiliated, but the treaty reinsurance agreement is not adjusted to the Company's retention capacity and risk profile. e. The Company designs products well, starting from projections, design development, and continuous evaluation. f. The Company determines premiums/contributions based on analysis and approval by the Company's actuary but is less aligned with the marketed product portfolio and assumed investment return rates. g. The Company has adequate underwriting and claims infrastructure. h. If the Company uses third-party services to perform some or all underwriting and/or claims handling functions, the Company has cooperation agreements, standard procedures, and good performance evaluation documentation.
i. Good distribution network with minimal dependence on one channel or one group of intermediaries.
j. The Company's coverage portfolio is concentrated in a specific area. k. The Company's coverage portfolio is less well diversified, there are still some concentrated portfolios (e.g., has varied business lines but the composition is not balanced).
l. Most of the nature of the insurance products or the nature of the business has low risk.
m. The business portfolio is well balanced in accordance with the hazard/risk level in the business assumed. n. The Company uses methods and assumptions in forming technical reserves that are accurate, there is a difference between incurred claim expenses and estimated claim expenses but it is not significant.

Rating Level 3 (Medium)
Considering the business activities conducted by the Company, the potential losses faced by the Company from insurance risk are classified as medium during a certain period in the future. Examples of characteristics of Companies included in Rating Level 3 (medium) include the following:
a. The Company's coverage portfolio may consist of several products that provide insurance benefits in the form of income stream payments/replacement. b. The Company's coverage portfolio may consist of several group insurance products.
c. The Company less frequently monitors the performance of each insurance product and conducts periodic evaluation of the monitoring of product performance.
d. The Company has a treaty reinsurance agreement for every risk it assumed with one or more affiliated reinsurers and the treaty reinsurance agreement is not adjusted to the Company's retention capacity and risk profile. e. The Company designs products reasonably well, starting from projections, design development, and continuous evaluation. f. The Company determines premiums/contributions based on analysis and approval by the Company's actuary but is not aligned with the marketed product portfolio and assumed investment return rates. g. The Company has reasonably adequate underwriting and claims infrastructure. h. If the Company uses third-party services to perform some or all underwriting and/or claims handling functions, the Company has cooperation agreements, standard procedures, and reasonably good performance evaluation documentation.
i. Distribution network depends on one channel or one group of intermediaries.
j. The Company's coverage portfolio is concentrated in a specific area. k. The Company's coverage portfolio is concentrated and less well diversified (e.g., has varied business lines but the composition is not balanced).
l. The business portfolio is balanced in accordance with the hazard/risk level in the business assumed.
m. The nature of the insurance products or the nature of the business is generally high risk. Most of the Company's business portfolio is dominated by products providing death and health benefits and/or products with morbidity and mortality risks. n. The Company uses methods and assumptions in forming technical reserves that are less accurate, there is a difference between incurred claim expenses and estimated claim expenses.

Rating Level 4 (Medium-High)
Considering the business activities conducted by the Company, the potential losses faced by the Company from insurance risk are classified as medium-high during a certain period in the future. Examples of characteristics of Companies included in Rating Level 4 (medium-high) include the following:
a. The Company's coverage portfolio consists of products that provide insurance benefits in the form of income stream payments/replacement. b. The Company's coverage portfolio consists of group insurance products.
c. The Company rarely monitors the performance of each insurance product and conducts periodic evaluation of the monitoring of product performance.
d. The Company has a treaty reinsurance agreement for every risk it assumed with one or more affiliated reinsurers and the treaty reinsurance agreement is not adjusted to the Company's retention capacity and is conducted proportionally, and the scope of the reinsurance/retrocession agreement, especially in important areas, is not in accordance with the risk profile. e. The Company designs products poorly, starting from projections, design development, and continuous evaluation. f. The Company less frequently determines premiums/contributions based on analysis and approval by the Company's actuary. g. The Company has less adequate underwriting and claims infrastructure. h. If the Company uses third-party services to perform some or all underwriting and/or claims handling functions, the Company has cooperation agreements, standard procedures, and less good performance evaluation documentation.
i. Distribution network is highly dependent on one channel or one group of intermediaries.
j. The Company's coverage portfolio is significantly concentrated in a specific area. k. The Company's coverage portfolio is significantly concentrated or not well diversified (e.g., has varied business lines but the composition is not balanced).
l. The portfolio is not balanced against the hazard/risk level in the business assumed, and there are higher risk elements.
m. The nature of the insurance products or the nature of the business is generally high risk. n. The Company uses methods and assumptions in forming technical reserves that are less accurate, there are many differences between incurred claim expenses and estimated claim expenses.

Rating Level 5 (High)
Considering the business activities conducted by the Company, the potential losses faced by the Company from insurance risk are classified as high during a certain period in the future. Examples of characteristics of Companies included in Rating Level 5 (high) include the following:
a. The Company's coverage portfolio consists of products that provide insurance benefits in the form of

Table II.C.2: Guidelines for Determining the Quality of Risk Management Implementation for Insurance Risk

Rating	Definition
Rating 1 (Strong)	Examples of characteristics of Companies included in Rating 1 (strong) are as follows:<br>a. Formulation of risk appetite and risk tolerance is very adequate and has aligned with the Company's overall strategic objectives and business strategy;<br>b. The Board of Directors, Board of Commissioners and/or Sharia Supervisory Board (DPS) has very adequate awareness and understanding regarding risk management for insurance risk, insurance risk sources, and insurance risk levels at the Company;<br>c. The risk management culture for insurance risk is very strong and has been internalized very well at all organizational levels;<br>d. The execution of duties by the Board of Directors, Board of Commissioners and/or DPS as a whole is very adequate;<br>e. The risk management function for insurance risk is independent, has clear duties and responsibilities, and operates very well;<br>f. The risk management strategy for insurance risk is very aligned with the risk appetite and insurance risk tolerance;<br>g. Policies and procedures for setting limits for insurance risk are very adequate and available for all areas of insurance risk management, aligned with implementation, and well understood by all employees;<br>h. The risk management process for insurance risk is very adequate in identifying, measuring, monitoring, and controlling insurance risk;<br>i. The Management Information System (MIS) for insurance risk is very good, producing comprehensive and integrated insurance risk reports to the Board of Directors, Board of Commissioners and/or DPS;<br>j. Human resources are generally very adequate in terms of quantity and quality in the risk management function for insurance risk;<br>k. The internal control system is very effective in supporting the implementation of risk management for insurance risk;<br>l. The implementation of independent review by the internal audit unit and functions performing independent review is very adequate in terms of methodology, frequency, and reporting to the Board of Directors, Board of Commissioners and/or DPS;<br>m. Generally, there are no significant weaknesses based on the results of independent review; and<br>n. Follow-up on independent review has been carried out very adequately.<br><br>Rating 2 (Fairly Strong)<br>Examples of characteristics of Companies included in Rating 2 (fairly strong) are as follows:<br>a. Formulation of risk appetite and risk tolerance is adequate and has aligned with the Company's overall strategic objectives and business strategy;<br>b. The Board of Directors, Board of Commissioners and/or DPS has adequate awareness and understanding regarding risk management for insurance risk, insurance risk sources, and insurance risk levels at the Company;<br>c. The risk management culture for insurance risk is strong and has been internalized well at all organizational levels;<br>d. The execution of duties by the Board of Directors, Board of Commissioners and/or DPS as a whole is
adequate;<br>e. The risk management function for insurance risk is independent, has clear duties and responsibilities, and operates well;<br>f. The risk management strategy for insurance risk is aligned with the risk appetite and insurance risk tolerance;<br>g. Policies and procedures for setting limits for insurance risk are adequate and available for all areas of insurance risk management, aligned with implementation, and well understood by all employees, although there are minor weaknesses;<br>h. The risk management process for insurance risk is adequate in identifying, measuring, monitoring, and controlling insurance risk;<br>i. The MIS for insurance risk is good, including insurance risk reporting to the Board of Directors and Board of Commissioners. There are minor weaknesses but they can be easily corrected;<br>j. Human resources are generally very adequate in terms of quantity and quality in the risk management function for insurance risk;<br>k. The internal control system is effective in supporting the implementation of risk management;<br>l. The implementation of independent review by the internal audit unit and functions performing independent review is adequate in terms of methodology, frequency, and reporting to the Board of Directors and Board of Commissioners;<br>m. There are weaknesses but not significant based on independent review results; and<br>n. Follow-up on independent review has been carried out adequately.<br><br>Rating 3 (Sufficient)<br>Examples of characteristics of Companies included in Rating 3 (sufficient) are as follows:<br>a. Formulation of risk appetite and risk tolerance is sufficiently adequate but not always aligned with the Company's overall strategic objectives and business strategy;<br>b. The Board of Directors, Board of Commissioners and/or DPS has sufficiently good awareness and understanding regarding risk management for insurance risk, insurance risk sources, and insurance risk levels at the Company;<br>c. The risk management culture for insurance risk is sufficiently strong and has been internalized sufficiently well but not always implemented consistently;<br>d. The execution of duties by the Board of Directors, Board of Commissioners and/or DPS is generally sufficiently adequate, but there are weaknesses in some assessment aspects that need management attention;<br>e. The risk management function for insurance risk is sufficiently good, but there are several weaknesses requiring management attention;<br>f. The risk management strategy for insurance risk is sufficiently aligned with the risk appetite and insurance risk tolerance;<br>g. Insurance risk management policies and procedures are sufficiently adequate but not always consistent with implementation;<br>h. The insurance risk management process is sufficiently adequate in identifying, measuring, monitoring, and controlling insurance risk;<br>i. The MIS for insurance risk meets minimum expectations but has several weaknesses, including
reporting to the Board of Directors and Board of Commissioners that requires management attention;<br>j. Human resources are sufficiently adequate in terms of quantity and competency quality in the risk management function for insurance risk strategy;<br>k. The internal control system is sufficiently effective in supporting the implementation of risk management;<br>l. The implementation of independent review by the internal audit unit and functions performing independent review is sufficiently adequate. There are several weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners that require management attention;<br>m. There are weaknesses that are quite significant based on independent review results, requiring management attention; and<br>n. Follow-up on independent review has been carried out sufficiently adequately.<br><br>Rating 4 (Fairly Weak)<br>Examples of characteristics of Companies included in Rating 4 (fairly weak) are as follows:<br>a. Formulation of risk appetite and risk tolerance is less adequate and not aligned with overall strategic objectives and business strategy;<br>b. There are significant weaknesses in the awareness and understanding of the Board of Directors, Board of Commissioners and/or DPS regarding risk management for insurance risk, insurance risk sources, and insurance risk levels at the Company;<br>c. The risk management culture for insurance risk is weak and has not been internalized well at every organizational level;<br>d. The execution of duties by the Board of Directors, Board of Commissioners and/or DPS is generally less adequate, but weaknesses in various assessment aspects require immediate improvement;<br>e. There are significant weaknesses in the risk management function for insurance risk that require immediate improvement;<br>f. The risk management strategy for insurance risk is less aligned with the risk appetite and insurance risk tolerance;<br>g. Significant weaknesses in insurance risk policies, procedures, and limits;<br>h. The insurance risk management process is less adequate in identifying, measuring, monitoring, and controlling insurance risk;<br>i. Significant weaknesses in the Management Information System (MIS), including reporting to the Board of Directors and Board of Commissioners that requires immediate improvement;<br>j. Human resources are less adequate in terms of quantity and competence in the risk management function for insurance risk;<br>k. The internal control system is less effective in supporting the implementation of risk management;<br>l. The implementation of independent review by the internal audit unit and functions performing independent review is less adequate. There are weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners that require immediate improvement;<br>m. There are significant weaknesses based on independent review results that require immediate corrective
action; and<br>n. Follow-up on independent review is less adequate.<br><br>Rating 5 (Weak)<br>Examples of characteristics of Companies included in Rating 5 (weak) are as follows:<br>a. Formulation of risk appetite and risk tolerance is inadequate and there is no connection with overall strategic objectives and business strategy;<br>b. The awareness and understanding of the Board of Directors, Board of Directors and/or DPS regarding risk management for insurance risk, insurance risk sources, and insurance risk levels at the Company is very weak;<br>c. The risk management culture for insurance risk is not strong or does not exist at all;<br>d. The execution of duties by the Board of Directors, Board of Commissioners and/or DPS is inadequate. There are significant weaknesses in almost all assessment aspects, and corrective actions and resolutions are beyond the Company's capability;<br>e. There are significant weaknesses in the risk management function for insurance risk that require fundamental improvement;<br>f. The risk management strategy for insurance risk is not aligned with the risk appetite and insurance risk tolerance;<br>g. Very significant weaknesses in insurance risk policies, procedures, and limits;<br>h. The insurance risk management process is inadequate in identifying, measuring, monitoring, and controlling insurance risk;<br>i. Fundamental weaknesses in the MIS for Insurance Risk. Insurance risk reporting to the Board of Commissioners and Board of Directors is very inadequate;<br>j. The internal control system is ineffective in supporting the implementation of risk management;<br>k. The implementation of independent review by the internal audit unit and functions performing independent review is less adequate. There are weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners that require fundamental improvement;<br>l. There are very significant weaknesses based on independent review results where corrective actions are beyond management's capability; and<br>m. Follow-up on independent review is inadequate or non-existent.

Table II.D.1: Parameters or Indicators for Inherent Risk Assessment for Credit Risk

No	Parameter	Indicator	Description
I	Quantitative
A. FOR INSURANCE COMPANIES AND REINSURANCE COMPANIES
1.	Ratio of Risk Assets	Investment with risk factor greater than 4% = (a) + (b) + ...+ (x) / total investment	To know exposure to investments with high risk or in cluster 3, cluster 4 and/or cluster 5. Risk increases if the composition of ownership of assets in this cluster increases as a percentage of total investment.<br>(a) time deposits and deposit certificates rated cluster 4<br>(b) time deposits and deposit certificates rated cluster 5<br>(c) corporate bonds rated cluster 4<br>(d) corporate bonds rated cluster 5<br>(e) MTN rated cluster 4<br>(f) MTN rated cluster 5<br>(g) securities issued by countries other than the home country rated cluster 4<br>(h) securities issued by countries other than the home country rated cluster 5<br>(i) financing through cooperation with other parties* - unhealthy<br>(j) other commercial properties: ltv < 65%<br>(k) other commercial properties: 65% < ltv < 75%<br>(l) unused properties<br>(m) direct writing premium receivables<br>(n) reinsurance assets sourced from capital oriented reinsurance programs<br>(o) co-insurance claim receivables rated cluster 3<br>(p) co-insurance claim receivables rated cluster 4<br>(q) co-insurance claim receivables rated cluster 5<br>(r) foreign reinsurance premium receivables rated cluster 3<br>(s) foreign reinsurance premium receivables rated cluster 4<br>(t) foreign reinsurance premium receivables rated cluster 5<br>(u) foreign reinsurance claim receivables rated cluster 3<br>(v) foreign reinsurance claim receivables rated cluster 4<br>(w) foreign reinsurance claim receivables rated cluster 5<br>(x) investment receivables that failed to pay on the due date/when cashed
2.	Growth of reinsurance premiums compared to insurance premium growth (calculated yoy)	Growth of reinsurance premiums / Growth of gross insurance premiums<br>(a) Growth of reinsurance premiums = (reinsurance premium of current quarter - reinsurance premium of previous year's quarter) / reinsurance premium of previous year's quarter<br>(b) Growth of gross insurance premiums = (gross premium of current quarter - gross premium of previous year's quarter) / gross premium of previous year's quarter	To know premium growth in Insurance Companies and Reinsurance Companies. This risk indicates that the greater the growth of reinsurance/retrocession premiums, the higher the risk exposure of Insurance Companies and Reinsurance Companies to reinsurers when the reinsurer's financial condition deteriorates.
3.	Ratio of foreign reinsurance placement to total reinsurance	(a+b) / foreign reinsurance premiums	To know the ratio of reinsurance placed with foreign reinsurers compared to total reinsurance/retrocession costs. This risk indicates that the greater the ratio, the greater the risk of violation of foreign reinsurance/retrocession placement and the risk of non-collection of foreign reinsurance/retrocession claims due to the reinsurer's deteriorating financial condition.
4.	Growth of reinsurance receivables	[(reinsurance premium receivables period t) - (reinsurance premium receivables period t-1)] / (reinsurance premium receivables period t-1)	To know the growth of reinsurance/retrocession receivables of Insurance Companies and Reinsurance Companies. Risk will increase when the ratio of reinsurance receivable growth becomes larger.
5.	Growth of credit risk (from MMBR)	[(total credit risk period t) - (total credit risk period t-1)] / (total credit risk period t-1)	To know the growth of credit risk in solvency level calculations. Risk will increase if credit risk increases compared to the previous year's credit risk.
6.	Ratio of Permitted Assets (AYD) for reinsurance receivables to total reinsurance receivables (can be from Premium/claim recovery)	AYD reinsurance receivables / total reinsurance receivables	Self-explanatory.
B. FOR SHARIA INSURANCE COMPANIES, SHARIA REINSURANCE COMPANIES, AND SHARIA UNITS
1.	Ratio of Risk Assets	Investment with risk factor greater than 4% = (a) + (b) + ...+ (x) / total investment	To know exposure to investments with high risk or in cluster 3, cluster 4 and/or cluster 5. Risk increases if the composition of ownership of assets in this cluster increases as a percentage of total investment.<br>Account Name:<br>(a) time deposits and deposit certificates rated cluster 4<br>(b) time deposits and deposit certificates rated cluster 5<br>(c) sharia corporate bonds/sukuk rated cluster 4<br>(d) sharia corporate bonds/sukuk rated cluster 5<br>(e) sharia MTN rated cluster 4<br>(f) sharia MTN rated cluster 5<br>(g) securities issued by countries other than the home country rated cluster 4<br>(h) securities issued by countries other than the home country rated cluster 5<br>(i) financing through cooperation with other parties* - unhealthy<br>(j) other commercial properties: ltv < 65%<br>(k) other commercial properties: 65% < ltv < 75%<br>(l) unused properties<br>(m) regional sukuk rated cluster 4<br>(n) regional sukuk rated cluster 5<br>(o) direct writing contribution receivables<br>(p) reinsurance assets sourced from capital oriented reinsurance programs<br>(q) foreign co-insurance claim receivables rated cluster 3<br>(r) foreign co-insurance claim receivables rated cluster 4<br>(s) foreign co-insurance claim receivables rated cluster 5<br>(t) foreign reinsurance contribution receivables rated cluster 3<br>(u) foreign reinsurance contribution receivables rated cluster 4<br>(v) foreign reinsurance contribution receivables rated cluster 5<br>(w) foreign reinsurance claim receivables rated cluster 3<br>(x) foreign reinsurance claim receivables rated cluster 4<br>(y) foreign reinsurance claim receivables rated cluster 5<br>(z) investment receivables that failed to pay on the due date/when cashed
2.	Reinsurance expense movement (Δ reinsurance expenses)	1) Tabarru' funds = [reinsurance contribution qtr n - reinsurance contribution qtr n-1] / reinsurance contribution qtr n-1<br>2) Company funds = [reinsurance ujrah qtr n - reinsurance ujrah qtr n-1] / reinsurance ujrah qtr n-1	To know the growth of reinsurance/retrocession costs from each fund in Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units. This risk indicates that the greater the growth of reinsurance/retrocession costs, the higher the risk exposure of Sharia Insurance Companies, Sharia Reinsurance Companies, and Sharia Units to reinsurers when the reinsurer's financial condition deteriorates.
3.	Ratio of foreign reinsurance placement to total reinsurance (Tabarru' funds)	Foreign reinsurance / total reinsurance	To know the ratio of reinsurance placed with foreign reinsurers compared to total reinsurance/retrocession costs. This risk indicates that the greater the ratio, the greater the risk of violation of foreign reinsurance/retrocession placement and the risk of non-collection of foreign reinsurance/retrocession claims due to the reinsurer's deteriorating financial condition.
4.	Ratio of growth of reinsurance receivables (Tabarru' funds)	[reinsurance receivables qtr n – reinsurance receivables qtr n-1] / reinsurance receivables qtr n-1<br>Includes reinsurance contribution receivables, reinsurance claim receivables, co-insurance contribution receivables, co-insurance claim receivables	To know the growth of reinsurance/retrocession receivables of the company. Risk will increase when the ratio of reinsurance receivable growth becomes larger.
5.	Growth of credit risk	1) Tabarru' Funds (DTMBR): [credit risk qtr n – credit risk qtr n-1] / credit risk qtr n-1<br>2) Company Funds (MMBR): [credit risk qtr n – credit risk qtr n-1] / credit risk qtr n-1<br>3) Company Funds (MMBR over PAYDI guaranteed): [credit risk qtr n – credit risk qtr n-1] / credit risk qtr n-1	To know the growth of credit risk in the calculation of solvency levels for Tabarru' Funds (Dana Tabarru and Dana Tanahud Minimum Berbasis Risiko (DTMBR)/Company Funds (MMBR). Risk will increase if credit risk increases compared to the previous year's credit risk.
6.	Ratio of AYD for reinsurance receivables to total reinsurance receivables (can be from contribution / claim recovery)	AYD reinsurance receivables = total reinsurance receivables qtr n (a+b+c) SAP balance / total reinsurance receivables qtr n (a+b+c) SAK balance	To know exposure to AYD reinsurance receivables. Risk increases if the composition of AYD reinsurance receivables decreases as a percentage of total receivables.
II	Qualitative
1.	Risk from receivables management	Credit Risk is generally indicated by the level of receivables collectability influenced by the insured's condition and collection efforts made by the Company.	Self-explanatory.
2.	Risk of concentration of investment placement and counterparty rating where investments are placed	a. Concentration of investment placement<br>Credit risk applies to all assets and reinsurance transactions conducted by the Company.<br>Generally, diversified placement of investment assets, receivables, and reinsurance has a lower inherent risk level compared to placement of investment assets, receivables, and reinsurance concentrated on a specific party.<br>In building an investment portfolio, the Company needs to pay attention to the size of the proportion of certain investment instruments against its total investments. Placement of investments that is too large in one type of instrument has the potential to increase risk in the event that the instrument experiences a decline. As an initial reference, the Company can compare its investment portfolio with the restrictions on each type of investment as regulated on...

No Parameter Indikator Keterangan regulations related to .
Furthermore, the strategy of placing funds in assets that have truly good prospects. This is to mitigate the errors that many Companies frequently commit, namely defaulting on payments to policyholders due to incorrect strategies in placing funds in assets/shares of Companies with poor prospects. In addition, the risk of concentration of investment placement is also influenced by the settlement of the aforementioned investment transactions in exchange trading, whether through the regular market, cash market, or negotiated market, and also the settlement of transactions outside the exchange either through Delivery Versus Payment (DVP)/Received Versus Payment (RVP)/Delivery Free of Payment (DFOP)/Receive Free of Payment (RFOP), or other instructions. b. counterparty rating In placing investment assets, receivables, and reinsurance, Companies need to consider the credibility and/or rating of third parties to minimize the occurrence of investment payment failures,

No Parameter Indikator Keterangan receivables and claim recovery. The credibility and/or rating of the counterparty can be assessed from the track record of past transactions, media reports, and the availability of ratings from rating agencies.
3. Reinsurer failure risk
a. Concentration of reinsurance placement; and b. Rating of reinsurance placement Explains the composition of reinsurance placement viewed from the reinsurers used by the Company or the composition viewed from the production lines/products that are reinsured/retroceded. The risk is higher if the reinsurer experiences financial difficulties.

