Implementation of Risk Management for Insurance Brokerage Companies, Reinsurance Brokerage Companies, and Insurance Loss Assessors

To:

The Board of Directors of Insurance Brokerage Companies;
The Board of Directors of Reinsurance Brokerage Companies; and
The Board of Directors of Insurance Loss Assessors,

at their respective locations.

COPY

CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 13 /SEOJK.05/2021

CONCERNING

THE IMPLEMENTATION OF RISK MANAGEMENT FOR INSURANCE BROKERAGE COMPANIES, REINSURANCE BROKERAGE COMPANIES, AND INSURANCE LOSS ASSESSORS

In relation to the mandate of Article 25 of Financial Services Authority Regulation Number 44/POJK.05/2020 concerning the Implementation of Risk Management for Non-Bank Financial Service Institutions (State Gazette of the Republic of Indonesia Year 2020 Number 200, Additional State Gazette of the Republic of Indonesia Number 6552), it is necessary to further regulate the implementation of risk management, the organizational structure of the risk management committee, the organizational structure of the risk management function, the relationship between business and operational functions with the risk management function, and the management of risk in the development or expansion of business activities for insurance brokerage companies, reinsurance brokerage companies, and insurance loss assessors in this Financial Services Authority Circular Letter as follows:

I. GENERAL PROVISIONS

In this Financial Services Authority Circular Letter, the following terms are defined as:

Company means an insurance brokerage company, a reinsurance brokerage company, and an insurance loss assessor.
Insurance Brokerage Company means a company that conducts insurance brokerage business.
Reinsurance Brokerage Company means a company that conducts reinsurance brokerage business.
Insurance Loss Assessor means a company that conducts insurance loss assessment business.
Risk means the potential for losses that cannot be controlled and/or can be controlled due to the occurrence of a specific event.
Risk Management means a series of procedures and methodologies used to identify, measure, control, and monitor Risks arising from all Company business activities.
Strategic Risk means Risk resulting from inaccuracies in the making and/or implementation of strategic decisions as well as failures in anticipating changes in the business environment.
Operational Risk means Risk resulting from insufficient and/or non-functioning internal processes, human error, system failures, and/or the existence of external events that affect the Company's operations.
Legal Risk means Risk arising from legal claims and/or weaknesses in legal aspects.
Compliance Risk means Risk resulting from the Company's failure to comply with and/or implement applicable laws and regulations and provisions applicable to the Company.
Reputational Risk means Risk resulting from a decrease in the level of trust of stakeholders stemming from negative perceptions of the Company.
Board of Directors means the corporate organ authorized and fully responsible for managing the company for the benefit of the company, in accordance with the purpose and objectives of the company and representing the company, both inside and outside of court, in accordance with the articles of association for Companies in the form of limited liability companies or equivalent to the Board of Directors for Companies in the form of cooperative legal entities.
Board of Commissioners means the corporate organ tasked with conducting general and/or specific supervision in accordance with the articles of association and providing advice to the Board of Directors for Companies in the form of limited liability companies or equivalent to the Board of Commissioners for Companies in the form of cooperative legal entities.

II. GUIDELINES FOR THE IMPLEMENTATION OF RISK MANAGEMENT

The implementation of Risk Management must be adjusted to the Company's objectives, business policies, size, and complexity of business, considering the development of conditions and potential problems faced.
In the implementation of Risk Management as referred to in item 1, the Company must have and implement written Risk Management strategies, policies, and procedures.
The implementation of Risk Management as referred to in items 1 and 2 refers to the guidelines for the implementation of Risk Management as contained in Appendix I, which is an integral part of this Financial Services Authority Circular Letter.
The written Risk Management strategies, policies, and procedures as referred to in item 2 can be formulated in the form of the Company's internal Risk Management guidelines.
The guidelines for the implementation of Risk Management as referred to in item 3 are the minimum reference for the Company in implementing Risk Management, to ensure that all Risks faced by the Company are identified, measured, controlled, and monitored correctly.
The Risk Management strategies, policies, and procedures as referred to in item 4 must at least cover:

a. the implementation of Risk Management which at least covers:

active supervision by the Board of Directors and Board of Commissioners;
adequacy of Risk Management policies and procedures as well as the establishment of Risk limits;
adequacy of the Risk identification, measurement, control, and monitoring processes, as well as the Risk Management information system; and
a comprehensive internal control system;

b. the implementation of Risk Management for each type of Risk, including the implementation of Risk Management for 5 (five) types of Risk, namely Strategic Risk, Operational Risk, Legal Risk, Compliance Risk, and Reputational Risk; and

c. the risk profile assessment conducted at least 1 (one) time in 1 (one) year.

The Company must have an organizational structure that supports the effective implementation of Risk Management, including the organizational structure of the Risk Management Committee and the organizational structure of the Risk Management function, which is an integral part of the Company's Risk Management organizational structure.
The Company's Risk Management organizational structure as referred to in item 7 must explain the relationship between business and operational functions with the Risk Management function.
The Risk Management organizational structure as referred to in items 7 and 8 refers to Appendix II, which is an integral part of this Financial Services Authority Circular Letter.
In order to implement effective Risk Management, the Company takes preparation, development, and/or refinement steps as necessary, including:

a. conducting an analysis of the organization, strategies, policies, and Risk Management procedures, or internal Risk Management guidelines;

b. preparing a plan to refine the Company's Risk Management in accordance with the reference in the standard guidelines for the implementation of Risk Management for the Company, in the event of inconsistencies between the Company's Risk Management strategies, policies, and procedures, or internal Risk Management guidelines, with the standard guidelines for the implementation of Risk Management for the Company as per the standard guidelines for the implementation of Risk Management in this Financial Services Authority Circular Letter;

c. socializing the Risk Management strategies, policies, and procedures, or internal Risk Management guidelines to employees so that they understand Risk Management practices, and developing a Risk culture (risk culture) among all employees at every level of the Company's organization; and

d. ensuring that the internal audit function participates in monitoring the process of drafting and refining internal Risk Management guidelines and the implementation of Risk Management as well as the risk profile assessment as referred to in item 6 letter c.

III. RISK PROFILE ASSESSMENT

A. General

The risk profile assessment as referred to in Section II item 6 letter c is an assessment of:

a. inherent risk; and

b. the quality of Risk Management implementation which reflects the adequacy of the Risk control system for the Company, in the Company's operational activities.

The Risks assessed in the risk profile assessment as referred to in item 1 consist of 5 (five) types of risk, namely:

a. Strategic Risk;

b. Operational Risk;

c. Legal Risk;

d. Compliance Risk; and

e. Reputational Risk.

B. Assessment of Inherent Risk

The assessment of inherent risk is an assessment of the inherent risk in the Company's business activities, both quantifiable and non-quantifiable, which has the potential to affect the Company's financial position.
The characteristics of the Company's inherent risk are determined by internal and external factors, including:

a. business strategy;

b. business characteristics;

c. complexity of the Company's business activities;

d. the insurance industry conditions; and

e. macroeconomic conditions.

The assessment of inherent risk is conducted by considering quantitative and qualitative parameters or indicators.
The determination of the level of inherent risk for each type of Risk is categorized into the following ranks:

a. rank 1 (low);

b. rank 2 (relatively low);

c. rank 3 (moderate);

d. rank 4 (relatively high); and

e. rank 5 (high).

C. Assessment of Inherent Risk for Strategic Risk

Sources of Strategic Risk include, among others:

a. the Company sets strategies that are not aligned with the Company's vision and mission;

b. the Company conducts strategic environment analysis that is not comprehensive;

c. there is inconsistency in strategic plans across strategic levels; and

d. failure to anticipate changes in the business environment such as technological changes, macroeconomic condition changes, market competition, and changes in relevant authority policies.

In assessing the inherent risk for Strategic Risk, the parameters or indicators used must at least include:

a. inconsistency of business strategy with the Company's vision and mission as well as business environment conditions;

b. choice of business strategy level, namely high-risk strategy and low-risk strategy;

c. the Company's strategic position in the industry; and

d. achievement of the Company's business realization.

The Company assesses the inherent risk for Strategic Risk using the parameters or indicators of inherent risk as contained in Table I.A.1 of Appendix I, which is an integral part of this Financial Services Authority Circular Letter.
The Company determines the level of inherent risk for Strategic Risk in 5 (five) ranks, namely:

a. rank 1 (low);

b. rank 2 (relatively low);

c. rank 3 (moderate);

d. rank 4 (relatively high); and

using the guidelines as contained in Table I.A.2 of Appendix I, which is an integral part of this Financial Services Authority Circular Letter.

D. Assessment of Inherent Risk for Operational Risk

Sources of Operational Risk can be caused by, among others:

a. weaknesses in human resources;

b. weaknesses in internal processes;

c. inadequate systems and infrastructure; and

d. external events that have a negative impact on the Company.

In assessing the inherent risk for Operational Risk, the parameters or indicators used must at least include:

a. organizational and business activity complexity;

b. human resources;

c. information technology systems;

d. fraud risk;

e. business and organizational disruption; and

f. administrative systems.

The Company assesses the inherent risk for Operational Risk using the parameters or indicators of inherent risk as contained in Table I.B.1 of Appendix I, which is an integral part of this Financial Services Authority Circular Letter.
The Company determines the level of inherent risk for Operational Risk in 5 (five) ranks, namely:

a. rank 1 (low);

b. rank 2 (relatively low);

c. rank 3 (moderate);

d. rank 4 (relatively high); and

using the guidelines as contained in Table I.B.2 of Appendix I, which is an integral part of this Financial Services Authority Circular Letter.

E. Assessment of Inherent Risk for Legal Risk

Legal Risk can arise, among others, due to:

a. absence and/or changes in supporting laws and regulations;

b. weaknesses in agreements, such as the failure to meet the requirements for a valid contract, causing a transaction already conducted by the Company to be inconsistent with regulations; and/or

c. litigation processes arising from lawsuits by third parties against the Company or by the Company against third parties.

In assessing the inherent risk for Legal Risk, the parameters or indicators used must at least include:

a. absence or changes in laws and regulations;

b. weaknesses in agreements or cooperation; and

c. dispute resolution processes.

The Company assesses the inherent risk for Legal Risk using the parameters or indicators of inherent risk as contained in Table I.C.1 of Appendix I, which is an integral part of this Financial Services Authority Circular Letter.
The Company determines the level of inherent risk for Legal Risk in 5 (five) ranks, namely:

a. rank 1 (low);

b. rank 2 (relatively low);

c. rank 3 (moderate);

d. rank 4 (relatively high); and

using the guidelines as contained in Table I.C.2 of Appendix I, which is an integral part of this Financial Services Authority Circular Letter.

F. Assessment of Inherent Risk for Compliance Risk

Sources of compliance risk arise, among others, from:

a. legal behavior, namely the Company's behavior or activities that deviate from or violate regulations and/or laws; and

b. organizational behavior, namely the Company's behavior or activities that deviate from or contradict generally applicable standards.

In assessing the inherent risk for Compliance Risk, the parameters or indicators used must at least include:

a. the type and significance of violations committed;

b. the frequency of violations (including sanctions) committed or the Company's non-compliance track record;

c. violations of laws and regulations, provisions applicable to the Company, or generally applicable business standards; and

d. follow-up on violations, including fulfillment of the action plan submitted to the Financial Services Authority.

The Company assesses the inherent risk for Compliance Risk using the parameters or indicators of inherent risk as contained in Table I.D.1 of Appendix I, which is an integral part of this Financial Services Authority Circular Letter.
The Company determines the level of inherent risk for Compliance Risk in 5 (five) ranks, namely:

a. rank 1 (low);

b. rank 2 (relatively low);

c. rank 3 (moderate);

d. rank 4 (relatively high); and

using the guidelines as contained in Table I.D.2 of Appendix I, which is an integral part of this Financial Services Authority Circular Letter.

G. Assessment of Inherent Risk for Reputational Risk

Reputational Risk arises, among others, due to negative media coverage and/or rumors regarding the Company, as well as the Company's ineffective communication strategy.
In assessing the inherent risk for Reputational Risk, the parameters or indicators used must at least include:

a. the reputational influence of directors, owners, and the Company group;

b. violations of business ethics;

c. complexity of insurance/reinsurance products mediated for placement or assessed for loss and business cooperation;

d. frequency, materiality, and exposure of negative reporting; and

e. frequency and materiality of consumer complaints.

The Company assesses the inherent risk for Reputational Risk using the parameters or indicators of inherent risk as contained in Table I.E.1 of Appendix I, which is an integral part of this Financial Services Authority Circular Letter.
The Company determines the level of inherent risk for Reputational Risk in 5 (five) ranks, namely:

a. rank 1 (low);

b. rank 2 (relatively low);

c. rank 3 (moderate);

d. rank 4 (relatively high); and

using the guidelines as contained in Table I.E.2 of Appendix I, which is an integral part of this Financial Services Authority Circular Letter.

H. Assessment of Risk Management Implementation Quality

The assessment of Risk Management implementation quality aims to evaluate the effectiveness of the Company's Risk Management implementation in accordance with the principles regulated in the Financial Services Authority Regulation concerning the implementation of Risk Management for non-bank financial service institutions.
The Company's Risk Management implementation varies greatly according to size, complexity, and the level of risk the Company can tolerate.
The assessment of Risk Management implementation quality is an assessment of 4 (four) interrelated aspects, namely:

a. active supervision by the Board of Directors and Board of Commissioners;

b. adequacy of Risk Management policies and procedures as well as the establishment of Risk limits;

c. adequacy of the Risk identification, measurement, control, and monitoring processes, as well as the Risk Management information system; and

d. a comprehensive internal control system.

Active supervision by the Board of Directors and Board of Commissioners as referred to in item 3 letter a includes evaluation of:

a. the adequacy of active supervision by the Board of Directors and Board of Commissioners; and

b. the adequacy of the exercise of authority and responsibilities of the Board of Directors and Board of Commissioners.

The adequacy of Risk Management policies and procedures as well as the establishment of Risk limits as referred to in item 3 letter b includes evaluation of:

a. the formulation of the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance);

b. Risk Management strategies aligned with the level of Risk to be taken and Risk tolerance;

c. the adequacy of Risk Management policies and procedures; and

d. the adequacy of the establishment of Risk limits.

The adequacy of the Risk identification, measurement, control, and monitoring processes, as well as the Risk Management information system as referred to in item 3 letter c includes evaluation of:

a. the adequacy of the Risk identification, measurement, control, and monitoring processes;

b. the adequacy of the Risk Management information system; and

c. the adequacy of the quantity and quality of human resources in supporting the effectiveness of the Risk Management process.

A comprehensive internal control system as referred to in item 3 letter d includes evaluation of:

a. the adequacy of the internal control system; and

b. the adequacy of review by the Risk Management function or by the internal audit function.

Review by the Risk Management function as referred to in item 7 letter b includes, among others, the methods, assumptions, and variables used to measure and establish Risk limits.
Review by the internal audit function as referred to in item 7 letter b includes, among others, the reliability of the Risk Management framework and the implementation of Risk Management by business and operational functions and/or support functions.
The level of Risk Management implementation quality for each type of Risk is categorized into 5 (five) ranks, namely:

a. rank 1 (strong);

b. rank 2 (relatively strong);

c. rank 3 (adequate);

d. rank 4 (relatively weak); and

e. rank 5 (weak).

The determination of Risk Management implementation quality is conducted for each type of Risk, namely:

a. Strategic Risk;

b. Operational Risk;

c. Legal Risk;

d. Compliance Risk; and

e. Reputational Risk,

using the guidelines as contained in Appendix I, which is an integral part of this Financial Services Authority Circular Letter.

I. Determination of Risk Profile Rank

The determination of the Risk profile rank is conducted in the following stages:

a. determination of the Risk level for each Risk, referring to the provisions as referred to in letters B through H;

b. determination of the composite inherent risk level and the composite Risk Management implementation quality level; and

c. determination of the Risk profile rank based on the results of the Risk level determination as referred to in letter a and the composite inherent risk level and composite Risk Management implementation quality level as referred to in letter b, based on comprehensive and structured analysis, considering the significance of each Risk to the overall Risk profile.

The determination of the Risk level as referred to in item 1 letter a is determined based on the assessment of the inherent risk level and Risk Management implementation quality for each type of Risk.
After the Company determines the inherent risk level and Risk Management implementation quality, the Company determines the Risk level for each type of Risk, namely:

a. Strategic Risk;

b. Operational Risk;

c. Legal Risk;

d. Compliance Risk; and

e. Reputational Risk,

using the guidelines as contained in the Risk Level Determination Matrix in Appendix I, which is an integral part of this Financial Services Authority Circular Letter.

The determination of the composite inherent risk level and the composite Risk Management implementation quality level as referred to in item 1 letter b is conducted by considering the significance of each Risk to the overall Risk profile. For example, Strategic Risk is generally the most dominant Risk in Company activities, thus having higher significance compared to other Risks.
In the event that the Company has subsidiaries, the Company calculates the impact of the subsidiary's Risk on the Company's Risk profile by considering the significance and materiality of the subsidiary and/or the significance of the subsidiary's problems.
In the event that the Company has subsidiaries, the Company ensures that the subsidiary has implemented Risk Management.
The Company determines the composite inherent risk level and the composite Risk Management implementation quality level with

using guidelines as contained in
Appendix I which is an inseparable part
of this Financial Services Authority Circular.
8. The Company sets a Risk Profile Rating
produced from a combination between Inherent Risk and the quality of Risk Management implementation.
9. The Risk Profile Rating is the final conclusion on
the Company's Risk after considering mitigations carried out through Risk Management implementation.
10. Setting the Risk Profile Rating consists of 5 (five)
ratings, namely:
a. rating 1; b. rating 2;
c. rating 3;
d. rating 4; and e. rating 5, with the order of smaller Risk Profile Ratings reflecting lower Risks faced by the Company.
11. Setting the Risk Profile Rating as referred to in
item 10 uses guidelines as contained in
Appendix I which is an inseparable part
of this Financial Services Authority Circular.
IV. RISK MANAGEMENT FOR DEVELOPMENT OR EXPANSION
OF THE COMPANY'S BUSINESS ACTIVITIES

The Company must have written policies and procedures to manage the Inherent Risk
associated with the development or expansion of business activities.
Risk Management policies and procedures for the purpose of
development or expansion of business activities must be consistent with the business plan for Insurance Broker Companies and Reinsurance Broker Companies.
Business activities of the Company categorized as a form of
development or expansion of business activities are business activities that:

a. have never been done before by the Company, such as an Insurance Broker providing brokerage services for insurance products in a new business line previously not offered by the Insurance Broker or a Loss Assessor providing loss assessment services in a new business line not yet conducted; or b. have been implemented previously by the Company, but involve development that changes or increases certain Risk exposures on the Company, such as an Insurance Broker providing brokerage services in a business line already offered previously but involving business process development through the use of information technology.
4. Risk Management strategies, policies, and procedures, or the Company's internal Risk Management guidelines regarding aspects as referred to in Roman numeral II item 6 letters a and b need to be adjusted in case the development or expansion of the Company's business activities has a significant impact on the Company's overall business activities.
V. OTHER PROVISIONS

Companies that already have Risk Management strategies, policies, and
procedures, or internal Risk Management guidelines, but do not yet comply with the standards of Risk Management implementation as referred to in the appendix of this Financial Services Authority Circular, must adjust and perfect their Risk Management strategies, policies, and procedures, or internal Risk Management guidelines by referring to this Financial Services Authority Circular.
Companies may expand and deepen the standards
of guidelines for Risk Management implementation as referred to in the appendix of this Financial Services Authority Circular according to the Company's needs.

This copy matches the original
Director of Legal Affairs 1
Legal Department signed
Mufli Asmawidjaja
VI. CLOSING

At the time this Financial Services Authority Circular takes effect, Financial Services Authority Circular Number
10/SEOJK.05/2016 concerning Guidelines for Implementation of Risk Management and Self-Assessment Report Results of Risk Management Implementation for Non-Bank Financial Service Institutions is repealed and declared invalid.
Provisions in this Financial Services Authority Circular take effect on the date of establishment.
Established in Jakarta on April 12, 2021
EXECUTIVE HEAD OF INSURANCE, PENSION FUND,
LENDING INSTITUTION, AND
OTHER FINANCIAL SERVICE INSTITUTIONS
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA, signed
RISWINANDI

APPENDIX I
FINANCIAL SERVICES AUTHORITY CIRCULAR
REPUBLIC OF INDONESIA
NUMBER 13 /SEOJK.05/2021
CONCERNING
IMPLEMENTATION OF RISK MANAGEMENT FOR
INSURANCE BROKER COMPANIES, REINSURANCE BROKER COMPANIES, AND LOSS ASSESSOR COMPANIES

i
TABLE OF CONTENTS
CHAPTER I IMPLEMENTATION OF RISK MANAGEMENT .........................................................1
1.1 Active Supervision by the Board of Directors and Board of Commissioners ......1
1.2 Adequacy of Risk Management Policies and Procedures, and Determination
of Risk Limits..............................................................................................9
1.3 Adequacy of Risk Identification, Measurement, Control, and
Monitoring Processes as well as Risk Management Information Systems ...............18
1.4 Comprehensive Internal Control System .....................................24
CHAPTER II IMPLEMENTATION OF RISK MANAGEMENT FOR EACH TYPE
OF RISK............................................................................................................30
2.1 Strategic Risk......................................................................................30
2.2 Operational Risk ............................................................................... 377
2.3 Legal Risk........................................................................................51
2.4 Compliance Risk................................................................................. 555
2.5 Reputational Risk.................................................................................... 611
CHAPTER III ASSESSMENT AND DETERMINATION OF RISK PROFILE RATINGS
FOR COMPANIES.................................................................................................70
3.1 Procedure for Assessment and Determination of Company Risk Profile Ratings .70
3.2 Stages and Guidelines for Determining Company Risk Profiles................. 777

ii
LIST OF TABLES
Table III.A.1 Parameters or Indicators for Assessing Inherent Risk for Strategic Risk...................................... 79
Table III.A.2 Guidelines for Determining the Level of Inherent Risk for Strategic Risk..................................................... 83
Table III.A.3 Guidelines for Determining KPMR Level for Strategic Risk ..... 86
Table III.B.1 Parameters or Indicators for Assessing Inherent Risk for Operational Risk.................................. 97
Table III.B.2 Guidelines for Determining the Level of Inherent Risk for Operational Risk................................................ 101
Table III.B.3 Guidelines for Determining KPMR Level for Operational Risk 104
Table III.C.1 Parameters or Indicators for Assessing Inherent Risk for Legal Risk ........................................ 108
Table III.C.2 Guidelines for Determining the Level of Inherent Risk for Legal Risk....................................................... 111
Table III.C.3 Guidelines for Determining KPMR Level for Legal Risk ............. 114
Table III.D.1 Parameters or Indicators for Assessing Inherent Risk for Compliance Risk ......................................... 121
Table III.D.2 Guidelines for Determining the Level of Inherent Risk for Compliance Risk ....................................................... 123
Table III.D.3 Guidelines for Determining KPMR Level for Compliance Risk 125
Table III.E.1 Parameters or Indicators for Assessing Inherent Risk for Reputational Risk ............................................ 132
Table III.E.2 Guidelines for Determining the Level of Inherent Risk for Reputational Risk........................................................... 134
Table III.E.3 Guidelines for Determining KPMR Level for Reputational Risk 138
Table III.F.1 Matrix for Determining Risk Levels................................................. 146
Table III.G.1 Format for Determining Composite Risk Profile Ratings ...................... 147
Table III.G.2 Guidelines for Determining Risk Profile Ratings................................148...