Table II.D.2: Guidelines for Setting Inherent Risk Level for Credit Risk
Rating Definition of Rating
Rating 1
(Low)
Considering the business activities conducted by the Company, the potential losses faced by the Company from credit risk are classified as low for a certain period in the future. Examples of Company characteristics included in Rating 1 (low) include the following:
a. no delay in payment of investment returns from the counterparty; b. the proportion of investment placement in one party is low (below 5%);
c. investment placement has been diversified in industries that are not correlated;
d. asset allocation has been diversified according to the limits per type and per party as regulated in statutory regulations and does not violate sound business practices; and e. there are no investments in "problematic" parties; and f. the credibility level of the investment counterparty is very high, for example: investment grade bond rating above single A, the health level of the deposit-issuing bank is very healthy or there are no violations of regulations committed by the counterparty. Rating 2 (Medium Low) Considering the business activities conducted by the Company, the potential losses faced by the Company from credit risk are classified as Medium Low for a certain period in the future. Examples of Company characteristics included in Rating 2 (Medium Low) include the following:
a. delay in payment of investment returns from the counterparty is medium low, can be resolved in a short time (< 1 year); b. the proportion of investment placement in one party is medium low (between 5-10%);
c. investment placement has been diversified in industries that are not correlated but there are indications that one investment of insignificant amount is placed in an industry that is positively correlated;
d. asset allocation has been diversified according to the limits per type and per party as regulated in statutory regulations but there is one type of investment that violates the limit per type and/or the limit per party;

Rating Definition of Rating e. there are investments in "problematic" parties with a low proportion (below 1%); and f. the credibility level of the investment counterparty is high, for example: investment grade bond rating above BBB, the health level of the deposit-issuing bank is healthy or generally there are no violations of regulations committed by the counterparty. Rating 3 (Medium) Considering the business activities conducted by the Company, the potential losses faced by the Company from credit risk are classified as quite high for a certain period in the future. Examples of Company characteristics included in Rating 3 (quite high) include the following:
a. delay in payment of investment returns from the counterparty is classified as medium, can be resolved in a short time (< 1 year); b. the proportion of investment placement in one party is medium (10% - 20%);
c. at least half of the investment placement has been diversified in industries that are not correlated.
d. at least half of the asset allocation is not well diversified. e. there are investments in "problematic" parties with a medium proportion (1%-5%); and f. the credibility level of the investment counterparty is quite high, for example: investment grade bond rating less than BBB+, the health level of the deposit-issuing bank is quite healthy or there are violations of regulations committed by the counterparty but not significant; Rating 4 (Medium High) Considering the business activities conducted by the Company, the potential losses faced by the Company from credit risk are classified as high for a certain period in the future. Examples of Company characteristics included in Rating 4 (high) include the following:
a. delay in payment of investment returns from the counterparty is classified as medium high, cannot be resolved in a short time (> 1 year); b. the proportion of investment placement in one party is medium high (above 20%), excluding the calculation of investment placement in SBN instrument types;
c. investment return level is unrealistic and higher than the general market benchmark;
d. asset allocation is not well diversified, namely there are violations against the limits per type and per party of

Rating Definition of Rating investment placement; e. there are investments in "problematic" parties with a medium high proportion (6%-10%); and f. the credibility level of the investment counterparty is low, for example: non-investment grade bond rating, the health level of the deposit-issuing bank is less healthy or there are violations of regulations committed by the counterparty that are quite significant. Rating 5 (High) Considering the business activities conducted by the Company, the potential losses faced by the Company from credit risk are classified as very high for a certain period in the future. Examples of Company characteristics included in Rating 5 (high) include the following:
a. delay in payment of investment returns from the counterparty is classified as high, has not been resolved in a short time (> 1 year) or Suspension of Debt Payment Obligations (PKPU) until bankruptcy; b. the proportion of investment placement in one party is high (above 20%), excluding the calculation of investment placement in SBN instrument types;
c. investment return level is unrealistic, higher than the general market benchmark and not supported by prior studies;
d. asset allocation is not well diversified, namely there are violations against the limits per type and per party of investment placement and there is investment concentration in a certain type of investment; e. there are investments in "problematic" parties with a high proportion (above 10%); and f. the credibility level of the investment counterparty is very low, for example: non-investment grade and default bond rating, the health level of the deposit-issuing bank is unhealthy or there are significant violations of regulations committed by the counterparty.

Table II.D.3: Guidelines for Setting the Quality of Risk Management Application for Credit Risk
Rating Definition of Rating
Rating 1
(Strong)
The quality of risk management application for credit risk is very adequate, there are minor weaknesses that are not significant so they can be ignored.
Examples of Company characteristics included in Rating 1 (strong) include the following:
a. the formulation of the level of risk to be taken (risk appetite) and risk tolerance (risk tolerance) is very adequate and has aligned with the overall strategic objectives and business strategy; b. the Board of Directors, Board of Commissioners, and/or DPS have very adequate awareness and understanding regarding risk management for credit risk, credit risk sources, and the level of credit risk in the Company;
c. the culture of risk management for credit risk is very strong and has been internalized very well at all levels of the organization;
d. the implementation of the duties of the Board of Directors, Board of Commissioners, and/or DPS as a whole is very adequate; e. the risk management function for credit risk is independent, has clear tasks and responsibilities, and has run very well; f. the delegation of authority is controlled and monitored periodically, and has run very well; g. investment strategy is very good and very aligned with the level of risk to be taken and credit risk tolerance; h. policies, procedures, and limit setting for credit risk are very adequate and available for all areas of risk management for credit risk, aligned with implementation and well understood by employees;
i. the risk management process for credit risk is very adequate in identifying, measuring, monitoring, and controlling credit risk;
j. analysis or feasibility tests (due diligence) of investment instruments are very good, applied very consistently, and well understood by employees; k. there is a credit risk monitoring function that runs very well;
l. the credit risk grading and application system (credit risk grading) is very good;
m. there is an independent investment review function that runs very well;

Rating Definition of Rating n. the risk management information system (SIM) for credit risk is very good so as to produce comprehensive and integrated credit risk reports to the Board of Directors, Board of Commissioners, and/or DPS; o. human resources are very adequate both in terms of quantity and quality in the risk management function for credit risk; p. the internal control system is very effective in supporting the implementation of risk management for credit risk; q. the implementation of independent review by the internal control unit and the function that conducts independent review is very adequate both in terms of methodology, frequency, and reporting to the Board of Directors, Board of Commissioners, and/or DPS; r. generally there are no significant weaknesses based on independent review results; s. follow-up on independent review has been implemented very adequately; t. the compliance function for credit risk has very clear tasks and responsibilities and has run very well; and u. the Company's policies, regulations, systems, and procedures, and business activities are very in accordance with statutory regulations. Rating 2 (Rather Strong) The quality of risk management application for credit risk is adequate although there are several minor weaknesses that can be resolved in normal business activities. Examples of Company characteristics included in Rating 2 (rather strong) include the following:
a. the formulation of the level of risk to be taken (risk appetite) and risk tolerance (risk tolerance) is adequate and has aligned with the overall strategic objectives and business strategy; b. the Board of Directors, Board of Commissioners, and/or DPS have good awareness and understanding regarding risk management for credit risk, credit risk sources, and the level of credit risk in the Company;
c. the culture of risk management for credit risk is strong and has been internalized well at all levels of the organization;
d. the implementation of the duties of the Board of Directors, Board of Commissioners, and/or DPS is generally adequate, there are several weaknesses that are not significant and can be improved immediately;

Rating Definition of Rating e. the risk management function for credit risk is independent, has clear tasks and responsibilities, and has run well, there are minor weaknesses that can be resolved in normal business activities; f. the delegation of authority is controlled and monitored periodically, and has run well; g. investment strategy is good and very aligned with the level of risk to be taken and credit risk tolerance; h. policies, procedures, and limit setting for credit risk are very adequate and available for all areas of risk management for credit risk, aligned with implementation, and well understood by employees although there are minor weaknesses;
i. the credit risk management process is adequate in identifying, measuring, monitoring, and controlling credit risk;
j. analysis or feasibility tests (due diligence) of investment instruments are good, applied consistently, and well understood by employees; k. there is a credit risk monitoring function that runs well;
l. the credit risk grading and application system (credit risk grading) is good;
m. there is an independent investment review function but there are minor weaknesses that do not disrupt the overall process so it runs well; n. the risk management information system (SIM) for credit risk is good including credit risk reporting to the Board of Directors, Board of Commissioners, and/or DPS, there are minor weaknesses but can be easily improved; o. human resources are adequate, both in terms of quantity and quality in the risk management function for credit risk; p. the internal control system is effective in supporting the implementation of risk management for credit risk; q. the implementation of independent review by the internal control unit and the function that conducts independent review is adequate both in terms of methodology, frequency, and reporting to the Board of Directors, Board of Commissioners, and/or DPS; r. there are weaknesses but not significant based on independent review results;

Rating Definition of Rating s. follow-up on independent review has been implemented adequately; t. the compliance function for credit risk has clear tasks and responsibilities and has run well; and u. the Company's policies, regulations, systems, and procedures, and business activities are in accordance with statutory regulations. Rating 3 (Adequate) The quality of risk management application for credit risk is quite adequate. Although minimum requirements are met, there are several weaknesses that require management attention. Examples of Company characteristics included in Rating 3 (adequate) include the following:
a. the formulation of the level of risk to be taken (risk appetite) and risk tolerance (risk tolerance) is quite adequate but not always aligned with the overall strategic objectives and business strategy; b. the Board of Directors, Board of Commissioners, and/or Sharia Supervisory Board have quite good awareness and understanding regarding risk management for credit risk, credit risk sources, and the level of credit risk in the Company;
c. the culture of risk management for credit risk is quite strong and has been internalized quite well but not always implemented consistently;
d. the implementation of the duties of the Board of Directors, Board of Commissioners, and/or DPS is generally quite adequate, there are several weaknesses in some assessment aspects that need management attention; e. the risk management function for credit risk is quite good, there are several weaknesses including reporting to the Board of Directors, Board of Commissioners, and/or DPS that require management attention; f. delegation of authority is quite good, but control and monitoring are not always implemented well; g. investment strategy is quite aligned with the level of risk to be taken and credit risk tolerance; h. policies, procedures, and limit setting for credit risk are quite adequate but not always consistent with implementation;
i. the credit risk management process is quite adequate in identifying, measuring, monitoring, and controlling credit risk;

Rating Definition of Rating j. analysis or feasibility tests (due diligence) of investment instruments are quite good, applied quite consistently, and well understood by employees; k. there is a credit risk monitoring function that runs quite well;
l. the credit risk grading and application system (credit risk grading) is quite good;
m. there is an investment review function that is quite good, but there are several weaknesses that need management attention; n. the risk management information system (SIM) for credit risk meets minimum expectations but there are several weaknesses including credit risk reporting to the Board of Directors, Board of Commissioners, and/or DPS that require management attention; o. human resources are quite adequate both in terms of quantity and quality in the risk management function for credit risk; p. the internal control system is quite effective in supporting the implementation of risk management for credit risk; q. the implementation of independent review by the internal control unit and the function that conducts independent review is quite adequate, but there are several weaknesses in methodology, frequency, and/or reporting to the Board of Directors, Board of Commissioners, and/or DPS that require management attention; r. there are weaknesses that are quite significant based on independent review results that require management attention; s. follow-up on independent review has been implemented quite adequately; t. the compliance function for credit risk has tasks and runs quite well; and u. the Company's policies, regulations, systems, and procedures, and business activities are quite in accordance with statutory regulations. Rating 4 (Rather Weak) The quality of risk management application for credit risk is weak, there are significant weaknesses in various aspects of risk management for credit risk that require immediate corrective action. Examples of Company characteristics included in Rating 4 (rather weak) include the following:
a. the formulation of the level of risk to be taken (risk appetite)

Rating Definition of Rating and risk tolerance (risk tolerance) is less adequate and not aligned with the overall strategic objectives and business strategy; b. there are significant weaknesses in the awareness and understanding of the Board of Directors, Supervisory Board, and/or DPS regarding risk management for credit risk, credit risk sources, and the level of credit risk in the Company;
c. the culture of risk management for credit risk is less strong and has not been internalized well at every level of the organization;
d. the implementation of the duties of the Board of Directors, Supervisory Board, and/or DPS is generally less adequate and there are weaknesses in various assessment aspects that require immediate improvement; e. there are significant weaknesses in the risk management function for credit risk that require immediate improvement; f. delegation of authority is weak, not controlled, and not monitored well; g. investment strategy is less aligned with the level of risk to be taken (risk appetite) and credit risk tolerance (risk tolerance); h. there are significant weaknesses in policies, procedures, and limit setting for credit risk;
i. the credit risk management process is less adequate in identifying, measuring, monitoring, and controlling credit risk;
j. analysis or feasibility tests (due diligence) of investment instruments are less good, there are several weaknesses that need immediate improvement; k. the credit risk monitoring function runs less well;
l. the credit risk grading and application system (credit risk grading) is less good;
m. investment review is less good and there are several weaknesses that need to be improved immediately; n. significant weaknesses in the risk management information system (SIM) for credit risk including reporting to the Board of Directors, Board of Commissioners and/or DPS that require immediate improvement; o. human resources are less adequate both in terms of quantity and quality in the risk management function for credit risk; p. the internal control system is less effective in supporting the implementation of risk management for credit risk;

Rating Definition of Rating q. the implementation of independent review by the internal control unit and the function that conducts independent review is less adequate, but there are weaknesses in methodology, frequency, and/or reporting to the Board of Directors, Board of Commissioners, and/or DPS that require immediate improvement; r. there are weaknesses that are significant based on independent review results that require immediate improvement; s. follow-up on independent review is less adequate; t. the compliance function for credit risk has tasks and responsibilities that are less clear and runs less well; and u. the Company's policies, regulations, systems, and procedures, and business activities are less in accordance with statutory regulations. Rating 5 (Weak) The quality of risk management application for credit risk is not adequate, there are significant weaknesses in various aspects of risk management for credit risk whose resolution is beyond the management's capability. Examples of Company characteristics included in Rating 5 (weak) include the following:
a. the formulation of the level of risk to be taken (risk appetite) and risk tolerance (risk tolerance) is not adequate and there is no connection with the overall strategic objectives and business strategy; b. the awareness and understanding of the Board of Directors, Board of Commissioners, and/or DPS regarding risk management for credit risk, credit risk sources, and the level of credit risk in the Company is very weak;
c. the culture of risk management for credit risk is not strong or does not exist at all;
d. the implementation of the duties of the Board of Directors, Board of Commissioners, and/or DPS is not adequate, there are significant weaknesses in almost all assessment aspects where actions and resolutions are beyond the Company's capability; e. there are significant weaknesses in the risk management function for credit risk that require fundamental improvement; f. delegation of authority is very weak or non-existent; g. investment strategy is less aligned with the level of risk to be taken (risk appetite) and credit risk tolerance (risk tolerance); h. there are very significant weaknesses in policies, procedures, and limit setting for credit risk;
i. the credit risk management process is not adequate in

Rating Definition

Identify, measure, monitor, and control credit risk;

j. analysis or due diligence of non-performing investment instruments;

k. credit risk monitoring function is absent or not functioning properly;

l. credit risk grading system and application is poor;

m. investment review function is poor, with several weaknesses that need immediate improvement;

n. fundamental weaknesses in the Risk Management Information System (SIM) regarding risk reporting to the Board of Directors, Board of Commissioners, and/or Sharia Supervisory Board (DPS) that need immediate improvement;

o. human resources are inadequate in terms of quantity and quality for the credit risk management function;

p. internal control system is ineffective in supporting credit risk management implementation;

q. independent review implementation by the internal control unit and the function performing independent review is inadequate, with weaknesses in methodology, frequency, and/or reporting to the Board of Directors, Board of Commissioners, and/or DPS requiring fundamental improvement;

r. significant weaknesses exist based on independent review results where corrective actions are beyond management's capability;

s. follow-up on independent review is inadequate or non-existent;

t. the credit risk compliance function has unclear tasks and responsibilities and has not functioned properly; and

u. the Company's policies, provisions, systems, procedures, and business activities are not in accordance with applicable regulations.

Table II.E.1: Parameters or Indicators for Assessing Inherent Risk for Market Risk

No	Parameter	Indicator	Description
I	Quantitative
A.	FOR INSURANCE COMPANIES AND REINSURANCE COMPANIES
1.	Investment Return Ratio (ROI)	(Net profit before tax) / (Total assets)	The investment return ratio is intended to measure the company's performance from investment activities. Generally, a higher ratio indicates better performance compared to a lower ratio.
2.	Ratio of risk assets greater than rating/cluster 3 to total assets	Risk assets (factor > 4%) / Total assets	Assets that can be categorized as risk assets are those with ratings below the minimum required rating (cluster 4 and cluster 5). These assets have higher market risk than assets with ratings above the minimum required rating (cluster 1, cluster 2, and cluster 3). Thus, the larger the risk assets, the greater the market risk held by the Insurance Company and Reinsurance Company.
3.	Market Risk Growth (from MMBR)	[(Market risk at period t) - (Market risk at period t-1)] / (Market risk at period t-1)	To determine the growth of market risk in solvency level calculations. Risk will increase if market risk increases compared to the previous year's market risk.
4.	Ratio of foreign currency assets to total assets	Foreign currency assets / Total assets	Generally, Insurance and Reinsurance Companies with assets in foreign currency have higher risk than those without foreign currency assets. This risk increases if the amount of foreign currency assets is larger and the foreign currencies used are more diverse. Additionally, this risk increases if a significant portion of assets is in the currency of a country with high exchange rate volatility and fluctuation.
5.	Ratio of foreign currency assets to foreign currency liabilities	Foreign currency assets / Foreign currency liabilities	To determine the comparison between assets and liabilities in foreign currency. Risk arises if foreign currency liabilities are not backed by sufficient foreign currency assets.
B.	FOR SHARIA INSURANCE COMPANIES, SHARIA REINSURANCE COMPANIES, AND SHARIA UNITS
1.	Ratio of risk assets (greater than rating/cluster 3) to total assets	Risk assets with cluster 3 and/or risk factor > 15% / Total assets	To determine exposure to investments with high risk or in cluster 3, cluster 4, and/or cluster 5. Risk increases if the composition of ownership affected by market price changes in this cluster increases as a percentage of total assets.
2.	Investment Return Ratio (ROI)	ROI Tabarru’ funds = Investment results of Tabarru’ funds / Average Tabarru’ fund investments<br>ROI Company funds = Investment results of Company funds / Average Company fund investments<br>ROI Participant Investment funds = Investment results of Participant Investment funds / Average Participant Investment fund investments<br>Average investment is taken from the average during the assessment period (e.g., 12-month average if the assessment period is 1 year)	To calculate the ratio of investment development results compared to the insurance company, Sharia reinsurance company, and Sharia Unit investments according to the managed funds. In assessing risk, a benchmark of investment results by industry/peer group per investment type is required. The greater the deviation between the ROI of the Sharia insurance company, Sharia reinsurance company, and Sharia Unit with the chosen benchmark, the greater the market risk of the company.
3.	Market Risk Growth (from DTMBR, MMBR, and PAYDI guarantee)	Tabarru’ funds (DTMBR): [Market risk at period n – Market risk at period n-1] / Market risk at period n-1<br>Company funds (MMBR): [Market risk at period n – Market risk at period n-1] / Market risk at period n-1<br>Company funds (MMBR over PAYDI guaranteed): [Market risk at period n – Market risk at period n-1] / Market risk at period n-1	To determine the growth of market risk in solvency level calculations for Tabarru’ Funds (DTMBR)/Company Funds (MMBR)/PAYDI guaranteeing the principal investment value in Company Funds (MMBR over PAYDI guaranteed). Risk will increase if market risk increases compared to the previous year's market risk.
4.	Ratio of foreign currency assets to total assets	Tabarru’ funds: Foreign currency assets / Total assets<br>Company funds: Foreign currency assets / Total assets<br>Participant Investment funds: Foreign currency assets / Total assets	To determine the composition of foreign currency assets held by Tabarru’ funds, Company funds, and Participant Investment funds. Risk arises from changes in the value of these foreign currencies.
5.	Ratio of foreign currency assets to foreign currency liabilities	Tabarru’ funds: Foreign currency assets / Foreign currency liabilities<br>Company funds: Foreign currency assets / Foreign currency liabilities<br>Participant Investment funds: Foreign currency assets / Foreign currency liabilities	To determine the comparison between assets and liabilities in foreign currency held by Tabarru’ funds, Company funds, and Participant Investment funds. Risk arises if foreign currency liabilities are not backed by sufficient foreign currency assets.
II	Qualitative
1.	Investment Allocation and/or Structure	a. Investment Portfolio<br>1) Volume and composition of portfolio<br>a) Volume/exposure to exchange rate risk<br>b) Assessment of volume/exposure to interest rate risk	PTB = fptb Max (CPrf – CP0)<br>Explanation: - Fptb is the PTB factor - CPrf is the premium reserve calculated with risk-free interest rate - CP0 is the premium reserve calculated by the company actuary (premium reserve presented in the financial position report/balance sheet)
		2) Assessment of Business Strategy and Policy Impacting Market Risk (Nature)<br>a) Trading characteristics: whether trading activities are proprietary or on behalf of policyholders, insureds, and/or participants (brokering), which have different inherent risk levels.<br>b) Business activity characteristics: whether corporate business or consumer business. Margins obtained by the Company from corporate business are usually relatively small compared to other businesses, because insurance premiums/contributions are generally large compared to non-corporate business, so the Company tends to offer low premiums/contributions for traditional insurance products (without investment elements) and offer high returns for insurance products containing investment elements. Consumer business is business with small value but a very large number of policyholders, insureds, and/or participants, so the return margin is relatively large.<br>c) Policyholder, insured, and/or participant characteristics: Identification of the Company's main policyholders, insureds, and/or participants, whether dominated by large companies, banks, and financial institutions, small companies, or retail policyholders, insureds, and/or participants. Generally, policyholders, insureds, and/or participants that are financial institutions or large companies are more sensitive to market factor changes compared to retail policyholders, insureds, and/or participants.
		b. Investment portfolio volatility	Proportion of investment placement per investment type affected by market volatility, interest rate risk, or market price risk. Investment instruments recorded using market value can be affected by market volatility, interest rate risk, or market price risk. Examples: stocks, bonds, government securities, sukuk, mutual funds, and asset-backed securities, including derivative transactions due to overall changes in market conditions. The term market is not limited to official stock exchanges or organized over-the-counter markets.
2.	Investment Objectives and Strategy	a. Investment Objectives and Strategy<br>1) The investment objective assessed is the investment style conducted by the Company and/or Sharia Unit. In managing investments, the Company's Board of Directors and/or Sharia Unit managers can choose active, passive, or intermediate strategies between active and passive. Active strategy means the Company's Board of Directors and/or Sharia Unit managers actively adjust the investment portfolio to take advantage of financial market dynamics (e.g., changes in stock and bond prices). Active strategy is often interpreted as an aggressive strategy.<br>Conversely, passive strategy means the Company's Board of Directors or Sharia Unit managers tend to be unreactive to market dynamics and often apply a buy-and-hold strategy.<br>2) Investment Strategy<br>a) Asset allocation strategy relates to the selection of investment instrument types (e.g., deposits, government securities, or stocks), location (domestic or abroad for investments allowed by regulations to be placed abroad), and composition.<br>b) Investment results strategy and desired risk are reflected in the targeted investment return (return). For Companies and Sharia Units that set return rates above market return (beta), investment manager expertise is required. Companies and Sharia Units that set such beta targets will have higher inherent risk than those that do not set beta targets (passive investment strategy or following market developments).<br>Beta is an assessment of the risk level (calculated based on asset value volatility) of an investment asset compared to the market risk level. Assessment of an investment asset based on the comparison between the return of that investment asset and market return is called alpha.<br>Furthermore, in relation to the existence of investment return guarantees, attention needs to be paid to the mechanism for setting realistic investment return guarantees and the mechanism for managing investments for this type of product prudently.
		b. Consistency of asset allocation strategy with desired targets	Quite clear.
		c. Investment Diversification	Diversification of the Company's and Sharia Unit's investments with diverse investment types will have lower inherent risk than Companies and Sharia Units with less diverse investment types.
3.	Investment Asset Valuation	a. Ease of investment portfolio transactions. Investment asset instruments, the more frequently investments are traded on the stock exchange, the easier it is to obtain fair market price.<br>b. Investment assessment:<br>1) Reliability level of investment portfolio valuation and<br>2) Reputation of the valuation service provider<br>1) Reliability level of investment portfolio valuation<br>The risk of possible errors in valuing assets can arise from the selection of inappropriate valuation methods and/or inconsistent application of valuation methods. Additionally, valuation of asset instruments uses assumptions that can change dynamically, so valuations may differ if performed at different times by different parties.<br>2) Reputation of the valuation service provider<br>Investment instruments whose fair value is not available in the market, such as property, require an independent appraiser to present the fair value of the asset. Independent valuation is required for investments where regulation requires the use of an independent party, for example, appraisal. Risk arises if the independent party is not fair in valuing investments, for example, by using assumptions that do not match actual conditions.

Table II.E.2: Guidelines for Setting Inherent Risk Levels for Market Risk

Rating	Definition
Rating 1 (Low)	Considering the business activities conducted by the Company, the potential losses faced by the Company from market risk are classified as very low during a certain period in the future.<br><br>Example characteristics of Companies included in Rating 1 (low) include:<br>a. Company portfolio is dominated by non-complex financial instruments;<br>b. All Company investments are not exposed to market risk;<br>c. All Company investments are not exposed to exchange rate risk;<br>d. All trading activities are for brokering purposes;<br>e. Proportion of investment placement per investment type affected by market volatility is low;<br>f. Investment objectives and strategies are formulated very well;<br>g. Investment return target strategy is at the market risk level (beta);<br>h. Asset allocation strategy with desired targets is very consistent;<br>i. Company investment placement is very well diversified;<br>j. Proportion of investment portfolio with prices not available in the market compared to investments is low;<br>k. No errors by the Company in valuing investment assets;<br>l. Investment portfolio valuation is conducted periodically and based on valuation bases in accordance with applicable regulations; and<br>m. The appraiser service used by the Company has a very good reputation and is registered with the Financial Services Authority (OJK).
Rating 2 (Low-Medium)	Considering the business activities conducted by the Company, the potential losses faced by the Company from market risk are classified as low during a certain period in the future.<br><br>Example characteristics of Companies included in Rating 2 (low-medium) include:<br>a. Company portfolio is dominated by less complex financial instruments;<br>b. Most Company investments are not exposed to market risk;<br>c. Most Company investments are not exposed to exchange rate risk;<br>d. Most trading activities are for brokering purposes;<br>e. Proportion of investment placement per investment type affected by market volatility is low-medium;<br>f. Investment objectives and strategies are formulated well;<br>g. Investment return target strategy is at the market risk level (beta) or above beta but there are investment management experts;<br>h. Asset allocation strategy with desired targets is consistent;<br>i. Company investment placement is well diversified;<br>j. Proportion of investment portfolio with prices not available in the market compared to investments is low-medium;<br>k. Very few errors by the Company in valuing investment assets;<br>l. Investment portfolio valuation is conducted periodically but some are not based on valuation bases in accordance with applicable regulations; and<br>m. The appraiser service used by the Company has a good reputation and is registered with the Financial Services Authority (OJK).
Rating 3 (Medium)	Considering the business activities conducted by the Company, the potential losses faced by the Company from market risk are classified as moderately high during a certain period in the future.<br><br>Example characteristics of Companies included in Rating 3 (moderately high) include:<br>a. Company portfolio is dominated by moderately complex financial instruments;<br>b. A small portion of Company investments are not exposed to market risk;<br>c. A small portion of Company investments are not exposed to exchange rate risk;<br>d. A small portion of trading activities are for brokering purposes;<br>e. Proportion of investment placement per investment type affected by market volatility is medium;<br>f. Investment objectives and strategies are formulated moderately well;<br>g. Investment return target strategy is slightly above the market risk level (beta) but there are investment management experts;<br>h. Asset allocation strategy with desired targets is moderately consistent;<br>i. Company investment placement is moderately well diversified;<br>j. Proportion of investment portfolio with prices not available in the market compared to investments is medium;<br>k. Some errors by the Company in valuing investment assets;<br>l. Investment portfolio valuation is conducted moderately periodically and some are not based on valuation bases in accordance with applicable regulations; and<br>m. The appraiser service used by the Company has a moderately good reputation and is registered with the Financial Services Authority (OJK).
Rating 4 (Medium-High)	Considering the business activities conducted by the Company, the potential losses faced by the Company from market risk are classified as high during a certain period in the future.<br><br>Example characteristics of Companies included in Rating 4 (high) include:<br>a. Company portfolio is dominated by complex financial instruments;<br>b. Most Company investments are exposed to market risk;<br>c. Most Company investments are exposed to exchange rate risk;<br>d. Most trading activities are for proprietary purposes;<br>e. Proportion of investment placement per investment type affected by market volatility is medium-high;<br>f. Investment objectives and strategies are formulated poorly;<br>g. Investment return target strategy is far above the market risk level (beta) but there are investment management experts;<br>h. Asset allocation strategy with desired targets is less consistent;<br>i. Investment placement is less well diversified;<br>j. Proportion of investment portfolio with prices not available in the market compared to investments is medium-high;<br>k. Frequent errors by the Company in valuing investment assets;<br>l. Investment portfolio valuation is less conducted periodically and some are not based on valuation bases in accordance with applicable regulations; and<br>m. The appraiser service used by the Company has a less good reputation and is registered with the Financial Services Authority (OJK).
Rating 5 (High)	Considering the business activities conducted by the Company, the potential losses faced by the Company from market risk are classified as very high during a certain period in the future.<br><br>Example characteristics of Companies included in Rating 5 (very high) include:<br>a. Company portfolio is dominated by very complex financial instruments;<br>b. All Company investments are exposed to market risk;<br>c. All Company investments are exposed to exchange rate risk;<br>d. All trading activities are for proprietary purposes;<br>e. Proportion of investment placement per investment type affected by market volatility is high;<br>f. Investment objectives and strategies are formulated poorly;<br>g. Investment return target strategy is far above the market risk level (beta) and there are no investment management experts;<br>h. Asset allocation strategy with desired targets is inconsistent;<br>i. Investment placement is very poorly diversified;<br>j. Proportion of investment portfolio with prices not available in the market compared to investments is high;<br>k. Very frequent errors by the Company in valuing investment assets;<br>l. Investment portfolio valuation is not conducted periodically and is not based on valuation bases in accordance with applicable regulations; and<br>m. The appraiser service used by the Company has a poor reputation or is not registered with the Financial Services Authority (OJK).

Table II.E.3: Guidelines for Determining the Quality of Market Risk Management Implementation

Rating	Definition
Rating 1 (Strong)	The quality of market risk management implementation is very adequate, with minor weaknesses that are not significant and can be ignored.

Examples of characteristics of Companies included in Rating 1 (Strong): a. Formulation of risk appetite and risk tolerance is very adequate and aligned with the Company's overall strategic objectives and business strategy; b. The Board of Directors, Board of Commissioners, and/or Sharia Supervisory Board (DPS) have very adequate awareness and understanding of market risk management, market risk sources, and market risk levels within the Company;
c. Market risk management culture is very strong and has been well internalized at all organizational levels;
d. The execution of duties by the Board of Commissioners, Board of Directors, and/or DPS as a whole is very adequate; e. The market risk management function, including related committees, is independent, has clear duties and responsibilities, and operates very well; f. Delegation of authority is controlled and monitored periodically, and operates very well; g. Market risk management strategy, including trading strategy and management of asset positions in the Hold to Maturity (HTM) and Available for Sale (AFS) categories, is very adequate; h. Market risk policies, procedures, and limits are very adequate, available to all market risk management areas, aligned with implementation, and well understood by employees;
i. The market risk management process is very adequate in identifying, measuring, monitoring, and controlling market risk;
j. The market risk management information system (SIM) is very good, producing comprehensive and integrated market risk reports for the Board of Commissioners, Board of Directors, and/or DPS; k. Human resources are very adequate in both quantity and quality in the market risk management function;
l. The internal control system is very effective in supporting the implementation of market risk management;
m. The execution of independent reviews by the internal audit unit and functions conducting independent reviews is very adequate in terms of methodology, frequency, and reporting to the Board of Directors, Board of Commissioners, and/or DPS; n. Generally, there are no significant weaknesses based on independent review results; and o. Follow-up on independent reviews has been implemented very adequately. p. The market risk compliance function has very clear duties and responsibilities and operates very well; and q. The Company's policies, provisions, systems, procedures, and business activities are very consistent with statutory regulations.

Rating	Definition
Rating 2 (Fairly Strong)	The quality of market risk management implementation is adequate, although there are some minor weaknesses that can be resolved in normal business activities.

Examples of characteristics of Companies included in Rating 2 (Fairly Strong): a. Formulation of risk appetite and risk tolerance is very adequate and aligned with the overall strategic objectives and business strategy of the insurance company; b. The Board of Commissioners and Board of Directors have good awareness and understanding of market risk management, market risk sources, and market risk levels within the Company;
c. Market risk management culture is strong and has been well internalized at all organizational levels;
d. The execution of duties by the Board of Commissioners, Board of Directors, and/or DPS as a whole is adequate, with some weaknesses that are not significant and can be repaired immediately; e. The market risk management function, including related committees, has clear duties and responsibilities and operates well, with minor weaknesses that can be resolved in normal business activities; f. Delegation of authority is controlled and monitored periodically, and operates well; g. Market risk strategy, including trading strategy and management of HTM and AFS asset positions, is adequate; h. Market risk policies, procedures, and limits are very adequate and available to all market risk management areas, aligned with implementation, and well understood by employees, although there are minor weaknesses;
i. The market risk management process is adequate in identifying, measuring, monitoring, and controlling market risk;
j. The market risk management information system (SIM) is good, producing comprehensive and integrated market risk reports for the Board of Commissioners and Board of Directors and/or Sharia Supervisory Board, but there are minor weaknesses that can be easily repaired; k. Human resources are adequate in both quantity and quality in the market risk management function;
l. The internal control system is effective in supporting the implementation of market risk management;
m. The execution of independent reviews by the internal audit unit and functions conducting independent reviews is adequate in terms of methodology, frequency, and reporting to the Board of Directors, Board of Commissioners, and/or DPS; n. There are weaknesses but they are not significant based on independent review results; o. Follow-up on independent reviews has been implemented adequately; p. The market risk compliance function has clear duties and responsibilities and operates well; and q. The Company's policies, provisions, systems, procedures, and business activities are consistent with statutory regulations.

Rating	Definition
Rating 3 (Sufficient)	The quality of market risk management implementation is sufficiently adequate. Although minimum requirements are met, there are some weaknesses that require management attention.

Examples of characteristics of Companies included in Rating 3 (Sufficient): a. Formulation of risk appetite and risk tolerance is sufficiently adequate and aligned with the overall strategic objectives and business strategy of the insurance company; b. The Board of Commissioners and Board of Directors have sufficient awareness and understanding of market risk management, market risk sources, and market risk levels within the Company;
c. Market risk management culture is sufficiently strong and has been well internalized at all organizational levels;
d. The execution of duties by the Board of Commissioners, Board of Directors, and/or DPS as a whole is sufficiently adequate, with weaknesses in some assessment aspects that need management attention; e. The market risk management function, including related committees, has clear duties and responsibilities and operates sufficiently well, with some weaknesses that need management attention; f. Delegation of authority is sufficiently good, but control and monitoring are not always implemented well; g. Market risk management strategy, including trading strategy and HTM and AFS position management, is sufficiently adequate; h. Market risk policies, procedures, and limits are sufficiently adequate but not always consistent with implementation;
i. The market risk management process is sufficiently adequate in identifying, measuring, monitoring, and controlling market risk;
j. The market risk management information system (SIM) meets minimum expectations but has some weaknesses, including reporting to the Board of Commissioners and Board of Directors and/or Sharia Supervisory Board, which requires management attention; k. Human resources are sufficiently adequate in both quantity and quality in the market risk management function;
l. The internal control system is sufficiently effective in supporting the implementation of market risk management;
m. The execution of independent reviews by the internal audit unit and functions conducting independent reviews is sufficiently adequate in terms of methodology, frequency, and reporting to the Board of Commissioners, Board of Directors, and/or Sharia Supervisory Board, which requires management attention; n. There are weaknesses that are sufficiently significant based on independent review results; o. Follow-up on independent reviews has been implemented sufficiently adequately; p. The market risk compliance function has duties and responsibilities and operates sufficiently well; and q. The Company's policies, provisions, systems, procedures, and business activities are sufficiently consistent with statutory regulations.

Rating	Definition
Rating 4 (Fairly Weak)	The quality of market risk management implementation is less adequate, with significant weaknesses in various aspects of market risk management that require immediate corrective action.

Examples of characteristics of Companies included in Rating 4 (Fairly Weak): a. Formulation of risk appetite and risk tolerance is less adequate and not aligned with the overall strategic objectives and business strategy of the insurance company; b. Significant weaknesses in the awareness and understanding of the Board of Commissioners, Board of Directors, and/or DPS regarding market risk management, market risk sources, and market risk levels within the Company;
c. Market risk management culture is less strong and has not been well internalized at all organizational levels;
d. The execution of duties by the Board of Commissioners and Board of Directors as a whole is less adequate, with weaknesses in some assessment aspects that need immediate improvement; e. The market risk management function for market risk has operated less well; f. Delegation of authority is weak and not controlled and monitored well; g. Market risk management strategy is less adequate, with weaknesses in liquidity management aspects that need immediate improvement; h. Significant weaknesses in market risk policies, procedures, and limits;
i. The market risk management process is less adequate in identifying, measuring, monitoring, and controlling market risk;
j. Significant weaknesses in the market risk management information system (SIM), including reporting to the Board of Commissioners, Board of Directors, and/or DPS, which requires immediate attention; k. Human resources are less adequate in both quantity and quality in the market risk management function;
l. The internal control system is less effective in supporting the implementation of market risk management;
m. The execution of independent reviews by the internal audit unit and functions conducting independent reviews is less adequate, with weaknesses in methodology, frequency, and reporting to the Board of Commissioners, Board of Directors, and/or DPS that require immediate attention; n. There are significant weaknesses based on independent review results that require immediate improvement; o. Follow-up on independent reviews has been implemented less adequately; p. The market risk compliance function has unclear duties and responsibilities and has operated less well; and q. The Company's policies, provisions, systems, procedures, and business activities are less consistent with statutory regulations.

Rating	Definition
Rating 5 (Weak)	The quality of market risk management implementation is inadequate, with significant weaknesses in various aspects of market risk management where resolution actions are beyond management's capacity.

Examples of characteristics of Companies included in Rating 5 (Weak): a. Formulation of risk appetite and risk tolerance is inadequate and has no connection with the overall strategic objectives and business strategy of the insurance company; b. Awareness and understanding of the Board of Commissioners, Board of Directors, and/or Sharia Supervisory Board regarding market risk management, market risk sources, and market risk levels within the Company are very weak;
c. Market risk management culture is not strong or does not exist at all;
d. The execution of duties by the Board of Commissioners, Board of Directors, and/or DPS is inadequate, with weaknesses in almost all assessment aspects where resolution actions are beyond the Company's capacity; e. The market risk management function for market risk has operated poorly; f. Delegation of authority is very weak or non-existent; g. Market risk management strategy is inadequate, with weaknesses in almost all aspects of market risk management that require immediate improvement; h. Very significant weaknesses in market risk policies, procedures, and limits;
i. The market risk management process is inadequate in identifying, measuring, monitoring, and controlling market risk;
j. Fundamental weaknesses in the market risk management information system (SIM). Reporting of market risk to the Board of Commissioners, Board of Directors, and/or DPS is very inadequate; k. Human resources are inadequate in both quantity and quality in the market risk management function;
l. The internal control system is ineffective in supporting the implementation of market risk management;
m. The execution of independent reviews by the internal audit unit and functions conducting independent reviews is inadequate, with very significant weaknesses in methodology, frequency, and reporting to the Board of Commissioners, Board of Directors, and/or DPS that require fundamental attention; n. There are very significant weaknesses based on independent review results where improvement actions are beyond management's capacity; o. Follow-up on independent reviews is inadequate or non-existent; p. The market risk compliance function has unclear duties and responsibilities and has operated poorly; and q. The Company's policies, provisions, systems, procedures, and business activities are inconsistent with statutory regulations.

Table II.F.1: Parameters or Indicators for Assessing Inherent Risk for Inherent Liquidity Risk

No	Parameter	Indicator	Description
I	Quantitative
A.	FOR INSURANCE COMPANIES AND REINSURANCE COMPANIES
1.	Current Asset to Current Liability Liquidity Ratio	Current Assets / Current Liabilities	Liquidity ratio is calculated by comparing the value of current assets to the value of current liabilities. Current asset and liability values are those that are liquid, i.e., have a maturity of up to one year.
2.	Current Wealth to Total Liabilities Ratio	Current Wealth / Total Liabilities	The ratio calculation is done by comparing the value of current assets to the total liabilities of the Insurance Company and Reinsurance Company, both short-term and long-term. The higher the presentation, the higher the ability of the Insurance Company and Reinsurance Company's current assets to meet liabilities.
3.	Investment Sufficiency Ratio for Less Than 1 Year	(Investments + Cash and Bank) / (Technical Reserves for Own Retention + Claims Payable for Own Retention + Other Payables to Insured)	The ratio describes the ability of the Insurance Company and Reinsurance Company to calculate short-term asset-liability mismatch. Risk arises if the Insurance Company's and Reinsurance Company's investments are dominated by long-term investments while most liabilities are short-term debts.
4.	Investment Sufficiency Ratio (RKI)	(Investments + Cash and Bank) / (Technical Reserves for Own Retention + Claims Payable for Own Retention + Other Payables to Insured)	The ratio describes the ability of the company to meet the obligations of the Insurance Company and Reinsurance Company to policyholders/participants, especially those that are the responsibility (retention) of the Insurance Company and Reinsurance Company. Risk arises when RKI is below 100% and/or growth continues to decline.
5.	RKI Growth Ratio	[(RKI period t) - (RKI market period t-1)] / (RKI period t-1)	Self-explanatory.
6.	Lock-up Period Asset Ratio	(Current Assets - Assets with lock-up period) / Current Liabilities	Some investments have a lock-up period, so there is a possibility that investments owned by the Insurance Company and Reinsurance Company cannot be traded during a certain period. This can affect the liquidity of the Insurance Company and Reinsurance Company if they cannot liquidate investments when they need cash to pay liabilities. Investments placed as guarantee funds and investments that are part of reciprocal business are included in investments with a lock-up period.
7.	Liquidity Risk Growth	[(Liquidity risk period t to n - Liquidity risk period t to n-1)] / Liquidity risk period t to n-1	To know the growth of liquidity risk in the solvency level calculation of the Company (MMBR). Risk will increase if liquidity risk increases compared to the previous year's liquidity risk.
B.	FOR SHARIA INSURANCE COMPANIES, SHARIA REINSURANCE COMPANIES, AND SHARIA UNITS
1.	Quick Ratio or Current Wealth to Current Liabilities Ratio	Tabarru' Fund: (Cash and Bank + Deposits) / Short-term Tabarru' Fund Liabilities<br>Company Fund: (Cash and Bank + Deposits) / Short-term Company Fund Liabilities<br>Participant Investment Fund: (Cash and Bank + Deposits) / Short-term Participant Investment Fund Liabilities	The acid ratio/quick ratio describes the ability of the Sharia Insurance Company, Sharia Reinsurance Company, and Sharia Unit to use current assets to cover current liabilities. Risk arises if the Sharia Insurance Company, Sharia Reinsurance Company, and Sharia Unit have short-term liabilities larger than their short-term assets. Short-term liabilities are all Tabarru' fund/Company fund/Participant investment fund debts that have an age of 1 year or less, including technical provisions.
2.	Investment Sufficiency Ratio for Less Than 1 Year divided by Total Liabilities to Policyholders for Less Than 1 Year	Investments less than 1 year / Total liabilities to policyholders less than 1 year<br>Total liabilities to policyholders less than 1 year = [Technical provisions for Tabarru' fund and Tanahud fund own retention + Claims payment liabilities for own retention and other liabilities to policyholders/participants less than 1 year]	The ratio describes the ability of the Sharia Insurance Company, Sharia Reinsurance Company, and Sharia Unit to calculate short-term asset-liability mismatch. Risk arises if the Sharia Insurance Company's, Sharia Reinsurance Company's, and Sharia Unit's investments are dominated by long-term investments while most liabilities are short-term debts.
3.	Investment Sufficiency Ratio (RKI)	(Investments + Cash and Bank) / (Technical Provisions for Own Retention + Claims Payable for Own Retention + Other Payables to Insured)	The ratio describes the ability of the Sharia Insurance Company, Sharia Reinsurance Company, and Sharia Unit to meet the obligations of the Sharia Insurance Company, Sharia Reinsurance Company, and Sharia Unit to policyholders/participants, especially those that are the responsibility (retention) of the Sharia Insurance Company, Sharia Reinsurance Company, and Sharia Unit.
4.	Growth of Investment Sufficiency Ratio (RKI) for Tabarru' Fund	RKI: [Investments + Cash and Bank] / [Technical provisions for Tabarru' fund and Tanahud fund own retention + Claims payment liabilities for own retention and other liabilities to policyholders/participants]<br>RKI Growth: [(RKI period t) - (RKI market period t-1)] / (RKI period t-1)	The ratio describes the ability of the Sharia Insurance Company, Sharia Reinsurance Company, and Sharia Unit to meet the obligations of the Sharia Insurance Company, Sharia Reinsurance Company, and Sharia Unit to policyholders/participants, especially those that are the responsibility (retention) of the Sharia Insurance Company, Sharia Reinsurance Company, and Sharia Unit. Risk arises whether RKI is below 100% and/or growth continues to decline.
5.	Growth of Liquidity Risk (from DTMBR, MMBR, and PAYDI Guarantee)	Tabarru' Fund (DTMBR): [(Liquidity risk period t to n - Liquidity risk period t to n-1)] / Liquidity risk period t to n-1<br>Company Fund (MMBR): [(Liquidity risk period t to n - Liquidity risk period t to n-1)] / Liquidity risk period t to n-1<br>Company Fund (MMBR for PAYDI Guaranteed): [(Liquidity risk period t to n - Liquidity risk period t to n-1)] / Liquidity risk period t to n-1	To know the growth of liquidity risk in the solvency level calculation of Tabarru' Fund (Risk-Based Minimum Tabarru' Fund (DTMBR)/Company Fund (MMBR)). Risk will increase if liquidity risk increases compared to the previous year's liquidity risk.
II	Qualitative
1.	Number, quality, diversification, and sales of assets and liabilities to meet needs	As a starting point, supervisors must assess the quality, number, and diversification of investments available to the Company and Sharia Unit, adjusted to the nature of liabilities and unexpected liquidity fluctuations in both normal and crisis conditions. Liquidity risk can also be influenced by investments concentrated on certain instruments. Therefore, the ability of the Company and Sharia Unit to diversify the liquidity portfolio can be used as one of the parameters used in assessing inherent risk on liquidity risk.	-
2.	Risk of mismatch between the size and maturity date of assets with the size and maturity date of liabilities	The risk of mismatch between the size and maturity date of assets with the size and maturity date of liabilities is calculated by comparing the value of Assets with Maturity (AYD) and liabilities grouped by their maturity date. The asset value must be sufficient to balance the Company's and Sharia Unit's liability value. Company and Sharia Unit assets must also be sufficiently liquid to pay every maturing liability (liquidity). Long-term liabilities of the Company and Sharia Unit must be balanced with long-term assets, as well as...

No Parameter Indicator Description with short-term liabilities with short-term assets, and balancing the cash flow characteristics of assets and liabilities.
3. Risk against lock-up period is the risk against investments that cannot be liquidated within a certain period.
Some investments have a lock-up period, so there is a possibility that investments owned by the Company and Sharia Unit cannot be sold during a certain period. This can affect the liquidity of the Company and Sharia Unit if the Company and Sharia Unit cannot liquidate investments when the Company and Sharia Unit need cash funds to pay obligations. Investments placed as guarantee funds and investments that are part of reciprocal business are included in investments that have a lock-up period.
4. Cash Flow Liquidity needs measurement is done by subtracting cash outflows and cash inflows so that the Company and Sharia Unit can identify future liquidity needs. In the Company and Sharia Unit, cash flow projections are assessed from the assessment of cash flows from operating activities sourced from premium receipts and claim payments, cash flows from investment receipts and liquidations, up to cash flows from financing activities.
5.
Short-term asset profile NA Explains the short-term profile owned by the Company and Sharia Unit. Short-term assets are assets with a life of 1 year or less. Risks arise, for example, if there are short-term assets that have not been collected, such as contribution receivables; the longer the age of the receivable, the greater the liquidity risk of the Company and Sharia Unit. 6. Short-term liability profile NA Short-term liabilities are liabilities with a life of 1 year or less. These liabilities can be technical provisions with a life of less than 1 year. Risks arise if these short-term liabilities are not backed by assets that can be liquidated in the short term.