STANDARD GUIDELINES FOR IMPLEMENTING RISK MANAGEMENT FOR INSURANCE BROKER COMPANIES, REINSURANCE BROKER COMPANIES, AND LOSS ASSESSORS
CHAPTER I
GENERAL IMPLEMENTATION OF RISK MANAGEMENT
As regulated in Financial Services Authority Regulation Number 44/POJK.05/2020 concerning Implementation of Risk Management for Nonbank Financial Service Institutions, insurance broker companies, reinsurance broker companies, and loss assessor companies hereinafter referred to as Companies must implement Risk Management, which at least includes the following principles:

active supervision by the Board of Directors and Board of Commissioners;
adequacy of Risk Management policies and procedures and determination
of Risk limits;
adequacy of risk identification, measurement, control, and
monitoring processes, as well as Risk Management information systems; and
a comprehensive internal control system.
The Risk Management principles of each of these pillars are elaborated as follows:
1.1 Active Supervision by the Board of Directors and Board of Commissioners
Board of Directors and Board of Commissioners
The Board of Directors and Board of Commissioners are responsible for the effectiveness of Risk Management implementation in the Company. Therefore, the Board of Directors and Board of Commissioners must at least:
a. understand the Risks faced by the Company and are able to take necessary actions to implement effective Risk Management according to their respective authorities; b. ensure that the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) of the Company have been established clearly and can support the achievement of the Company's objectives;
c. ensure active supervision and risk mitigation;
d. develop a Risk Management culture in the Company;

e. ensure an adequate organizational structure to support effective Risk Management implementation; f. ensure clear assignment of duties and responsibilities in the implementation of Risk Management in each function; and g. ensure the adequacy of quantity and quality of resources to support effective Risk Management implementation.

Active Supervision by the Board of Directors
Authority and responsibility of the Board of Directors in the context of implementing the Company's Risk Management at least include:
a) Formulating written and comprehensive Risk Management policies and strategies. Risk Management policies and strategies serve as a reference framework for the Company in implementing Risk Management integrated with activities and functions within the Company to support the achievement of the Company's objectives. The formulation of Risk Management policies and strategies must involve business and operational functions (risk taking function) and the Risk Management function. b) Responsible for the implementation of Risk Management policies and Risk exposures taken by the Company as a whole, including:
i. effectively communicating Risk Management policies and strategies to all relevant organizational levels so that they are clearly understood and ensuring that Risk Management policies and
strategies can be understood and applied by all levels of the organization;
ii. ensuring that business and operational functions (risk
taking function) have informed the Risk Management function of inherent Risk exposures periodically at least once every 6 (six) months and whenever there are factors affecting the Company's business activities significantly;
iii. evaluating Risk Management implementation and
providing guidance based on reports submitted by the Risk Management function;
iv. ensuring that significant Risk impacts have been followed up. Significant Risk based on reports submitted by the
Risk Management function to the Board of Directors as referred to in item iii. Significant Risk is Risk that has the potential to cause losses that could disrupt Company operations;
v. submitting accountability reports to the Board of Commissioners at least 1 (one) time every 6 (six) months; and
vi. determining the overall Risk exposure taken by the Company, the Board of Directors must know the Risk inherent in the business and operational functions (risk taking function).
Information regarding Risk inherent in the business and operational functions (risk taking function) is obtained based on reports submitted by the Risk Management function as referred to in item ii. Determination of Risk exposure taken must be supported by complete, accurate, current, and holistic data and information related to Risk Management implementation. c) Evaluating and deciding on transactions and Risk limits that require Board of Directors approval, including evaluating proposed transactions received before granting approval. Transactions requiring Board of Directors approval include, among others, transactions that have exceeded the authority of the Company official one level below the Board of Directors, in accordance with internal policies and procedures, including regarding transaction approval mechanisms for each job level. d) Developing a Risk Management culture across all organizational levels, including:
i. developing a Risk Management culture, for example, through effective and adequate communication regarding Risk Management principles, including a risk-aware culture, the active role of each employee, and the importance of effective internal controls.
Development of Risk Management culture can also be done in the form of training for Company employees on Risk Management according to each function within the Company; and
ii. developing a risk-aware culture consisting of adequate awareness and understanding by each Company employee, whether handling business and operational functions (risk taking function) or support functions, regarding potential Risks that may arise from all Company activities or operations. Application of a risk-aware culture aims to enable Company employees to understand their respective roles and responsibilities in implementing Risk Management.
e) Ensuring improvement of human resource competence related to Risk Management, including:
i. ensuring adequate resource support for managing and controlling Risk, including regarding the adequacy of quantity and quality of human resources. Improvement of human resource competence can be realized, for example, through continuous education and training programs on Risk Management implementation; and
ii. ensuring that employees placed in each function within the Company have an understanding of the Risk inherent in each activity or operation of the Company as well as Risk Management policies formulated by the Board of Directors and approved by the Board of Commissioners.
f) Ensuring that the Risk Management function operates independently, manifested through, among others, separation of the Risk Management function from business and operational functions (risk taking function). What is meant by business and operational functions (risk taking function) is the function that carries out business activities or operations of the Company. g) Conducting periodic reviews to ensure:
i. Accuracy of Risk assessment methodologies;
ii. Adequacy of Risk Management information system implementation; and
iii. Appropriateness of Risk Management policies and procedures and determination of Risk limits.
Active Supervision by the Board of Commissioners
Authority and responsibility of the Board of Commissioners in implementing Risk Management at least include:
a) Approving and evaluating Risk Management policies, including:
i. considering whether the established Risk Management framework is consistent with the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) of the Company;
ii. evaluating Risk Management policies periodically at least 1 (one) time every 1 (one) year and whenever there are changes that affect
the Company's business activities significantly.
Evaluation results from the Board of Commissioners become input for the Board of Directors to adjust Risk Management policies if needed. b) Evaluating the Board of Directors' accountability for the implementation of Risk Management policies, including:
i. evaluation of accountability reports on Risk Management implementation submitted by the Board of Directors to the Board of Commissioners every 6
(six) months. Evaluation results from the Board of Commissioners become input for the Board of Directors in improving the quality of Risk Management implementation.
ii. supervising the implementation of Risk Management policies. If necessary, the Board of Commissioners can provide input to the Board of Directors regarding improvements to Risk Management implementation.
c) Evaluating and deciding on requests from the Board of Directors related to transactions that require Board of Commissioners approval. Transactions conducted by the Company are generally the authority and responsibility of the Board of Directors, but it is possible that certain transactions must first obtain Board of Commissioners approval, for example, large-value asset purchase and sale transactions. The Board of Commissioners' approval mechanism can be carried out if the Board of Commissioners indeed has such authority based on the Company's articles of association.

Human Resources (HR)
In carrying out responsibilities for implementing Risk Management related to HR competence enhancement, the Board of Directors must:

a. establish clear HR qualifications for each job level related to Risk Management implementation; b. ensure the adequacy of quantity and quality of existing HR in the Company and ensure that said HR understands their duties and responsibilities, both for business and operational functions (risk taking function), Risk Management function, internal audit function, and support functions responsible for implementing Risk Management;
c. develop employee recruitment, development, and training systems including managerial succession plans and adequate remuneration to ensure the availability of competent personnel in Risk Management;
d. ensure improvement of leadership and employee competence and integrity in business and operational functions (risk taking function), Risk Management function, and internal audit function, considering factors such as knowledge, experience or track record, and adequate capabilities in Risk Management through continuous education and training programs, to guarantee the effectiveness of the Risk Management process; e. placing competent employees in each function according to the nature, volume, and complexity of the Company's business activities; f. ensuring that employees placed in each of these functions have:

understanding of the inherent risk (inherent risk)
in each activity or operation of the Company;
understanding of relevant Risk factors and external factor conditions affecting Company activities or operations, and the ability to estimate the impact of changes in these factors on the Company's business continuity; and
ability to communicate the implications of the Company's Risk exposure to the Board of Directors, Risk Management function, and Risk Management committee in a timely manner;
and

g. ensuring that all HR understand the strategy, level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance), and Risk Management policies established by the Board of Directors and approved by the Board of Commissioners and implement them consistently in the activities or operations handled.
3. Risk Management Organization
In order to implement effective Risk Management, the Company's Board of Directors establishes a Risk Management organizational structure.
The intended organizational structure can be developed according to the characteristics of the business and complexity of the Company's activities.
In formulating the organizational structure, the Company's Board of Directors considers at least the following matters:
a. The organized structure must be accompanied by clarity of duties and responsibilities in general and regarding Risk Management implementation in all functions adjusted to business objectives and policies, size, and complexity of the Company's activities. b. The Company has a Risk Management committee and an independent Risk Management function.
c. The organizational structure must be designed to ensure
that the internal audit function and Risk Management function are independent of business and operational functions (risk taking function) of the Company. d. The organizational structure is designed so that the Risk Management function has direct access and reporting to the Board of Directors and/or Board of Commissioners usually for matters such as the following:

assessment of Risk and Risk exposure position and steps to be taken to manage such Risk;
assessment of changes in the Company's Risk profile;
assessment of established Risk limits;
Risk Management issues related to strategy, e.g., Company strategy, mergers and acquisitions, and investment; and
assessment of Risks that have occurred and identification of appropriate corrective actions for such Risk.
e. The head of the Risk Management function must have the authority and obligation to inform the Board of Commissioners of any event that may materially impact the Company's Risk Management system. f. Adequacy of the delegation of authority framework is adjusted to the Company's characteristics and complexity, the Company's level of Risk to be taken (risk appetite), and the experience and expertise of the respective personnel. Delegated authority must be evaluated periodically to ensure that such authority is consistent with current conditions and the performance level of the concerned employee.
1.2 Adequacy of Risk Management Policies and Procedures and Determination of Risk Limits

Effective Risk Management implementation with a Risk Management framework encompassing Risk Management policies and procedures and clearly determined Risk limits aligned with the Company's vision, mission, and business strategy.
The formulation of Risk Management policies and procedures takes into account, among others, the type, complexity of business activities, Risk profile, level of Risk to be taken (risk appetite), interrelationship between Risks, as well as applicable laws and regulations and healthy insurance business practices.
Implementation of Risk Management policies and procedures must be supported by adequate capital, quality HR, and adequate infrastructure.
Risk Management policies and procedures owned by the Company must be based on Risk Management strategy and equipped with Risk tolerance (risk tolerance) and Risk limits. Determination of Risk tolerance (risk tolerance) and Risk limits is done considering the level of Risk to be taken (risk appetite) and the Company's overall strategy.
Risk Management Policy must explain the relationship between Risk Management and the Company's current objectives, strategies, and conditions.
Matters to be considered in establishing Risk Management policy strategies and procedures, as well as Risk limits, include:

a. Risk Management Strategy

The Company formulates Risk Management strategies in accordance with the overall business strategy, considering the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance).
Risk Management strategies are formulated to ensure that the Company's Risk exposure is managed in a controlled manner in accordance with applicable laws and regulations.
Risk Management strategies are formulated based on the following general principles:

i. Risk Management strategies are long-term oriented to ensure the Company's business continuity, considering economic conditions/cycles;

ii. Risk Management strategies are comprehensive in controlling and managing the Company's Risk; and

iii. Risk Management strategies support the achievement of capital adequacy accompanied by adequate resource allocation.

Risk Management strategies are formulated by considering the following factors:

i. the Company's objectives and strategic plans;

ii. economic and industry developments and their impact on the Company's Risk;

iii. the Company's organization, including the adequacy of human resources and supporting infrastructure;

iv. the Company's financial conditions, including the ability to generate profit; and

v. the Company's ability to manage Risks arising from changes in external and internal factors.

The Board of Directors must elaborate the Risk Management strategy into Risk Management policies and procedures.
The Board of Directors effectively communicates the Risk Management strategy to all employees to ensure clear understanding.
The Board of Directors periodically evaluates the Risk Management strategy, including its impact on the Company's financial performance, to determine whether changes to the Company's Risk Management strategy are necessary.

b. Risk Management Policy

The Company's Risk Management Policy is established to identify and analyze the Risks faced by the Company, to determine appropriate Risk boundaries and controls, and to supervise Risk and compliance with established boundaries.
Risk Management Policy is written guidance for implementing Risk Management and must align with the Company's vision, mission, and strategy.
The formulation of Risk Management Policy must involve the Company's business and operational functions (risk taking function), Risk Management function, and Risk Management committee.
The establishment of Risk Management Policy considers business characteristics, complexity of business activities, Risk profile, level of Risk to be taken (risk appetite), Risk tolerance (risk tolerance), Risk limits, financial conditions, and the Company's organizational structure.
Risk Management Policy is formulated and established by the Board of Directors and approved and evaluated by the Board of Commissioners at least once (1) per year (1) or whenever there are changes that significantly affect the Company's business activities.
Risk Management Policy is adequately documented and communicated to all employees, and is periodically reviewed and updated to accommodate changes in factors affecting the Company's Risk.
Risk Management Policy must include at least:

i. Determination of Risks related to the Company's business activities and services.

Determination of Risks related to the Company's business activities and services is based on the Company's analysis of Risks inherent in the Company's business activities and services, considering business characteristics and the complexity of business activities.

ii. Determination and use of Risk Management measurement methods and information systems.

The Company must establish methods for Risk identification, measurement, control, and monitoring, as well as Risk Management information systems, to accurately assess Risk exposure for each insurance business product and transaction, as well as the Company's business activities.

Included in the Risk Management information system is the information flow to the Company's Board of Directors utilizing information technology and data processing results to support decision-making.

Risk Management information systems must be able to provide complete, accurate, current, and integrated information, including data and information for the assessment of Risk Management implementation, such as consumer data, violation data, deviation (fraud) data, consumer complaint data, and negative news data.

Determination of data to be reported, report formats, and types of information to be included in Risk Management reports must reflect Risk exposure considered in business decision-making, while maintaining the principle of prudence.

iii. Determination of the level of Risk to be taken (risk appetite statement), Risk limits, and Risk tolerance (risk tolerance).

The level of Risk to be taken (risk appetite) is established to support the achievement of the Company's overall objectives, considering internal and external factors that may affect the Company's Risk level.

The Company must establish authority and limit magnitudes in a hierarchical manner, including transaction boundaries requiring Board of Directors approval.

Risk limits are established in accordance with the level of Risk to be taken (risk appetite), Risk tolerance (risk tolerance), and the Company's overall business strategy, considering the Company's capital ability to absorb Risk exposure or losses arising, past loss experience, human resource capabilities, and compliance with applicable laws and regulations.

Limit determination is conducted comprehensively across all aspects related to Risk, establishing the level and type of Risk to be taken to achieve the Company's objectives. The Company must establish Risk tolerance, which is the potential loss that can be absorbed by the Company's capital.

iv. Determination of Risk rating assessment.

Risk rating assessment is the basis for the Company to establish the Company's Risk rating, categorized into 5 (five) Risk ratings, namely:

(1) rating 1 (low);

(2) rating 2 (low-medium);

(3) rating 3 (medium);

(4) rating 4 (medium-high); and

(5) rating 5 (high).

The results of Risk rating assessment can be used by the Company as a basis for determining improvement steps for the Company's business activities and services. The results of Risk rating assessment can also be used by the Company to evaluate the implementation results of Risk Management policies.

v. Formulation of contingency plans in worst-case conditions.

Contingency plans are scenario development plans to anticipate internal disruptions, including system failures, and external disruptions that may cause operational disruptions to the Company.

In formulating contingency plans (contingency plan), the Company must also formulate business continuity plans (business continuity plan) for possible worst-case external and internal conditions, so that the Company's business continuity can be maintained, including disaster recovery plans (disaster recovery plan).

Formulation of business continuity plans (business continuity plan) must meet the following requirements, among others:

(1) involving various related functions;

(2) being flexible to respond to various scenarios of unexpected and specific disruptions, i.e., specific conditions and immediate required actions;

(3) periodic testing and evaluation of business continuity plans;

(4) the Board of Directors periodically tests and updates business continuity plans to ensure the effectiveness of the formulated business continuity plans.

vi. Determination of internal control systems in the implementation of Risk Management.

The determination of internal control systems in the implementation of Risk Management is conducted to ensure the Company's compliance with applicable laws and regulations, the effectiveness of Risk Management culture at all levels of the Company's organization, and the availability of complete, accurate, current, and integrated Risk Management information.

In formulating Risk Management Policy, the Board of Directors must provide clear guidance regarding:

i. The Company's level of Risk to be taken (risk appetite).

The level of Risk to be taken (risk appetite) is the level and type of Risk the Company is willing to take to achieve the Company's objectives. The level of Risk to be taken (risk appetite) is reflected in the Company's business strategies and objectives.

ii. The Company's Risk tolerance (risk tolerance).

Risk tolerance (risk tolerance) is the level and type of Risk set at the maximum by the Company. Risk tolerance (risk tolerance) is an elaboration of the level of Risk to be taken (risk appetite). In establishing Risk tolerance (risk tolerance), the Company needs to consider the Company's business strategies and objectives, as well as the Company's ability to take Risk (risk bearing capacity).

The level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) must be considered in the formulation of Risk Management Policy, including in the determination of limits.

c. Risk Management Procedures

Risk Management procedures are adjusted to the Company's level of Risk to be taken (risk appetite). The level of Risk to be taken (risk appetite) considers the Company's past experience related to the Risk of the Company's business transactions. Risk Management procedures must include at least:

Clear levels of delegation of authority and accountability.

The Company must have a clear organizational structure regarding the implementation of Risk Management. A clear organizational structure formulates the roles and responsibilities of the Board of Directors, Board of Commissioners, Risk Management committee, Risk Management function, business and operational functions (risk taking function), internal audit function, and other supporting functions. The Company must have procedures explaining the authority of each position, including in conditions where there is an exceedance of position authority in the implementation of Risk Management.

Adequate documentation of procedures and determination of Risk limits.

Adequate documentation is written, complete, accurate, current, and integrated documentation so that it facilitates audit trails for the Company's internal control purposes. Documentation of procedures and determination of Risk limits must facilitate the internal audit function in carrying out tasks related to internal control.

d. Determination of Risk limits.

The Company must establish Risk limits in accordance with the level of Risk to be taken (risk appetite), Risk tolerance (risk tolerance), and the Company's business strategy, considering the Company's capital ability to absorb Risk exposure or losses arising, past loss experience, human resource capabilities, and compliance with applicable laws and regulations.
The determination of Risk limits must include at least:

i. clear accountability and hierarchical delegation of authority;

ii. adequate documentation of Risk limit determination to facilitate evaluation implementation and audit trails; and

iii. periodic evaluation of Risk limit determination at least once (1) per year (1) or more frequently, depending on the type of Risk, needs, and Company development.

Risk limit determination is conducted comprehensively across all aspects related to Risk, covering overall Risk limits, limits per Risk type, and limits per Company business activities with Risk exposure.
Risk limits must be understood by all relevant parties and communicated well, including when changes occur.
The magnitude of Risk limits is proposed by the relevant business and operational functions (risk taking function), which is then recommended to the Risk Management function to obtain approval from the Board of Directors or Board of Commissioners through the Risk Management committee.
Risk limits are used as threshold boundaries to determine the level of Risk mitigation intensity to be implemented by the Company.
Any exceedance of Risk limits must obtain approval based on mechanisms and procedures regulated in the Company's internal regulations.
The Risk Management function, through coordination with the relevant business and operational functions (risk taking function), must provide complete, accurate, current, and integrated information that facilitates the Board of Directors in formulating and determining Risk limits.
Risk limit determination includes:

i. Overall limits

Overall limits are the Risk boundaries that can be tolerated by the Company for all Risks applied.

ii. Limits per Risk type

Limits per Risk type are the Risk boundaries that can be tolerated by the Company for each type of Risk.

iii. Limits per specific functional activities with Risk exposure

Limits per specific functional activities are the Risk boundaries that can be tolerated by the Company for each functional activity.