Table II.F.2: Guidelines for Determining Inherent Risk Level for Liquidity Risk
Rating Rating Definition
Rating 1 (Low)
Considering the business activities conducted by the Company, the potential losses faced by the Company from liquidity risk are classified as very low during a certain period in the future. Examples of Company characteristics included in rating 1 (low) include the following:
a. Liquidity level determination has taken into account the type, nature, and duration of investments owned by the Company; b. Company investments are very well diversified to meet needs adjusted to the nature of liabilities and unexpected liquidity fluctuations in both normal and crisis conditions;
c. The Company has adequate high-quality liquid assets to cover maturing liabilities;
d. There is no very significant gap between the average duration of assets and the average duration of Company liabilities; e. The Company does not have investments with a lock-up period; f. The Company is very capable of meeting obligations and cash flow needs under normal conditions and in crisis scenarios; g. Cash flows originating from assets and liabilities can cover each other very well; and h. has a non-complex current asset structure. Rating 2 (Low-Medium) Considering the business activities conducted by the Company, the potential losses faced by the Company from liquidity risk are classified as low during a certain period in the future. Examples of Company characteristics included in rating 2 (low-medium) include the following:
a. Liquidity level determination has taken into account the type, nature, and duration of investments owned by the Company; b. Company investments are well diversified to meet needs adjusted to the nature of liabilities and unexpected liquidity fluctuations in both normal and crisis conditions;
c. The Company has adequate high-quality liquid assets to cover maturing liabilities;
d. There is a gap between the average duration of assets and the average duration of Company liabilities; e. The Company has a few investments with a lock-up period;

Rating Rating Definition f. The Company is very capable of meeting obligations and cash flow needs under normal conditions and in crisis scenarios; g. Cash flows originating from assets and liabilities can cover each other very well for the majority of time scales; and h. has a less complex current asset structure. Rating 3 (Medium) Considering the business activities conducted by the Company, the potential losses faced by the Company from liquidity risk are classified as moderately high during a certain period in the future. Examples of Company characteristics included in rating 3 (medium) include the following:
a. Liquidity level determination does not take into account the type, nature, and duration of investments owned by the Company; b. Company investments are moderately diversified to meet needs adjusted to the nature of liabilities and unexpected liquidity fluctuations in both normal and crisis conditions;
c. Company liquid assets are moderately adequate to cover maturing liabilities;
d. There is a very significant gap between the average duration of assets and the average duration of Company liabilities; e. The Company has a fairly large number of investments with a lock-up period; f. The Company is moderately capable of meeting obligations and cash flow needs under normal conditions and in crisis scenarios; g. Cash flows originating from assets and liabilities can cover each other moderately well, especially in the short term; and h. has a moderately complex current asset structure. Rating 4 (Medium-High) Considering the business activities conducted by the Company, the potential losses faced by the Company from liquidity risk are classified as high during a certain period in the future. Examples of Company characteristics included in rating 4 (medium-high) include the following:
a. Liquidity level determination does not take into account the type, nature, and duration of investments owned by the Company; b. Company investments are poorly diversified to meet needs adjusted to the nature of liabilities and unexpected liquidity fluctuations in both normal and crisis conditions;
c. There are concerns regarding the quality of Company liquid assets and

Rating Rating Definition the ability of liquid assets to cover maturing liabilities; d. There is a significant gap between the average duration of assets and the average duration of Company liabilities, which is indicated to threaten the Company's sustainability in the short term; e. The Company has many investments with a lock-up period; f. The Company is less capable of meeting obligations and cash flow needs under normal conditions and in crisis scenarios; g. Cash flow mismatches at various time scales are quite significant; and h. has a complex current asset structure. Rating 5 (High) Considering the business activities conducted by the Company, the potential losses faced by the Company from liquidity risk are classified as very high during a certain period in the future. Examples of Company characteristics included in rating 5 (very high) include the following:
a. Liquidity level determination does not take into account the type, nature, and duration of investments owned by the Company; b. Company investments are not well diversified to meet needs adjusted to the nature of liabilities and unexpected liquidity fluctuations in both normal and crisis conditions;
c. Liquid asset quality is poor, and the volume of liquid assets is very inadequate to meet maturing liabilities;
d. There is a significant gap between the average duration of assets and the average duration of Company liabilities, which is indicated to threaten the Company's sustainability in the short term; e. The Company has very many investments with a lock-up period; f. The Company is unable to meet obligations and cash flow needs under normal conditions and in crisis scenarios; g. Cash flows cannot cover each other; and h. has a very complex current asset structure.

Table II.F.3: Guidelines for Determining the Quality of Risk Management Implementation for Liquidity Risk
Rating Rating Definition
Rating 1 (Strong)
The quality of risk management implementation for liquidity risk is very adequate, with minor weaknesses that are not significant and can be ignored.
Examples of Company characteristics included in rating 1 (strong) include the following:
a. Formulation of risk appetite and risk tolerance is very adequate and aligned with the Company's overall strategic objectives and business strategy; b. The Board of Directors, Board of Commissioners, and/or Sharia Supervisory Board (DPS) have very adequate awareness and understanding of liquidity risk management, liquidity risk sources, and the level of liquidity risk in the Company;
c. The Company's reporting mechanism containing asset and liability management risk issues is very good;
d. The Company has and applies asset-liability matching management or alignment between asset allocation and liability maturity very well; e. The Company's liquidity management analysis and early warning system is very adequate; f. Periodic evaluation by the Board of Directors and Board of Commissioners over the Company's liquidity management is very adequate; g. The risk management culture for liquidity risk is very strong and has been internalized very well at all organizational levels; h. The execution of duties by the Board of Directors, Board of Commissioners, and/or DPS as a whole is very adequate;
i. The risk management function for liquidity risk is independent, has clear duties and responsibilities, and has operated very well;
j. Delegation of authority is controlled and monitored periodically, and has operated very well; k. The risk management strategy for liquidity risk is very aligned with the risk appetite and liquidity risk tolerance;
l. Policies, procedures, and limit setting for liquidity risk are very adequate and available for all risk management areas for liquidity risk, aligned with implementation, and well understood by employees;
m. The risk management process for liquidity risk is very adequate in identifying, measuring, monitoring,

Rating Rating Definition and controlling liquidity risk; n. The risk management information system (SIM) for liquidity risk is very good, producing comprehensive and integrated liquidity risk reports to the Board of Directors, Board of Commissioners, and/or DPS; o. Human resources are very adequate in quantity and quality in the risk management function for liquidity risk; p. The internal control system is very effective in supporting the implementation of risk management for liquidity risk; q. Independent review implementation by the internal audit unit and functions conducting independent reviews is very adequate, both in terms of methodology, frequency, and reporting to the Board of Directors, Board of Commissioners, and/or DPS; r. Generally, there are no significant weaknesses based on independent review results; s. Follow-up on independent reviews has been carried out very adequately; t. The compliance function for liquidity risk has very clear duties and responsibilities and has operated very well; and u. The Company's policies, regulations, systems, procedures, and business activities are very in accordance with regulatory provisions. Rating 2 (Fairly Strong) The quality of risk management implementation for liquidity risk is adequate despite some minor weaknesses that can be resolved in normal business activities. Examples of Company characteristics included in rating 2 (fairly strong) include the following:
a. The Board of Commissioners and Board of Directors have good awareness and understanding of liquidity risk management, liquidity risk sources, and the level of liquidity risk in the Company. b. The Board of Directors and Board of Commissioners have set the risk appetite to be taken, which is in accordance with the Company's overall strategic objectives.
c. The Company's reporting mechanism containing asset and liability management risk issues is good but has not yet been implemented;
d. The Company has and applies asset-liability matching management or alignment between asset allocation and liability maturity well, but not continuously; e. The Company's liquidity management analysis and early warning system is adequate, but not conducted continuously; f. Periodic evaluation by the Board of Directors and Board of Commissioners over the Company's liquidity management is adequate; g. The risk management culture for liquidity risk is strong and has been internalized well at all organizational levels; h. The execution of duties by the Board of Directors, Board of Commissioners, and/or DPS is generally adequate, with some weaknesses that are not significant and can be repaired immediately;
i. The risk management function for liquidity risk is independent, has clear duties and responsibilities, and has operated well, with minor weaknesses that can be resolved in normal business activities;
j. Delegation of authority is controlled and monitored periodically and has operated well; k. The risk management strategy for liquidity risk is aligned with the risk appetite and liquidity risk tolerance;
l. Policies, procedures, and limit setting for liquidity risk are adequate and available for all risk management areas for liquidity risk, aligned with implementation, and well understood by employees despite minor weaknesses;
m. The liquidity risk management process is adequate in identifying, measuring, monitoring, and controlling liquidity risk; n. The risk management information system (SIM) is good, including reporting to the Board of Directors and Board of Commissioners. There are minor weaknesses but can be easily repaired. o. Human resources are adequate in quantity and quality in the risk management function for liquidity risk; p. The internal control system is effective in supporting risk management implementation; q. Independent review implementation by the internal audit unit and functions conducting independent reviews is adequate, both in terms of methodology, frequency, and reporting to the Board of Directors, Board of Commissioners, and/or DPS; r. There are weaknesses but not significant based on independent review results;

Rating Rating Definition s. Follow-up on independent reviews has been carried out adequately; t. The compliance function for liquidity risk has clear duties and responsibilities and has operated well; and u. The Company's policies, regulations, systems, procedures, and business activities are in accordance with regulatory provisions. Rating 3 (Sufficient) The quality of risk management implementation for liquidity risk is sufficiently adequate. Although minimum requirements are met, there are some weaknesses that require management attention. Examples of Company characteristics included in rating 3 (sufficient) include the following:
a. The Board of Commissioners and Board of Directors have a fairly good awareness and understanding of liquidity risk management, liquidity risk sources, and the level of liquidity risk in the Company; b. The Board of Directors and Board of Commissioners have set the risk appetite to be taken, which is fairly in accordance with the Company's overall strategic objectives;
c. The Company's reporting mechanism containing asset and liability management risk issues is fairly good, but not conducted continuously;
d. The Company has and applies asset-liability matching management fairly well, but does not cover all types of assets and liabilities; e. The Company's liquidity management analysis and early warning system is sufficiently adequate, but does not cover all types of assets and liabilities; f. Periodic evaluation by the Board of Directors and Board of Commissioners over the Company's liquidity management is sufficiently adequate, but not conducted continuously; g. The risk management culture for liquidity risk is fairly strong and has been internalized fairly well, but not always implemented consistently; h. The execution of duties by the Board of Directors, Board of Commissioners, and/or DPS regarding liquidity risk management is generally sufficiently adequate, but there are weaknesses in some assessment aspects that need management attention;
i. The risk management function for liquidity risk is fairly good, with some weaknesses including reporting to the Board of Directors, Board of Commissioners, and/or DPS that require management attention;
j. Delegation of authority is fairly good, but control and monitoring are not always implemented well; k. The risk management strategy for liquidity risk is fairly aligned with the risk appetite and liquidity risk tolerance;
l. Policies, procedures, and limit setting for liquidity risk are sufficiently adequate but not always consistent with implementation;
m. The liquidity risk management process is sufficiently adequate in identifying, measuring, monitoring, and controlling liquidity risk; n. The risk management information system (SIM) meets minimum expectations but has some weaknesses including reporting to the Board of Commissioners and Board of Directors that require management attention. o. Human resources are sufficiently adequate in quantity and quality in the risk management function for liquidity risk; p. The internal control system is sufficiently effective in supporting risk management implementation; q. Independent review implementation by the internal audit unit and functions conducting independent reviews is sufficiently adequate, with weaknesses in methodology, frequency, and reporting to the Board of Directors, Board of Commissioners, and/or Sharia Supervisory Board that require management attention; r. There are weaknesses that are fairly significant based on independent review results that require management attention; s. Follow-up on independent reviews has been carried out sufficiently adequately; t. The compliance function for liquidity risk has fairly clear duties and responsibilities and has operated fairly well; and u. The Company's policies, regulations, systems, procedures, and business activities are fairly in accordance with regulatory provisions. Rating 4 (Fairly Weak) The quality of risk management implementation for liquidity risk is weak, with significant weaknesses in various aspects of liquidity risk management that require immediate corrective action. Examples of Company characteristics included in rating 4 (weak) include the following:
a. The Board of Commissioners and Board of Directors have poor awareness

Rating Rating Definition and understanding of liquidity risk management, liquidity risk sources, and the level of liquidity risk in the Company; b. The Board of Directors and Board of Commissioners have set the risk appetite to be taken, which is less in accordance with the Company's overall strategic objectives;
c. The Company's reporting mechanism containing asset and liability management risk issues is poor, still under preparation, and not yet implemented;
d. The Company has and applies asset-liability matching management poorly; e. The Company has a liquidity management analysis and early warning system, but it is inadequate and not yet implemented; f. Periodic evaluation by the Board of Directors and Board of Commissioners over the Company's liquidity management is inadequate and not conducted continuously; g. The risk management culture for liquidity risk is not strong and has not been internalized well at each organizational level; h. The execution of duties by the Board of Directors, Board of Commissioners, and/or DPS is generally inadequate, with weaknesses in various assessment aspects that require immediate improvement;
i. There are significant weaknesses in the risk management function for liquidity risk that require immediate improvement;
j. Delegation of authority is weak and not controlled and monitored well; k. The risk management strategy for liquidity risk is less aligned with the risk appetite and liquidity risk tolerance;
l. There are significant weaknesses in policies, procedures, and limit setting for liquidity risk;
m. The liquidity risk management process is inadequate in identifying, measuring, monitoring, and controlling liquidity risk; n. Significant weaknesses in the management information system (SIM) including reporting to the Board of Commissioners and Board of Directors that require management attention; o. The internal control system is less effective in supporting risk management implementation; p. Human resources are inadequate in quantity and quality in the risk management function for liquidity risk;

q. implementation of independent review by internal audit work units and functions performing independent review is inadequate, there are weaknesses in methodology, frequency, or reporting to the Board of Directors, Board of Commissioners, and/or Sharia Supervisory Board (DPS) that require immediate improvement; r. There are significant weaknesses based on independent review results that require immediate corrective action; s. follow-up on independent review has been implemented inadequately; t. the compliance function for liquidity risk has unclear duties and responsibilities and has operated poorly; and u. the Company's policies, provisions, systems, procedures, and business activities are less consistent with regulatory provisions.

Rating 5
(Weak)
The quality of risk management implementation for liquidity risk is very weak, with significant weaknesses in various aspects of liquidity risk management, the resolution of which is beyond the management's capability.

Examples of Company characteristics included in Rating 5 (very weak) are as follows:
a. formulation of risk levels to be taken (risk appetite) and risk tolerance is inadequate and there is no link with strategic objectives and overall business strategy; b. the Board of Commissioners and Board of Directors lack awareness and have poor understanding regarding liquidity risk management, sources of liquidity risk, and the level of liquidity risk in the Company;
c. the Company does not have a reporting mechanism containing asset and liability management risk issues;
d. the Company does not have asset and liability matching management or consistency between asset allocation and liability maturity; e. the Company does not have an analysis and early warning system for liquidity management; f. the Company does not have procedures for periodic evaluation by the Board of Directors and Supervisory Board over the Company's liquidity management; g. the risk management culture for liquidity risk is not strong or does not exist at all; h. the implementation of duties by the Board of Directors, Board of Commissioners, and/or DPS is inadequate, with significant weaknesses

Rating Definition

Rating

on almost all assessment aspects and actions, and the resolution is beyond the Company's capability;
i. there are very significant weaknesses in the liquidity risk management function that require fundamental improvement;
j. delegation of authority is very weak or non-existent; k. the risk management strategy for liquidity risk is not aligned with the risk level to be taken and liquidity risk tolerance;
l. there are very significant weaknesses in policies, procedures, and limit setting for liquidity risk;
m. the liquidity risk management process is inadequate in identifying, measuring, monitoring, and controlling liquidity risk; n. fundamental weaknesses in the Management Information System (MIS) for reporting liquidity risk to the Board of Commissioners and Board of Directors are very inadequate; o. human resources are inadequate in both quantity and quality in the liquidity risk management function; p. the internal control system is ineffective in supporting risk management implementation; q. implementation of independent review by internal audit work units and functions performing independent review is inadequate, there are weaknesses in methodology, frequency, or reporting to the Board of Directors, Board of Commissioners, and/or DPS that require fundamental improvement; r. There are very significant weaknesses based on independent review results where corrective actions are beyond management's capability; s. follow-up on independent review is inadequate or non-existent; t. the compliance function for liquidity risk has unclear duties and responsibilities and has operated poorly; and u. the Company's policies, provisions, systems, procedures, and business activities are inconsistent with regulatory provisions.

Table II.G.1: Parameters or Indicators for Assessment of Inherent Risk for Legal Risk

No	Parameter	Indicator
I	Quantitative
A. FOR INSURANCE COMPANIES AND REINSURANCE COMPANIES
1. Ratio of contingency liabilities to current assets	\frac{contingency liabilities}{current assets}	Contingency liabilities are losses paid by the Insurance Company and Reinsurance Company compared to the current assets of the Insurance Company and Reinsurance Company. The contingency liability ratio is calculated to view the ability of the Insurance Company and Reinsurance Company to pay obligations arising from legal risk.
2. Ratio of the number of legal cases won by the Insurance Company and Reinsurance Company in court to the number of lawsuits	\frac{Number of legal cases won}{Number of lawsuits}	History of the number and value of judgments on legal cases previously handled by the Insurance Company and Reinsurance Company, i.e., the number of legal cases won by the Insurance Company and Reinsurance Company in court compared to the number of lawsuits.
3. Nominal amount of lawsuits currently filed	Nominal amount (Rp)	Litigation can occur due to lawsuits or claims from third parties against the Insurance Company and Reinsurance Company, or lawsuits or claims filed against third parties, both through court or out of court. Such lawsuits or claims essentially incur costs that can harm the condition of the Insurance Company and Reinsurance Company.
FOR SHARIA INSURANCE COMPANIES, SHARIA REINSURANCE COMPANIES, AND SHARIA UNITS
1. Ratio of contingency liabilities to current assets	\frac{contingency liabilities}{current assets company funds}	Contingency liabilities are losses paid by the Sharia Insurance Company, Sharia Reinsurance Company, and Sharia Unit compared to the current assets of the Sharia Insurance Company, Sharia Reinsurance Company, and Sharia Unit. The contingency liability ratio is calculated to view the ability of the Sharia Insurance Company, Sharia Reinsurance Company, and Sharia Unit to pay obligations arising from legal risk.
2. Ratio of the number of legal cases won by the Sharia Insurance Company, Sharia Reinsurance Company, and Sharia Unit in court to the number of lawsuits	\frac{Number of legal cases won}{Number of lawsuits}	History of the number and value of judgments on legal cases previously handled by the insurance company, i.e., the number of legal cases won by the Sharia Insurance Company, Sharia Reinsurance Company, and Sharia Unit in court compared to the number of lawsuits.
3. Nominal amount of lawsuits currently filed	Nominal amount (Rp)	Litigation can occur due to lawsuits or claims from third parties against the Sharia Insurance Company, Sharia Reinsurance Company, and Sharia Unit, or lawsuits or claims filed against third parties, both through court or out of court. Such lawsuits or claims essentially incur costs that can harm the condition of the Insurance Company, Sharia Reinsurance Company, and Sharia Unit.
B	Qualitative
1. Absence or change in regulatory provisions	NA	Indicator in assessing factors of Companies and Sharia Units that conduct international activities (having a relatively higher legal risk level compared to Companies and Sharia Units that do not conduct international activities), such as the contract standards used by the Company and Sharia Unit still referring to outdated contracts. The absence or change in regulatory provisions, especially regarding products owned by the Company and Sharia Unit or transactions conducted by the Company and Sharia Unit, will result in disputes later on, potentially causing legal risk. Parameters that can be assessed for the absence/change of regulations are the use of best practices for certain contract standards that the Company and Sharia Unit still refer to outdated contracts even though there have been changes in best practices or regulatory provisions or other matters.
2. Contract failure / Weakness of obligation	NA	Weaknesses in obligations conducted by the Company and Sharia Unit are sources of problems or disputes later on that can cause potential legal risk for the Company and Sharia Unit. Parameters that can be assessed for the absence/change of regulations are:
a. failure to meet the validity requirements of the contract; b. weaknesses in contract clauses and/or failure to meet agreed requirements;
c. understanding of the parties regarding the contract, especially regarding risks in complex transactions using terms that are difficult to understand or uncommon for the general public;
d. inability to execute a contract, either in whole or in part; e. existence of supporting documents related to contracts conducted by the Company and Sharia Unit with third parties. Types of third-party supporting documents where before entering and signing a contract, the Company and Sharia Unit must first check the corporate documents owned by the third party, consisting of, but not limited to:

Deed of establishment;
Deed of last change regarding articles of association and company data;
Business identification number;
Business license; and/or
Other supporting documents deemed necessary by the company.
If one or more of the above documents cannot be collected by the Insurance Company and Sharia Unit, the Insurance Company and Sharia Unit may face legal risk at any time; f. updating and periodic review of the use of standard contracts based on the enforceability of contracts both in commercial practice and based on applicable law by the Insurance Company and Sharia Unit and/or independent parties; and g. use of Indonesian law choice for contracts entered into by the Insurance Company and Sharia Unit and also the use of dispute resolution forum.
| 3. Litigation/Dispute resolution | NA | In evaluating lawsuits, several things need to be considered, including:
a) The basis of the lawsuit that occurred. b) The value of the lawsuit filed or the estimated loss that the Insurance Company and Sharia Unit may experience due to the lawsuit. c) The possibility of similar lawsuits arising due to the same contract with other parties. d) The position of the Insurance Company and Sharia Unit in the litigation process, either as the defendant or the plaintiff. |

Table II.G.2: Guidelines for Setting the Level of Inherent Risk for Legal Risk

Rating	Definition	Rating
Rating 1
(Low)	Considering the business activities conducted by the Company, the potential losses faced by the Company from legal risk are classified as very small during a certain period in the future.

Examples of Company characteristics included in Rating 1 (low) are as follows:
a. There is no litigation process occurring in the insurance company; b. Contracts made by the insurance company are adequate and have been reviewed periodically by the legal work unit or independent legal consultants, so contract updates are continuously performed to adjust to applicable standards and provisions; and
c. The Company does not have any activities and products that are completely unregulated and/or all existing insurance company activities and products are in accordance with applicable regulatory provisions.
d. There is no history of complaints, cease and desist letters, and legal claims filed against the Company.

Rating 2
(Medium Low) | Considering the business activities conducted by the Company, the potential losses faced by the Company from legal risk are classified as small during a certain period in the future.

Examples of Company characteristics included in Rating 2 (medium low) are as follows:
a. There is no litigation process occurring in the insurance company or there is a litigation process but the number of lawsuits is not significant enough to disturb financial conditions and does not have a major impact on the reputation of the insurance company; b. Contracts made by the insurance company are adequate but still have some minor weaknesses. Contracts have been reviewed by independent legal consultants but not periodically, but the legal work unit has conducted periodic reviews of the contracts used by the Company.
c. The Company does not have any activities and products that are completely unregulated and/or all existing insurance activities and products are in accordance with regulatory provisions.
d. There is a history of legal claims against the insurance company, but the number is not significant enough to disturb financial conditions and does not have a major impact on the Company's reputation.

Rating 3
(Medium High) | Considering the business activities conducted by the Company, the potential losses faced by the Company from legal risk are classified as medium during a certain period in the future.

Examples of Company characteristics included in Rating 3 (medium) are as follows:
a. There is a litigation process occurring in the insurance company but the number of lawsuits is less significant so it less disturbs financial conditions but has the possibility of emerging reputational risk for the insurance company; and b. Contracts made by the insurance company are quite adequate but still have some insignificant weaknesses that need to be improved immediately. The Company has not fully updated the contracts used.
c. There are some insurance activities and products in a less significant percentage compared to the Company's total capital that are not regulated by regulations from the relevant authority.
d. There is a history of legal claims against the insurance company, but the number is quite significant enough to disturb financial conditions and does not have a major impact on the Company's reputation.

Rating 4
(High) | Considering the business activities conducted by the Company, the potential losses faced by the Company from legal risk are classified as quite high during a certain period in the future.

Examples of Company characteristics included in Rating 4 (high) are as follows:
a. There is a litigation process occurring in the insurance company and the number of lawsuits is significant so that if the insurance company loses, compensation for the lawsuit can disturb financial conditions and have a major impact on the Company's reputation. b. Contracts made by the insurance company are less adequate and there are some major weaknesses that can cause errors in contract interpretation by the parties or law enforcement officials. The legal work unit pays less attention to recent developments in order to periodically review the contracts used by the Company.
c. There are some insurance products in a significant percentage compared to the total capital of the insurance company that are not regulated by regulations from the relevant authority.
d. There is a history of legal claims occurring at the Company and the number of claims is significant so that if the Company loses, compensation for the lawsuit can disturb financial conditions and impact the Company's reputation.

Rating 5
(Very High) | Considering the business activities conducted by the Company, the potential losses faced by the Company from legal risk are classified as high during a certain period in the future.

Examples of Company characteristics included in Rating 5 (high) are as follows:
a. There is a litigation process against the insurance company by policyholders/holders of policies/other third parties in a very significant number so that if the insurance company is defeated in a court decision, this condition can significantly affect the Company's business conditions; b. Contracts made by the Company are completely inadequate and have never been reviewed so that weaknesses are unknown.
c. There are insurance products that are not regulated by applicable provisions in a very significant number compared to the Company's total capital.
d. There is a history of legal claims and potential legal claims against the Company by policyholders/holders of policies/other third parties in a very significant number so that if the insurance company is defeated in a court decision, this condition can significantly affect the Company's business conditions. |

Table II.G.3: Guidelines for Setting the Quality of Risk Management Implementation for Legal Risk

Rating	Definition	Rating
Rating 1
(Strong)	The quality of risk management implementation for legal risk is very adequate, with minor weaknesses that are not significant and can be ignored.

Examples of Company characteristics included in Rating 1 (strong) are as follows:
a. The Board of Commissioners, Board of Directors, and/or DPS have very good awareness and understanding regarding legal risk management, sources of legal risk, and the level of legal risk in the Company; b. Formulation of risk appetite and risk tolerance is very adequate and aligned with the Company's strategic objectives and overall business strategy;
c. Legal risk management culture is very strong and has been internalized very well at all organizational levels;
d. Implementation of duties by the Board of Commissioners, Board of Directors, and/or DPS is overall very adequate; e. The legal risk management function is independent, has clear duties and responsibilities, and operates very well; f. Delegation of authority is controlled and monitored periodically, and operates very well; g. Management strategy for legal risk is very aligned with risk appetite and tolerance; h. Legal risk management policies and procedures are very adequate and available for all areas of legal risk management, aligned with implementation, and well understood by employees;
i. Legal risk management process is very adequate in identifying, measuring, monitoring, and controlling legal risk;
j. Risk Management Information System (MIS) is very good so as to produce comprehensive and integrated legal risk reports to the Board of Commissioners, Board of Directors, and/or DPS; k. Generally, human resources are very adequate in terms of quantity and competence in the legal risk management function;
l. Internal control system is very effective in supporting risk management implementation;

Rating 2
(Somewhat Strong) | The quality of risk management implementation for legal risk is adequate although there are some minor weaknesses that can be resolved in normal business activities.

Examples of Company characteristics included in Rating 2 (somewhat strong) are as follows:
a. The Board of Commissioners, Board of Directors, and/or DPS have good awareness and understanding regarding legal risk management, sources of legal risk, and the level of legal risk in the Company; b. Formulation of risk appetite and risk tolerance is adequate and aligned with the Company's strategic objectives and overall business strategy;
c. Legal risk management culture is strong and has been internalized well at all organizational levels;
d. Implementation of duties by the Board of Commissioners, Board of Directors, and/or DPS is generally adequate. There are some weaknesses but not significant and can be improved immediately; e. The legal risk management function has clear duties and responsibilities and operates well. There are minor weaknesses, but can be resolved in normal business activities; f. Delegation of authority is controlled and monitored periodically, and operates well; g. Management strategy for legal risk is aligned with risk appetite and tolerance; h. Legal risk management policies and procedures are adequate and available for all areas of legal risk management, aligned with implementation, and well understood by employees;

Rating 3
(Moderate) | The quality of risk management implementation for legal risk is moderate, with some weaknesses that require improvement.

Examples of Company characteristics included in Rating 3 (moderate) are as follows:
a. The Board of Commissioners, Board of Directors, and/or DPS have moderate awareness and understanding regarding legal risk management, sources of legal risk, and the level of legal risk in the Company; b. Formulation of risk appetite and risk tolerance is moderate and aligned with the Company's strategic objectives and overall business strategy;
c. Legal risk management culture is moderate and has been internalized moderately at all organizational levels;
d. Implementation of duties by the Board of Commissioners, Board of Directors, and/or DPS is moderate. There are some weaknesses that require improvement; e. The legal risk management function has moderate duties and responsibilities and operates moderately. There are some weaknesses that require improvement; f. Delegation of authority is controlled and monitored periodically, and operates moderately; g. Management strategy for legal risk is moderately aligned with risk appetite and tolerance; h. Legal risk management policies and procedures are moderate and available for all areas of legal risk management, aligned with implementation, and understood by employees;

Rating 4
(Weak) | The quality of risk management implementation for legal risk is weak, with significant weaknesses that require fundamental improvement.

Examples of Company characteristics included in Rating 4 (weak) are as follows:
a. The Board of Commissioners, Board of Directors, and/or DPS have poor awareness and understanding regarding legal risk management, sources of legal risk, and the level of legal risk in the Company; b. Formulation of risk appetite and risk tolerance is inadequate and not aligned with the Company's strategic objectives and overall business strategy;
c. Legal risk management culture is weak or does not exist;
d. Implementation of duties by the Board of Commissioners, Board of Directors, and/or DPS is inadequate; e. The legal risk management function has unclear duties and responsibilities and operates poorly; f. Delegation of authority is not controlled or monitored; g. Management strategy for legal risk is not aligned with risk appetite and tolerance; h. Legal risk management policies and procedures are inadequate or not available for all areas of legal risk management, not aligned with implementation, and not understood by employees;

Rating 5
(Very Weak) | The quality of risk management implementation for legal risk is very weak, with very significant weaknesses that require fundamental improvement.

Examples of Company characteristics included in Rating 5 (very weak) are as follows:
a. The Board of Commissioners, Board of Directors, and/or DPS lack awareness and have poor understanding regarding legal risk management, sources of legal risk, and the level of legal risk in the Company; b. Formulation of risk appetite and risk tolerance is inadequate and not aligned with the Company's strategic objectives and overall business strategy;
c. Legal risk management culture is not strong or does not exist at all;
d. Implementation of duties by the Board of Commissioners, Board of Directors, and/or DPS is inadequate; e. The legal risk management function has unclear duties and responsibilities and has operated poorly; f. Delegation of authority is very weak or non-existent; g. Management strategy for legal risk is not aligned with risk appetite and tolerance; h. Legal risk management policies and procedures are inadequate or not available for all areas of legal risk management, not aligned with implementation, and not understood by employees;

Rating Definition Rating officials even if there are minor weaknesses;
i. Legal risk management processes are adequate in identifying, measuring, monitoring, and controlling legal risks;
j. Legal Risk Management Information System (SIM) is good, including legal risk reporting to the Board of Commissioners, Board of Directors, and/or DPS. There are minor weaknesses but they can be easily corrected; k. Human resources are adequate in terms of quantity and competence in the legal risk management function;
l. Internal control systems are effective in supporting risk management implementation;
m. Independent review implementation by internal audit units and functions conducting independent reviews is adequate in terms of methodology, frequency, and reporting to the Board of Commissioners, Board of Directors, and/or DPS; n. There are weaknesses but not significant based on independent review results; o. Follow-up on independent reviews has been adequately implemented; p. the compliance function for legal risks has clear tasks and responsibilities and has been running well; and q. policies, provisions, systems, and procedures, as well as business activities conducted by the Company are in accordance with the provisions of legislation.

Rating 3
(Adequate)
The quality of legal risk management implementation is adequately sufficient. Although minimum requirements are met, there are some weaknesses that require management attention. Examples of Company characteristics included in Rating 3 (adequate) include the following:
a. The Board of Commissioners, Board of Directors, and/or DPS have adequate awareness and understanding of legal risk management, legal risk sources, and the level of legal risk in the Company; b. Formulation of risk appetite and risk tolerance is adequate and has aligned with the strategic objectives and overall business strategy of the insurance company;
c. Legal risk management culture is strong and has been well internalized at all levels, always implemented consistently;
d. Implementation of the duties of the Board of Commissioners, Board of Directors, and/or DPS is generally adequately sufficient. There are weaknesses in some assessment aspects that need management attention; e. The legal risk management function is quite good, but there are some weaknesses including reporting to the Board of Directors, Board of Commissioners, and/or DPS that need management attention; f. Delegation of authority is quite good, but control and monitoring are not always implemented well; g. Management strategy for legal risks is quite aligned with risk appetite and risk tolerance; h. Legal risk management policies and procedures are quite adequate but not always consistent with implementation;
i. Legal risk management processes are adequately sufficient in identifying, measuring, monitoring, and controlling legal risks;
j. Legal Risk Management Information System (SIM) meets minimum expectations but has some weaknesses including reporting to the Board of Commissioners, Board of Directors, and/or DPS that require management attention; k. Generally, human resources are quite adequate in terms of quantity and competence in the legal risk management function;
l. Internal control systems are quite effective in supporting legal risk management implementation;
m. Independent review implementation by internal audit units and functions conducting independent reviews is quite adequate. There are some weaknesses in methodology, frequency, and/or reporting to the Board of Commissioners, Board of Directors, and/or DPS that require management attention; n. There are weaknesses that are quite significant based on independent review results that require management attention; o. Follow-up on independent reviews has been implemented quite adequately; p. the compliance function for legal risks has tasks and responsibilities that are quite clear and running quite well; and q. policies, provisions, systems, and procedures, as well as business activities conducted by the Company are quite in accordance with the provisions of legislation.

Rating 4
(Quite Weak)
The quality of legal risk management implementation is less adequate, with significant weaknesses in various aspects of legal risk management that require immediate corrective action. Examples of Company characteristics included in Rating 4 (quite weak) include the following:
a. Significant weaknesses in the awareness and understanding of the Board of Commissioners, Board of Directors, and/or DPS regarding legal risk management, legal risk sources, and the level of legal risk in the Company. b. Formulation of risk appetite and risk tolerance is less adequate and not aligned with the strategic objectives and overall business strategy of the Company;
c. Legal risk management culture is less strong and has not been well internalized at every level of work unit;
d. Implementation of duties of the Board of Commissioners and Board of Directors is generally less adequate. There are weaknesses in various assessment aspects that require immediate improvement; e. Significant weaknesses in the legal risk management function that require immediate improvement; f. Delegation of authority is weak and not controlled and monitored well; g. Management strategy for legal risks is less aligned with risk appetite and risk tolerance; h. Significant weaknesses in legal risk policies, procedures, and limits;
i. Legal risk management processes are less adequate in identifying, measuring, monitoring, and controlling legal risks;
j. Significant weaknesses in the Management Information System (SIM) including reporting to the Board of Commissioners, Board of Directors, and/or DPS that require immediate improvement; k. Human resources are less adequate in terms of quantity and competence in the legal risk management function;
l. Internal control systems are less effective in supporting risk management implementation;
m. Independent review implementation by internal audit units and functions conducting independent reviews is less adequate. There are weaknesses in methodology, frequency, and/or reporting to the Board of Commissioners and Board of Directors that require immediate improvement; n. There are significant weaknesses based on independent review results that require immediate corrective action; o. Follow-up on independent reviews is less adequate; p. the compliance function for legal risks has tasks and responsibilities that are less clear and has been running less well; and q. policies, provisions, systems, and procedures, as well as business activities conducted by the Company are less in accordance with the provisions of legislation.

Rating 5
(Weak)
The quality of legal risk management implementation is inadequate, with significant weaknesses in various aspects of legal risk management where resolution actions are beyond management's capability. Examples of Company characteristics included in Rating 5 (weak) include the following:
a. The Board of Commissioners, Board of Directors, and/or DPS have very weak awareness and understanding of legal risk management, legal risk sources, and the level of legal risk in the Company; b. Formulation of risk appetite and risk tolerance is inadequate and there is no connection with the strategic objectives and overall business strategy of the Company;
c. Legal risk management culture is not strong or does not exist at all;
d. Implementation of duties of the Board of Commissioners and Board of Directors is inadequate. There are significant weaknesses in almost all assessment aspects and resolution actions are beyond the Company's capability; e. Significant weaknesses in the legal risk management function that require fundamental improvement; f. Delegation of authority is very weak or non-existent. g. Management strategy for legal risks is not aligned with risk appetite and risk tolerance; h. Very significant weaknesses in legal risk policies, procedures, and limits;
i. Legal risk management processes are inadequate in identifying, measuring, monitoring, and controlling legal risks;
j. Fundamental weaknesses in the Legal Risk Management Information System (SIM). Legal risk reporting to the Board of Commissioners and Board of Directors is very inadequate; k. Human resources are inadequate in terms of quantity and competence in the legal risk management function;
l. Internal control systems are ineffective in supporting risk management implementation;
m. Independent review implementation by internal audit units and functions conducting independent reviews is less adequate. There are weaknesses in methodology, frequency, and/or reporting to the Board of Commissioners and Board of Directors that require fundamental improvement. n. There are very significant weaknesses based on independent review results where corrective actions are beyond management's capability; o. Follow-up on independent reviews is inadequate or non-existent; p. the compliance function for legal risks has tasks and responsibilities that are unclear and has been running poorly; and q. policies, provisions, systems, and procedures, as well as business activities conducted by the Company are not in accordance with the provisions of legislation.

Table II.H.1: Parameters or Indicators for Assessing Inherent Risk for Compliance Risk
No Parameter Indicator Description
I Quantitative

Frequency of violations against applicable regulations
a. Number of violations of provisions b. Number of same violations in the last 3 (three) years Frequency is more historical by looking at the Company's and Sharia Unit's compliance trends over the last 3 (three) years to determine whether the type of violation committed is recurring or if significant improvements were not made by the Company and Sharia Unit for such errors. Violations of provisions also include violations of Money Laundering Criminal Offenses (TPPU). Money Laundering Criminal Offense (TPPU) and Terrorist Financing Criminal Offense (TPPT) risks arise due to the potential for Money Laundering and Terrorist Financing. Generally, TPPU and TPPT risks exist in all Financial Service Actors (PJK) activities. Therefore, TPPU and TPPT risks in PJK can be viewed based on policyholders, insured parties, and/or participants of products and services, geographic areas, and distribution networks.

No Parameter Indicator Description
Same provision violations can also be grouped into violations of Sharia principles. Such violations are violations of provisions or fatwas of the National Sharia Council of the Indonesian Ulema Council for financial transactions implemented based on Sharia Principles. Companies and Sharia Units must have management ethics containing ethics as a guide for ethical behavior of directors/managers and all levels of employees in the Company and Sharia Unit. As a reference, the implementation of these ethical values must be written in guidelines or code of conduct. Violations of the code of ethics will also increase compliance risk for Companies and Sharia Units. For daily activities, companies also have guidelines/SOPs/procedures or similar. Violations of internal provisions of the Company and Sharia Unit will ultimately increase compliance risk for Companies and Sharia Units.

No Parameter Indicator Description
2. Frequency of follow-up on violations against applicable regulations
Number of follow-ups on violations of provisions After a violation of provisions occurs, whether identified by the Financial Services Authority (OJK) or by the Company and Sharia Unit, the next steps that can be used as material for evaluation and evidence of mitigation to reduce the risk of the Company and Sharia Unit are the steps taken by the Company and Sharia Unit to complete improvements for the violations committed. If such sanctions require the Company and Sharia Unit to formulate an action plan, then if the action plan is not implemented according to targets and/or not done and/or done but not in accordance, the compliance risk of the Company and Sharia Unit will be higher.
3. Number of fines
Number of fines Compliance risk of the Company and Sharia Unit can be assessed based on the existence of sanctions/fines ever imposed by the Financial Services Authority. The more sanctions/fines imposed, the higher the compliance risk of the Company and Sharia Unit. Violation coverage is violations of applicable provisions and commitments to the Financial Services Authority, including sanctions imposed for violations committed by the Company and Sharia Unit. II Qualitative

Type and significance of violations committed
a. Number of administrative sanctions in the form of warnings or reprimands imposed on the Company and Sharia Unit. b. Number of administrative sanctions in the form of fines for payment obligations imposed on the Company and Sharia Unit by the Financial Services Authority.
c. Type of violations or non-compliance committed by the Company and Sharia Unit.
Violation coverage is violations of applicable provisions and commitments to the Financial Services Authority, including sanctions imposed for violations committed by the Company and Sharia Unit.
Frequency of violations including sanctions committed or track record of non-compliance of the Company
a. Type and frequency of same violations found annually in the last 3 (three) years. b. Significance of violation findings.
Frequency is more historical by looking at the Company's and Sharia Unit's non-compliance trends over the last 3 (three) years to determine whether the type of violation committed is recurring or if significant improvements were not made by the Company and Sharia Unit for such errors.
Violations of provisions in legislation, provisions applicable to the Company, or generally accepted business standards;
Frequency of violations of provisions in certain financial transactions because they do not conform to generally accepted standards.
For example, violations include among others ICP, PSAK, and IFRS, or other standards generally applicable in the financial sector.
Follow-up on violations including fulfillment of action plans submitted to OJK.
Follow-up on provision violations including fulfillment of action plans submitted to OJK.
After a violation of provisions occurs, whether identified by the Financial Services Authority (OJK) or by the Company and Sharia Unit, the next steps that can be used as material for evaluation and evidence of mitigation to reduce the risk of the Company and Sharia Unit are the steps taken by the Company and Sharia Unit to complete improvements for the violations committed. If such sanctions require the Company and Sharia Unit to formulate an action plan, then if the action plan is not implemented according to targets and/or not done and/or done but not in accordance, the compliance risk of the Company and Sharia Unit will be higher.

Table II.H.2: Guidelines for Determining Inherent Risk Level for Compliance Risk
Rating Definition Rating
Rating 1
(Low)
The potential loss caused by compliance risk is very small or almost non-existent during a certain period in the future, based on the company's business without considering the compliance risk management aspect. Examples of Company characteristics included in Rating 1 (low) include the following:
a. there are no violations at all or there are very minor violations in the assessment period and immediate corrective action is taken with the supervisor; b. the company's compliance track record with OJK in the last 3 (three) years is very good;
c. there are no violations of Sharia principles or provisions in other legislation or generally accepted business standards for the Company's activities;
d. the Company is very cooperative and fulfills all commitments with the OJK Supervisor or other relevant authorities by formulating and implementing action plans.
Rating 2
(Medium Low)
The potential loss caused by compliance risk is small during a certain period in the future, based on the company's business without considering the compliance risk management aspect. Examples of Company characteristics included in Rating 2 (medium low) include the following:
a. there are very minor violations in the assessment period and immediate corrective action is taken with the supervisor; b. the company's compliance track record with OJK in the last 3 (three) years is good;
c. there are less significant violations of Sharia principles or provisions in other legislation or generally accepted business standards for the Company's activities and can be immediately corrected by the Company; and
d. the Company is cooperative and fulfills most commitments with the OJK Supervisor or other relevant authorities by formulating and implementing action plans.
Rating 3
(Medium)
The potential loss caused by compliance risk is quite high during a certain period in the future, based on the life insurance company's business without considering the compliance risk management aspect. Examples of Company characteristics included in Rating 3 (medium) include the following:

Rating Definition Rating a. there are violations committed by the Company that are quite significant and require management attention, such violations have occurred several times because the improvements made are less adequate; b. the Company's compliance track record with OJK in the last 3 (three) years is quite good;
c. there are quite significant violations of Sharia principles or provisions in other legislation or generally accepted business standards for the Company's activities and can be immediately corrected by the Company; and
d. the Company is quite cooperative and fulfills some significant commitments with the OJK Supervisor or other relevant authorities by formulating and implementing action plans. Rating 4 (Medium High) The potential loss caused by compliance risk in the future is high, based on the company's business without considering the compliance risk management aspect. Examples of Company characteristics included in Rating 4 (medium high) include the following:
a. there are violations committed by the Company that are relatively quite heavy or such violations occur quite frequently and no fundamental improvements are made to the existing problems. b. the Company's compliance track record with OJK in the last 3 (three) years is less good;
c. there are significant violations of Sharia principles or provisions in other legislation or generally accepted business standards for the Company's activities and can be immediately corrected by the Company; and
d. the Company is less cooperative and less fulfills commitments with the OJK Supervisor or other relevant authorities.
Rating 5
(High)
The potential loss caused by compliance risk in the future is very high, based on the Company's business without considering the compliance risk management aspect.
Examples of Company characteristics included in Rating 5 (high) include the following:
a. there are heavy violations committed by the Company or violations that continue to occur repeatedly and the Company makes no effort to correct such errors. b. the Company's compliance track record with OJK in the last 3 (three) years is not good;

Rating Definition Rating
c. there are very significant violations of Sharia principles or provisions in other legislation or generally accepted business standards for the Company's activities and can be immediately corrected by the Company; and
d. the Company is not cooperative and does not fulfill commitments with the OJK Supervisor or other relevant authorities.

Table II.H.3: Guidelines for Determining the Quality of Risk Management Implementation for Compliance Risk
Rating Definition Rating
Rating 1
(Strong)
The quality of compliance risk management implementation is very adequate, with minor weaknesses that are not significant and can be ignored.
Examples of Company characteristics included in Rating 1 (strong) include the following:
a. The Board of Commissioners, Board of Directors, and/or DPS have very good awareness and understanding of compliance risk management, compliance risk sources, and the level of compliance risk in the Company; b. formulation of risk appetite and risk tolerance (risk tolerance) is very adequate and has aligned with the strategic objectives and overall business strategy of the Company;
c. compliance risk management culture is very strong and has been very well internalized at all levels of the organization;
d. implementation of duties of the Board of Commissioners, Board of Directors, and/or DPS is overall very adequate; e. the compliance risk management function is independent, has clear tasks and responsibilities, and has been running very well; f. delegation of authority is controlled and monitored periodically, and has been running very well; g. management strategy for compliance risk is very aligned with risk appetite and risk tolerance; h. compliance risk management policies and procedures are very adequate and available for all areas of compliance risk management, aligned with implementation, and well understood by employees;
i. compliance risk management processes are very adequate in identifying, measuring, monitoring, and controlling compliance risks;
j. Compliance Risk Management Information System (SIM) is very good, producing comprehensive and integrated compliance risk reports to the Board of Commissioners, Board of Directors, and/or DPS; k. generally, human resources are very adequate in terms of quantity and competence in the compliance risk management function;
l. internal control systems are very effective in supporting compliance risk management implementation;
m. independent review implementation by internal audit units and functions conducting

independent reviews is very adequate. There are no weaknesses in methodology, frequency, and/or reporting to the Board of Commissioners, Board of Directors, and/or DPS; n. there are no weaknesses based on independent review results; o. follow-up on independent reviews has been implemented very adequately; p. the compliance function for compliance risks has clear tasks and responsibilities and has been running very well; and q. policies, provisions, systems, and procedures, as well as business activities conducted by the Company are in accordance with the provisions of legislation.

Rating 2
(Moderate)
The quality of compliance risk management implementation is adequate. Although minimum requirements are met, there are some weaknesses that require management attention.
Examples of Company characteristics included in Rating 2 (moderate) include the following:
a. The Board of Commissioners, Board of Directors, and/or DPS have adequate awareness and understanding of compliance risk management, compliance risk sources, and the level of compliance risk in the Company; b. formulation of risk appetite and risk tolerance is adequate and has aligned with the strategic objectives and overall business strategy of the Company;
c. compliance risk management culture is strong and has been well internalized at all levels of the organization;
d. implementation of duties of the Board of Commissioners, Board of Directors, and/or DPS is generally adequate. There are weaknesses in some assessment aspects that need management attention; e. the compliance risk management function is quite good, but there are some weaknesses including reporting to the Board of Directors, Board of Commissioners, and/or DPS that need management attention; f. delegation of authority is quite good, but control and monitoring are not always implemented well; g. management strategy for compliance risk is quite aligned with risk appetite and risk tolerance; h. compliance risk management policies and procedures are quite adequate but not always consistent with implementation;
i. compliance risk management processes are adequately sufficient in identifying, measuring, monitoring, and controlling compliance risks;
j. Compliance Risk Management Information System (SIM) meets minimum expectations but has some weaknesses including reporting to the Board of Commissioners, Board of Directors, and/or DPS that require management attention; k. generally, human resources are quite adequate in terms of quantity and competence in the compliance risk management function;
l. internal control systems are quite effective in supporting compliance risk management implementation;
m. independent review implementation by internal audit units and functions conducting independent reviews is quite adequate. There are some weaknesses in methodology, frequency, and/or reporting to the Board of Commissioners, Board of Directors, and/or DPS that require management attention; n. there are weaknesses that are quite significant based on independent review results that require management attention; o. follow-up on independent reviews has been implemented quite adequately; p. the compliance function for compliance risks has tasks and responsibilities that are quite clear and running quite well; and q. policies, provisions, systems, and procedures, as well as business activities conducted by the Company are quite in accordance with the provisions of legislation.