1.3 Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes as well as Risk Management Information Systems

Risk identification, measurement, control, and monitoring are main parts of the Risk Management implementation process, which is continuous. Risk identification is proactive, covering all Company business activities, and is conducted to analyze Risk sources and possible arising impacts. All identified Risks are then measured to determine Risk exposure before Risk controls. Subsequently, the Company implements Risk controls considering the results of Risk measurement. The results of Risk measurement and controls are monitored by the Risk Management function, regarding Risk levels and trends, and analyzing Risk directions.
To support the risk identification, measurement, control, and monitoring processes, the Company needs to develop Risk Management information systems adapted to the Company's business characteristics, activities, and complexity. The system must also contain accurate and informative reporting systems regarding the Company's financial conditions, functional activity performance, and the Company's Risk exposure.
Matters to be considered in the implementation of risk identification, measurement, control, and monitoring processes, as well as Risk Management information systems, include the following:

a. Risk Identification

Risk identification aims to determine all types of Risks inherent in each functional activity that have the potential to harm the Company. Risk identification is based on past experiences related to transactions causing losses, reducing profits, or causing problems for the Company. Risk identification processes must be conducted periodically. Implementation of Risk identification processes is conducted through analysis of all Risk sources, at least conducted against Company activities, and ensuring that Risks from new activities have undergone adequate Risk Management processes before activities are implemented.

b. Risk Measurement

Risk measurement approaches are used to measure the Company's Risk exposure. Risk measurement processes must be conducted periodically regarding Company business activities and services. In implementing Risk measurement, the Company conducts at least:

Evaluation of the suitability of assumptions, data sources, and procedures used to measure Risk.

Evaluation is conducted by independent functions not related to the formulation and/or determination in Risk measurement, in accordance with business development, internal and external Company conditions that can directly affect Company conditions.

In the case where the formulation and/or determination of assumptions, data, and procedures for Risk measurement are conducted by business and operational functions (risk taking function), evaluation is conducted by the Risk Management function. In the case where the formulation and/or determination of assumptions, data, and procedures for Risk measurement are conducted by the Risk Management function, evaluation is conducted by the internal audit function.

Evaluation of the suitability of assumptions, data sources, and procedures used to measure Risk can also be conducted by the Risk Management function through self-evaluation mechanisms.

Adjustment of Risk measurement processes if there are material changes in Company service activities, activities, and Risk factors.

Material changes include changes in activities, Company service activities, organizational structure, information systems, and quantitative and qualitative Risk factors that significantly influence Company conditions.

The results of Risk measurement are the Company's assessment of Risks inherent in the Company's functional activities. The assessment results are part of the assessment of the Company's Risk Management implementation, documented in the Company's Risk profile reports.

c. Risk Control

Risk controls are used by the Company to manage Risks that may endanger the Company's business continuity. Risk controls include capital additions to absorb potential losses. The Company implements Risk controls based on analysis results of Risk identification and measurement. Risk controls are actions taken by the Company to mitigate Risks, conducted by functions related to each respective Risk. The Company must have adequate Risk control systems referring to established policies and strategies. The Company's applied Risk control processes must be in accordance with Risk exposure as well as the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance).

d. Risk Monitoring

In implementing Risk monitoring, the Company conducts at least:

Evaluation of Risk exposure by functions not related to the formulation and/or determination of Risk exposure through monitoring and reporting of significant Risks or those impacting the Company's capital conditions, which among others is conducted using historical data analysis.

In the case where the formulation and/or determination of Risk exposure is conducted by business and operational functions (risk taking function), evaluation of Risk exposure is conducted by the Risk Management function. In the case where the formulation and/or determination of Risk exposure is conducted by the Risk Management function, evaluation of Risk exposure is conducted by the internal audit function, or by the Risk Management function through self-evaluation mechanisms.

Adjustment of reporting processes if there are material changes in Company business activities, Risk factors, information technology, and Risk Management information systems.

The results of Risk monitoring are presented in periodic reports submitted to the Board of Directors for Risk mitigation and decision-making or necessary actions. The Company must prepare a backup system and effective procedures to prevent disruptions in the Risk monitoring process, and periodically check and re-evaluate the backup system.

e. Risk Management Information Systems

Adequate Risk Management information systems are Risk Management information systems capable of providing complete, accurate, current, and integrated data and information for decision-making by the Board of Directors.
Risk Management information systems must be owned and developed according to the Company's needs for effective Risk Management implementation. Risk Management information systems are used to support the implementation of risk identification, measurement, control, and monitoring processes.
Risk Management information systems must ensure:

a) the effectiveness of Risk Management implementation, including Risk Management policies and procedures, and Risk limit determination; and

b) the availability of information on the results or realization of Risk Management implementation compared to targets established by the Company in accordance with Risk Management implementation policies and strategies.

Risk Management information systems must be able to generate data and information needed in accordance with the Company's internal and external condition developments, business characteristics, and complexity of business activities, and can adapt to changes.
Risk Management information systems must include at least reports or information regarding:

a) Risk exposure, i.e., reports or information on Risk exposure covering overall quantitative and/or qualitative Risk exposure, details per Risk type, and per functional activity type.

b) Compliance with Risk Management policies, considering the objectives of establishing Risk Management policies, including supervising Risk and compliance with established Risk boundaries and controls.

c) Compliance with Risk Management procedures and Risk limit determination, including regarding the implementation of delegation of authority and accountability, and the use of Risk limits.

d) Realization of Risk Management implementation compared to established targets, to ensure information on the results or realization of Risk Management implementation compared to targets established by the Company in accordance with Risk Management implementation policies and strategies.

Reports or information generated from Risk Management information systems are submitted periodically by the Risk Management function to the Board of Directors or whenever there are operational changes and/or implementation of new activities. Risk Management information systems must also support reporting to the Financial Services Authority (Otoritas Jasa Keuangan).
The frequency of report submissions to the Board of Directors, and Risk Management committees, must be increased according to needs, especially when market conditions change rapidly.
In developing new information systems and software, the Company must ensure that the implementation of new information systems and technologies will not disrupt the continuity of the Company's information systems.
The Company must account for and update documentation of the system containing hardware, software, databases, parameters, process stages, assumptions used, data sources, and generated outputs so as to facilitate control and the execution of audit trails.

1.4 Comprehensive Internal Control System

The internal control system is a supervision mechanism established by the Company on an ongoing basis. The Company must effectively implement a comprehensive internal control system against the execution of business and operational activities at all levels of the organization. The implementation of a comprehensive internal control system must at least be able to detect weaknesses and deviations that occur in a timely manner. The Company must consider several factors in the implementation of the internal control system, including total assets, types of services, operational complexity, office network, the Risk profile of each business activity, as well as laws and regulations.
Matters that need to be considered in the implementation of the internal control system are as follows:

a. The objectives of a comprehensive internal control system are to ensure:

Compliance with laws and regulations, policies, and internal Company regulations.
This is intended to ensure that all Company business activities have been carried out in accordance with laws and regulations, policies, and internal Company regulations.
The availability of complete, accurate, current, and reliable financial and management information.
This is intended to ensure the availability of information to support the preparation of complete, accurate, current, and reliable reports required for decision-making by the Board of Directors that is appropriate and accountable.
Effectiveness and efficiency in operational activities.
This is intended to increase effectiveness and efficiency in using assets and other resources in order to protect the Company from losses.
The effectiveness of the Risk culture within the Company organization comprehensively.
This is intended to identify weaknesses and assess deviations early and to continuously reassess the reasonableness of existing Risk Management policies and procedures at the Company.

b. A reliable and effective internal control system becomes the responsibility of all parties involved in the Company organization, including:

Board of Commissioners
The Board of Commissioners is responsible for supervising the implementation of the internal control system in general, including the policies of the Board of Directors that establish the internal control.
Board of Directors
The Board of Directors is responsible for the internal control system, including:
a) creating and maintaining an effective internal control system; b) establishing an effective and efficient organizational structure that supports the internal control system; c) ensuring that all functions in the Company are aware of the existence of the internal control system as part of the Company's culture, so that each function can cooperate in supporting the implementation of the internal control system; d) ensuring the execution of the duties and responsibilities of the internal audit function in the implementation of internal control; and e) ensuring the independence and adequate competence of the internal audit function.
Risk Management Function
In carrying out its authority and responsibilities, the Risk Management function participates in the implementation of the internal control system.
Internal Audit Function
The internal audit function must be able to evaluate and play an active role in improving the effectiveness of the internal control system. Evaluation is carried out on an ongoing basis in relation to the Company's operational execution that has the potential to cause losses in achieving objectives set by the Board of Directors and the Board of Commissioners of the Company.
Company Employees
Every Company employee must understand and participate in implementing the established internal control system. Effective internal control will increase the responsibility of Company employees, encourage an adequate Risk culture, and accelerate the identification process of unhealthy insurance practices and organizational problems through an efficient early detection system.
External Parties
External parties of the Company include the Financial Services Authority (OJK), external auditors, and Company consumers who are interested in the implementation of the Company's internal control system.

c. A comprehensive internal control system in the context of Risk Management implementation must at least include:

Alignment of the internal control system with the type and level of Risk inherent in the Company's business activities and service types.
The determination of the internal control system is adjusted to the Company's needs linked to the type and level of Risk inherent in the Company's business activities and service types. The more complex the type and level of Risk of the Company, the more adequate the internal control system required.
Determination of authority and responsibility for monitoring compliance with Risk Management policies.
The implementation of monitoring compliance with Risk Management policies is the authority and responsibility of the Risk Management function.
Determination of authority and responsibility for monitoring compliance with Risk Management procedures and the establishment of Risk limits.
The implementation of monitoring compliance with Risk Management procedures and the establishment of Risk limits is the authority and responsibility of the Risk Management function.
Determination of clear reporting lines and separation of functions.
The determination of clear reporting lines and separation of functions is:
a) reporting lines from business and operational functions (risk taking function) to control functions, namely the Risk Management function and the internal audit function. b) separation of business and operational functions (risk taking function) from control functions, namely the Risk Management function and the internal audit function.
Organizational structure that clearly depicts the Company's business activities.
The Company must have an organizational structure that supports the effective and efficient execution of business activities. The Company's organizational structure must also meet requirements for the execution of the Risk Management function and governance as regulated in the Financial Services Authority Regulation regarding the implementation of Risk Management for non-bank financial service institutions and the Financial Services Authority Regulation regarding insurance company governance.
Accurate and timely financial and operational reporting.
The Company must ensure that financial and operational reporting is supported by complete, accurate, current, and reliable data and information. To support this, the Company must have an adequate Risk Management information system that can facilitate the Board of Directors in decision-making.
Adequacy of procedures to ensure the Company's compliance with laws and regulations.
In order to ensure compliance of all activities and functional activities with laws and regulations, the Company must have procedures created in the form of internal Company regulations. The Company must ensure that its internal procedures are in line with laws and regulations.
Complete and adequate documentation.
The Company must carry out complete and adequate documentation of all matters related to the implementation of Risk Management, including matters related to the supervision of the Board of Directors and Board of Commissioners, Risk Management policies and procedures, establishment of Risk limits, Risk identification, measurement, control, and monitoring processes, Risk Management information systems, and the comprehensive internal control system.
Verification and review of the internal control system.
Verification and review of the internal control system also covers the handling of significant Company weaknesses and the Company's actions to correct deviations that occur.

d. Monitoring must be carried out by the internal audit function regarding improvements based on the results of internal audit findings as well as external audits. Audit findings that have not been followed up must be reported by the internal audit function to the Board of Directors to take necessary steps.

e. The Company must be responsive to weaknesses and/or deviations that occur against internal and external regulations.

CHAPTER II
IMPLEMENTATION OF RISK MANAGEMENT FOR EACH RISK

2.1 Strategic Risk

2.1.1 Definition and General Understanding

Strategic Risk is Risk due to the Company's inaccuracy in making and/or executing a strategic decision and the Company's failure to anticipate changes in the business environment.
Strategic Risk is important because the Company's weakness in managing Strategic Risk can lower the Company's competitive position in the industry and has the potential to trigger the overall failure of the Company's business.
Strategic Risk can originate from, among others:
a. The Company sets a strategy that is less aligned with the Company's vision and mission; b. The Company conducts a strategic environment analysis that is not comprehensive;
c. there is a mismatch of strategic plans (strategic plan) between strategic levels; and
d. failure to anticipate changes in the business environment such as changes in technology, macroeconomic conditions, market competition, and changes in relevant authority policies.
The implementation of Risk Management for Strategic Risk aims to ensure that the Risk Management process can minimize the likelihood of negative impacts from inaccurate strategic decision-making and failure to anticipate changes in the business environment.
In formulating strategies to minimize Strategic Risk, the following must be considered:
a. External factors, including economic conditions, technological developments, competitive conditions or competitors, and consumer preferences. b. Internal factors, including vision, mission, corporate culture, financial conditions, human resources, and Company infrastructure.

Considerations of the Company regarding external and internal factors and alignment with the Company's vision and mission must be formulated into strategies established by the Company in conducting business as set forth in the Company's business plan. In addition, the Company must consider changes in business strategy in the implementation of Risk Management for Strategic Risk, including additional or changes in main business focus and organizational changes related to the expansion of office networks and activities.

2.1.2 Active Supervision by the Board of Directors and Board of Commissioners

In implementing Risk Management through the supervision of the Board of Directors and Board of Commissioners for Strategic Risk, in addition to carrying out supervision as referred to in Chapter I item 1.1, the Company must fulfill the following:

Authority and Responsibility of the Board of Directors and Board of Commissioners
a. The Board of Directors and Board of Commissioners must understand the Strategic Risk inherent in specific Company activities, especially those that can significantly affect the Company's financial condition, and carry out approval and evaluation of policies for the control of Strategic Risk. b. The Board of Directors of Insurance Brokerage Companies and Reinsurance Brokerage Companies must formulate business plans and obtain approval from the Board of Commissioners for the aforementioned business plans by fulfilling the provisions as referred to in the Financial Services Authority Regulation regarding business plans for non-bank financial service institutions and communicate the aforementioned business plans to employees at every level of the organization.
c. The Board of Directors is responsible for ensuring that established strategic objectives are aligned with the vision and mission, corporate culture, business direction, and the Company's Risk tolerance (risk tolerance), providing approval for strategic plans and any changes, and conducting periodic evaluations.
d. The Board of Directors must ensure that the structure, corporate culture, infrastructure, financial conditions, manpower, and managerial competence including executive officials, as well as systems and controls are adequate and appropriate to support the implementation of established strategies. e. The Board of Directors must monitor internal conditions (Company weaknesses and strengths) and the development of external factors/conditions that directly or indirectly affect the Company's established strategies. f. The Board of Directors must establish functions with authority and responsibility that support the formulation and monitoring of strategy execution, including strategic plans and business plans. g. The Board of Directors is responsible for ensuring that Risk Management for Strategic Risk has been implemented effectively and consistently at all relevant organizational levels. In the event that the Board of Directors delegates part of its responsibilities to executive officials or management below them, such delegation does not eliminate the Board of Directors' obligation as the primary party responsible.
Human Resources
Adequacy of Human Resources for Strategic Risk refers to the general scope of implementation as referred to in Chapter I item 1.1 number 2.
Risk Management Organization for Strategic Risk
a. All business and operational functions (risk taking function) as well as support functions are responsible for assisting the Board of Directors in formulating plans and implementing strategies effectively. b. Business and operational functions (risk taking function) as well as support functions are responsible for ensuring at least:

Risk Management practices for Strategic Risk and controls in business functions are consistent with the overall Risk Management framework for Strategic Risk; and
business and operational functions (risk taking function) as well as support functions have policies, procedures, and resources to support the effectiveness of the Risk Management framework for Strategic Risk.
c. The Board of Directors leads change programs required in the implementation of established strategies.
d. The strategic planning function is responsible for assisting the Board of Directors in managing Strategic Risk and facilitating change management in the context of sustainable Company development. e. The Risk Management function is responsible for the Risk Management process for Strategic Risk at least:
coordinating with all business and operational functions (risk taking function) in the strategic plan formulation process;
monitoring and evaluating the development of strategic plan implementation, providing input regarding opportunities and options available for continuous strategy development and improvement; and
ensuring that all strategic issues and their impact on achieving strategic objectives have been followed up in a timely manner.

2.1.3 Adequacy of Risk Management Policies and Procedures and Establishment of Risk Limits

In carrying out Risk Management policies and procedures and the establishment of Risk limits for Strategic Risk, in addition to carrying out Risk Management policies and procedures and the establishment of Risk limits as referred to in Chapter I item 1.2, the Company must add the following implementation:

Risk Management Strategy
a. The Company must evaluate its competitive position in the industry in the context of formulating Risk Management strategy, at least including:

analyzing external factors covering business, economic, and insurance industry environmental conditions in the location where the Company operates, including the impact of environmental changes on the Company's business, products, technology, and office network.
measuring the Company's strengths and weaknesses related to competitive position, the Company's business position in the insurance industry, financial performance, organizational structure and Risk Management function, infrastructure for current and future business needs, managerial capability, and the availability and limitations of Company resources;
analyzing all available strategy alternatives after considering the Company's strategic objectives and Risk tolerance (risk tolerance). The depth and scope of analysis must be aligned with the scale and complexity of the Company's business activities.
b. The Company must establish strategic plans and business plans in writing, and execute these plans.
c. The Company evaluates strategic plans and business plans and makes adjustments in the event of deviations from targets to be achieved due to significant external and internal changes. In the event of a long-term strategy implementation plan, the Company must have adequate managerial succession plans to support the effectiveness of the aforementioned strategy.
d. The Company must have sufficient resources to support the implementation of strategic plans.

Policies and Procedures
a. The Company must have and apply policies and procedures for formulating and approving strategic plans. b. The Company must have adequate procedures to identify and respond to changes in the business environment.
c. The Company must have procedures to measure the progress achieved from the realization of business plans and performance according to the established schedule.
Establishment of Risk Limits
a. Strategic Risk limits in general relate to boundaries of deviation from the established strategic plan, such as budget deviation limits and target completion time deviation limits. b. The establishment of the level of Risk to be taken (risk appetite statement) and Risk tolerance (risk tolerance) for Strategic Risk refers to the general scope of implementation as referred to in Chapter I item 1.2 number 6.d.

Example:
After comparing historical data, economic conditions, and market conditions, Company A establishes the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) for Strategic Risk by establishing parameters including:

Parameter	Risk Appetite	Risk Tolerance
Ratio of realization to business profit target	As per Company business plan	100%	90%

Note: This table is only an example and cannot immediately be used as a basis for determining the level of Risk to be taken (risk appetite) nor Risk tolerance (risk tolerance) for each Company.

2.1.4 Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, as well as Risk Management Information Systems

The risk identification, measurement, control, and monitoring processes, as well as Risk Management information systems for Strategic Risk, the Company must fulfill the provisions as referred to in Chapter I item 1.3 and the following matters:

Identification of Strategic Risk
a. The Company must identify and account for performance changes resulting from the non-realization or ineffective execution of established business strategies or business plans, especially those significant to the Company's capital. b. The Company must conduct Risk analysis, especially regarding strategies that require many resources and/or are high-risk, such as strategies to compete with competitor Companies, offering insurance/reinsurance products mediated by placement/loss assessment or new services, or attracting new consumers/service users.
Measurement of Strategic Risk
a. In the process of measuring Strategic Risk, the Company can use indicators/parameters including at least:

mismatch of business strategy with the Company's vision and mission and business environment conditions;
choice of business strategy level, namely high-risk strategy and low-risk strategy;
the Company's strategic position (strategic position) in the industry; and
achievement of the Company's business realization.
b. The Company can conduct trials on strategy implementation in order to identify any events or changes in the business environment that can have a negative impact on the fulfillment of initial assumptions of the strategic plan and measure the potential negative impact of such events on the Company's business performance, both financially and non-financially.
c. Trial results must provide feedback to the strategy planning process.
d. In the event that trial results show a Risk level higher than the Company's ability to absorb the aforementioned Risk (Risk tolerance), the Company develops a contingency plan or strategy to mitigate the Risk.

Control of Strategic Risk
a. The Company must have systems and controls to monitor Company performance including financial performance by monitoring realization compared to targets to be achieved and ensuring that the level of Risk to be taken (risk appetite) remains within Risk tolerance limits (risk tolerance). b. The aforementioned system is evaluated periodically by the Board of Directors to ensure the continuous alignment of the system.
Monitoring of Strategic Risk
a. The Company monitors Strategic Risk on an ongoing basis by analyzing past loss experiences caused by Strategic Risk or deviations in the execution of strategic plans. b. Strategic issues arising from operational and business environment changes that have a negative impact on business conditions or the Company's financial condition are reported to the Board of Directors in a timely manner accompanied by an analysis of the impact on Strategic Risk and necessary corrective actions.
Strategic Risk Management Information System
a. The Company must ensure that the Risk Management information system owned is adequate in supporting the strategic planning and decision-making process and is evaluated periodically. b. The Risk Management function is responsible for analyzing reports on realization against targets in the business plan and reporting them to the Board of Directors in a timely manner.

2.1.5 Comprehensive Internal Control System

The adequacy of the internal control system in the implementation of Risk Management for Strategic Risk refers to the general scope of implementation as referred to in Chapter I item 1.4.