Rating 3
(Weak)
The quality of compliance risk management implementation is less adequate, with significant weaknesses in various aspects of compliance risk management that require immediate corrective action. Examples of Company characteristics included in Rating 3 (weak) include the following:
a. significant weaknesses in the awareness and understanding of the Board of Commissioners, Board of Directors, and/or DPS regarding compliance risk management, compliance risk sources, and the level of compliance risk in the Company. b. formulation of risk appetite and risk tolerance is less adequate and not aligned with the strategic objectives and overall business strategy of the Company;
c. compliance risk management culture is less strong and has not been well internalized at every level of work unit;
d. implementation of duties of the Board of Commissioners and Board of Directors is generally less adequate. There are weaknesses in various assessment aspects that require immediate improvement; e. significant weaknesses in the compliance risk management function that require immediate improvement; f. delegation of authority is weak and not controlled and monitored well; g. management strategy for compliance risk is less aligned with risk appetite and risk tolerance; h. significant weaknesses in compliance risk policies, procedures, and limits;
i. compliance risk management processes are less adequate in identifying, measuring, monitoring, and controlling compliance risks;
j. significant weaknesses in the Management Information System (SIM) including reporting to the Board of Commissioners, Board of Directors, and/or DPS that require immediate improvement; k. human resources are less adequate in terms of quantity and competence in the compliance risk management function;
l. internal control systems are less effective in supporting risk management implementation;
m. independent review implementation by internal audit units and functions conducting independent reviews is less adequate. There are weaknesses in methodology, frequency, and/or reporting to the Board of Commissioners and Board of Directors that require immediate improvement; n. there are significant weaknesses based on independent review results that require immediate corrective action; o. follow-up on independent reviews is less adequate; p. the compliance function for compliance risks has tasks and responsibilities that are less clear and has been running less well; and q. policies, provisions, systems, and procedures, as well as business activities conducted by the Company are less in accordance with the provisions of legislation.

Rating 4
(Very Weak)
The quality of compliance risk management implementation is inadequate, with significant weaknesses in various aspects of compliance risk management where resolution actions are beyond management's capability. Examples of Company characteristics included in Rating 4 (very weak) include the following:
a. the Board of Commissioners, Board of Directors, and/or DPS have very weak awareness and understanding of compliance risk management, compliance risk sources, and the level of compliance risk in the Company; b. formulation of risk appetite and risk tolerance is inadequate and there is no connection with the strategic objectives and overall business strategy of the Company;
c. compliance risk management culture is not strong or does not exist at all;
d. implementation of duties of the Board of Commissioners and Board of Directors is inadequate. There are significant weaknesses in almost all assessment aspects and resolution actions are beyond the Company's capability; e. significant weaknesses in the compliance risk management function that require fundamental improvement; f. delegation of authority is very weak or non-existent. g. management strategy for compliance risk is not aligned with risk appetite and risk tolerance; h. very significant weaknesses in compliance risk policies, procedures, and limits;
i. compliance risk management processes are inadequate in identifying, measuring, monitoring, and controlling compliance risks;
j. fundamental weaknesses in the Compliance Risk Management Information System (SIM). Compliance risk reporting to the Board of Commissioners and Board of Directors is very inadequate; k. human resources are inadequate in terms of quantity and competence in the compliance risk management function;
l. internal control systems are ineffective in supporting risk management implementation;
m. independent review implementation by internal audit units and functions conducting independent reviews is less adequate. There are weaknesses in methodology, frequency, and/or reporting to the Board of Commissioners and Board of Directors that require fundamental improvement. n. there are very significant weaknesses based on independent review results where corrective actions are beyond management's capability; o. follow-up on independent reviews is inadequate or non-existent; p. the compliance function for compliance risks has tasks and responsibilities that are unclear and has been running poorly; and q. policies, provisions, systems, and procedures, as well as business activities conducted by the Company are not in accordance with the provisions of legislation.

Rating Definition Rating

conducting an independent review that is very adequate in terms of methodology, frequency, and reporting to the Board of Commissioners, Board of Directors, and/or DPS; n. generally, no significant weaknesses are found based on independent review results; o. follow-up on independent reviews has been carried out very adequately; p. the compliance function for compliance risk has very clear duties and responsibilities and operates very well; and q. the Company's policies, provisions, systems, procedures, and business activities are very consistent with regulatory provisions.

Rating 2
(Somewhat Strong)
The quality of compliance risk management implementation is adequate, although there are some minor weaknesses that can be resolved in normal business activities.
Examples of characteristics of Companies included in Rating 2 (somewhat strong) include the following:
a. The Board of Commissioners, Board of Directors, and/or DPS have good awareness and understanding of compliance risk management, sources of compliance risk, and the level of compliance risk in the Company; b. the formulation of risk appetite and risk tolerance is adequate and aligned with the Company's overall strategic objectives and business strategy;
c. the compliance risk management culture is strong and has been well internalized at all organizational levels;
d. the implementation of duties by the Board of Commissioners, Board of Directors, and/or DPS is generally adequate. There are some weaknesses but not significant and can be corrected immediately; e. the compliance risk management function has clear duties and responsibilities and operates well. There are minor weaknesses, but they can be resolved in normal business activities; f. delegation of authority is controlled and monitored periodically, and operates well; g. management strategy for compliance risk is aligned with risk appetite and risk tolerance; h. compliance risk management policies and procedures are adequate and available to all compliance risk management areas, aligned with implementation, and well understood by employees despite minor weaknesses;

Rating Definition Rating

i. the compliance risk management process is adequate in identifying, measuring, monitoring, and controlling compliance risk;
j. Compliance Risk Management Information System (SIM) is good, including reporting compliance risk to the Board of Commissioners, Board of Directors, and/or DPS. There are minor weaknesses but can be easily corrected; k. human resources are adequate in terms of quantity and competence in the compliance risk management function;
l. the internal control system is effective in supporting the implementation of compliance risk management;
m. the implementation of independent review by the internal audit unit and the function conducting independent review is adequate in terms of methodology, frequency, and reporting to the Board of Commissioners, Board of Directors, and/or DPS; n. there are weaknesses but not significant based on independent review results; o. follow-up on independent reviews has been carried out adequately; p. the compliance function for compliance risk has clear duties and responsibilities and operates well; and q. the Company's policies, provisions, systems, procedures, and business activities are consistent with regulatory provisions.

Rating 3
(Adequate)
The quality of compliance risk management implementation is adequately sufficient. Although minimum requirements are met, there are some weaknesses that require management attention. Examples of characteristics of Companies included in Rating 3 (adequate) include the following:
a. The Board of Commissioners, Board of Directors, and/or DPS have fairly good awareness and understanding of compliance risk management, sources of compliance risk, and the level of compliance risk in the Company; b. the formulation of risk appetite and risk tolerance is adequately sufficient but not always aligned with the Company's overall strategic objectives and business strategy;
c. the compliance risk management culture is fairly strong and has been internalized fairly well but not always implemented consistently;
d. the implementation of duties by the Board of Commissioners, Board of Directors, and/or Sharia Supervisory Board is generally fairly adequate. There are weaknesses in some assessment aspects that need management attention; e. the compliance risk management function is fairly good, but there are some weaknesses that need management attention; f. delegation of authority is fairly good, but control and monitoring are not always implemented well; g. management strategy for compliance risk is fairly aligned with risk appetite and risk tolerance; h. compliance risk management policies and procedures are adequately sufficient but not always consistent with implementation;
i. the compliance risk management process is adequately sufficient in identifying, measuring, monitoring, and controlling compliance risk;
j. Compliance Risk Management Information System (SIM) meets minimum expectations but has some weaknesses, including reporting to the Board of Commissioners, Board of Directors, and/or DPS that requires management attention; k. generally, human resources are adequately sufficient in terms of quantity and competence in the compliance risk management function;
l. the internal control system is fairly effective in supporting the implementation of compliance risk management;
m. the implementation of independent review by the internal audit unit and the function conducting independent review is fairly adequate. There are some weaknesses in methodology, frequency, and/or reporting to the Board of Commissioners, Board of Directors, and/or DPS that require management attention; n. there are weaknesses that are fairly significant based on independent review results that require management attention; o. follow-up on independent reviews has been carried out fairly adequately; p. the compliance function for compliance risk has fairly clear duties and responsibilities and operates fairly well; and q. the Company's policies, provisions, systems, procedures, and business activities are fairly consistent with regulatory provisions.

Rating 4
(Somewhat Weak)
The quality of compliance risk management implementation is weak, with significant weaknesses in various aspects of compliance risk management that require immediate corrective action. Examples of characteristics of Companies included in Rating 4 (somewhat weak) include the following:
a. significant weaknesses in the awareness and understanding of the Board of Commissioners, Board of Directors, and/or DPS regarding compliance risk management, sources of compliance risk, and the level of compliance risk in the Company; b. the formulation of risk appetite and risk tolerance is less adequate and not aligned with the Company's overall strategic objectives and business strategy;
c. the compliance risk management culture is not strong and has not been well internalized at every organizational level;
d. the implementation of duties by the Board of Commissioners, Board of Directors, and/or DPS is generally less adequate. There are weaknesses in various assessment aspects that require immediate improvement; e. significant weaknesses in the compliance risk management function that require immediate improvement; f. delegation of authority is weak and not controlled and monitored well; g. management strategy for compliance risk is less aligned with risk appetite and risk tolerance; h. significant weaknesses in compliance risk policies, procedures, and limits;
i. the compliance risk management process is less adequate in identifying, measuring, monitoring, and controlling compliance risk;
j. significant weaknesses in the Compliance Management Information System (SIM), including reporting to the Board of Commissioners, Board of Directors, and/or DPS that requires immediate improvement; k. human resources are less adequate in terms of quantity and competence in the compliance risk management function;
l. the internal control system is less effective in supporting the implementation of compliance risk management;
m. the implementation of independent review by the internal audit unit and the function conducting independent review is less adequate. There are weaknesses in methodology, frequency, and/or reporting to the Board of Commissioners, Board of Directors, and/or DPS that require immediate improvement;

Rating Definition Rating

n. there are significant weaknesses based on independent review results that require immediate corrective action; o. follow-up on independent reviews is less adequate; p. the compliance function for compliance risk has unclear duties and responsibilities and operates poorly; and q. the Company's policies, provisions, systems, procedures, and business activities are less consistent with regulatory provisions.

Rating 5
(Weak)
The quality of compliance risk management implementation is very weak, with significant weaknesses in various aspects of compliance risk management where resolution actions are beyond management's capability. Examples of characteristics of Companies included in Rating 5 (weak) include the following:
a. the Board of Commissioners, Board of Directors, and/or DPS have very weak awareness and understanding of compliance risk management, sources of compliance risk, and the level of compliance risk in the Company; b. the formulation of risk appetite and risk tolerance is inadequate and not linked to the Company's overall strategic objectives and business strategy;
c. the compliance risk management culture is not strong or does not exist at all;
d. the implementation of duties by the Board of Commissioners, Board of Directors, and/or DPS is inadequate. There are significant weaknesses in almost all assessment aspects, and corrective actions are beyond the Company's capability; e. significant weaknesses in the compliance risk management function that require fundamental improvement; f. delegation of authority is very weak or non-existent; g. management strategy for compliance risk is not aligned with risk appetite and risk tolerance; h. very significant weaknesses in compliance risk policies, procedures, and limits;
i. the compliance risk management process is inadequate in identifying, measuring, monitoring, and controlling compliance risk;
j. fundamental weaknesses in the Compliance Risk Management Information System (SIM). Reporting compliance risk to the Board of Directors management is very inadequate; k. human resources are inadequate in terms of quantity and competence in the compliance risk management function;
l. the internal control system is ineffective in supporting the implementation of compliance risk management;
m. the implementation of independent review by the internal audit unit and the function conducting independent review is less adequate. There are weaknesses in methodology, frequency, and/or reporting to the Board of Directors management that require fundamental improvement; n. there are very significant weaknesses based on independent review results where corrective actions are beyond management's capability; o. follow-up on independent reviews is inadequate or non-existent; p. the compliance function for compliance risk has unclear duties and responsibilities and operates poorly; and q. the Company's policies, provisions, systems, procedures, and business activities [are inconsistent with] regulatory provisions.

Table II.I.1: Parameters or Indicators for Assessing Inherent Risk for Reputation Risk
No Parameter Indicator Description
A Quantitative

Ratio of complaints to total policies
Number of complaints / Total policies
This ratio is used to assess the extent to which the Company and Sharia Unit receive complaints. One criterion that can be used to measure the satisfaction of policyholders, insured parties, and/or participants of the Company and Sharia Unit is the number of complaints submitted to the Company and Sharia Unit. The more complaints submitted by policyholders, insured parties, and/or participants, the higher the reputation risk for the Company and Sharia Unit.
Ratio of complaint follow-up to number of complaints
Complaint follow-up / Number of complaints
This ratio is used to assess the extent to which the Company and Sharia Unit conduct follow-up (whether completed or still in process) on incoming/received complaints. To mitigate greater risk, the Company and Sharia Unit must immediately conduct follow-up on complaints from policyholders, insured parties, and/or participants. The more follow-ups on complaints conducted by the company, the lower the reputation risk for the Company and Sharia Unit.
Frequency of negative news about the Company in 1 year
Number of negative news items in 1 year
The Company and Sharia Unit will be exposed to reputation risk whether shortcomings in the Company and Sharia Unit's service are conveyed through media accessible to anyone. The more negative news about the Company and Sharia Unit, the higher the reputation risk. B Qualitative
Influence of owner and group reputation
a. Credibility of owner and related Company. b. Reputational event on owner and related Company.
The credibility of the owner and group has the potential to influence or be associated with the reputation of the Company and Sharia Unit. Therefore, performance, professionalism, competitive advantage, and the position of the Company and Sharia Unit owner in national/international business and economy should be considered as one indicator in assessing the reputation of the Company and Sharia Unit. Public perception, both nationally and internationally, that impacts business other than insurance operated by the owner or group, or policies taken by the owner regarding non-insurance business, can influence sentiment and affect reputation risk.

No Parameter Indicator Description

Violation of business ethics
Violations of ethics are visible, among others, through:
a. Financial information transparency; and b. Business cooperation with other stakeholders.
c. Fraud practices committed by Company HR.
d. Product marketing transparency. e. Sale of insurance products without OJK permit.
What needs to be considered is whether the Company and Sharia Unit violate generally applicable business ethics or norms. Violations of business ethics by the Company and Sharia Unit can be categorized into several aspects, including:
a. Financial information transparency, such as manipulation of financial reports to stakeholders. b. Business cooperation with other stakeholders, such as the Company and Sharia Unit breaching agreements with business partners and delaying claim payments without technical justification.
c. Company and Sharia Unit HR committing fraud that harms internal and external parties. Examples include manipulation of insurance investments involving Company and Sharia Unit HR and/or employees embezzling premium/contribution receipts.
d. Regarding product marketing transparency, violations that can be committed by the Company and Sharia Unit include, among others, intentionally not providing complete information to policyholders, insured parties, and/or participants, resulting in misunderstanding of the offered insurance product (misselling). e. The Company and Sharia Unit selling products that have not received OJK approval or violating other OJK Regulation provisions.
Complexity of products and business cooperation
a. Number and level of usage by policyholders/insured parties and/or participants of complex products of the Company and Sharia Unit. b. Number and materiality of the Company and Sharia Unit's cooperation with business partners. The Company and Sharia Unit's business, which continues to develop, creates variations in marketing channels and increasingly complex insurance products offered. This has the potential to create misunderstandings or incorrect use of products by policyholders, often followed by complaints submitted directly to the Company and Sharia Unit or through mass media or social media. In addition, the Company and Sharia Unit often cooperates with third parties (business partners) to support marketing activities, such as: banks (bancassurance), agents, brokers, insurance aggregators, etc. If a reputational event occurs with a business partner, it will affect the reputation of the Company and Sharia Unit.
Implementation of branding strategy
a. Consistency of the Company and Sharia Unit's branding strategy with the vision, mission, and business complexity. b. Evaluation of the implementation of the Company and Sharia Unit's branding strategy. Increasingly fierce competition in the national insurance and reinsurance industry requires the Company and Sharia Unit to continuously innovate in creating insurance products and better services adapted to community needs. The Company and Sharia Unit's branding strategy can be conducted through above the line (ATL) communication marketing concepts, i.e., marketing activities through advertising placement in mass media, and below the line (BTL), i.e., marketing strategies through marketing activities. Both strategies aim to form brand identity, brand awareness, brand positioning, brand loyalty, and brand knowledge. BTL strategies are not limited to marketing activities but can also include corporate social responsibility activities to help community development.
Materiality of complaints from policyholders, insured parties, and/or participants
a. Frequency of complaints from policyholders, insured parties, and/or participants. b. Materiality of complaints from policyholders, insured parties, and/or participants.
If complaints from policyholders, insured parties, and/or participants involve nominal amounts, and if the amount is material, the risk of damaging the reputation of the Company and Sharia Unit is higher. The more complaints from policyholders, insured parties, and/or participants, the higher the reputation risk. Complaints from policyholders, insured parties, and/or participants regarding material issues have a greater impact than complaints that are less material. For example, complaints from policyholders, insured parties, and/or participants regarding promised claim payments that are not paid or are delayed by the Company and Sharia Unit have higher materiality compared to complaints from policyholders, insured parties, and/or participants regarding unfriendly branch staff service during claim processing.
Exposure of negative news about the Company and Sharia Unit
a. Materiality of negative news about the Company and Sharia Unit. b. Type of media and scope of news.
c. Media relations and media monitoring of news.
Focus areas for the Company and Sharia Unit include exposure to negative news or reputational events on the related Company owner that can negatively impact the reputation of the Company and Sharia Unit in both print/electronic media and social media. Such events can include, for example, bankruptcy, business failure, financial scandals, material legal violations/lawsuits, occurring at the owner or related Company and Sharia Unit and impacting reputation risk.

No Parameter Indicator Description

Negative news can be caused by problems between the Company and Sharia Unit and stakeholders (policyholders, insured/participants, employees, partners, and regulators), misunderstandings with stakeholders, or manipulation (rumors/hoaxes) created for specific purposes. This risk source is ex-post but can develop into a larger reputational event, so it can be used as a parameter to assess the future reputation risk of the Company and Sharia Unit, especially if the Company and Sharia Unit do not have crisis handling and media relations strategies.

Table II.I.2: Guidelines for Setting Inherent Risk Level for Reputation Risk
Rating Definition Rating
Rating 1
(Low)
Considering the business activities conducted by the Company, the potential losses faced by the Company from reputation risk are classified as very low during a certain period in the future. Examples of characteristics of Companies included in Rating 1 (low) include the following:
a. No negative reputational influence from the Company owner and related companies; in fact, insurance owners and related companies are expected to provide a very positive influence on insurance reputation; b. Violations/potential violations of business ethics towards all insurance stakeholders are very minimal; in fact, insurance is expected to have a reputation as a Company that highly upholds business ethics;
c. Insurance products are very simple, so they do not require special understanding from policyholders, and business cooperation with business partners is very minimal;
d. Branding strategy is supported by very adequate studies and aligned with the Company's vision, mission, and business plan; e. The Company consistently evaluates the implementation of branding very adequately; f. No negative impact on the Company's reputation from the branding strategy conducted; g. The frequency of negative news is very minimal, the news is very non-material, and the scope of news is very small relative to the scale of the insurance; and h. The frequency of complaint submissions is very minimal and very non-material.

Rating 2
(Medium Low)
Considering the business activities conducted by the Company, the potential losses faced by the Company from reputation risk are low during a certain period in the future.
Examples of characteristics of Companies included in Rating 2 (medium low) include the following:
a. There is a negative reputational influence from the Company owner and related companies, but the scale of influence is small and can be well mitigated; b. Violations/potential violations of business ethics towards all insurance stakeholders are minimal, and insurance is expected to have a reputation as a company that upholds business ethics;

Rating Definition Rating

c. Simple insurance products so that they relatively do not require special understanding by policyholders and business cooperation conducted with business partners is minimal;
d. Branding strategy is supported by adequate studies and is consistent with the Company's vision, mission, and business plan; e. The Company is relatively consistent in evaluating the implementation of adequate branding; f. There is a negative impact on the Company's reputation from the branding strategy conducted that is not significant; g. Frequency of negative reporting is minimal, negative reporting is not material, and the scope of reporting is small relatively in line with the insurance scale; h. Frequency of complaint submissions is minimal and very non-material.

Rating 3

(Moderately High)

Considering the business activities conducted by the Company, the potential losses faced by the Company from reputational risk are classified as moderately high during a certain period in the future.

Examples of Company characteristics included in Rating 3 (moderately high) include the following:
a. There is a negative reputation influence from the Company's owners and related companies, with a scale of influence that is quite significant but still controllable; b. Violations/potential violations of business ethics occur but can be addressed quickly by actions that are normal/routine;
c. A number of insurance products are slightly complex so that at a certain level they require special understanding by policyholders and there is business cooperation conducted with business partners in a moderate amount;
d. Branding strategy is supported by studies that are less adequate but still consistent with the Company's vision, mission, and business plan; e. The Company is less consistent in evaluating the implementation of adequate branding; f. There is a slight negative impact on the Company's reputation from the branding strategy conducted; g. Frequency of negative reporting is moderate, negative reporting is moderate in nature, and the scope of reporting is quite moderate relatively in line with the insurance scale; and h. Frequency of complaint submissions is quite moderate and moderate in materiality.

Rating 4

(High)

Considering the business activities conducted by the Company, the potential losses faced by the Company from reputational risk are classified as high during a certain period in the future.

Examples of Company characteristics included in Rating 4 (high) include the following:
a. There is a negative reputation influence from the Company's owners and related companies with a material scale of influence and public relations efforts requiring special attention may be needed; b. Violations/potential violations of business ethics occur with a material scale and mitigation efforts requiring special attention are needed;
c. Insurance products are quite complex so that they require special understanding by policyholders and business cooperation conducted with business partners is quite material;
d. Branding strategy is supported by studies that are inadequate and less consistent with the Company's vision, mission, and business plan; e. The Company rarely evaluates the implementation of adequate branding; f. There is a negative impact on the Company's reputation from the branding strategy conducted but does not require special handling; g. Frequency of negative reporting is frequent, negative reporting is material in nature, and the scope of reporting is large relatively in line with the insurance scale; and h. Frequency of complaint submissions is high and material.

Rating 5

(High)

Considering the business activities conducted by the Company, the potential losses faced by the Company from reputational risk are classified as very high during a certain period in the future.

Examples of Company characteristics included in Rating 5 (high) include the following:
a. There is a negative reputation influence from the Company's owners and related companies with a very material scale of influence and public relations efforts requiring special attention are very much needed; b. Violations/potential violations of business ethics occur with a very material scale and mitigation efforts requiring special attention are very much needed;
c. Insurance products are complex so that they very much require special insurance understanding and business cooperation conducted with business partners is material;
d. Branding strategy has no studies and is not consistent with the Company's vision, mission, and business plan; e. The Company does not evaluate the implementation of branding; f. There is a negative impact on the Company's reputation from the branding strategy conducted and needs to be handled specially; g. Frequency of negative reporting is very frequent, negative reporting is very material in nature, and the scope of reporting is very large relatively in line with the insurance scale; and h. Frequency of complaint submissions is very high and very material.

Table II.I.3: Guidelines for Determining the Quality of Risk Management Implementation for Reputational Risk

Rating Definition Rating

Rating 1

(Strong)

The quality of risk management implementation for reputational risk is very adequate, there are minor weaknesses that are not significant so they can be ignored.

Examples of Company characteristics included in Rating 1 (strong) include the following:
a. Formulation of the level of risk to be taken (risk appetite) and risk tolerance is very adequate and has been aligned with strategic objectives and overall business strategy; b. Awareness, support, and understanding regarding risk management for reputational risk, sources of reputational risk, and the level of reputational risk are very good from the Board of Directors, Board of Commissioners, and/or DPS.
c. Risk management culture for reputational risk is very strong and has been internalized very well at all levels of the organization;
d. Execution of duties by the Board of Directors, Board of Commissioners, and/or DPS as a whole is very adequate; e. The risk management function for reputational risk is independent, has clear duties and responsibilities, and has been running very well; f. Delegation of authority is controlled and monitored periodically, and has been running very well; g. Management strategy for reputational risk is very aligned with the level of risk to be taken (risk appetite) and risk tolerance; h. Policies, procedures, and limit setting for reputational risk are very adequate and available for all areas of risk management for reputational risk, aligned with implementation, and well understood by employees;
i. Risk management process for reputational risk is very adequate in identifying, measuring, monitoring, and controlling reputational risk;
j. Management information system for reputational risk is very good so as to produce comprehensive and integrated reputational risk reports to the Board of Directors, Board of Commissioners, and/or DPS; k. Human resources are very adequate in terms of quantity and quality in the risk management function for reputational risk;
l. Internal control system is very effective in supporting the implementation of risk management for reputational risk;
m. Implementation of independent review by internal audit work units and functions conducting independent review is very adequate in terms of methodology, reporting to the Board of Directors, Board of Commissioners, and/or DPS; n. Generally, there are no significant weaknesses based on independent review results; o. Follow-up on independent review has been implemented very adequately; p. The compliance function for reputational risk has very clear duties and responsibilities and has been running very well; and q. Policies, regulations, systems, and procedures, as well as business activities conducted by the Company are very consistent with statutory regulations.

Rating 2

(Rather Strong)

The quality of risk management implementation for reputational risk is adequate although there are several minor weaknesses that can be resolved in normal business activities.

Examples of Company characteristics included in Rating 2 (rather strong) include the following:
a. Formulation of the level of risk to be taken (risk appetite) and risk tolerance is adequate and has been aligned with strategic objectives and overall business strategy; b. Awareness, support, and understanding regarding risk management for reputational risk from the Board of Directors, Board of Commissioners, and/or DPS is good.
c. Risk management culture for reputational risk is strong and has been internalized well at all levels of the organization;
d. Execution of duties by the Board of Directors, Board of Commissioners, and/or DPS is generally adequate, there are some weaknesses but not significant and can be repaired immediately; e. The risk management function for reputational risk has clear duties and responsibilities, and has been running well, but there are minor weaknesses that can be resolved in normal business activities; f. Delegation of authority is controlled and monitored periodically, and has been running well; g. Management strategy for reputational risk is aligned with the level of risk to be taken (risk appetite) and risk tolerance; h. Policies, procedures, and limit setting for reputational risk are adequate and available for all areas of risk management for reputational risk, aligned with implementation, and well understood by employees although there are minor weaknesses;
i. Risk management process for reputational risk is adequate in identifying, measuring, monitoring, and controlling reputational risk;
j. Management information system for reputational risk is good including reporting of reputational risk to the Board of Directors, Board of Commissioners, and/or DPS, but there are minor weaknesses that can be easily repaired; k. Human resources are good in terms of quantity and quality in the risk management function for reputational risk;
l. Internal control system is effective in supporting the implementation of risk management for reputational risk;
m. Implementation of independent review by internal audit work units and functions conducting independent review is adequate in terms of methodology, frequency, and reporting to the Board of Directors, Board of Commissioners, and DPS; n. There are weaknesses but not significant based on independent review results; o. Follow-up on independent review has been implemented adequately; p. The compliance function for reputational risk has clear duties and responsibilities and has been running well; and q. Policies, regulations, systems, and procedures, as well as business activities conducted by the Company are consistent with statutory regulations.

Rating 3

(Adequate)

The quality of risk management implementation for reputational risk is quite adequate. Although minimum requirements are met, there are several weaknesses that require management attention.

Examples of Company characteristics included in Rating 3 (adequate) include the following:
a. Formulation of the level of risk to be taken (risk appetite) and risk tolerance is quite adequate but not always aligned with strategic objectives and overall business strategy; b. Awareness, support, and understanding regarding risk management for reputational risk, sources of reputational risk, and the level of reputational risk at the Company by the Board of Directors, Board of Commissioners, and DPS is quite good;
c. Management culture for reputational risk is quite strong and has been internalized quite well but not always implemented consistently;
d. Execution of duties by the Board of Directors, Board of Commissioners, and/or DPS is generally quite adequate, but there are weaknesses in some assessment aspects that need management attention; e. The risk management function for reputational risk is quite good, but there are several weaknesses including reporting to the Board of Directors, Board of Commissioners, and/or DPS that require management attention; f. Delegation of authority is quite good, but control and monitoring are not always implemented well; g. Management strategy for reputational risk is quite aligned with the level of risk to be taken (risk appetite) and risk tolerance; h. Policies, procedures, and limit setting for reputational risk are quite adequate but not always consistent with implementation;
i. Risk management process for reputational risk is quite adequate in identifying, measuring, monitoring, and controlling reputational risk;
j. Management information system for reputational risk meets minimum expectations but there are several weaknesses including reporting to the Board of Directors, Board of Commissioners, and/or DPS that require management attention; k. Human resources are quite good in terms of quantity and quality in the risk management function for reputational risk;
l. Internal control system is quite effective in supporting the implementation of risk management for reputational risk;
m. Implementation of independent review by internal audit work units and functions conducting independent review is quite adequate, but there are weaknesses in methodology, frequency, and/or reporting to the Board of Directors, Board of Commissioners, and DPS that require management attention; n. There are weaknesses that are quite significant based on independent review results that require management attention; o. Follow-up on independent review has been implemented quite adequately; p. The compliance function for reputational risk has duties and responsibilities that are quite clear and has been running quite well; and q. Policies, regulations, systems, and procedures, as well as business activities conducted by the Company are quite consistent with statutory regulations.

Rating 4

(Rather Weak)

The quality of risk management implementation for reputational risk is weak, there are significant weaknesses in various aspects of risk management for reputational risk that require immediate corrective action.

Examples of Company characteristics included in Rating 4 (rather weak) include the following:
a. Formulation of the level of risk to be taken (risk appetite) and risk tolerance is less adequate and not aligned with strategic objectives and overall business strategy; b. Awareness, support, and understanding regarding risk management for reputational risk, sources of reputational risk, and the level of reputational risk at the Company by the Board of Directors, Board of Commissioners, and/or DPS are not good;
c. Risk management culture for reputational risk is not strong and has not been internalized well at each level of the organization;
d. Execution of duties by the Board of Directors, Board of Commissioners, and/or DPS is generally less adequate, there are weaknesses in some assessment aspects that require immediate improvement; e. There are significant weaknesses in the risk management function for reputational risk that require immediate improvement; f. Delegation of authority is weak, not controlled and not monitored well; g. Management strategy for reputational risk is less aligned with the level of risk to be taken (risk appetite) and risk tolerance; h. There are significant weaknesses in policies, procedures, and limit setting for reputational risk;
i. Risk management process for reputational risk is less adequate in identifying, measuring, monitoring, and controlling reputational risk;
j. There are significant weaknesses in the management information system for reputational risk including reporting to the Board of Directors, Board of Commissioners, and/or DPS that require immediate improvement; k. Human resources are less adequate in terms of quantity and quality in the risk management function for reputational risk;
l. Internal control system is less effective in supporting the implementation of risk management for reputational risk;
m. Implementation of independent review by internal audit work units and functions conducting independent review is less adequate, there are weaknesses in methodology, frequency, and/or reporting to the Board of Directors, Board of Commissioners, and DPS that require immediate improvement; n. There are weaknesses that are significant based on review results that require immediate corrective action; o. Follow-up on independent review is less adequate; p. The compliance function for reputational risk has duties and responsibilities that are less clear and has been running less well; and q. Policies, regulations, systems, and procedures, as well as business activities conducted by the Company are less consistent with statutory regulations.

Rating 5

(Weak)

The quality of risk management implementation for reputational risk is inadequate, there are significant weaknesses in various aspects of risk management for reputational risk whose resolution is beyond the capability of management.

Examples of Company characteristics included in Rating 5 (weak) include the following:
a. Formulation of the level of risk to be taken (risk appetite) and risk tolerance is inadequate and there is no connection with strategic objectives and overall business strategy; b. Awareness, support, and understanding regarding risk management for reputational risk, sources of reputational risk, and the level of reputational risk at the Company by the Board of Directors, Board of Commissioners, and DPS are not good;
c. Risk management culture for reputational risk is not strong or does not exist at all;
d. Execution of duties by the Board of Directors, Board of Commissioners, and/or DPS is inadequate, there are weaknesses in almost all assessment aspects and actions and their resolution are beyond the Company's capability; e. There are significant weaknesses in the risk management function for reputational risk that require fundamental improvement; f. Delegation of authority is very weak or non-existent; g. Management strategy for reputational risk is not aligned with the level of risk to be taken (risk appetite) and risk tolerance; h. There are very significant weaknesses in policies, procedures, and limit setting for reputational risk;
i. Risk management process for reputational risk is inadequate in identifying, measuring, monitoring, and controlling reputational risk;
j. There are fundamental weaknesses in the management information system for reputational risk; k. Human resources are inadequate in terms of quantity and quality in the risk management function for reputational risk;
l. Internal control system is ineffective in supporting the implementation of risk management for reputational risk;
m. Implementation of independent review by internal audit work units and functions conducting independent review is less or not adequate, there are weaknesses in methodology, frequency, and/or reporting to the Board of Directors, Board of Commissioners, and DPS that require fundamental improvement; n. There are weaknesses that are very significant based on independent review results whose corrective actions are beyond the capability of management; o. Follow-up on independent review is inadequate or non-existent; p. The compliance function for reputational risk has duties and responsibilities that are unclear and has been running poorly; and q. Policies, regulations, systems, and procedures, as well as business activities conducted by the Company are not consistent with statutory regulations.

Table II.J: Format for Risk Assessment Analysis

Risk Rating:
Final conclusion regarding the Company's risk level which includes inherent risk level and quality of risk management implementation so as to describe the Company's risk level.

Inherent Risk:
Description of inherent risk assessment based on analysis of assessment factors using both quantitative indicators and qualitative indicators so as to describe the Company's inherent risk level.

Quality of Risk Management Implementation: Analysis of the quality of risk management implementation consists of risk governance, risk management framework, risk management process, human resources, and management information systems, as well as risk control.

Table II.K: Format for Composite Risk Profile Determination

Risk Type	Inherent Risk Level	Quality of Risk Management Implementation Level	Risk Level
Strategic Risk
Operational Risk
Insurance Risk
Credit Risk
Market Risk
Liquidity Risk
Legal Risk
Compliance Risk
Reputational Risk
Composite Rating			Risk Profile Rating

Table II.L: Guidelines for Determining the Rating of Risk Profile Factors

Rating Definition

Rating 1
Company risk profiles included in this rating generally have characteristics as follows:
a. Considering the business activities conducted by the company, the potential losses faced by the company from composite inherent risk are classified as very low during a certain period in the future; and b. The quality of risk management implementation as a whole is very adequate, in case there are minor weaknesses, such weaknesses can be ignored.

Rating 2
Company risk profiles included in this rating generally have characteristics as follows:
a. Considering the business activities conducted by the company, the potential losses faced by the company from composite inherent risk are classified as low during a certain period in the future; and b. The quality of risk management implementation as a whole is adequate, in case there are minor weaknesses, such weaknesses need to receive management attention.

Rating 3
Company risk profiles included in this rating generally have characteristics as follows:
a. Considering the business activities conducted by the company, the potential losses faced by the company from composite inherent risk are classified as moderately high during a certain period in the future; and b. The quality of risk management implementation as a whole is quite adequate, although minimum requirements are met, there are several weaknesses that require management attention and improvement.

Rating 4
Company risk profiles included in this rating generally have characteristics as follows:
a. Considering the business activities conducted by the company, the potential losses faced by the company from composite inherent risk are classified as high during a certain period in the future; and b. The quality of risk management implementation as a whole is less adequate, there are significant weaknesses in various aspects of risk management that require immediate corrective action.

Rating 5
Company risk profiles included in this rating generally have characteristics as follows:
a. Considering the business activities conducted by the company,

This copy is consistent with the original
Legal Director 1
Legal Department signed
Mufli Asmawidjaja
Rating Definition companies, the likelihood of losses faced by the company from composite inherent risk is classified as very high during a certain period in the future; and b. the quality of composite risk management implementation is inadequate, there are significant weaknesses in various aspects of risk management whose remedial actions are beyond the management's capabilities. Established in Jakarta on January 15, 2021 EXECUTIVE HEAD OF SUPERVISOR INSURANCE, PENSION FUNDS, FINANCING INSTITUTIONS, AND OTHER FINANCIAL SERVICE INSTITUTIONS FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA, signed RISWINANDI

APPENDIX III
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 1 /SEOJK.05/2021 CONCERNING ASSESSMENT OF THE HEALTH LEVEL OF INSURANCE COMPANIES, REINSURANCE COMPANIES, SHARIA INSURANCE COMPANIES, AND SHARIA REINSURANCE COMPANIES

ASSESSMENT OF PROFITABILITY FACTORS
HEALTH LEVEL OF INSURANCE COMPANIES, REINSURANCE COMPANIES, SHARIA INSURANCE COMPANIES AND SHARIA REINSURANCE COMPANIES
Table III.A: Parameters or Indicators for Assessing Profitability Factors 4
Table III.B: Guidelines for Determining Profitability Factor Ratings 17

Filling Instructions:

The parameters or indicators for assessing profitability factors in Appendix III are minimum standards that must be used in conducting profitability factor assessments.
Companies may add other parameters or indicators in accordance with the characteristics and complexity of the Company's business.
Assessments are conducted per position and period for the last 12 (twelve) months for parameters or indicators that are quantitative in nature.
For certain parameters or indicators, assessments may be conducted by considering trends for at least a period of 3 (three) years.
In assessing the Company's profitability on a consolidated basis, parameters or indicators for assessing the Company's profitability on an individual basis may be used, adjusted for the scale, characteristics, and complexity of the Subsidiary Company's business.

Table III.A: Parameters or Indicators for Assessing Profitability Factors

Company Performance
in generating profit (profitability)
A. For Insurance Companies and Reinsurance Companies

Return on asset (RoA) a) All assets including PAYDI
Profit or loss before tax
Average total assets
(1) Profit or loss before tax is as stated in the financial performance report.
(2) Average total assets is the average total assets (including PAYDI) in the balance sheet as stated in the monthly financial reports of Insurance Companies and Reinsurance Companies. b) Traditional products only Profit or loss before tax Average total assets (1) Profit or loss before tax is as stated in the financial performance report. (2) Average total assets is the average total assets (only traditional products) in the balance sheet as stated in the monthly financial reports of Insurance Companies and Reinsurance Companies.
Premium growth ratio
(Gross Premium (Y1) – Gross Premium (Y0))
Gross Premium (Y0) a) The premium growth ratio can be used as an indicator of the business growth conducted by Insurance Companies and Reinsurance Companies, calculated from this year's gross premium minus last year's gross premium divided by last year's. b) Gross premium is calculated from direct written premium plus indirect written premium minus commissions paid.
Loss ratio
Net Claims Incurred
Net Premium Earned a) The loss ratio measures losses occurring proportionally to the premium income obtained. b) Net claims incurred is calculated from gross claims minus reinsurance claims. c) Net premium earned is calculated from premium income minus reinsurance premium plus the decrease (increase) in CAPYBMP.
Expense ratio
Operating Expenses (Expense)
Net Premium Earned + Investment Income
To determine the level of efficiency of Insurance Companies and Reinsurance Companies in conducting their business or the costs incurred. a) Operating expenses are expenses incurred by Insurance Companies and Reinsurance Companies in conducting their business, including marketing expenses, general and administrative expenses, management expenses, and other operating expenses as stated in the financial performance report. b) Net premium earned is calculated from premium income minus reinsurance premium plus the decrease (increase) in CAPYBMP as stated in the financial performance report.
Actual profit performance against profit projections and budget estimates
Analysis using the Company's business plan data for Insurance Companies and Reinsurance Companies. The results of this comparative analysis can be used as a tool for validating the budgeting process and profit projections. The greater the difference between actual conditions and projections, the greater the probability that future projections will be unreliable. Actual profit component (profitability) performance Budget projections Performance on profit components (profitability) is a comparison between realization and budget projections for income statement accounts, including:
a) operational income; b) operational expenses; c) non-operational income; d) non-operational expenses; and e) net profit.
Ability of profit to increase capital
Qualitative analysis viewed from financial health ratios, dividend policies, income statements, and capital statements.
Example:
High retained earnings can increase capital faster. If asset growth is low, while profit and capital are high or strong, a relatively high dividend payout ratio policy can still be applied by Insurance Companies and Reinsurance Companies. However, if asset growth is rapid, while profit and capital are low/weak, a low dividend payout ratio policy is more appropriate for Insurance Companies and Reinsurance Companies. Dividend payout ratio = Total dividends paid Net profit after tax B. For Sharia Insurance Companies and Sharia Reinsurance Companies
Return on asset (RoA) This ratio indicates the indication of profit from all business activity operations; a ratio with a high value may indicate high-risk activities or insufficient provisioning.
a) All assets including PAYDI
Profit or loss before tax
((Total assets all funds period n + total assets all funds period n-1)) (1) Profit or loss before tax is as stated in the financial performance report.
(2) Average total assets is the average total assets (including PAYDI) in the balance sheet as stated in the monthly financial reports of Sharia Insurance Companies and Sharia Reinsurance Companies. b) Traditional products only Profit or loss before tax ((Total assets all funds period n + total assets all funds period n-1)) (1) Profit or loss before tax is as stated in the financial performance report. (2) Average total assets is the average total assets (only traditional products) in the balance sheet as stated in the monthly financial reports of Sharia Insurance Companies and Sharia Reinsurance Companies.
Gross contribution growth
For gross contribution growth, the following formula is calculated:
[Gross contribution period n – gross contribution period n-1] Gross contribution period n-1 An increasing contribution growth ratio indicates a business growth indicator.
Loss ratio from core business
% Loss ratio from core business
Claims ratio =
Net claims incurred
Net tabarru' fund contribution
Core business loss ratio =
Net claims incurred
Net tabarru' fund contribution
Core business of Sharia Insurance and Reinsurance Companies may consist of products/product lines that provide the most optimal income to Sharia Insurance and Reinsurance Companies.
Expense ratio
Operating expenses of the company fund
(underwriting income + investment income) of the company fund Expense ratio to see operational efficiency.
Actual performance of company fund (profitability)
against projections
Actual profit component (profitability) performance Budget projections Performance on profit components (profitability) including, among others:
a) ujroh income; b) investment income; c) investment management ujroh income; d) operating expenses; e) other income and expenses; and f) net profit compared to budget projections.
Surplus (deficit) underwriting
a) Growth ratio of surplus (deficit) underwriting [Surplus (deficit) Underwriting Tabarru' Fund Period n – Surplus (deficit) Underwriting Tabarru' Fund Period n-1] Surplus (deficit) Underwriting Tabarru' Fund Period n-1 Growth of underwriting surplus and the ratio of comparison of underwriting surplus with profit (loss) in the tabarru' fund, indicating an improvement in the performance of the tabarru' fund owned by Sharia Insurance and Reinsurance Companies, especially for the benefit of participants. b) Surplus (deficit) underwriting tabarru' fund against profit (loss) tabarru' fund Surplus (deficit) underwriting tabarru' fund Profit (loss) tabarru' fund before tax Growth of underwriting surplus and the ratio of comparison of underwriting surplus with profit (loss) in the tabarru' fund, indicating an improvement in the performance of the tabarru' fund owned by Sharia Insurance and Reinsurance Companies, especially for the benefit of participants.
Formation of provisions
In calculating the formation of provisions, it is necessary to consider at least:
a) Growth in the increase (decrease) of technical provisions for tabarru' funds.
The increase (decrease) of technical provisions for tabarru' funds is as stated in the financial performance reports of Sharia Insurance and Reinsurance Companies. b) Growth in the increase (decrease) of ujroh provisions for company funds. The increase (decrease) of ujroh provisions for company funds is as stated in the financial performance reports of Sharia Insurance and Reinsurance Companies. c) Growth in the increase (decrease) of profit equalization reserve on participant investment funds if there are guaranteed PAYDI. The increase (decrease) of profit equalization reserve on participant investment funds if there are guaranteed PAYDI is as stated in the financial performance reports of Sharia Insurance and Reinsurance Companies.

Sources
that support profitability

Premium/contribution income analysis
Assessment of premium/contribution income is not based solely on the amount of premium/contribution income at a specific position (level), but also on the growth of premium/contribution income in recent years, for example, premium/contribution growth in the last 5 years. Assessment of premium/contribution income is conducted using the following ratio:
Premium/contribution growth ratio (premium growth ratio) = Gross premium/contribution (Y1) – gross premium/contribution (Y0) Gross premium/contribution (Y0) Gross premium/contribution is calculated from direct written premium/contribution plus indirect written premium/contribution minus commissions paid.
Analysis of income other than
premium/contribution income
This analysis shows the dependence and contribution of non-premium income or fee-based income to profitability performance. If the contribution is high and/or fluctuates from the previous period, further analysis is required. Components included in income other than premium/contribution income:
a) Investment Results Analysis
Investment yield ratio:
Interest or profit-sharing income, rent, and other investment income Average total investments b) Income from service fees/other management fees and other income.
Analysis of claims expenses (insurance expenses)
Analysis of claims expenses includes analysis of claims and insurance benefits and acquisition costs. High claims expenses indicate weaknesses in the underwriting process conducted by the Company. Especially if it turns out that the claims occurring are very high, exceeding premium/contribution insurance income in the relevant year. Loss ratio = Net claims incurred Net premium/contribution income
Analysis of operating/operational expenses
Analysis of operational expenses includes analysis of all operational expenses of the Company.
Operational expenses may include, among others:
a) Marketing expenses; b) Employee and official expenses; c) Education and training expenses; d) Other general and administrative expenses; and e) Management expenses.
Assessment uses the efficiency ratio:
Operational expenses
Average total assets (average assets)
Analysis of asset impairment
Analysis of asset impairment is one of the factors in determining whether the Company's profitability conditions are stable and sustainable.
Ratio used = Investment asset impairment
Average total assets

Stability
of components that support profitability
A. For Insurance Companies and Reinsurance Companies

Combined ratio (combine ratio)
Combined ratio = loss ratio + expense ratio
The combined ratio is a quick and simple way to measure the profitability and financial health of Insurance Companies and Reinsurance Companies. This ratio measures insurance expenses and operational expenses in relation to income (premium income and income other than premium income), so this ratio measures the extent to which insurance expenses and operational expenses can be covered by income.
Average profit (loss)
growth before tax for 3 years forward
Average profit (loss) growth before tax for 3 years forward as stated in the business plan of Insurance Companies and Reinsurance Companies.
Future profitability prospects
Analysis of the fairness of profitability projections by understanding the validity of the assumptions underlying these projections. In addition, external factors also need to be considered, such as: economic conditions, the profitability conditions of an industry that affect the profitability of Insurance Companies and Reinsurance Companies, as well as the track record of management of Insurance Companies and Reinsurance Companies in providing reliable budgets that meet profitability projections and unexpected external factors. These factors need to be considered because they can affect the profitability of Insurance Companies and Reinsurance Companies in the future. Example:
a) External factors impact on profitability outlook macroeconomic outlook:
 How does the macroeconomic outlook affect the trend of stability of premium income and investment results?
 How great is the possibility of increasing the provisioning for asset impairment in the future related to commodity price movements?

b) Financial market conditions
 What is the impact of interest rate changes and exchange rate fluctuations on the profitability of life insurance companies? c) Insurance market  How is the competition in the insurance market based on sectors, segments, or geographical regions?
4) Comparison of total income
with total expenses
This is an analysis of the quality of profit. a. Conducting an analysis of income components.
Companies must conduct premium income analysis starting with understanding the category of components included as income and expenses. Premium income and insurance expenses may include stable income and expense components or those that are more fluctuating, depending on the risk level of the Company's main business lines. b. Determining the fairness and suitability of components included in premium income. Companies must conduct an analysis of components included in income, because components included in these categories can be fluctuating. As an example: if premium income comes from guaranteed products with high guarantee promises that can attract many policyholders, and at a certain time, Insurance Companies and Reinsurance Companies lower their guarantee promises, causing a decrease in premium income. Investment income comes from non-recurring sources (sale of investment assets) and will not be sustainable.

c. Conducting an analysis of income components other than premium income.
d. Conducting an analysis of insurance expense and operating expense components.
5) Trend of retained earnings and dividend payments
a. Trend of retained earnings
Retained earnings of company funds are as stated in the balance sheet of Insurance Companies and Reinsurance Companies. b. Trend of dividend payments Retained earnings of company funds are as stated in the statement of changes in equity, financial reports of Insurance Companies and Reinsurance Companies. B. For Sharia Insurance Companies and Sharia Reinsurance Companies

Combined ratio (combine ratio)
[net claims incurred + operating expenses]
[net tabarru' fund contribution + ujroh]
Combined ratio is the insurance business performance of a Sharia Insurance Company and Sharia Reinsurance Company derived from the main activities of Sharia Insurance and Reinsurance Companies, including related costs. Combined ratio for Insurance Companies and Reinsurance Companies is calculated by adding net claims incurred from the tabarru' fund plus operating expenses from the company fund, then dividing the total by tabarru' fund contribution and ujroh.
Average profit (loss)
growth before tax for 3 years forward
Average profit (loss) growth before tax for 3 years forward as stated in the business plan of Sharia Insurance Companies and Sharia Reinsurance Companies.
Future profitability prospects
Analysis of the fairness of profitability projections by understanding the validity of the assumptions underlying these projections. In addition, external factors also need to be considered, such as economic conditions, the profitability conditions of an industry that affect the profitability of Sharia Insurance Companies and Sharia Reinsurance Companies, as well as the track record of management in providing reliable budgets that meet profitability projections and unexpected external factors. These factors need to be considered because they can affect the profitability of Sharia Insurance Companies and Sharia Reinsurance Companies in the future.
Trend of retained earnings and dividend payments
a) Trend of retained earnings
Retained earnings of company funds are as stated in the balance sheet of Sharia Insurance Companies and Sharia Reinsurance Companies. b) Trend of dividend payments Retained earnings of company funds are as stated in the statement of changes in equity, financial reports of Sharia Insurance Companies and Sharia Reinsurance Companies.