2.2 Operational Risk

2.2.1 Definition and General Understanding

Operational Risk is Risk due to the inadequacy and/or malfunction of internal processes, human error, system failure, and/or the occurrence of external events that affect the Company's operations.
Operational Risk can cause direct or indirect financial losses and potential losses from the loss of opportunity to obtain profits.
Operational Risk is inherent in every functional activity of the Company, such as operations and services, information technology, Risk Management information systems, and human resource management. Furthermore, Operational Risk is also inherent in business and institutional complexity viewed from the scale of business and organizational structure, the diversity of insurance/reinsurance products mediated/placed or loss assessed, and/or the Company's services, office network, and corporate actions.
Operational Risk is an important Risk because it is related to all business processes and procedures of the Company, is inherent in all business and supporting activities of the Company, and reflects changes in the Company's Risk profile.
The Company's business and operational functions and supporting functions must be part of the implementation of Risk Management for Operational Risk.
Operational Risk in Companies in general is caused by 4 (four) main sources, namely:

a. Human Resource (HR) Weaknesses
HR can be a source of Operational Risk as a result of HR's inability to perform tasks according to their responsibilities. Operational Risk caused by HR is among others caused by:

occupational health and safety issues;
employee turnover;
internal misconduct (fraud);
insufficient number of HR; and
low HR competence.

b. Internal Process Weaknesses
Failures of processes or procedures within the Company become the cause of Operational Risk, among others caused by:

ineffective organizational structure;
inappropriate division of labor;
incomplete documentation;
inaccurate reports;
overlapping functions;
inadequate internal procedures; and
abuse of authority.

c. Inadequate Systems and Infrastructure
Failures in the use of information technology and infrastructure used by the Company can be the cause of Operational Risk, among others caused by:

absence of systems;
programming errors;
inadequate data controls;
service disruptions; and
weak system security.

d. Adverse External Events Impacting the Company External events can be a source of Operational Risk as a result of events outside the Company's direct control which generally have low frequency but high impact. Examples of such external events include:

fire;
natural disasters;
social and political conditions; and
epidemics of diseases spreading on a national scale.

Operational Risk can cause the following impacts:

a. Direct Losses, namely financial losses that directly impact the income statement such as asset depreciation, business activities, asset damage or loss, payment of administrative fines, and payment of compensation to third parties.

b. Indirect Losses, namely losses that are difficult to calculate financially but reduce the effectiveness and efficiency of the Company's business, including loss of income such as work process inefficiency, reporting errors, loss of opportunity to obtain profits, loss of potential consumers, and resignation of potential employees.

The main objective of Risk Management for Operational Risk is to minimize the possibility of negative impacts from the malfunction of internal processes, human error, system failures, including information systems used by the Company, and/or events originating from outside the Company's environment.
Operational Risk is inherent in all supporting activities of the Company, thus touching upon other Risks such as Strategic Risk, Compliance Risk, and Reputational Risk. Weaknesses in HR, internal processes, systems and infrastructure, and external events can cause weaknesses in compliance aspects, compliance violations, and Company reputation issues that can impact Strategic Risk, Compliance Risk, and Reputational Risk.

2.2.2 Active Supervision by the Board of Directors and Board of Commissioners
In implementing Risk Management through the supervision of the Board of Directors and Board of Commissioners for Operational Risk, in addition to implementing supervision as referred to in Chapter I item 1.1, the Company adds the implementation of:

Authority and Responsibilities of the Board of Directors and Board of Commissioners

a. The Board of Directors and Board of Commissioners of the Company understand Operational Risk and actively approve and evaluate Operational Risk policies and strategies periodically.

b. The Board of Directors and Board of Commissioners are responsible for developing an organizational culture aware of Operational Risk and fostering commitment in managing Operational Risk in accordance with the Company's business strategy.

c. The Board of Directors and Board of Commissioners are responsible for ensuring that the implementation of Risk Management for Operational Risk is adequate in accordance with the characteristics of the business, complexity of business activities, and the Company's Risk profile.

d. Operational Risk policies and strategies must consider the impact on capitalization by paying attention to external and internal changes.

e. The Board of Directors must elaborate and communicate Operational Risk Management policies to all functions in the Company and evaluate the implementation of the aforementioned policies.

f. The Board of Directors must identify and manage Operational Risk inherent in new insurance/reinsurance products mediated/placed/loss assessed or new services and ensure that the Risk of such insurance/reinsurance products mediated/placed/loss assessed or new services has gone through adequate Risk control processes, before the product is issued or the service is implemented.

g. The Board of Directors must ensure the placement and enhancement of adequate HR competence and integrity in all functional activities of the Company.

h. The Board of Directors must create a culture of objective disclosure of Operational Risk in all organizational elements so that Operational Risk can be identified quickly and mitigated appropriately.

i. The Board of Directors establishes effective reward policies including remuneration and punishment integrated into the performance appraisal system in order to support optimal Risk Management implementation.

j. The Board of Commissioners ensures that the Company's remuneration policies are in accordance with the Company's Risk Management strategy.

Human Resources (HR)

a. The Company must have an ethical code applied to all employees at every level of the organization.

b. The Company must apply sanctions consistently to employees proven to have committed misconduct and violations.

Risk Management Organization for Operational Risk
Regarding the Risk Management organization for Operational Risk, the management of business and operational functions (risk taking function) and supporting functions are responsible for the daily Operational Risk Management process and report specific Operational Risk issues and Risks in their respective functions according to the reporting level.

2.2.3 Adequacy of Risk Management Policies and Procedures and Risk Limit Determination
In implementing Risk Management policies and procedures and limit determination for Operational Risk, in addition to implementing policies, procedures, and limit determination as referred to in Chapter I item 1.2, the Company needs to add the implementation of several matters in each aspect of policy, procedure, and limit determination, as follows:

Risk Management Strategy
The formulation of Risk Management strategy for Operational Risk refers to the general scope of implementation as referred to in Chapter I item 1.2 number 6.a.
Policies and Procedures

a. The Company must establish Operational Risk Management policies that must be internalized into the Company's business processes and supporting activities.

b. The Company must have procedures that are derivatives of Operational Risk Management policies which can be general controls, such as separation of functions, mandatory leave taking, and specific controls such as document management of insureds and/or service users.

c. The Company must have procedures to measure the exposure of transaction settlement Risk.

d. The Company must formulate a procedure for monitoring the settlement of new transactions or if there are transactions whose payment has not been settled.

e. The Company must provide transaction settlement procedures caused by worsening liquidity conditions of the Company.

f. The Company confirms transactions accurately and on time according to established procedures and monitors such transactions consistently.

g. The Company is expected to have business continuity management (BCM), namely an integrated and comprehensive protocol to ensure the continuity of the Company's operations in conducting business and serving consumers, to anticipate inevitable conditions such as natural disasters, fires, robberies, or technical problems experienced by the Company that affect the continuity of the Company's operational activities. In implementing BCM, the Company has policies that at least include:

business impact analysis;
assessment of Operational Risks that may occur due to disruptions in the Company's operations;
recovery strategies implemented by the Company for each type of disruption that occurs;
documentation (including disaster recovery plans and emergency plans); and
periodic testing of the BCM approach used to ensure it can be operated effectively during disruptions.

h. To mitigate Operational Risk originating from internal process complexity, the Company must have Operational Risk Management policies in accordance with the vision, mission, business strategy, capital adequacy, and HR adequacy at least including:

controls to prevent Operational Risk for both all internal processes and those directly related to consumers;
transaction settlement procedures from internal processes, including to ensure the effectiveness of the transaction settlement process;
accounting execution procedures to ensure accurate accounting records, including among others the suitability of accounting methods used, the accounting processes carried out, and the management of supporting documents;
procedures for the provision of products/services and other activities carried out by the Company; and
procedures for preventing and settling misconduct (fraud).

i. To reduce the possibility of Operational Risk originating from HR, the Company's Risk Management policies must at least contain policies regarding recruitment and placement according to organizational needs, competitive remuneration and incentive structures, training and development, periodic rotation, career planning and succession policies, and handling of employment termination and labor union issues.

j. To reduce the possibility of Operational Risk originating from systems and infrastructure, the Company's Risk Management policies must be supported by access procedures including among others to the Risk Management information system, accounting information system, and Risk management system.

k. For Insurance Brokerage Companies, to reduce the possibility of Operational Risk originating from consumer and potential consumer profiles, the Risk Management policy must contain the Company's obligation to conduct Customer Due Diligence (CDD) or Enhanced Due Diligence (EDD) periodically and consistently in accordance with Operational Risk exposure. The implementation of CDD or EDD refers to all requirements and guidelines as referred to in legislation and Financial Services Authority Regulations regarding the implementation of anti-money laundering and counter-terrorism financing programs. CDD or EDD must be supported by an effective internal control system, specifically the Company's efforts to prevent internal misconduct (internal fraud).

l. The Company ensures that the use of accounting methods must be in accordance with applicable accounting standards and pays attention to the following matters:

conducting periodic reviews to ensure the accuracy of methods used to assess transactions;
conducting periodic reviews of the suitability of accounting methods used with applicable financial accounting standards;
conducting periodic reconciliation of transaction data;
identifying and analyzing any irregularities in transactions that occur; and
maintaining all documents and archives (files) related to account details, general ledgers, and asset classification administration, to facilitate the audit trail process.

Risk Limit Determination

a. The Company must determine Operational Risk limits by considering Risk exposure and past loss experience caused by Operational Risk. Such limit determination must be evaluated and adjusted in the event of significant changes in Operational Risk exposure.

b. The Company must determine Risk limits in accordance with the level of Risk to be taken (risk appetite), Risk tolerance (risk tolerance), and the Company's business strategy by paying attention to the Company's capital ability to absorb Risk exposure or losses arising, past loss experience, HR capability, and compliance with laws and regulations.

c. The determination of the level of Risk to be taken (risk appetite statement) and Risk tolerance (risk tolerance) for Operational Risk refers to the general scope of implementation as referred to in Chapter I item 1.2 number 6.d.

Example:
After comparing historical data, economic and market conditions, Company A determines the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) for Operational Risk by establishing several parameters as follows:

Parameter	Risk Appetite	Risk Tolerance
Human error amount	Maximal impact of 2% on Company finances	Maximal impact of 5% on Company finances
Database system errors	Maximal system error occurrence 1 time	Maximal system error occurrence 2 times

Note: This table is only an example and cannot immediately serve as the basis for determining the level of Risk to be taken (risk appetite) nor Risk tolerance (risk tolerance) for each Company.

2.2.4 Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems
In implementing Risk Management through the processes of Risk identification, measurement, control, and monitoring, as well as Risk Management information systems for Operational Risk, in addition to implementing processes as referred to in Chapter I item 1.3, the Company adds the implementation of:

Operational Risk Identification and Measurement

a. The Company must perform identification and measurement of parameters affecting Operational Risk exposure, including among others the frequency and impact of:

system failures and errors;
information technology system weaknesses;
failure of consumer relationships;
accounting errors;
delays and errors in payment settlement;
misconduct (fraud); and
accounting manipulation.

b. The Company develops a database regarding:

types and impacts of losses caused by Operational Risk based on Risk identification results, consisting of predictable and difficult-to-predict loss data;
violations of control systems; and/or
other operational issues that may cause losses in the future.

c. The Company considers various internal and external factors in performing Operational Risk identification and measurement, including among others:

the Company's organizational structure, Risk culture, HR management, organizational changes, and employee turnover;
the Company's consumer characteristics, products and/or activities, and the complexity of business activities and transaction volume;
the design and implementation of systems and processes used; and/or
the external environment, industry trends, market structure including social and political conditions.

d. Methods that the Company can use to identify and measure Operational Risk, including among others:

self-risk assessment consisting of checklists to identify strengths and weaknesses in the Company's Operational Risk environment, such as the role of the Board of Directors and Board of Commissioners, organizational structure, HR, and information and communication flows within the Company;
risk mapping consisting of mapping according to Risk type against functional activities, organizational structure, and transaction process flows;
key risk indicators consisting of statistics or matrices that provide data on the Company's Operational Risk position, such as the number of transaction cancellations, employee turnover rates, and frequency of errors; and
scorecards that provide methods to translate qualitative assessments/criteria into quantitative matrices, which can be used to allocate capital requirements for each functional activity.

Operational Risk Control

a. The Company performs effective Operational Risk control by at least considering:

Risks that can be accepted;
Risks that must be avoided, including settlement steps; and
steps to mitigate Risk.

b. The Company controls Risk consistently in accordance with the level of Operational Risk to be taken and the results of Operational Risk identification and measurement as determined in Risk Management policies.

c. The Company establishes clear delegation of authority and clarity of control steps for parties responsible for implementing Operational Risk Management in all Company functions.

d. The Company can develop programs to mitigate Operational Risk, including among others information technology process security. In the event the Company develops information technology process security, the Company ensures the level of electronic data processing security.

e. Controls on information systems must ensure:

periodic assessment of information system security, accompanied by corrective actions if necessary;
backup procedures and contingency plans to ensure the Company's operational activities continue and prevent significant disruptions, and are tested periodically;
submission of information to the Board of Directors regarding items 1) and 2); and
storage of information and documents related to analysis, programming, and data processing execution.

f. The Company has support systems, at least including:

early error identification;
efficient, accurate, and timely processing and settlement of all transactions; and
confidentiality, truthfulness, and transaction security.

g. In the implementation of Operational Risk control, the Company can develop programs to mitigate Operational Risk, including among others information technology process security, insurance, and outsourcing of part of the Company's operational activities.

Operational Risk Monitoring

a. The Company performs continuous monitoring of Operational Risk against all Operational Risk exposures and losses that can be caused by main functional activities, among others by implementing internal control systems and providing periodic reports on losses caused by Operational Risk.

b. The Company periodically evaluates the causes of Operational Risk and its loss impacts.

c. The Company has a reliable monitoring mechanism for Operational Risk and operational losses that is capable of generating informative and up-to-date Operational Risk profiles for the Board of Directors in order to determine necessary control steps.

d. The Risk Management function must compile reports on losses from Operational Risk and submit such reports to the Board of Directors and the Risk Management Committee.

Risk Management Information Systems

a. The Company has adequate information systems and technology in accordance with the nature and volume of transactions.

b. Risk Management information systems must be able to generate complete and accurate reports used for Risk monitoring in order to detect and correct deviations in a timely manner to reduce the potential for losses.

c. The Company has a reporting mechanism for Operational Risk that must be able to provide information according to user needs, including among others:

Operational Risk profiles and losses caused by Operational Risk;
results from various Operational Risk measurement methods and trends, and/or summaries of internal audit findings;
status and effectiveness reports on the implementation of action plans for Operational Risk issues;
procedure deviation reports;
misconduct (fraud) reports; and
recommendations from the Operational Risk Management function, external auditor guidance letters, specifically regarding the Company's operational control aspects, and Financial Services Authority guidance letters.

d. Risk Management information systems must be able to provide complete, accurate, current, and comprehensive Operational Risk exposure reports so that decision-making by the Board of Directors can be done in a timely manner.

Risk Management information systems must be able to provide storage of information and documents related to analysis, programming, and data processing execution.

2.2.5 Comprehensive Internal Control Systems

In implementing Risk Management through the implementation of internal control systems for Operational Risk, in addition to implementing internal controls as referred to in Chapter I item 1.4, the Company needs to have a routine rotation system to avoid the potential for self-dealing, collusion, or concealment of unwarranted documentation or transactions.
The Company must conduct periodic evaluations of procedures, documentation, data processing systems, and emergency plans.

(contingency plan), and other operational practices to reduce the likelihood of human error causing Operational Risk.

2.3 Legal Risk

2.3.1 Definition and General Understanding

Legal Risk is Risk arising from legal demands and/or weaknesses in legal aspects.
Legal Risk may originate from, among others:
a. the absence and/or changes in supporting legislation; b. weaknesses in agreements, such as the failure to meet the validity requirements of a contract, causing a transaction already conducted by the Company to be inconsistent with regulations; and/or
c. litigation processes arising from lawsuits by third parties against the Company or by the Company against third parties.
The implementation of Risk Management for Legal Risk aims to ensure that the Risk Management process can minimize the possibility of negative impacts from weaknesses in legal aspects, the absence and/or changes in legislation, and litigation processes.

2.3.2 Active Supervision by the Board of Directors and Board of Commissioners

In implementing Risk Management through the supervision of the Board of Directors and Board of Commissioners for Legal Risk, in addition to implementing supervision as referred to in Chapter I item 1.1, the Company needs to add the implementation of:

Authority and Responsibility of the Board of Directors and Board of Commissioners
a. The Board of Directors must establish effective communication mechanisms, including involving Company employees, regarding legal issues faced with the legal function, so that Legal Risk can be prevented and controlled immediately. b. The Board of Directors and Board of Commissioners must implement legal governance, namely a management system to form, execute, and interpret regulations and internal provisions, including the contract standards used.
c. The Board of Directors must ensure legal consistency in all its business activities, namely the harmony between the business activities or operations conducted and the regulations, and not causing ambiguity in agreements made by the Company.
d. The Board of Directors must ensure legal completeness, so that all matters regulated by provisions, both national and international, can be well implemented by the Company, including prohibitions in the provisions, clearly regulated in the Company's internal provisions.
Human Resources
The Company must consistently apply sanctions to Company employees proven to have deviated from and violated external and internal regulations and the Company's internal code of ethics.
Risk Management Organization for Legal Risk
a. The Company must have a function acting as a legal watch that provides analysis or legal advice to all employees at every level of the organization. This also needs to be supported by Human Resources with knowledge in the legal field related to insurance. b. The Company must have an independent function that assesses and monitors the continuous implementation of Risk Management for Legal Risk. Generally, this is done by the Risk Management function or a function conducting legal business that reports directly to the Company's President Director. Furthermore, this function is also responsible for developing and evaluating strategies, policies, and procedures for Risk Management for Legal Risk and providing input to the Board of Directors and Board of Commissioners. The involvement of the function conducting legal business is also very important in every business activity of the Company exposed to Legal Risk, including, among others, when the Company will conduct activities and/or introduce new products.
c. The function conducting legal business, the Risk Management function, and the business and operational functions (risk-taking unit) must jointly assess the impact of changes in certain regulations on Legal Risk exposure.

2.3.3 Adequacy of Risk Management Policies and Procedures and Determination of Risk Limits

In implementing Risk Management policies and procedures and determining Risk limits for Legal Risk, in addition to implementing Risk Management policies and procedures and determining Risk limits as referred to in Chapter I item 1.2, the Company needs to add the implementation of:

Risk Management Strategy
The Risk Management Strategy for Legal Risk is an inseparable part of the Company's overall Risk Management strategy as referred to in Chapter I item 1.2 number 6.a.
Policies and Procedures
a. The Company must have and implement procedures for analyzing legal aspects of the Company's new products and/or activities. b. The Company must conduct periodic evaluations and updates of Legal Risk control policies and procedures, in accordance with external and internal Company developments, such as regulatory changes.
Determination of Risk Limits
The determination of the level of Risk to be taken and Risk tolerance (risk tolerance) for Legal Risk refers to the general scope of implementation as referred to in Chapter I item 1.2 number 6.d.

Example:
After comparing historical data, economic conditions, and markets, Company A determines the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) for Legal Risk by setting parameters including:

Parameter	Risk Appetite	Risk Tolerance
Number of unenforceable agreements	Maximum 4 cases per year	Maximum 5 cases per year

Note: This table is only an example and therefore cannot immediately be used as a basis for determining the level of Risk to be taken (risk appetite) nor Risk tolerance (risk tolerance) for each Company.

2.3.4 Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, as well as Risk Management Information Systems

In implementing Risk Management through the processes of identification, measurement, control, and monitoring of Risk, as well as Risk Management information systems for Legal Risk, in addition to implementing processes as referred to in Chapter I item 1.3, the Company adds the implementation of:

Legal Risk Identification
The implementation of identification for Legal Risk refers to the general scope of implementation as referred to in Chapter 1 item 1.3 number 3.a.
Legal Risk Measurement
a. The Company must have adequate Risk measurement methods for Legal Risk that are integrated with the Company's Risk Management framework, using either quantitative or qualitative approaches. b. In measuring Legal Risk, the Company may use indicators or parameters including at least:
1. the absence or changes in legislation;
2. weaknesses in agreements or cooperation; and
3. dispute resolution processes.
Legal Risk Control
The function conducting legal business must periodically review contracts and agreements between the Company and other parties, among others, by re-evaluating the effectiveness of the enforceability process to check the validity of rights in such contracts and agreements.
Legal Risk Monitoring
The implementation of monitoring for Legal Risk refers to the general scope of implementation as referred to in Chapter I item 1.3 number 3.d.
Strategic Risk Management Information System
The Company must record and account for every incident, including litigation processes related to Legal Risk, along with the amount of potential losses caused by such incidents, in a data administration system. The collection and accounting of this data are compiled into a statistical data set that can be used to project potential losses of the Company's business activities for a certain period.

2.3.5 Comprehensive Internal Control System

The implementation of the internal control system for Legal Risk refers to the general scope of implementation as referred to in Chapter I item 1.4.

2.4 Compliance Risk

2.4.1 Definition and General Understanding

Compliance Risk is Risk due to the Company not complying with and/or not implementing legislation and regulations.
Compliance Risk can originate from legal aspects, namely the Company's behavior or activities that deviate from or violate legislation or regulations or contradict generally applicable standards.
The main objective of Risk Management for Compliance Risk is to ensure that the Risk Management process can minimize the possibility of negative impacts from the Company's behavior that deviates from or violates generally applicable standards and/or legislation.
Sources of Compliance Risk include, among others:
a. Legal Behavior
The Company as a legal subject can engage in legal behavior consisting of errors that can be interpreted broadly, including three elements: intent, negligence, and accountability. Legal behavior conducted by the Company can include violations of public law, among others, regarding regulations, including regulations of the Financial Services Authority (OJK), or private law, such as agreements with third parties. b. Organizational Behavior The Board of Directors as the representative of the organization must establish ways to achieve organizational objectives implemented in the form of organizational behavior. In this case, the Board of Directors has the authority to influence the Company's organizational performance. There are several factors influencing the Board of Directors' decisions in conducting business related to Compliance Risk, including business profile factors, economic factors, psychological factors, and sociological factors. The impact of Compliance Risk can be direct losses and indirect losses. Direct losses are financial losses that directly impact profit or loss, such as decreased profits and business losses, and decreased asset values. Indirect losses are losses that are difficult to calculate financially and do not directly impact profit or loss, such as work process inefficiencies, and loss of opportunities to obtain profits.

2.4.2 Active Supervision by the Board of Directors and Board of Commissioners

In implementing Risk Management through the supervision of the Board of Directors and Board of Commissioners for Compliance Risk, in addition to implementing supervision as referred to in Chapter I item 1.1, the Company adds the implementation, namely:

Authority and Responsibility of the Board of Directors and Board of Commissioners
a. The Board of Directors and Board of Commissioners must ensure that Risk Management for Compliance Risk is implemented integrated with other Risk Managements that can impact the Company's Compliance Risk profile. b. The Board of Directors has the authority and responsibility to:
1. Ensure that Risk Management is implemented integrated with other Risk Managements existing in the Company's Compliance Risk profile, such as compliance with regulations regarding the Company's experts related to Operational Risk.
2. Ensure that every compliance issue that arises can be resolved effectively by the relevant function and that monitoring is conducted on the corrective actions taken.
3. Ensure that the Risk Management function for Compliance Risk has been implemented independently, reflected, among others, by the separation of functions between the function conducting the identification, measurement, control, and monitoring of Compliance Risk and the function conducting and completing transactions with Compliance Risk exposure.
  c. The Director overseeing the compliance function plays an important role in Risk Management for Compliance Risk with responsibilities including, among others:
4. formulating strategies to encourage the creation of a compliance culture;
5. proposing compliance policies or compliance principles to be established by the Board of Directors;
6. establishing compliance systems and procedures to be used to formulate the Company's internal regulations and guidelines;
7. ensuring that all policies, regulations, systems, and procedures, as well as business activities conducted by the Company, are in accordance with legislation;
8. minimizing the Company's Compliance Risk;
9. taking preventive actions so that policies and/or decisions taken by the Company's Board of Directors do not deviate from legislation; and
10. performing other tasks related to the compliance function.
Human Resources
The compliance function is not allowed to be placed in a position vulnerable to conflicts of interest in executing the compliance function's responsibilities.
Risk Management Organization for Compliance Risk
a. The Company must have an adequate Risk Management function for Compliance Risk with clear authority and responsibilities. b. The Company must have a compliance function as referred to in the Financial Services Authority Regulation regarding good corporate governance for insurance companies. This compliance function has tasks, authorities, and responsibilities, including, among others:
1. making steps to support the creation of a compliance culture in all business activities of the Company at every level of the organization;
2. having written work programs and conducting identification, measurement, control, and monitoring related to Risk Management for Compliance Risk;
3. assessing and evaluating the effectiveness, adequacy, and suitability of the policies, systems, and procedures owned by the Company with legislation;
4. recommending updates and improvements to the Company's policies, regulations, systems, and procedures to be in accordance with legislation;
5. making efforts to ensure that the Company's policies, regulations, systems, and procedures, as well as business activities, are in accordance with legislation; and
6. performing other tasks related to the compliance function.

2.4.3 Adequacy of Risk Management Policies and Procedures and Determination of Risk Limits

In implementing Risk Management policies and procedures and determining Risk limits for Compliance Risk, in addition to implementing Risk Management policies and procedures and determining Risk limits as referred to in Chapter I item 1.2, the Company adds the implementation, namely:

Risk Management Strategy
The formulation of strategies for Compliance Risk refers to the general scope of implementation as referred to in Chapter I item 1.2 number 6.a.
Policies and Procedures
a. The Company has adequate compliance work plans. b. The Company ensures the effectiveness of implementing Risk Management for Compliance Risk, especially in the formulation of policies and procedures to be in accordance with generally applicable standards and/or legislation.
Determination of Risk Limits
a. The determination of Risk limits for Compliance Risk refers to the general scope of implementation as referred to in Chapter I item 1.2 number 6.d. b. The Company must comply with legislation. This requires the Company to have no tolerance for Compliance Risk and to take quick and precise steps in handling Compliance Risk.

2.4.4 Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, as well as Risk Management Information Systems

Compliance Risk Identification
The Company must conduct identification and analysis of several factors that can increase Compliance Risk exposure and quantitatively impact the Company's profit or loss and capital, such as:
a. the Company's business activities, namely the type and complexity of the Company's business activities, including products and/or new activities; b. the Company's non-compliance, namely the number and materiality of the Company's non-compliance with internal policies and procedures, legislation, practices, and healthy business ethics standards; and
c. litigation, namely the number and materiality of litigation demands.
Compliance Risk Measurement
In measuring Compliance Risk, indicators or parameters may be used including at least:
a. the type and significance of violations committed; b. the frequency of violations (including sanctions) committed or the Company's track record of non-compliance;
c. violations of legislation, regulations applicable to the Company, or generally applicable business standards; and
d. follow-up on violations, including fulfillment of action plans submitted to the Financial Services Authority.
Compliance Risk Control
The Company must ensure the effectiveness of the control system, namely:
a. there is monitoring of deviating decision-making capable of identifying and measuring the increase in the frequency and number of Risk exposures; b. the Company's responsiveness to deviations from the Company's internal policies and procedures; and
c. the Company's responsiveness to deviations in the Company's internal control system.
Compliance Risk Monitoring
a. In executing the Risk Management function for Compliance Risk, continuous monitoring of Compliance Risk occurring across all Compliance Risk exposures must be conducted. b. The Risk Management function prepares periodic progress reports on Compliance Risk, including factors causing Compliance Risk, submitted to the Director overseeing the Risk Management function and the Risk Management Committee.
Risk Management Information System
The implementation of the Risk Management information system for Compliance Risk refers to the general scope of implementation as referred to in Chapter I item 1.3 number 3.e.

2.4.5 Comprehensive Internal Control System

In implementing Risk Management for Compliance Risk, in addition to implementing internal controls as referred to in Chapter I item 1.4, the Company must have an internal control system for Compliance Risk, among others, to ensure the Company's responsiveness to deviations from generally applicable standards and/or legislation.

2.5 Reputational Risk

2.5.1 Definition and General Understanding

Reputational Risk is Risk due to the decline in the level of trust of stakeholders (stakeholders) stemming from negative perceptions of the Company.
The main objective of implementing Risk Management for Reputational Risk is to anticipate and minimize the loss impact of the Company's Reputational Risk.
Reputational Risk is not a standalone Risk, but rather a second-tier risk (second tier risk), namely Risk that occurs because it is triggered by other Risks such as Operational Risk. Thus, in assessing Reputational Risk, the interrelationship between Reputational Risk and other Risks must be understood.
For example, weaknesses in the Company's information technology causing consumer transaction failures are Operational Risks that can cause Reputational Risk in the form of negative media coverage of the Company's services. However, in certain cases, Reputational Risk can also occur without being preceded by other Risks, such as negative media coverage due to misunderstandings with consumers or information manipulation by business competitors.
Reputational Risk can originate from various business activities of the Company at least as follows:
a. the reputational influence of management, owners, and the Company's group; b. violations of business ethics;
c. the complexity of insurance/reinsurance products intermediated in placement or assessed for losses and business cooperation;
d. the frequency, materiality, and exposure of negative reporting; and e. the frequency and materiality of consumer complaints.
The Company's Reputational Risk can also be caused by the influence of reputational events involving members of the Board of Directors, members of the Board of Commissioners, shareholders, and/or parties associated with the Company. The Company must also pay attention to the frequency and significance of consumer complaints. Furthermore, business partners can also play a role in increasing the Company's Reputational Risk. Cooperation conducted by the Company with business partners experiencing reputational disturbances can impact the Company's operational activities, especially if the business partners in question support the Company's operational activities, such as information technology service providers continuously operating the core applications of the Company's business.
The Company must implement Risk Management for Reputational Risk appropriate to the scale and complexity of the business. Risk Management for Reputational Risk not only mitigates the downside aspects of the Company's reputation but is also part of the Company's overall efforts to build the Company's reputation to increase competitiveness.
Reputation is heavily influenced by several factors in the Company's business, including:
a. managerial and leadership aspects and the implementation of governance; b. other Risks, so the Company needs to pay attention to the level and exposure of the Company to Risks other than Reputational Risk, especially Operational Risk; and
c. the development of stakeholder needs and the business environment.
By considering the interrelationship between Risks, building reputation, and improving issues related to the Company's reputation, the Company is permitted to make improvements in other aspects that can increase the Company's reputation.

2.5.2 Active Supervision by the Board of Directors and Board of Commissioners

In implementing Risk Management through the supervision of the Board of Directors and Board of Commissioners for Reputational Risk, in addition to implementing supervision as referred to in Chapter I item 1.1, the Company adds the implementation:

Authority and Responsibility of the Board of Directors and Board of Commissioners
a. The Board of Directors and Board of Commissioners must pay attention to the implementation of Risk Management for Reputational Risk by relevant functions, including public relations (PR) and other relevant business functions. b. The Board of Directors and Board of Commissioners must understand the Reputational Risk inherent in certain Company activities, especially those that can significantly affect financial conditions, and implement approval and evaluation of policies for controlling Reputational Risk.
c. The Board of Directors and Board of Commissioners must behave professionally and maintain business ethics so that they can serve as examples for all elements of the Company's organization in efforts to build and maintain reputation.
d. The Board of Directors must ensure the Company has policies to calculate the impact of Reputational Risk on the Company's capital.

e. The Board of Directors must ensure the Company has a function with the authority and responsibility to provide comprehensive information to consumers and other Company stakeholders regarding the Company's business activities in order to control Reputational Risk.

Human Resources
The adequacy of Human Resources for Reputational Risk refers to the general scope of implementation as referred to in Chapter I item 1.1 number 2.
Risk Management Organization for Reputational Risk
a. Regarding the Risk Management Organization for Reputational Risk, all employees, including business and operational function management (risk-taking function) and the Company's support functions, must be part of the Risk Management Organization for Reputational Risk structure, given that reputation is the result of all the Company's business activities. The role of business function management is to identify Reputational Risks occurring in the business or activities of that function and to act as front-liners in building and preventing Reputational Risk, particularly regarding relationships with consumers. b. The Risk Management Function for Reputational Risk is, among others, responsible for:

carrying out public relations functions and following up on negative news or other events that affect the Company's reputation and may cause losses to the Company; and
communicating information needed by Company stakeholders, including investors, consumers, associations, and the public.

2.5.3 Adequacy of Risk Management Policies and Procedures and Risk Limit Setting
In implementing Risk Management policies and procedures and setting Risk limits for Reputational Risk, in addition to implementing the Risk Management policies and procedures and risk setting as referred to in Chapter I item 1.2, the Company adds the implementation of:

Risk Management Strategy
The formulation of Risk Management Strategy for Reputational Risk refers to the general scope of implementation as referred to in Chapter I item 1.2 number 6.a.
Policies and Procedures
a. The Company must have written policies and procedures that meet the principles of transparency and improvement of consumer and other stakeholder service quality in order to control Reputational Risk. These policies must align with regulations concerning consumer protection. b. The Company must have and implement appropriate communication policies to handle negative news or publications or prevent information that tends to be counterproductive, for example by applying effective media usage strategies to respond to negative news.
c. The Company needs to have special protocols for reputation management during crises so that it can quickly anticipate increases in Reputational Risk.
d. The Company must implement procedures to control Reputational Risk related to Reputational Risk experiences that materially affect the Company's financial condition.
Risk Limit Setting
a. Reputational Risk limits in general are not limits that can be quantified financially. Examples include: the time limit for following up on consumer complaints and the waiting time limit in queues to receive services. The aforementioned examples relate to risk mitigation in handling consumer complaints and mitigating Reputational Risk due to consumer complaints. b. The setting of the level of Risk to be taken (risk appetite statement) and Risk tolerance (risk tolerance) for Reputational Risk refers to the general scope of implementation as referred to in Chapter I item 1.2 number 6.d

Example:
After comparing historical data, economic conditions, and market conditions, Company A sets the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) for Reputational Risk by setting several parameters as follows:

Parameter	Risk Appetite	Risk Tolerance
Number of consumer complaints in 1 (one) year	10	15
Number of negative news reports about the Company in 1 (one) year	1 news report in mass media	3 news reports in mass media

Note: This table is only an example and cannot immediately be used as a basis for determining the level of Risk to be taken (risk appetite) nor Risk tolerance (risk tolerance) for each Company.

3.1.1 Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems
In implementing Risk Management through the processes of risk identification, measurement, control, and monitoring, as well as Risk Management information systems for Reputational Risk, in addition to implementing the processes as referred to in Chapter I item 1.3, the Company must add the implementation of:

Identification and Measurement of Reputational Risk
a. The Company must identify Reputational Risks inherent in specific functional activities such as operations and services, information technology, and Human Resources. b. The Company records and accounts for every event related to Reputational Risk, including the amount of potential losses caused by the said event, in a data administration system. The recording and accounting of this data are compiled into a statistical data set that can be used to project potential losses in a certain period and specific functional activities.
c. The Company can use several information sources to identify and measure the impact of Reputational Risk, including mass media news, the Company's website and social network analysis results, consumer complaints through customer service, and consumer satisfaction questionnaires.
Reputational Risk Control
a. The Company must immediately follow up on and resolve consumer complaints and lawsuits that can increase Reputational Risk exposure. b. The Company must develop reliable mechanisms to carry out effective Reputational Risk control measures. Generally, Reputational Risk control can be done through 2 (two) things:

Prevention of events causing Reputational Risk, which is generally done through a series of activities as follows:
a) social and environmental responsibility (corporate social responsibility), which is a series of activities carried out by the Company for community empowerment in the form of economic or social activities expected to build a positive reputation among stakeholders towards the Company; and b) routine communication or education to stakeholders in order to form a positive reputation among stakeholders.
Recovery of the Company's reputation after an event causing Reputational Risk occurs, which is all follow-up actions by the Company to restore reputation and prevent a decline in the Company's reputation.
c. Mitigation of Reputational Risk or events causing Reputational Risk is done by considering the materiality of the problem and costs. Nevertheless, Reputational Risk can be accepted as long as it is in accordance with the level of Risk to be taken (risk appetite).
d. In order to control greater Reputational Risk in the future, the preventive and restorative actions for Reputational Risk that have been carried out need to be followed by improvements to control weaknesses and procedures that trigger Reputational Risk.

Reputational Risk Monitoring
The Company monitors Reputational Risk continuously in accordance with past loss experiences caused by Reputational Risk. The implementation of monitoring for Reputational Risk refers to the general scope of implementation as referred to in Chapter I item 1.3 number 3.d.
Risk Management Information System
a. The Company must have regular procedures and mechanisms for reporting Reputational Risk or events causing Reputational Risk, both in written form and in electronic system form, including discussions in the Board of Directors and/or Board of Commissioners meetings of the Company. b. The Company must have an early warning system mechanism to provide signals to the Board of Directors and/or Board of Commissioners so that they can carry out necessary follow-up and mitigation.

3.1.2 Comprehensive Internal Control System

The Company must resolve consumer complaints and lawsuits that can increase Reputational Risk exposure, for example by communicating continuously with opposing parties and conducting bilateral negotiations with consumers to avoid litigation and legal claims.
The Company can cooperate with third parties, such as the use of outsourcing, in order to control Reputational Risk by considering the costs and benefits of using outsourcing.
The implementation of the internal control system for Reputational Risk refers to the general scope of implementation as referred to in Chapter I item 1.4.

CHAPTER III
ASSESSMENT AND DETERMINATION OF COMPANY RISK PROFILE RANKING

3.1 Procedures for Assessment and Determination of Risk Profile Ranking
3.1.1 General
Risk profile assessment is an assessment of the inherent risk and the quality of Risk Management implementation in the Company's operational activities. Risk profile assessment is carried out for each type of Risk, namely Strategic Risk, Operational Risk, Legal Risk, Compliance Risk, and Reputational Risk.

3.1.2 Assessment and Determination of Inherent Risk Level
Inherent risk assessment is an assessment of risks inherent in the Company's business activities, both quantifiable and non-quantifiable, which have the potential to affect the Company's financial position. The characteristics of the Company's inherent risk are determined by internal and external factors, including business strategy, business characteristics, complexity of the Company's business activities, insurance industry conditions, and macroeconomic conditions.

Assessment of inherent risk is done by considering quantitative and qualitative parameters or indicators. The determination of the inherent risk level is individual, meaning it is not influenced by the quality of Risk Management implementation or Risk mitigation carried out by the Company. The inherent risk level is categorized into rank 1 (low), rank 2 (low-medium), rank 3 (medium), rank 4 (medium-high), and rank 5 (high).

Strategic Risk
Strategic Risk is the Risk resulting from the Company's inaccuracy in making and/or implementing a strategic decision and the Company's failure to anticipate changes in the business environment. Strategic Risk can originate from weaknesses and/or inaccuracies in the strategy formulation and development process, inadequate management information systems, inadequate or non-comprehensive internal and external environment analysis results, and failure to anticipate changes in the business environment, such as unstable political conditions, market competition, and the spread of epidemics on a national scale. a. The assessment of inherent risk for Strategic Risk refers to the parameters or indicators for assessing inherent risk as referred to in Table III.A.1: Parameters or Indicators for Assessing Inherent Risk for Strategic Risk. b. The Company sets the inherent risk level for Strategic Risk in 5 (five) ranks, namely rank 1 (low), rank 2 (low-medium), rank 3 (medium), rank 4 (medium-high), and rank 5 (high). The determination of the inherent risk level for Strategic Risk refers to the guidelines for determining the inherent risk level as referred to in Table III.A.2: Guidelines for Determining Inherent Risk Level for Strategic Risk.
Operational Risk
a. Operational Risk is the Risk resulting from the inadequacy and/or malfunction of internal processes, human error, system failure, and/or external events affecting the Company's operations. Sources of Operational Risk can be caused, among others, by human resources, internal processes, systems and infrastructure, and external events. b. The assessment of inherent risk for Operational Risk refers to the parameters or indicators for assessing inherent risk as referred to in Table III.B.1: Parameters or Indicators for Assessing Inherent Risk for Operational Risk.
c. The Company sets the inherent risk level for Operational Risk in 5 (five) ranks, namely rank 1 (low), rank 2 (low-medium), rank 3 (medium), rank 4 (medium-high), and rank 5 (high). The determination of the inherent risk level for Operational Risk refers to the guidelines for determining the inherent risk level as referred to in Table III.B.2: Guidelines for Determining Inherent Risk Level for Operational Risk.
Legal Risk
a. Legal Risk is the Risk arising from legal claims and/or weaknesses in legal aspects. Sources of Legal Risk can be caused, among others, by the absence and/or changes in regulations or weaknesses in agreements, such as the failure to meet the validity requirements of a contract, causing a transaction already carried out by the Company to be inconsistent with regulations, and litigation processes arising from third-party lawsuits against the Company or the Company against third parties. b. The assessment of inherent risk for Legal Risk refers to the parameters or indicators for assessing inherent risk as referred to in Table III.C.1: Parameters or Indicators for Assessing Inherent Risk for Legal Risk.
c. The Company sets the inherent risk level for Legal Risk in 5 (five) ranks, namely rank 1 (low), rank 2 (low-medium), rank 3 (medium), rank 4 (medium-high), and rank 5 (high). The determination of the inherent risk level for Legal Risk refers to the guidelines for determining the inherent risk level as referred to in Table III.C.2: Guidelines for Determining Inherent Risk Level for Legal Risk.
Compliance Risk
a. Compliance Risk is the Risk resulting from the Company's failure to comply with and/or implement regulations and provisions. Sources of Compliance Risk can be caused, among others, by the Company's behavior or activities that deviate from or violate regulations and organizational behavior, namely the Company's behavior or activities that deviate from or contradict generally accepted standards. b. The assessment of inherent risk for Compliance Risk refers to the parameters or indicators for assessing inherent risk as referred to in Table III.D.1: Parameters or Indicators for Assessing Inherent Risk for Compliance Risk.
c. The Company sets the inherent risk level for Compliance Risk in 5 (five) ranks, namely rank 1 (low), rank 2 (low-medium), rank 3 (medium), rank 4 (medium-high), and rank 5 (high). The determination of the inherent risk level for Compliance Risk refers to the guidelines for determining the inherent risk level as referred to in Table III.D.2: Guidelines for Determining Inherent Risk Level for Compliance Risk.
Reputational Risk
a. Reputational Risk is the Risk resulting from a decrease in the level of trust of stakeholders sourced from negative perceptions of the Company. Sources of Reputational Risk can be caused, among others, by negative news reports about the Company in the mass media and consumer complaints. b. The assessment of inherent risk for Reputational Risk refers to the parameters or indicators for assessing inherent risk as referred to in Table III.E.1: Parameters or Indicators for Assessing Inherent Risk for Reputational Risk.
c. The Company sets the inherent risk level for Reputational Risk in 5 (five) ranks, namely rank 1 (low), rank 2 (low-medium), rank 3 (medium), rank 4 (medium-high), and rank 5 (high). The determination of the inherent risk level for Reputational Risk refers to the guidelines for determining the inherent risk level as referred to in Table III.E.2: Guidelines for Determining Inherent Risk Level for Reputational Risk.