Table III.B: Guidelines for Determining Profitability Factor Ratings
Rating Definition
Rating 1 Profitability is very adequate, Company profit exceeds target, and supports capital growth.
Companies included in Rating 1 meet all or most of the following example characteristics:
a. Company performance in generating profit
(profitability) is very adequate; b. the main source of profitability from premium/contribution income is very dominant;
c. components supporting premium/contribution income are very stable; and
d. the Company's ability to increase capital and future profit prospects are very high.
Rating 2 Profitability is adequate, Company profit exceeds target, and supports capital growth.
Companies included in Rating 2 meet all or most of the following example characteristics:
a. Company performance in generating profit or profitability is adequate; b. the main source of profitability from premium/contribution income is dominant;
c. components supporting premium/contribution income are stable; and
d. the Company's ability to increase capital and future profit prospects are high.
Rating 3 Profitability is sufficiently adequate, Company profit meets target, although there is pressure on profit performance that may cause a decrease in profit but still sufficiently supports Company capital growth. Companies included in Rating 3 meet all or most of the following example characteristics:

Rating Definition a. Company performance in generating profit or profitability is sufficiently adequate; b. the main source of profitability from premium/contribution income is sufficiently dominant but there is a fairly large influence from investment results;
c. components supporting premium/contribution income are sufficiently stable; and
d. the Company's ability to increase capital and future profit prospects are sufficiently good.
Rating 4 Profitability is less adequate, Company profit does not meet target, and is estimated to remain in such conditions in the future, thus less supporting capital growth and business continuity of the Company. Companies included in Rating 4 meet all or most of the following example characteristics:
a. Company performance in generating profit or profitability is inadequate or the Company incurs losses; b. the main source of profitability comes from investment results;
c. components supporting premium/contribution income are less stable; and
d. the Company's ability to increase capital and future profit prospects are less good or even can have a negative impact on Company capital.
Rating 5 Profitability is inadequate, Company profit does not meet target and is unreliable, and immediately requires improvement in profit performance to ensure the Company's business continuity. Companies included in Rating 5 meet all or most of the following example characteristics:

This copy is consistent with the original
Legal Director 1
Legal Department signed
Mufli Asmawidjaja
Rating Definition a. The Company incurs significant losses; b. the main source of profitability comes from investment results;
c. components supporting premium/contribution income are unstable; and
d. Company losses significantly affect capital.
Established in Jakarta on January 15, 2021
EXECUTIVE HEAD OF SUPERVISOR
INSURANCE, PENSION FUNDS,
FINANCING INSTITUTIONS, AND
OTHER FINANCIAL SERVICE INSTITUTIONS
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA, signed
RISWINANDI

APPENDIX IV
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 1 /SEOJK.05/2021 CONCERNING ASSESSMENT OF THE HEALTH LEVEL OF INSURANCE COMPANIES, REINSURANCE COMPANIES, SHARIA INSURANCE COMPANIES, AND SHARIA REINSURANCE COMPANIES

ASSESSMENT OF CAPITAL ADEQUACY FACTORS
HEALTH LEVEL OF INSURANCE COMPANIES, REINSURANCE COMPANIES, SHARIA INSURANCE COMPANIES AND SHARIA REINSURANCE COMPANIES
Table IV.A: Parameters or Indicators for Assessing Capital Adequacy Factors
Table IV.B: Guidelines for Determining Capital Adequacy Factor Ratings 9

Filling Instructions:

The parameters or indicators for assessing the capital factor in Appendix IV are minimum standards that must be used in conducting the assessment of the capital factor.
Companies may add other parameters or indicators in accordance with the characteristics and complexity of the Company's business.
The assessment is conducted per position and period for the last 12 (twelve) months for parameters or indicators that are quantitative in nature.
For certain parameters or indicators, the assessment may be conducted by considering trends for at least a period of 3 (three) years.
In assessing the Company's capital factor on a consolidated basis, the Company may use the Company's individual capital funding assessment parameters or indicators, adjusted to the scale, characteristics, and complexity of the Subsidiary Company's business.

Table IV.A: Parameters or Indicators for Assessing the Capital Factor

I. Qualitative

Assessment of level (position), trend, and composition of permitted assets (admitted assets) of the Company.
a) Assessment of the accuracy of the Solvency Calculation Report (LPTS), namely the presentation of the report, analysis of investment limits, adequacy of guarantee funds, and adequacy of investments. b) Changes in capital. Reduction of paid-up capital must be with the approval of OJK considering the impact on solvency and capital adequacy. c) The composition of assets required by the Company, both in the form of investments and non-investments. The larger the amount of the Company's assets included in the group of permitted assets, both in type and limits, indicates that the management of the Company's assets is quite good.
Assessment of capital adequacy by considering risks at the Company.
Assessment by considering minimum risk-based capital for credit risk, market risk, operational risk, liquidity risk, and insurance risk to assess whether there are underestimated risks, among others due to the following:
a) inaccuracy in defining the components of minimum risk-based capital; b) errors in calculating minimum risk-based capital; and c) lack of reserve formation caused by actuarial assumptions.
Determination of minimum capital adequacy according to risk profile.
Assessment to determine whether the Company's capital is sufficient to cover risks that are not within the scope of minimum risk-based capital regulations in accordance with regulations, among others: investment concentration risk, liquidity risk, strategic risk, reputation risk, legal risk, and compliance risk. The trend of minimum risk-based capital is the increase (decrease) in the amount of funds needed to anticipate potential losses arising from deviations in the management of assets and liabilities from the Company's funds.

II. Quantitative
A. Insurance Companies and Reinsurance Companies

Return on Equity (RoE) Profit before tax
Equity of year n + Equity of year n-1
This ratio indicates the return on equity owned by Insurance Companies and Reinsurance Companies so as to be able to absorb expenses for the conduct of insurance and/or reinsurance business.
Growth of retained earnings [Retained earnings of year n – Retained earnings of year n-1]
Retained earnings of year n-1
The growth of retained earnings indicates good management of profits by Insurance Companies and Reinsurance Companies, showing the performance of Insurance Companies and Reinsurance Companies.

B. For Islamic Insurance Companies and Islamic Reinsurance Companies

Return on Equity (RoE) on Company Funds Profit before tax
Equity of Company Funds Year n + Equity of Company Funds Year n-1 This ratio indicates the return on equity owned by Islamic Insurance Companies and Islamic Reinsurance Companies so as to be able to absorb expenses for the conduct of insurance and/or reinsurance business.
Growth of Company Funds Retained Earnings [Company Funds Retained Earnings Year n – Company Funds Retained Earnings Year n-1]
Company Funds Retained Earnings Year n-1
The growth of Company Funds retained earnings indicates good management of profits by Islamic Insurance Companies and Islamic Reinsurance Companies, showing the performance of Islamic Insurance Companies and Islamic Reinsurance Companies.

Capital Management
a. Company capital management. Assessment of capital management includes:
Active supervision by the Board of Commissioners and Board of Directors.
The responsibility of the Board of Commissioners and Board of Directors in managing the Company's capital is inseparable from the responsibility in implementing effective risk management at the Company.
Capital management policies and procedures.
Capital management needs to be supported by adequate policies and procedures as a basis for each relevant committee/function/work unit to carry out its duties well.
Capital planning.
Every Company is required to prepare a capital plan to ensure that the Company can meet capital needs to cover risks faced by the Company, to support current and future business activities, and to meet shareholder expectations.
Internal control system.
The Company must have an adequate internal control system to ensure the integrity of internal capital adequacy assessments.

b. Capital access capability viewed from internal and external sources.

Assessment of the Company's profitability and its role in internal capital accumulation, and the fairness of dividend/bonus distribution policies.
The fairness of dividend distribution policies and the target dividend distribution to shareholders every year (because retained earnings distributed as dividends cannot certainly be counted as additional capital). In assessing the fairness of dividend distribution policies, the Company can conduct analysis on the objectives, timing of dividend distribution, profitability conditions, liquidity, capital, and the Company's future business plan.
Assessment of the Company's ability to access capital, including from the capital market or from the parent company or corporate group.
Companies with strong financial conditions, listed companies, or companies supported by a strong group usually have good capital access to overcome capital shortages. Good risk management practices require companies to have a sufficiently large capital buffer (high RBC) that can be used at any time, and additional capital from share sales is the last resort. Capital support originating from the parent company or corporate group can be analyzed qualitatively, among others by assessing the parent company's commitment to support the Company's capital in the event of financial difficulties, whether manifested in minutes of Board of Commissioners or Board of Directors meetings, letters of comfort, or other documents that can be equated with them.

Table IV.B: Guidelines for Determining Capital Factor Ratings

Rating Definition
Rank 1 The Company has very adequate capital quality and adequacy relative to the risk profile, accompanied by very strong capital management in accordance with the characteristics, business scale, and complexity of the Company's business. Companies included in Rank 1 meet all or most of the following example characteristics:

The Company has own capital equal to or more than 2.5 times the minimum own capital value required;
The Company has a very adequate capital level, very able to anticipate all risks faced, and supports the Company's future business expansion;
The quality of capital components is generally very good, permanent, and able to absorb losses;
The Company has conducted stress tests with results that can cover all risks faced very adequately;
The Company has very good capital management and/or has a very good capital adequacy assessment process in accordance with business strategy and objectives as well as business complexity and scale;
The Company has very good access to capital sources and/or has capital support from the business group or parent company;
The Company sets solvency achievement ratio targets much higher than the solvency level ratio determined by OJK and can meet the targets well;
The Company's profits for the last 3 years have increased significantly and have an increasing trend;
The allocation and distribution of Company profits have been done fairly; and
There is an underwriting surplus.

Rank 2 The Company has adequate capital quality and adequacy relative to the risk profile, accompanied by strong management in accordance with the characteristics, business scale, and complexity of the Company's business. Companies included in Rank 2 meet all or most of the following example characteristics:

The Company has own capital equal to or more than 1.8 times but less than 2.5 times the minimum own capital value required;
The Company has an adequate capital level and can anticipate almost all risks faced;
The quality of capital components is generally good, permanent, and able to absorb losses;
The Company has conducted stress tests with results that can cover all risks faced adequately;
The Company has good capital management and/or has a good capital adequacy assessment process;
The Company has good access to capital sources and/or there is capital support from the business group or parent company;
The Company sets solvency achievement ratio targets higher than the solvency level ratio determined by OJK and can meet them well;
The Company's profits for the last 3 years have increased significantly and have a fairly increasing trend;
The allocation and distribution of Company profits are done fairly enough; and
Underwriting deficits can be covered by investment results.

Rank 3 The Company has fairly adequate capital quality and adequacy relative to the risk profile, accompanied by fairly strong capital management in accordance with the characteristics, business scale, and complexity of the Company's business. Companies included in Rank 3 meet all or most of the following example characteristics:

The Company has own capital equal to or more than 1.1 times but less than 1.8 times the minimum own capital value required;
The Company has a fairly adequate capital level, and is fairly able to anticipate risks faced;
The quality of capital components is generally fairly good, fairly permanent, and fairly able to absorb losses;
The Company has conducted stress tests with results that can cover all risks faced fairly adequately;
The Company has fairly good capital management and/or has a fairly good capital adequacy assessment process;
The Company has fairly good access to capital sources, but support from the business group or parent company is not done explicitly;
The Company sets solvency achievement ratio targets higher than the solvency level ratio determined by the regulator but cannot meet them well;
The Company's profits for the last 2 years have been stable and have a steady trend;
The allocation and distribution of Company profits are done less fairly; and
Investment results can only cover 50% of underwriting deficits.

Rank 4 The Company has less adequate capital quality and adequacy relative to the risk profile, accompanied by weak capital management compared to the characteristics, business scale, and complexity of the Company's business. Companies included in Rank 4 meet all or most of the following example characteristics:

The Company has own capital equal to or more than 1 time but less than 1.1 times the minimum own capital value required;
The Company has a less adequate capital level and cannot anticipate all risks faced;
The quality of capital components is generally less good, less permanent, and less able to absorb losses;
The Company has conducted stress tests with results that are less able to cover all risks faced;
The Company has less good capital management and/or has a less good capital adequacy assessment process;
The Company is less able to access capital sources, and there is no support from the business group or parent company;
The Company does not set solvency achievement ratio targets higher than the solvency level ratio determined by the regulator;
The Company's profits for the last 2 years have been unstable;
The allocation and distribution of Company profits are not done fairly; and
Investment results can only cover 25% of underwriting deficits.

Rank 5 The Company has inadequate capital quality and adequacy relative to the risk profile, accompanied by very weak capital management compared to the characteristics, business scale, and complexity of the Company's business. Companies included in Rank 5 meet all or most of the following example characteristics:

The Company has own capital less than 1 time the minimum own capital value required;
The Company has an inadequate capital level, so the Company must add capital to anticipate all risks faced under normal and crisis conditions;
The quality of capital instruments is generally not good, not permanent, and not able to absorb losses;
The Company has conducted stress tests with results that cannot cover all risks faced;
The Company has bad capital management and/or has a bad capital adequacy assessment process;
The Company is unable to access capital sources, and there is no support from the business group or parent company;
The Company sets solvency achievement ratio targets determined by the regulator;
The Company has tended to incur losses for the last 2 years;
There is no allocation and distribution of profits; and
Investment results cannot cover underwriting deficits.

This copy is in accordance with the original
Legal Director 1
Legal Department signed
Mufli Asmawidjaja

Appointed in Jakarta on January 15, 2021
EXECUTIVE HEAD OF SUPERVISOR
OF INSURANCE, PENSION FUNDS,
LENDING INSTITUTIONS, AND
OTHER FINANCIAL SERVICE INSTITUTIONS
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA, signed
RISWINANDI

APPENDIX V
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 1 /SEOJK.05/2021 CONCERNING ASSESSMENT OF THE HEALTH LEVEL OF INSURANCE COMPANIES, REINSURANCE COMPANIES, ISLAMIC INSURANCE COMPANIES, AND ISLAMIC REINSURANCE COMPANIES

GUIDELINES FOR DETERMINING THE COMPOSITE HEALTH LEVEL RATING OF INSURANCE COMPANIES, REINSURANCE COMPANIES, ISLAMIC INSURANCE COMPANIES, AND ISLAMIC REINSURANCE COMPANIES *)

Rating Explanation
PK-1
Reflects the condition of the Company that is generally very healthy so that it is assessed to be very capable of facing significant negative influences from changes in business conditions and other external factors, reflected in the assessment factor ratings, among others good corporate governance implementation for the Company, risk profile, profitability, and capital that are generally very good. In the event of weaknesses, generally these weaknesses are not significant. PK-2 Reflects the condition of the Company that is generally healthy so that it is assessed to be capable of facing significant negative influences from changes in business conditions and other external factors, reflected in the assessment factor ratings, among others good corporate governance implementation for the Company, risk profile, profitability, and capital that are generally good. In the event of weaknesses, generally these weaknesses are less significant. PK-3 Reflects the condition of the Company that is generally fairly healthy so that it is assessed to be fairly capable of facing significant negative influences from changes in business conditions and other external factors, reflected in the assessment factor ratings, among others good corporate governance implementation for the Company, risk profile, profitability, and capital that are generally fairly good. In the event of weaknesses, generally these weaknesses are fairly significant and if not successfully overcome by management, they can disrupt the Company's business continuity. PK-4 Reflects the condition of the Company that is generally less healthy so that it is assessed to be less capable of facing significant negative influences from changes in business conditions and other external factors, reflected in the assessment factor ratings, among others good corporate governance implementation for the Company, risk profile, profitability, and capital that are generally less good. There are weaknesses that are generally significant and cannot be overcome well by management and disrupt the Company's business continuity. PK-5 Reflects the condition of the Company that is generally unhealthy so that it is assessed to be unable to face significant negative influences from changes in business conditions and other external factors, reflected in the assessment factor ratings, among others good corporate governance implementation for the Company, risk profile, profitability, and capital that are generally not good.

This copy is in accordance with the original
Legal Director 1
Legal Department signed
Mufli Asmawidjaja

Rating Explanation
There are weaknesses that are generally very significant so that to overcome them, financial support from shareholders or financial sources from other parties is needed to strengthen the Company's financial condition. *) Applicable for individual and consolidated Company Health Level assessments.

APPENDIX VI
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 1 /SEOJK.05/2021 CONCERNING ASSESSMENT OF THE HEALTH LEVEL OF INSURANCE COMPANIES, REINSURANCE COMPANIES, ISLAMIC INSURANCE COMPANIES, AND ISLAMIC REINSURANCE COMPANIES

REPORT FORMAT AND WORK PAPER
ASSESSMENT OF THE HEALTH LEVEL OF INSURANCE COMPANIES, REINSURANCE COMPANIES, ISLAMIC INSURANCE COMPANIES, AND ISLAMIC REINSURANCE COMPANIES
Company Name : .................................................
Report letter number : .................................................
Report letter date : .................................................
Report responsible person:
Name : .................................................
Position : .................................................
Telephone : .................................................
Electronic mail (e-mail) : .................................................

A. Company Health Level Assessment Result Report No Assessment Factor Rating Individual Consolidated*) 1 Good corporate governance for the Company 2 Risk profile 3 Profitability 4 Capital Company Health Level Rating *) In the event the Company has a Subsidiary Company that is consolidated

Analysis
Analysis regarding the Company's overall condition is reflected in the four Company Health Level assessment factors as follows:

analysis of good corporate governance implementation for the Company;
risk profile analysis covering inherent risk, quality of risk management implementation, and risk level for each risk and risk level rating;
profitability analysis; and
capital analysis.
In the event the Company has a Subsidiary Company that is consolidated, the Company pays attention to:
a. the significance or materiality of the Subsidiary Company's share to the Company on a consolidated basis; and b. Subsidiary Company issues regarding good corporate governance for the Company, risk profile, profitability, and capital that have a significant impact on the Company on a consolidated basis.

Date : Date :
Prepared by: Approved by:

B. Assessment of the Good Corporate Governance Factor for the Company Good Corporate Governance Rating for the Company Individual Consolidated Analysis Description regarding the conclusion of good corporate governance performance for the Company considering the comprehensive and structured good corporate governance assessment factors, covering both structure, process, and outcome of good corporate governance for the Company. In the event the Company has a Subsidiary Company that is consolidated, the Company pays attention to:
a. the significance or materiality of the Subsidiary Company's share to the Company on a consolidated basis; and b. Subsidiary Company issues regarding good corporate governance for the Company, risk profile, profitability, and capital that have a significant impact on the Company on a consolidated basis.

C. Assessment of the Risk Profile Factor for the Company and Islamic Unit
C.1. Assessment of the Risk Profile Factor for the Company Risk Profile Individual Consolidated Rating Inherent Risk Rating Quality of Risk Management Implementation Rating Risk Level Rating Inherent Risk Rating Quality of Risk Management Implementation Rating Risk Level Rating Strategic Risk Operational Risk Insurance Risk Credit Risk Market Risk Liquidity Risk Legal Risk Compliance Risk Reputation Risk Composite Rating Risk Profile Rating Risk Profile Rating Analysis Description regarding the conclusion of the Company's overall risk profile including assessment of inherent risk and quality of risk management implementation, with analysis focus on significant risk exposures at the Company. In the event the Company has a Subsidiary Company that is consolidated, the Company pays attention to:
a. the significance or materiality of the Subsidiary Company's share to the Company on a consolidated basis; and b. Subsidiary Company issues regarding good corporate governance for the Company, risk profile, profitability, and capital that have a significant impact on the Company on a consolidated basis.

C.2. Assessment of the Risk Profile Factor for the Islamic Unit Risk Profile Islamic Unit Inherent Risk Rating Quality of Risk Management Implementation Rating Risk Level Rating Strategic Risk Operational Risk Insurance Risk Credit Risk Market Risk Liquidity Risk Legal Risk Compliance Risk Reputation Risk Composite Rating Risk Profile Rating Description regarding the conclusion of the Islamic Unit's overall risk profile including assessment of inherent risk and quality of risk management implementation, with analysis focus on significant risk exposures at the Islamic Unit.

This copy is consistent with the original
Legal Director 1
Legal Department signed
Mufli Asmawidjaja
D. Assessment of Profitability Factors
Consolidated Individual Profitability Rating
Analysis
The final conclusion regarding the profitability performance of the Company by considering profitability assessment factors. In the event that the Company has Consolidated Subsidiaries, the Company considers the impact of the Subsidiary's profitability performance on the Company's overall profitability by considering the significance and materiality of the Subsidiary. E. Assessment of Capital Factors Consolidated Individual Capital Rating Analysis The final conclusion regarding the capital adequacy performance of the Company by considering capital adequacy assessment factors. In the event that the Company has Consolidated Subsidiaries, the Company considers the impact of the Subsidiary's capital adequacy performance on the Company's overall capital adequacy by considering the significance and materiality of the Subsidiary. Determined in Jakarta on January 15, 2021 EXECUTIVE HEAD OF THE INSURANCE, PENSION FUND, FINANCING INSTITUTION, AND OTHER FINANCIAL SERVICE INSTITUTIONS SUPERVISOR FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA, signed RISWINANDI

Circular Letter of the Financial Services Authority of the Republic of Indonesia Number 1/SEOJK.05/2021 Concerning the Assessment of the Health Level of Insurance Companies, Sharia Insurance Companies, Reinsurance Companies, and Sharia Reinsurance Companies

Rating Definition

Rating 3 (Sufficient)

Rating 4 (Fairly Weak)

Rating 5 (Weak)

Table II.C.1: Parameters or Indicators for Assessing Inherent Insurance Risk for Insurance Risk

Rating Definition

Table II.E.1: Parameters or Indicators for Assessing Inherent Risk for Market Risk

Table II.E.2: Guidelines for Setting Inherent Risk Levels for Market Risk

Rating Definition Rating

Rating 3

Rating 4

Rating 5

Table II.I.3: Guidelines for Determining the Quality of Risk Management Implementation for Reputational Risk

Rating Definition Rating

Rating 1

Rating 2

Rating 3

Rating 4

Rating 5

Table II.J: Format for Risk Assessment Analysis

Table II.K: Format for Composite Risk Profile Determination

Table II.L: Guidelines for Determining the Rating of Risk Profile Factors

Rating Definition

Lineage: In force