3.1.3 Assessment and Determination of Risk Management Implementation Quality (KPMR) Level
The KPMR assessment reflects an assessment of the adequacy of the Risk control system covering all pillars of Risk Management implementation as regulated in the Financial Services Authority regulations regarding the implementation of Risk Management for non-bank financial service institutions. The KPMR assessment aims to evaluate the effectiveness of the Company's Risk Management implementation in accordance with principles regulated in the Financial Services Authority regulations regarding the implementation of Risk Management for non-bank financial service institutions. The Company's Risk Management implementation varies greatly according to size, complexity, and the level of Risk the Company can tolerate.

The KPMR assessment is an assessment of 4 (four) interrelated aspects, namely:

Active supervision by the Board of Directors and Board of Commissioners, which includes evaluation of:
a. the adequacy of active supervision by the Board of Directors and Board of Commissioners; and b. the adequacy of the exercise of authority and responsibility by the Board of Directors and Board of Commissioners.
Adequacy of Risk Management policies and procedures and risk limit setting, which includes evaluation of:
a. the formulation of the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance); b. Risk Management strategies aligned with the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance);
c. the adequacy of Risk Management policies and procedures; and
d. the adequacy of risk limit setting.
Adequacy of risk identification, measurement, control, and monitoring processes, and Risk Management information systems, which includes evaluation of:
a. the adequacy of risk identification, measurement, monitoring, and control processes; b. the adequacy of the Risk Management information system; and
c. the adequacy of the quantity and quality of Human Resources in supporting the effectiveness of the Risk Management process.
Comprehensive internal control system, which includes evaluation of:
a. the adequacy of the internal control system; and b. the adequacy of review by independent parties within the Company, either by the function handling Risk Management or by the function handling internal audit.

The KPMR level for each type of Risk is categorized into 5 (five) ranks, namely rank 1 (strong), rank 2 (fairly strong), rank 3 (adequate), rank 4 (fairly weak), and rank 5 (weak).

The Company assesses the KPMR for each type of Risk by referring to the guidelines for determining the KPMR level for each type of Risk, as referred to in:

Table III.A.3: Guidelines for Determining KPMR Level for Strategic Risk
Table III.B.3: Guidelines for Determining KPMR Level for Operational Risk
Table III.C.3: Guidelines for Determining KPMR Level for Legal Risk
Table III.D.3: Guidelines for Determining KPMR Level for Compliance Risk
Table III.E.3: Guidelines for Determining KPMR Level for Reputational Risk

3.1.4 Determination of Risk Level for Each Type of Risk
The Risk level is determined based on the assessment of the inherent risk level and KPMR of each type of Risk as referred to in item 3.1.2 and item 3.1.3. After the Company sets the inherent risk level and KPMR, the Company sets the Risk level for each type of Risk, namely Strategic Risk, Operational Risk, Legal Risk, Compliance Risk, and Reputational Risk by referring to the Risk level determination matrix as referred to in Table III.F.1: Risk Level Determination Matrix.

The Risk level determination matrix is basically used as an indicative reference to map the Risk level resulting from the combination of the inherent risk level and the KPMR level. In the event that the matrix is less able to describe the Company's Risk level, comprehensive and structured analysis can be used to adjust the Risk level as long as it is believed to more accurately describe the Risk level in the Company.

3.1.5 Determination of Risk Profile Ranking
The determination of the Risk profile ranking is carried out in the following stages:

Determination of the Risk level for each Risk by referring to item 3.1.4;
Determination of the composite inherent risk level and composite KPMR level, paying attention to the significance of each Risk to the overall Risk profile. The determination of the Risk level refers to the Risk profile ranking determination format as referred to in Table III.G.1: Composite Risk Profile Ranking Determination Format; and
Determination of the Risk profile ranking based on the results of the Risk level determination as referred to in number 1 and the composite inherent risk level and composite KPMR level as referred to in number 2, based on comprehensive and structured analysis, paying attention to the significance of each Risk to the overall Risk profile.

The determination of the Risk profile ranking consists of 5 (five) ranks, namely rank 1, rank 2, rank 3, rank 4, and rank 5. The order of Risk profile rankings with smaller numbers reflects a lower level of Risk faced by the Company. The determination of the Risk profile ranking is carried out by referring to the Risk profile ranking matrix as referred to in Table III.G.2: Guidelines for Determining Risk Profile Ranking.

3.2 Stages and Guidelines for Determining Company Risk Profile
Briefly, the determination of the Risk profile and quality of risk management implementation is carried out in stages and guidelines as follows:

Stage	Guideline	Item
A. Determination of Inherent Risk Level and KPMR for Strategic Risk
1. Inherent risk assessment.	Table III.A.1 Parameters or Indicators for Assessing Inherent Risk for Strategic Risk
2. Determination of inherent risk level.	Table III.A.2 Guidelines for Determining Inherent Risk Level for Strategic Risk
3. Determination of KPMR level.	Table III.A.3 Guidelines for Determining KPMR Level for Strategic Risk
B. Determination of Inherent Risk Level and KPMR for Operational Risk
1. Inherent risk assessment.	Table III.B.1 Parameters or Indicators for Assessing Inherent Risk for Operational Risk
2. Determination of inherent risk level.	Table III.B.2 Guidelines for Determining Inherent Risk Level for Operational Risk

Guideline Stages
3. Determination of KPMR Level
Table III.B.3 Guidelines for Determining KPMR Level
for Operational Risk

C. Determination of Inherent Risk Level and KPMR for Legal Risk

Inherent risk assessment.
Table III.C.1 Parameters or Indicators for Assessing
Inherent Risk for Legal Risk
Determination of
inherent risk level.
Table III.C.2 Guidelines for Determining Inherent Risk
Level for Legal Risk
Determination of
KPMR Level
Table III.C.3 Guidelines for Determining KPMR Level
for Legal Risk

D. Determination of Inherent Risk Level and KPMR for Compliance Risk

Inherent risk assessment.
Table III.D.1 Parameters or Indicators for Assessing
Inherent Risk for Compliance Risk
Determination of
inherent risk level.
Table III.D.2 Guidelines for Determining Inherent Risk
Level for Compliance Risk
Determination of
KPMR Level
Table III.D.3 Guidelines for Determining KPMR Level
for Compliance Risk

E. Determination of Inherent Risk Level and KPMR for Reputational Risk

Inherent risk assessment.
Table III.E.1 Parameters or Indicators for Assessing
Inherent Risk for Reputational Risk
Determination of
inherent risk level.
Table III.E.2 Guidelines for Determining Inherent Risk
Level for Reputational Risk
Determination of
KPMR Level
Table III.E.3 Guidelines for Determining KPMR Level
for Reputational Risk

F. Determination of Composite Risk Profile

Determination of risk level for each
risk type.
Table III.F.1 Risk Level Determination Matrix 146
Determination
of profile ranking
Table III.G.1 Format for Determining Composite
Risk Profile Ranking

Guideline Stages composite risk profile. Table III.G.2 Guidelines for Determining Profile Ranking

Table III.A.1: Parameters or Indicators for Assessing Inherent Risk for Strategic Risk
Parameter or Indicator Description

Misalignment
of business strategy with the Company's vision and mission as well as business environment conditions a. Stages or mechanisms for strategic plan formulation by the Board of Directors.
Parameter assessment includes, among others, the availability of formulation procedures. b. The Board of Directors' understanding of the Company's overall strategic plan.
Quite clear.
c. The Company's process in formulating business strategy and any changes in business strategy made (if any).
Quite clear. d. Alternative strategies (contingent/emergent strategy) in the event of anticipated changes in the business environment.
Quite clear. e. The determination of strategic objectives needs to consider internal and external business factors of the Company.
Internal factors, among others:

vision, mission, and business direction the Company aims to achieve;
organizational culture, particularly in that the determination of strategic objectives requires changes in organizational structure and adjustment of business processes;
organizational capability factors including
Parameter assessment includes, among others, measuring whether the determination of strategic targets by the Board of Directors is supported by internal and external conditions of the Company's business environment.

Parameter or Indicator Description among others human resources, infrastructure, office networks, and management information systems; and
4) risk tolerance level, which is the Company's financial capacity to absorb Risk.
External factors, among others:

macroeconomic conditions;
technological developments;
level of business competition; and
developments in existing regulations and provisions.

Choice of business
strategy level, namely high-risk strategy and low-risk strategy.
Whether the Company's strategy tends to use a high-risk strategy or a low-risk strategy.

A high-risk strategy is a strategy where the Company plans to enter a new business area, whether in the form of a new market share/business line, offering new products/services, or attracting new consumers.
A low-risk strategy is a strategy where the Company conducts business activities in a previously known market share/business line and consumer base (familiar market and customer), or provides intermediation for

Parameter or Indicator Description traditional insurance products, namely products that have long been known in the market.
3. Strategic position
(strategic position) of the Company in the industry. a. Market conditions where the Company conducts business activities.
Quite clear. b. Competitive advantages owned by the Company compared to its competitors.
Quite clear.
c. Company reputation. Quite clear.
d. The Company's readiness to face macroeconomic changes and their impact on Company conditions, including interest rates, inflation, and exchange rates.
Quite clear. e. The Company's strategy to maintain or improve its strategic position in the market, which the Company will carry out through business activities, operational scope coverage, or other means. Quite clear.
4. Achievement of
business realization by the Company a. The level of deviation between strategic targets and the Company's achievement results.
The level of deviation between strategic targets and the Company's achievement results can be assessed quantitatively, among others, by:

Comparison of realization against targets:
The purpose of the assessment is, among others, to measure how large the deviation of business plan realization is compared to the targets in the business plan.

Parameter or Indicator Description a) Intermediation service revenue; b) Consultation service revenue; c) Claim handling service revenue; d) Investment results; and e) Operating profit.
2) Realization of new business line development against targets and realization of office network development against targets.
b. Documentation of the causes of business plan deviation.
The Company must formally document all causes of the failure to achieve strategic plans.
This document will subsequently become one of the information sources both during evaluation and during the formulation of the next strategic plan.

Table III.A.2: Guidelines for Determining Inherent Risk Level for Strategic Risk
Ranking Ranking Definition
Rank 1
(Low)
Considering the business activities conducted by the Company, the potential losses faced by the Company from Strategic Risk are classified as very low during a certain period in the future.
Examples of Company characteristics included in Rank 1 (low) include, among others, the following:
a. The Company continues existing strategies in accordance with business environment conditions with a high level of strategy success; b. the Company's strategy is classified as conservative or low-risk;
c. the insurance/reinsurance products intermediated or whose risk/loss is assessed, services, and/or the Company's activities are classified as stable, not complex, and diversified;
d. the Company has stable competitive advantages and there are no threats from competitors; and e. business plan achievement is very adequate.
Rank 2
(Low
Medium)
Considering the business activities conducted by the Company, the potential losses faced by the Company from Strategic Risk are classified as low during a certain period in the future.
Examples of Company characteristics included in Rank 2 (low medium) include, among others, the following:
a. the Company continues the same strategy or has some new strategies in accordance with business environment conditions but still within the Company's core business and competence; b. the Company's strategy is low-risk;
c. the insurance/reinsurance products intermediated or whose risk/loss is assessed, services, and/or the Company's activities are classified as not complex and diversified;
d. the Company has competitive advantages and competitor threats are classified as minor; and e. business plan achievement is adequate.

Ranking Ranking Definition
Rank 3
(Medium)
Considering the business activities conducted by the Company, the potential losses faced by the Company from Strategic Risk are classified as fairly high during a certain period in the future.
Examples of Company characteristics included in Rank 3 (medium) include, among others, the following:
a. the Company applies new strategies to enter new business or markets in accordance with business environment conditions but still within the core business and competence of the Company; b. the Company's strategy is classified as fairly high-risk;
c. the insurance/reinsurance products intermediated or whose risk/loss is assessed, services, and/or the Company's activities are generally diversified, but some are classified as complex;
d. the Company has moderate competitive advantages and there are threats from competitors; and e. business plan achievement is fairly adequate.
Rank 4
(Medium
High)
Considering the business activities conducted by the Company, the potential losses faced by the Company from Strategic Risk are classified as high during a certain period in the future.
Examples of Company characteristics included in Rank 4 (medium high) include, among others, the following:
a. the Company applies strategies to enter new business or markets in accordance with business environment conditions with an uncertain level of success; b. the Company's strategy is classified as high-risk;
c. some insurance/reinsurance products intermediated or whose risk/loss is assessed, services, and/or the Company's activities are concentrated and classified as complex;
d. the Company lacks competitive advantages, or there are significant threats from competitors; and e. business plan achievement is less adequate.
Rank 5 (High)
Considering the business activities conducted by the

Ranking Ranking Definition
Company, the potential losses faced by the Company from Strategic Risk are classified as very high during a certain period in the future.
Examples of Company characteristics included in Rank 5 (high) include, among others, the following:
a. the majority of the Company's strategies shift to areas that are different and not core business and competence in accordance with the Company's business environment conditions; b. the Company's strategy is classified as very high-risk;
c. the insurance/reinsurance products intermediated or whose risk/loss is assessed, services, and/or business activities are very concentrated and classified as complex;
d. the Company has no competitive advantages and there are very significant threats from competitors; and e. the Company's business plan achievement is inadequate.

Table III.A.3: Guidelines for Determining KPMR Level for Strategic Risk
Ranking Ranking Definition
Rank 1
(Strong)
KPMR for Strategic Risk is very adequate, with minor weaknesses that are not significant and can be ignored.
Examples of Company characteristics included in Rank 1 (strong) include, among others, the following:
a. the formulation of the level of Risk to be taken (risk appetite) and risk tolerance (risk tolerance) is very adequate and has aligned with strategic targets and overall business strategy; b. the Board of Directors and Board of Commissioners have very good awareness and understanding of Risk Management for Strategic Risk, sources of Strategic Risk, and the level of Strategic Risk in the Company;
c. the Risk Management culture for Strategic Risk is very strong and has been internalized very well at all organizational levels;
d. the execution of duties by the Board of Directors and Board of Commissioners as a whole is very adequate; e. the Risk Management function for Strategic Risk is independent, has clear duties and responsibilities, and has operated very well; f. the delegation of authority is controlled and monitored periodically, and has operated very well; g. the Risk Management strategy for Strategic Risk is very aligned with the level of Risk to be taken (risk appetite) and Strategic Risk tolerance; h. policies, procedures, and limit determinations for Strategic Risk are very adequate and available for all areas of Risk Management for Strategic Risk, aligned with implementation, and well understood by employees;
i. the Risk Management process for Strategic Risk is very adequate in identifying, measuring, controlling, and monitoring Strategic Risk;
j. the Risk Management information system for Strategic Risk is very good, producing comprehensive and integrated Strategic Risk reports to the

Ranking Ranking Definition
Board of Directors and Board of Commissioners; k. human resources are very adequate in both quantity and quality in the Risk Management function for Strategic Risk;
l. the internal control system is very effective in supporting the implementation of Risk Management for Strategic Risk;
m. the implementation of independent review by the internal audit function and functions conducting independent review is very adequate in terms of methodology, frequency, and reporting to the Board of Directors and Board of Commissioners; n. generally, there are no significant weaknesses based on independent review results; and o. follow-up on independent review has been implemented very adequately. Rank 2 (Fairly Strong) KPMR for Strategic Risk is adequate although there are some minor weaknesses that can be resolved in normal business activities. Examples of Company characteristics included in Rank 2 (fairly strong) include, among others, the following:
a. the formulation of the level of Risk to be taken (risk appetite) and risk tolerance (risk tolerance) is adequate and has aligned with strategic targets and overall business strategy; b. the Board of Directors and Board of Commissioners have good awareness and understanding of Risk Management for Strategic Risk, sources of Strategic Risk, and the level of Strategic Risk in the Company;
c. the Risk Management culture for Strategic Risk is strong and has been internalized well at all organizational levels;
d. the execution of duties by the Board of Directors and Board of Commissioners is generally adequate, with some weaknesses but not significant and can be improved immediately; e. the Risk Management function for Strategic Risk has clear duties and responsibilities and has operated well, but there are minor weaknesses that can be resolved in normal business activities; f. the delegation of authority is controlled and monitored periodically and has operated well; g. the Risk Management strategy for Strategic Risk is aligned with the level of Risk to be taken (risk appetite) and Strategic Risk tolerance; h. policies, procedures, and limit determinations for Strategic Risk are adequate and available for all areas of Risk Management for Strategic Risk, aligned with implementation, and well understood by employees although there are minor weaknesses;
i. the Risk Management process for Strategic Risk is adequate in identifying, measuring, controlling, and monitoring Strategic Risk;
j. the Risk Management information system for Strategic Risk is good, including Strategic Risk reporting to the Board of Directors and Board of Commissioners, but there are minor weaknesses that can be easily improved; k. human resources are adequate in both quantity and quality in the Risk Management function for Strategic Risk;
l. the internal control system is effective in supporting the implementation of Risk Management for Strategic Risk;
m. the implementation of independent review by the internal audit function and functions conducting independent review is adequate in terms of methodology, frequency, and reporting to the Board of Directors and Board of Commissioners; n. there are weaknesses but not significant based on independent review results; and o. follow-up on independent review has been implemented adequately. Rank 3 (Adequate) KPMR for Strategic Risk is fairly adequate. Although minimum requirements are met, there are some weaknesses that require management attention. Examples of Company characteristics included in Rank 3 (adequate) include, among others, the following:
a. the formulation of the level of Risk to be taken (risk appetite) and risk tolerance (risk tolerance) is fairly adequate but

Ranking Ranking Definition not always aligned with strategic targets and overall business strategy; b. the Board of Directors and Board of Commissioners have fairly good awareness and understanding of Risk Management for Strategic Risk, sources of Strategic Risk, and the level of Strategic Risk in the Company;
c. the Risk Management culture for Strategic Risk is fairly strong and has been internalized fairly well but is not always implemented consistently;
d. the execution of duties by the Board of Directors and Board of Commissioners is generally fairly adequate, but there are weaknesses in some assessment aspects that need management attention; e. the Risk Management function for Strategic Risk is fairly good, but there are some weaknesses including reporting to the Board of Directors and Board of Commissioners that require management attention; f. the delegation of authority is fairly good, but control and monitoring are not always implemented well; g. the Risk Management strategy for Strategic Risk is fairly aligned with the level of Risk to be taken (risk appetite) and Strategic Risk tolerance; h. policies, procedures, and limit determinations for Strategic Risk are fairly adequate but not always consistent with implementation;
i. the Risk Management process for Strategic Risk is fairly adequate in identifying, measuring, controlling, and monitoring Strategic Risk;
j. the Risk Management information system for Strategic Risk meets minimum expectations but there are some weaknesses including reporting to the Board of Directors and Board of Commissioners that require management attention; k. human resources are fairly adequate in both quantity and quality in the Risk Management function for Strategic Risk;
l. the internal control system is fairly effective in supporting the implementation of Risk Management for Strategic Risk;
m. the implementation of independent review by the internal audit function and functions conducting independent review is fairly adequate, but there are some weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners that require management attention; n. there are fairly significant weaknesses based on independent review results that require management attention; and o. follow-up on independent review has been implemented fairly adequately. Rank 4 (Fairly Weak) KPMR for Strategic Risk is less adequate, with significant weaknesses in various aspects of Risk Management for Strategic Risk that require immediate corrective action. Examples of Company characteristics included in Rank 4 (fairly weak) include, among others, the following:
a. the formulation of the level of Risk to be taken (risk appetite) and risk tolerance (risk tolerance) is less adequate and not aligned with strategic targets and overall business strategy; b. there are significant weaknesses in the awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Strategic Risk, sources of Strategic Risk, and the level of Strategic Risk in the Company;
c. the Risk Management culture for Strategic Risk is not strong and has not been internalized well at every organizational level;
d. the execution of duties by the Board of Directors and Board of Commissioners is generally less adequate, with weaknesses in various assessment aspects that require immediate improvement; e. there are significant weaknesses in the Risk Management function for Strategic Risk that require immediate improvement; f. delegation of authority is weak, not controlled and not monitored well; g. the Risk Management strategy for Strategic Risk is not aligned with the level of Risk to be taken (risk appetite) and Strategic Risk tolerance; h. there are significant weaknesses in policies, procedures, and limit determinations for Strategic Risk;
i. the Risk Management process for Strategic Risk is less adequate in identifying, measuring, controlling, and monitoring Strategic Risk;
j. there are significant weaknesses in the Risk Management information system for Strategic Risk including reporting to the Board of Directors and Board of Commissioners that require immediate improvement; k. human resources are less adequate in both quantity and quality in the Risk Management function for Strategic Risk;
l. the internal control system is less effective in supporting the implementation of Risk Management for Strategic Risk;
m. the implementation of independent review by the internal audit function and functions conducting independent review is less adequate, with weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners that require immediate improvement; n. there are significant weaknesses based on independent review results that require immediate improvement action; and o. follow-up on independent review is less adequate. Rank 5 (Weak) KPMR for Strategic Risk is inadequate, with significant weaknesses in various aspects of Risk Management for Strategic Risk whose resolution is beyond management's capability. Examples of Company characteristics included in Rank 5 (weak) include, among others, the following:
a. the formulation of the level of Risk to be taken (risk appetite) and risk tolerance (risk tolerance) is inadequate and there is no connection with strategic targets and overall business strategy; b. the awareness and understanding of the Board of Directors and Board of Commissioners is very weak regarding Risk Management for Strategic Risk, sources of Strategic Risk, and the level of Strategic Risk in the Company;
c. the Risk Management culture for Strategic Risk is not strong or does not exist at all;
d. the execution of duties by the Board of Directors and Board of Commissioners is inadequate, with significant weaknesses in almost all assessment aspects and actions and their resolution are beyond the Company's capability; e. there are significant weaknesses in the Risk Management function for Strategic Risk that require fundamental improvement; f. delegation of authority is very weak or non-existent; g. the Risk Management strategy for Strategic Risk is not aligned with the level of Risk to be taken (risk appetite) and Strategic Risk tolerance; h. there are very significant weaknesses in policies, procedures, and limit determinations for Strategic Risk;
i. the Risk Management process for Strategic Risk is inadequate in identifying, measuring, controlling, and monitoring Strategic Risk;
j. there are fundamental weaknesses in the Risk Management information system for Strategic Risk; k. human resources are inadequate in both quantity and quality in the Risk Management function for Strategic Risk;
l. the internal control system is ineffective in supporting the implementation of Risk Management for Strategic Risk;
m. the implementation of independent review by the internal audit function and functions conducting independent review is lacking or inadequate, with weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners that require fundamental improvement; n. there are very significant weaknesses based on independent review results whose improvement actions are o. follow-up on independent review is inadequate or non-existent.

Table III.B.1: Parameters or Indicators for Assessing Inherent Risk for Operational Risk

Parameter or Indicator	Description
1. Organizational and business activity complexity	a. Size and organizational structure of the Company.<br>b. Complexity of business processes and diversity of products/services.<br>c. Corporate actions and new business development.<br>d. Use of third-party services (outsourcing and business carriers).<br>e. Significant changes in work patterns.<br>f. History of transaction process failures or management process failures.<br><br>Things to note include the following:<br>1) Company size: total assets, number of intermediary services or consulting services<br>2) Number of office networks<br>3) Number of human resources<br>4) Ownership structure<br>5) Quality of implementation of work process flows and business functions, including insurance and reinsurance placement, claim handling, and premium management for Insurance Brokerage Companies and Reinsurance Brokerage Companies, as well as loss assessment processes for Insurance Loss Assessors.<br>6) Frequency of providing intermediary services or consulting services<br>7) Use of outsourcing in critical operational activities and systems<br>8) Credibility of outsourcing providers<br>9) Company monitoring of outsourcing providers<br>10) Frequency and materiality of problems previously occurred with outsourcing providers
2. Human Resources (HR)	a. Implementation of HR management.<br>b. Failures due to human factors (human error).<br>c. Realization of education and training costs against the budget.<br>d. Realization of education and training costs against employee and official costs.<br><br>Ineffective HR management can result in potential operational disruptions or losses for the Company. Assessment can be conducted based on:<br>1) Recruitment and placement (person-to-job fit) according to needs;<br>2) Employee turnover rate;<br>3) Budgeting and realization of education and training costs against the HR budget; and<br>4) Materiality of losses resulting from human error.
3. Information Technology Systems	a. Complexity of information technology systems.<br>b. Changes in information technology systems.<br>c. Maturity of information technology systems.<br>d. Reliability of information systems, including supporting infrastructure, against information technology threats and attacks.<br>e. Alignment of information technology systems with Company activities.<br>f. Failure of information technology systems.<br><br>Inadequate information technology and/or ineffective and inefficient management can cause losses to the Company. Assessment can be conducted based on the number of system disruptions for internal and external parties within 1 (one) year.
4. Fraud Risk	a. History of internal fraud.<br>b. History of external fraud.<br><br>Fraud assessment is conducted on:<br>1) Frequency and materiality of internal fraud, such as: potential premium embezzlement by the Company, potential fraud arising from weaknesses in business aspects, HR, information technology, unreported transactions, and transactions not intentionally authorized.<br>2) Frequency and materiality of external fraud, such as: fictitious claims, data theft and forgery; and<br>3) Types and trends of internal and external fraud experienced by the Company.
5. Business and Organizational Disruption	a. Frequency and materiality of external events.<br>b. Company location and geographical conditions.<br><br>External events include terrorism, criminality, pandemics, and natural disasters.<br><br>Company location and geographical conditions include the number and significance of services in disaster-prone areas, social conflicts, criminality, and terrorism.
6. Administrative Systems	a. Administrative procedures used by the Company.<br>b. Level of errors/deviations in administrative procedures.<br><br>Administrative functions can be one of the sources of Operational Risk, particularly related to transaction processing errors (premium receipt, claim handling, insurance/reinsurance placement, processing and service level agreement for claim handling, claim handover for brokers receiving claims, and preparation of Risk/Loss assessment reports), and internal fraud.

Table III.B.2: Guidelines for Setting Inherent Risk Levels for Operational Risk

Rating	Definition	Rating
Rating 1 (Low)	Considering the business activities conducted by the Company, the potential losses faced by the Company from Operational Risk are classified as very low during a certain period in the future.<br><br>Examples of Company characteristics included in Rating 1 (low) include the following:<br>a. Company business has very simple characteristics: products and/or activities are not varied, business mechanisms are very simple, transaction volume is low, organizational structure is not complex, there are no significant corporate actions, and the use of outsourcing is very minimal;<br>b. HR is very adequate, both in terms of quantity and quality adequacy, and historical data on losses due to human error is not significant.<br>c. Information technology is very mature and there are no significant changes in information technology systems, vulnerability of information technology to disruptions or attacks is very low, supporting infrastructure is very reliable in supporting Company business;<br>d. Frequency and materiality of internal and external fraud are very low and losses caused are not significant compared to transaction volume or Company revenue;<br>e. Threat of business disruption due to external events is very low; and<br>f. Administrative procedures are very easy for administrative staff to understand, and the level of errors or deviations in administrative procedures is very low.
Rating 2 (Low-Medium)	Considering the business activities conducted by the Company, the potential losses faced by the Company from Operational Risk are low during a certain period in the future.<br><br>Examples of Company characteristics included in Rating 2 (low-medium) include the following:<br>a. Company business has simple characteristics: products and/or activities are relatively less varied, business mechanisms are simple, transaction volume is relatively low, organizational structure is less complex, corporate actions are less significant, and the use of outsourcing is minimal;<br>b. HR is adequate, both in terms of quantity and quality adequacy, and historical data on losses due to human error is less significant;<br>c. Information technology is relatively mature and there are no significant changes in information technology systems, vulnerability of information technology to disruptions or attacks is low, supporting infrastructure is reliable in supporting Company business;<br>d. Frequency and materiality of internal and external fraud are low and losses caused are less significant compared to transaction volume or Company revenue;<br>e. Threat of business disruption due to external events is low; and<br>f. Administrative procedures are easy for administrative staff to understand, and the level of errors or deviations in administrative procedures is low.
Rating 3 (Medium)	Considering the business activities conducted by the Company, the potential losses faced by the Company from Operational Risk are classified as fairly high during a certain period in the future.<br><br>Examples of Company characteristics included in Rating 3 (medium) include the following:<br>a. Company business has fairly complex characteristics, products and/or activities are fairly varied, business mechanisms are fairly complex, transaction volume is fairly high, organizational structure is fairly complex, corporate actions are fairly significant, and the use of outsourcing is fairly significant;<br>b. HR is fairly adequate, both in terms of quantity and quality adequacy, and historical data on losses due to human error is fairly significant;<br>c. Information technology is moving towards maturity and significant changes may occur in information technology systems, information technology is fairly vulnerable to disruptions or attacks, supporting infrastructure is fairly reliable in supporting Company business;<br>d. Frequency and materiality of internal and external fraud are fairly high and losses caused are fairly significant compared to transaction volume or Company revenue;<br>e. Threat of business disruption due to external events is fairly high; and<br>f. Administrative procedures are fairly difficult for administrative staff to understand, and the level of errors or deviations in administrative procedures is fairly high.
Rating 4 (Medium-High)	Considering the business activities conducted by the Company, the potential losses faced by the Company from Operational Risk are classified as high during a certain period in the future.<br><br>Examples of Company characteristics included in Rating 4 (medium-high) include the following:<br>a. Company business has complex characteristics: products and/or activities are varied, business mechanisms are complex, transaction volume is high, organizational structure is complex, corporate actions are significant, and the use of outsourcing is significant.<br>b. HR is less adequate, both in terms of quantity and quality adequacy, and historical data on losses due to human error is significant;<br>c. Information technology is not yet mature and significant changes occur in information technology systems, information technology is vulnerable to disruptions or attacks, supporting infrastructure is less reliable in supporting Company business;<br>d. Frequency and materiality of internal and external fraud are high and losses caused are significant compared to transaction volume or Company revenue;<br>e. Threat of business disruption due to external events is high; and<br>f. Administrative procedures are difficult for administrative staff to understand, and the level of errors or deviations in administrative procedures is high.
Rating 5 (High)	Considering the business activities conducted by the Company, the potential losses faced by the Company from Operational Risk are classified as very high during a certain period in the future.<br><br>Examples of Company characteristics included in Rating 5 (high) include the following:<br>a. Company business has very complex characteristics: products and/or activities are very varied, business mechanisms are very complex, transaction volume is very high, organizational structure is very complex, corporate actions are significant, and the use of outsourcing is very high;<br>b. HR is inadequate, both in terms of quantity and quality adequacy, and historical data on losses due to human error is very significant;<br>c. Information technology is not mature and very significant changes occur in information technology systems, information technology is very vulnerable to disruptions or attacks, supporting infrastructure is unreliable in supporting Company business;<br>d. Frequency and materiality of internal and external fraud are very high and losses caused are very significant compared to transaction volume or Company revenue;<br>e. Threat of business disruption due to external events is very high; and<br>f. Administrative procedures are very difficult for administrative staff to understand, and the level of errors or deviations in administrative procedures is very high.

Table III.B.3: Guidelines for Setting Operational Risk Management Framework (KPMR) Levels

Rating	Definition	Rating
Rating 1 (Strong)	KPMR for Operational Risk is very adequate, with minor weaknesses that are not significant and can be ignored.<br><br>Examples of Company characteristics included in Rating 1 (strong) include the following:<br>a. Formulation of risk appetite and risk tolerance is very adequate and aligned with overall strategic objectives and business strategy;<br>b. Board of Directors and Board of Commissioners have very good awareness and understanding of Operational Risk Management, sources of Operational Risk, and the level of Operational Risk in the Company;<br>c. Operational Risk Management culture is very strong and has been internalized very well at all organizational levels;<br>d. Execution of duties by the Board of Directors and Board of Commissioners is overall very adequate;<br>e. Operational Risk Management function is independent, has clear duties and responsibilities, and operates very well;<br>f. Delegation of authority is controlled and monitored periodically, and operates very well;<br>g. Operational Risk Management strategy is very aligned with the risk appetite and Operational Risk tolerance;<br>h. Operational Risk Management policies, procedures, and limit setting are very adequate and available for all Operational Risk Management areas, aligned with implementation, and well understood by employees;<br>i. Operational Risk Management process is very adequate in identifying, measuring, controlling, and monitoring Operational Risk;<br>j. Business continuity management is very reliable and very tested;<br>k. Operational Risk Management information system is very good, producing comprehensive and integrated Operational Risk reports for the Board of Directors and Board of Commissioners;<br>l. HR is very adequate in terms of quantity and quality in the Operational Risk Management function;<br>m. Internal control system is very effective in supporting the implementation of Operational Risk Management;<br>n. Independent review implementation by internal audit function and independent review function is very adequate in terms of methodology, frequency, and reporting to the Board of Directors and Board of Commissioners;<br>o. Generally, there are no significant weaknesses based on independent review results; and<br>p. Follow-up on independent reviews has been implemented very adequately.
Rating 2 (Fairly Strong)	KPMR for Operational Risk is adequate despite some minor weaknesses that can be resolved in normal business activities.<br><br>Examples of Company characteristics included in Rating 2 (fairly strong) include the following:<br>a. Formulation of risk appetite and risk tolerance is adequate and aligned with overall strategic objectives and business strategy;<br>b. Board of Directors and Board of Commissioners have good awareness and understanding of Operational Risk Management, sources of Operational Risk, and the level of Operational Risk in the Company;<br>c. Operational Risk Management culture is strong and has been internalized well at all organizational levels;<br>d. Execution of duties by the Board of Directors and Board of Commissioners is generally adequate, with some weaknesses but not significant and can be repaired immediately;<br>e. Operational Risk Management function has clear duties and responsibilities and operates well, but there are minor weaknesses that can be resolved in normal business activities;<br>f. Delegation of authority is controlled and monitored periodically and operates well;<br>g. Operational Risk Management strategy is aligned with risk appetite and Operational Risk tolerance;<br>h. Operational Risk policies, procedures, and limit setting are adequate and available for all Operational Risk Management areas, aligned with implementation, and well understood by employees despite minor weaknesses;<br>i. Operational Risk Management process is adequate in identifying, measuring, controlling, and monitoring Operational Risk;<br>j. Business continuity management is reliable and tested;<br>k. Operational Risk Management information system is good, including Operational Risk reporting to the Board of Directors and Board of Commissioners, but there are minor weaknesses that can be easily repaired;<br>l. HR is adequate in terms of quantity and quality in the Operational Risk Management function;<br>m. Internal control system is effective in supporting the implementation of Operational Risk Management;<br>n. Independent review implementation by internal audit function and independent review function is adequate in terms of methodology, frequency, and reporting to the Board of Directors and Board of Commissioners;<br>o. There are weaknesses but not significant based on independent review results; and<br>p. Follow-up on independent reviews has been implemented adequately.
Rating 3 (Fair)	KPMR for Operational Risk is fairly adequate. Although minimum requirements are met, there are some weaknesses requiring management attention.<br><br>Examples of Company characteristics included in Rating 3 (fair) include the following:<br>a. Formulation of risk appetite and risk tolerance is fairly adequate but not always aligned with overall strategic objectives and business strategy;<br>b. Board of Directors and Board of Commissioners have fairly good awareness and understanding of Operational Risk Management, sources of Operational Risk, and the level of Operational Risk in the Company;<br>c. Operational Risk Management culture is fairly strong and has been internalized fairly well but not always implemented consistently;<br>d. Execution of duties by the Board of Directors and Board of Commissioners is generally fairly adequate, but there are weaknesses in some assessment aspects that need management attention;<br>e. Operational Risk Management function is fairly good, but there are some weaknesses including reporting to the Board of Directors and Board of Commissioners that require management attention;<br>f. Delegation of authority is fairly good, but control and monitoring are not always implemented well;<br>g. Operational Risk Management strategy is fairly aligned with risk appetite and Operational Risk tolerance;<br>h. Operational Risk policies, procedures, and limit setting are fairly adequate but not always consistent with implementation;<br>i. Operational Risk Management process is fairly adequate in identifying, measuring, monitoring, and controlling Operational Risk;<br>j. Business continuity management is fairly reliable;<br>k. Operational Risk Management information system meets minimum expectations but there are some weaknesses including reporting to the Board of Directors and Board of Commissioners that require management attention;<br>l. HR is fairly adequate in terms of quantity and quality in the Operational Risk Management function;<br>m. Internal control system is fairly effective in supporting the implementation of Operational Risk Management;<br>n. Independent review implementation by internal audit function and independent review function is fairly adequate, but there are some weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners that require management attention;<br>o. There are fairly significant weaknesses based on independent review results that require management attention; and<br>p. Follow-up on independent reviews has been implemented fairly adequately.
Rating 4 (Fairly Weak)	KPMR for Operational Risk is less adequate, with significant weaknesses in various aspects of Operational Risk Management requiring immediate corrective action.<br><br>Examples of Company characteristics included in Rating 4 (fairly weak) include the following:<br>a. Formulation of risk appetite and risk tolerance is less adequate and not aligned with overall strategic objectives and business strategy;<br>b. There are significant weaknesses in the awareness and understanding of the Board of Directors and Board of Commissioners regarding Operational Risk Management, sources of Operational Risk, and the level of Operational Risk in the Company;<br>c. Operational Risk Management culture is less strong and has not been internalized well at every organizational level;<br>d. Execution of duties by the Board of Directors and Board of Commissioners is generally less adequate, with weaknesses in various assessment aspects requiring immediate improvement;<br>e. There are significant weaknesses in the Operational Risk Management function requiring immediate improvement;<br>f. Delegation of authority is weak, not controlled and not monitored well;<br>g. Operational Risk Management strategy is less aligned with risk appetite and Operational Risk tolerance;<br>h. There are significant weaknesses in Operational Risk policies, procedures, and limit setting;<br>i. Operational Risk Management process is less adequate in identifying, measuring, monitoring, and controlling Operational Risk;<br>j. Business continuity management is less reliable;<br>k. There are significant weaknesses in the Operational Risk Management information system including reporting to the Board of Directors and Board of Commissioners requiring immediate improvement;<br>l. HR is less adequate in terms of quantity and quality in the Operational Risk Management function;<br>m. Internal control system is less effective in supporting the implementation of Operational Risk Management;<br>n. Independent review implementation by internal audit function and independent review function is less adequate, with weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners requiring immediate improvement;<br>o. There are significant weaknesses based on independent review results requiring immediate improvement action; and<br>p. Follow-up on independent reviews is less adequate.
Rating 5 (Weak)	KPMR for Operational Risk is inadequate, with significant weaknesses in various aspects of Operational Risk Management whose resolution is beyond management's capability.<br><br>Examples of Company characteristics included in Rating 5 (weak) include the following:<br>a. Formulation of risk appetite and risk tolerance is inadequate and there is no connection with overall strategic objectives and business strategy;

Rating Definition Rating b. awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Operational Risk, sources of Operational Risk, and the level of Operational Risk in the Company are very weak;
c. Risk Management culture for Operational Risk is not strong or does not exist at all;
d. the performance of duties by the Board of Directors and Board of Commissioners is inadequate, there are significant weaknesses in almost all aspects of assessment, actions, and resolutions beyond the Company's capabilities; e. there are significant weaknesses in the Risk Management function for Operational Risk requiring fundamental improvement; f. delegation of authority is very weak or non-existent; g. the Risk Management strategy for Operational Risk is not aligned with the level of Risk to be taken (risk appetite) and Operational Risk tolerance; h. there are very significant weaknesses in policies, procedures, and limit setting for Operational Risk;
i. the Risk Management process for Operational Risk is inadequate in identifying, measuring, controlling, and monitoring Operational Risk;
j. business continuity management is unreliable; k. there are fundamental weaknesses in the Risk Management information system for Operational Risk;
l. Human Resources are inadequate in both quantity and quality in the Risk Management function for Operational Risk;
m. the internal control system is ineffective in supporting the implementation of Risk Management for Operational Risk; n. the implementation of independent review by the internal audit function and the function conducting independent review is inadequate, there are weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners requiring fundamental improvement; o. there are very significant weaknesses based on the results of independent review whose corrective actions are beyond

Rating Definition Rating p. follow-up on independent review is inadequate or non-existent.

Table III.C.1: Parameters or Indicators for Assessing Inherent Risk for Legal Risk
Parameter or Indicator Description

Absence or change in legislation
a. The number and nominal value of the Company's total products or activities not clearly regulated by legislation, and insurance/reinsurance products mediated or risk/loss assessed therefrom tend to have a high level of complexity compared to the Company's total revenue. Revenue from Products or Activities Not Regulated by Legislation Total Revenue b. The use of contract standards that do not comply with legislation or best practice compared to the total value of contracts. Value of Contracts Using Contract Standards Not Compliant with Legislation or Best Practice Total Value of Contracts
Weakness in agreements or cooperation
a. Failure to meet the validity requirements of agreements. b. Weaknesses in agreement clauses and/or failure to meet agreed requirements.
c. The parties' understanding of the agreement, especially in complex transactions using terms that are difficult to understand or unusual for the general public.
Weakness in agreements conducted by the Company is a source of problems or disputes later on that can generate potential Legal Risk for the Company. d. The existence of supporting documents related to agreements conducted by the Company with third parties. e. Periodic updating and review of agreements including the impact of said agreements.
Dispute resolution process
a. Inability to execute an agreement, either in whole or in part. b. The use of choice of law and legal jurisdiction in dispute resolution.
c. History of legal claims against the Company.
d. The nominal amount of the lawsuit and the estimated losses that the Company may experience due to legal claims.
It is clear enough.

e. The amount of losses experienced by the Company due to a court decision that has acquired permanent legal force compared to the Company's capital. f. The basis of the lawsuit that occurred and the party being sued or suing the Company in a filed lawsuit, as well as management's actions regarding a filed lawsuit. g. The possibility of similar lawsuits arising due to the same contract standards and the estimated total losses that may arise compared to the Company's capital.

Table III.C.2: Guidelines for Setting the Level of Inherent Risk for Legal Risk
Rating Definition Rating
Rating 1
(Low)
Considering the business activities conducted by the Company, the potential losses faced by the Company from Legal Risk are classified as very low during a certain period in the future.
Examples of characteristics of Companies included in rating 1 (low) include the following:
a. there are no products and/or Company activities not regulated by legislation, or there are products and/or activities not regulated by legislation in insignificant numbers. b. agreements made by the Company are very adequate; and
c. there are no litigation processes occurring in the Company, or there are litigation processes but the frequency and/or financial impact of lawsuits do not significantly disrupt the Company's financial conditions and do not have a major impact on the Company's reputation.
Rating 2
(Medium
Low)
Considering the business activities conducted by the Company, the potential losses faced by the Company from Legal Risk are classified as low during a certain period in the future.
Examples of characteristics of Companies included in rating 2 (medium low) include the following:
a. there are products and/or activities not regulated in legislation in less than significant numbers. b. agreements made by the Company are adequate; and
c. there are litigation processes occurring in the Company but the frequency and/or financial impact of the lawsuits are less than significant in disrupting the Company's financial conditions and less than significantly impacting the Company's reputation.
Rating 3
(Medium)
Considering the business activities conducted by the Company, the potential losses faced by the Company from Legal Risk are classified as moderately high during a certain period in the future.
Examples of characteristics of Companies included in rating 3 (medium) include the following:

Rating Definition Rating a. there are products and/or activities not regulated in legislation in a fairly significant number. b. agreements made by the Company are fairly adequate; and
c. there are litigation processes occurring in the Company with a frequency and/or financial impact of lawsuits that are fairly significant but less than disruptive to the Company's financial conditions, although there is a possibility of emerging Reputational Risk for the Company.
Rating 4
(Medium
High)
Considering the business activities conducted by the Company, the potential losses faced by the Company from Legal Risk are classified as high during a certain period in the future.
Examples of characteristics of Companies included in rating 4 (medium high) include the following:
a. there are products and/or activities not regulated in legislation in a significant number. b. agreements made by the Company are less than adequate; and
c. there are litigation processes occurring in the Company and the frequency and/or financial impact of lawsuits are significant so that if the Company loses, compensation for the lawsuit can disrupt the Company's financial conditions and have a major impact on the Company's reputation.
Rating 5
(High)
Considering the business activities conducted by the Company, the potential losses faced by the Company from Legal Risk are classified as very high during a certain period in the future.
Examples of characteristics of Companies included in rating 5 (high) include the following:
a. there are products and/or activities not regulated in legislation in a very significant number; b. agreements made by the Company are inadequate; and
c. there are litigation processes against the Company by the Company's consumers in a frequency and/or financial impact that are very significant so that if the Company loses

Rating Definition Rating in a court decision, such conditions can significantly affect the Company's business conditions.

Table III.C.3: Guidelines for Setting the Level of KPMR for Legal Risk
Rating Definition Rating
Rating 1
(Strong)
KPMR for Legal Risk is very adequate, there are minor weaknesses that are insignificant and can be ignored.
Examples of characteristics of Companies included in rating 1 (strong) include the following:
a. the formulation of the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) is very adequate and has aligned with overall strategic objectives and business strategy; b. the Board of Directors and Board of Commissioners have very good awareness and understanding regarding Risk Management for Legal Risk, sources of Legal Risk, and the level of Legal Risk in the Company;
c. the Risk Management culture for Legal Risk is very strong and has been internalized very well at all organizational levels;
d. the performance of duties by the Board of Directors and Board of Commissioners as a whole is very adequate; e. the Risk Management function for Legal Risk is independent, has clear tasks and responsibilities, and has operated very well; f. the delegation of authority is controlled and monitored periodically, and has operated very well; g. the Risk Management strategy for Legal Risk is very aligned with the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance); h. policies, procedures, and limit setting for Legal Risk are very adequate and available for all areas of Risk Management for Legal Risk, aligned with implementation, and well understood by employees;
i. the Risk Management process for Legal Risk is very adequate in identifying, measuring, controlling, and monitoring Legal Risk;
j. the Risk Management information system for Legal Risk is very good, producing comprehensive and integrated Legal Risk reports to the Board of Directors and Board of Commissioners;

Rating Definition Rating k. Human Resources are very adequate in both quantity and quality in the Risk Management function for Legal Risk;
l. the internal control system is very effective in supporting the implementation of Risk Management for Legal Risk;
m. the implementation of independent review by the internal audit function and the function conducting independent review is very adequate in terms of methodology, frequency, and reporting to the Board of Directors and Board of Commissioners; n. generally, there are no significant weaknesses based on the results of independent review; and o. follow-up on independent review has been implemented very adequately. Rating 2 (Rather Strong) KPMR for Legal Risk is adequate although there are some minor weaknesses that can be resolved in normal business activities. Examples of characteristics of Companies included in rating 2 (rather strong) include the following:
a. the formulation of the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) is adequate and has aligned with overall strategic objectives and business strategy; b. the Board of Directors and Board of Commissioners have good awareness and understanding regarding Risk Management for Legal Risk, sources of Legal Risk, and the level of Legal Risk in the Company;
c. the Risk Management culture for Legal Risk is strong and has been internalized well at all organizational levels;
d. the performance of duties by the Board of Directors and Board of Commissioners is generally adequate, there are some weaknesses but not significant and can be repaired immediately; e. the Risk Management function for Legal Risk has clear tasks and responsibilities and has operated well, but there are minor weaknesses that can be resolved in normal business activities; f. the delegation of authority is controlled and monitored periodically and has operated well;

Rating Definition Rating g. the Risk Management strategy for Legal Risk is aligned with the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance); h. policies, procedures, and limit setting for Legal Risk are adequate and available for all areas of Risk Management for Legal Risk, aligned with implementation, and well understood by employees although there are minor weaknesses;
i. the Risk Management process for Legal Risk is adequate in identifying, measuring, controlling, and monitoring Legal Risk;
j. the Risk Management information system for Legal Risk is good, including Legal Risk reporting to the Board of Directors and Board of Commissioners, but there are minor weaknesses that can be easily repaired; k. Human Resources are adequate in both quantity and quality in the Risk Management function for Legal Risk;
l. the internal control system is effective in supporting the implementation of Risk Management for Legal Risk;
m. the implementation of independent review by the internal audit function and the function conducting independent review is adequate in terms of methodology, frequency, and reporting to the Board of Directors and Board of Commissioners; n. there are weaknesses but not significant based on the results of independent review; and o. follow-up on independent review has been implemented adequately. Rating 3 (Adequate) KPMR for Legal Risk is fairly adequate. Although minimum requirements are met, there are some weaknesses that require management attention. Examples of characteristics of Companies included in rating 3 (adequate) include the following:
a. the formulation of the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) is fairly adequate but not always aligned with overall strategic objectives and business strategy; b. the Board of Directors and Board of Commissioners have fairly good awareness and understanding regarding Risk Management for Legal Risk, sources of

Rating Definition Rating
Legal Risk, and the level of Legal Risk in the Company;
c. the Risk Management culture for Legal Risk is fairly strong and has been internalized fairly well but not always implemented consistently;
d. the performance of duties by the Board of Directors and Board of Commissioners is generally fairly adequate, but there are weaknesses in some aspects of assessment that need management attention; e. the Risk Management function for Legal Risk is fairly good, but there are some weaknesses including reporting to the Board of Directors and Board of Commissioners that require management attention; f. the delegation of authority is fairly good, but control and monitoring are not always implemented well; g. the Risk Management strategy for Legal Risk is fairly aligned with the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance); h. policies, procedures, and limit setting for Legal Risk are fairly adequate but not always consistent with implementation;
i. the Risk Management process for Legal Risk is fairly adequate in identifying, measuring, controlling, and monitoring Legal Risk;
j. the Risk Management information system for Legal Risk meets minimum expectations but there are some weaknesses including reporting to the Board of Directors and Board of Commissioners that require management attention; k. Human Resources are fairly adequate in both quantity and quality in the Risk Management function for Legal Risk;
l. the internal control system is fairly effective in supporting the implementation of Risk Management for Legal Risk;
m. the implementation of independent review by the internal audit function and the function conducting independent review is fairly adequate, but there are some weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners that require management attention;

Rating Definition Rating n. there are fairly significant weaknesses based on the results of independent review that require management attention; and o. follow-up on independent review has been implemented fairly adequately. Rating 4 (Rather Weak) KPMR for Legal Risk is less than adequate, there are significant weaknesses in various aspects of Risk Management for Legal Risk requiring immediate corrective action. Examples of characteristics of Companies included in rating 4 (rather weak) include the following:
a. the formulation of the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) is less than adequate and not aligned with overall strategic objectives and business strategy; b. there are significant weaknesses in the awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Legal Risk, sources of Legal Risk, and the level of Legal Risk in the Company;
c. the Risk Management culture for Legal Risk is less than strong and has not been internalized well at every organizational level;
d. the performance of duties by the Board of Directors and Board of Commissioners is generally less than adequate, there are weaknesses in various aspects of assessment requiring immediate repair; e. there are significant weaknesses in the Risk Management function for Legal Risk requiring immediate repair; f. delegation of authority is weak, not controlled and not monitored well; g. the Risk Management strategy for Legal Risk is less than aligned with the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance); h. there are significant weaknesses in policies, procedures, and limit setting for Legal Risk;
i. the Risk Management process for Legal Risk is less than adequate in identifying, measuring, controlling, and monitoring Legal Risk;

Rating Definition Rating j. there are significant weaknesses in the Risk Management information system for Legal Risk including reporting to the Board of Directors and Board of Commissioners requiring immediate repair; k. Human Resources are less than adequate in terms of quantity and quality in the Risk Management function for Legal Risk;
l. the internal control system is less than effective in supporting the implementation of Risk Management for Legal Risk;
m. the implementation of independent review by the internal audit function and the function conducting independent review is less than adequate, there are weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners requiring immediate repair; n. there are significant weaknesses based on the results of independent review requiring immediate corrective action; and o. follow-up on independent review is less than adequate. Rating 5 (Weak) KPMR for Legal Risk is inadequate, there are significant weaknesses in various aspects of Risk Management for Legal Risk whose resolutions are beyond management's capabilities. Examples of characteristics of Companies included in rating 5 (weak) include the following:
a. the formulation of the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) is inadequate and there is no connection with overall strategic objectives and business strategy; b. the awareness and understanding of the Board of Directors and Board of Commissioners are very weak regarding Risk Management for Legal Risk, sources of Legal Risk, and the level of Legal Risk in the Company;
c. the Risk Management culture for Legal Risk is not strong or does not exist at all;
d. the performance of duties by the Board of Directors and Board of Commissioners is inadequate, there are significant weaknesses in almost all aspects of assessment and actions and resolutions beyond the Company's capabilities;

Rating Definition Rating e. there are significant weaknesses in the Risk Management function for Legal Risk requiring fundamental improvement; f. delegation of authority is very weak or non-existent; g. the Risk Management strategy for Legal Risk is not aligned with the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance); h. the Risk Management process for Legal Risk is inadequate in identifying, measuring, controlling, and monitoring Legal Risk;
i. there are fundamental weaknesses in the Risk Management information system for Legal Risk;
j. there are very significant weaknesses in the Risk Management information system for Legal Risk; k. Human Resources are inadequate in both quantity and quality in the Risk Management function for Legal Risk;
l. the internal control system is ineffective in supporting the implementation of Risk Management for Legal Risk;
m. the implementation of independent review by the internal audit function and the function conducting independent review is less than or inadequate, there are weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners requiring fundamental improvement; n. there are very significant weaknesses based on the results of independent review whose corrective actions are beyond o. follow-up on independent review is inadequate or non-existent.

Table III.D.1: Parameters or Indicators for Assessing Inherent Risk for Compliance Risk
Parameter or Indicator Description

Type and
significance of violations committed a. The type of violation or non-compliance committed by the Company b. The number of administrative sanctions in the form of fines imposed on the Company by the Financial Services Authority.
c. The number of administrative sanctions in the form of warnings or reprimands imposed on the Company
d. Significance of the violation e. Behavior underlying the violation The scope of the violation is a violation of legislation regulations and commitments to the Financial Services Authority, including sanctions imposed for violations committed by the Company.
Frequency of
violations
(including sanctions) committed or track record of company non-compliance a. The type and frequency of the same violations found each year in the last 3 (three) years. b. Significance of the same violation. Frequency is more historical by looking at the Company's compliance trend over the last 3 (three) years to determine whether the type of violation committed is repeated or whether significant improvements have not been made for said error by the Company.
Violations of
regulations
Frequency of violations of regulations because not in accordance with legislation regulations For example, violations include among others: tax regulations, accounting standards, codes of ethics, or other standards

Parameter or Indicator	Description
Regulations, applicable provisions for the Company, or general business standards	Laws or standards generally applicable in the financial services sector.

Follow-up on violations | Follow-up on violations of regulations, including fulfillment of the action plan submitted to the Financial Services Authority and other authorities. This is considered clear.

Table III.D.2: Guidelines for Setting Inherent Risk Levels for Compliance Risk

Rating	Definition	Rating
Rating 1 (Low)	Considering the business activities conducted by the Company, the potential losses the Company faces from Compliance Risk are classified as very low during a certain period in the future. Examples of characteristics of Companies included in Rating 1 (low) include the following: a. no violations of regulations; b. the Company's compliance track record is very good; and c. the Company has implemented all applicable business standards and codes of conduct.
Rating 2 (Low-Medium)	Considering the business activities conducted by the Company, the potential losses the Company faces from Compliance Risk are classified as low during a certain period in the future. Examples of characteristics of Companies included in Rating 2 (low-medium) include the following: a. there are relatively minor violations of regulations that can be promptly corrected by the Company (less significant); b. the Company's compliance track record is good; and c. the Company has implemented almost all applicable business standards and codes of conduct (there are less significant violations).
Rating 3 (Medium)	Considering the business activities conducted by the Company, the potential losses the Company faces from Compliance Risk are classified as moderately high during a certain period in the future. Examples of characteristics of Companies included in Rating 3 (medium) include the following: a. there are quite significant violations of regulations requiring management attention; b. the Company's compliance track record is less good; and c. there are quite significant violations of applicable business standards and codes of conduct.
Rating 4 (Medium-High)	Considering the business activities conducted by the Company, the potential losses the Company faces from Compliance Risk are classified as high during a certain period in the future. Examples of characteristics of Companies included in Rating 4 (medium-high) include the following: a. there are significant violations of regulations requiring immediate corrective action; b. the Company's compliance track record is poor; and c. there are significant violations of applicable business standards and codes of conduct.
Rating 5 (High)	Considering the business activities conducted by the Company, the potential losses the Company faces from Compliance Risk are classified as very high during a certain period in the future. Examples of characteristics of Companies included in Rating 5 (high) include the following: a. there are very significant violations of regulations requiring immediate correction; b. the Company's compliance track record is very poor; and c. there are very significant violations of applicable business standards and codes of conduct.

Table III.D.3: Guidelines for Setting KPMR Levels for Compliance Risk

Rating	Definition	Rating
Rating 1 (Strong)	The KPMR for Compliance Risk is very adequate; there are minor weaknesses that are not significant and can be ignored. Examples of characteristics of Companies included in Rating 1 (strong) include the following: a. the formulation of risk appetite and risk tolerance is very adequate and aligned with overall strategic objectives and business strategy; b. the Board of Directors and Board of Commissioners have very good awareness and understanding of Compliance Risk Management, sources of Compliance Risk, and the level of Compliance Risk in the Company; c. the Compliance Risk Management culture is very strong and has been well internalized at all organizational levels; d. the execution of duties by the Board of Directors and Board of Commissioners is overall very adequate; e. the Compliance Risk Management function is independent, has clear tasks and responsibilities, and operates very well; f. delegation of authority is controlled and monitored periodically, and operates very well; g. the Compliance Risk Management strategy is very aligned with risk appetite and risk tolerance; h. policies, procedures, and limits for Compliance Risk are very adequate and available to all Compliance Risk Management areas, aligned with implementation, and well understood by employees; i. the Compliance Risk Management process is very adequate in identifying, measuring, controlling, and monitoring Compliance Risk; j. the Compliance Risk Management information system is very good, producing comprehensive and integrated Compliance Risk reports to the Board of Directors and Board of Commissioners; k. Human Resources are very adequate in both quantity and quality for the Compliance Risk Management function; l. the internal control system is very effective in supporting the implementation of Compliance Risk Management; m. the implementation of independent reviews by the internal audit function and functions conducting independent reviews is very adequate in terms of methodology, frequency, and reporting to the Board of Directors and Board of Commissioners; n. generally, there are no significant weaknesses based on independent review results; and o. follow-up on independent reviews has been implemented very adequately.
Rating 2 (Fairly Strong)	The KPMR for Compliance Risk is adequate despite some minor weaknesses that can be resolved in normal business activities. Examples of characteristics of Companies included in Rating 2 (fairly strong) include the following: a. the formulation of risk appetite and risk tolerance is adequate and aligned with overall strategic objectives and business strategy; b. the Board of Directors and Board of Commissioners have good awareness and understanding of Compliance Risk Management, sources of Compliance Risk, and the level of Compliance Risk in the Company; c. the Compliance Risk Management culture is strong and has been well internalized at all organizational levels; d. the execution of duties by the Board of Directors and Board of Commissioners is generally adequate, with some weaknesses that are not significant and can be promptly corrected; e. the Compliance Risk Management function has clear tasks and responsibilities and operates well, but there are minor weaknesses that can be resolved in normal business activities; f. delegation of authority is controlled and monitored periodically and operates well; g. the Compliance Risk Management strategy is aligned with risk appetite and risk tolerance; h. policies, procedures, and limits for Compliance Risk are adequate and available to all Compliance Risk Management areas, aligned with implementation, and well understood by employees despite minor weaknesses; i. the Compliance Risk Management process is adequate in identifying, measuring, controlling, and monitoring Compliance Risk; j. the Compliance Risk Management information system is good, including reporting to the Board of Directors and Board of Commissioners, but there are minor weaknesses that can be easily corrected; k. Human Resources are adequate in both quantity and quality for the Compliance Risk Management function; l. the internal control system is effective in supporting the implementation of Compliance Risk Management; m. the implementation of independent reviews by the internal audit function and functions conducting independent reviews is adequate in terms of methodology, frequency, and reporting to the Board of Directors and Board of Commissioners; n. there are weaknesses but not significant based on independent review results; and o. follow-up on independent reviews has been implemented adequately.
Rating 3 (Sufficient)	The KPMR for Compliance Risk is sufficiently adequate. Although minimum requirements are met, there are some weaknesses requiring management attention. Examples of characteristics of Companies included in Rating 3 (sufficient) include the following: a. the formulation of risk appetite and risk tolerance is sufficiently adequate but not always aligned with overall strategic objectives and business strategy; b. the Board of Directors and Board of Commissioners have sufficiently good awareness and understanding of Compliance Risk Management, sources of Compliance Risk, and the level of Compliance Risk in the Company; c. the Compliance Risk Management culture is sufficiently strong and has been sufficiently internalized but not always implemented consistently; d. the execution of duties by the Board of Directors and Board of Commissioners is generally sufficiently adequate, but there are weaknesses in some assessment aspects that need management attention; e. the Compliance Risk Management function is sufficiently good, but there are some weaknesses including reporting to the Board of Directors and Board of Commissioners that require management attention; f. delegation of authority is sufficiently good, but control and monitoring are not always implemented well; g. the Compliance Risk Management strategy is sufficiently aligned with risk appetite and risk tolerance; h. policies, procedures, and limits for Compliance Risk are sufficiently adequate but not always consistent with implementation; i. the Compliance Risk Management process is sufficiently adequate in identifying, measuring, controlling, and monitoring Compliance Risk; j. the Compliance Risk Management information system meets minimum expectations but has some weaknesses including reporting to the Board of Directors and Board of Commissioners that require management attention; k. Human Resources are sufficiently adequate in both quantity and quality for the Compliance Risk Management function; l. the internal control system is sufficiently effective in supporting the implementation of Compliance Risk Management; m. the implementation of independent reviews by the internal audit function and functions conducting independent reviews is sufficiently adequate, but there are some weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners that require management attention; n. there are weaknesses that are quite significant based on independent review results requiring management attention; and o. follow-up on independent reviews has been implemented sufficiently adequately.
Rating 4 (Fairly Weak)	The KPMR for Compliance Risk is less adequate; there are significant weaknesses in various aspects of Compliance Risk Management requiring immediate corrective action. Examples of characteristics of Companies included in Rating 4 (fairly weak) include the following: a. the formulation of risk appetite and risk tolerance is less adequate and not aligned with overall strategic objectives and business strategy; b. there are significant weaknesses in the awareness and understanding of the Board of Directors and Board of Commissioners regarding Compliance Risk Management, sources of Compliance Risk, and the level of Compliance Risk in the Company; c. the Compliance Risk Management culture is less strong and has not been well internalized at every organizational level; d. the execution of duties by the Board of Directors and Board of Commissioners is generally less adequate, with weaknesses in various assessment aspects requiring immediate improvement; e. there are significant weaknesses in the Compliance Risk Management function requiring immediate improvement; f. delegation of authority is weak, not controlled, and not monitored well; g. the Compliance Risk Management strategy is less aligned with risk appetite and risk tolerance; h. there are significant weaknesses in policies, procedures, and limits for Compliance Risk; i. the Compliance Risk Management process is less adequate in identifying, measuring, monitoring, and controlling Compliance Risk; j. there are significant weaknesses in the Compliance Risk Management information system including reporting to the Board of Directors and Board of Commissioners requiring immediate improvement; k. Human Resources are less adequate in quantity and quality for the Compliance Risk Management function; l. the internal control system is less effective in supporting the implementation of Compliance Risk Management; m. the implementation of independent reviews by the internal audit function and functions conducting independent reviews is less adequate, with weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners requiring immediate improvement; n. there are significant weaknesses based on independent review results requiring immediate corrective action; and o. follow-up on independent reviews is less adequate.
Rating 5 (Weak)	The KPMR for Compliance Risk is inadequate; there are significant weaknesses in various aspects of Compliance Risk Management whose resolution is beyond management's capability. Examples of characteristics of Companies included in Rating 5 (weak) include the following: a. the formulation of risk appetite and risk tolerance is inadequate and not linked to overall strategic objectives and business strategy; b. the awareness and understanding of the Board of Directors and Board of Commissioners regarding Compliance Risk Management, sources of Compliance Risk, and the level of Compliance Risk in the Company is very weak; c. the Compliance Risk Management culture is not strong or does not exist at all; d. the execution of duties by the Board of Directors and Board of Commissioners is inadequate, with significant weaknesses in almost all assessment aspects and resolution actions beyond the Company's capability; e. there are significant weaknesses in the Compliance Risk Management function requiring fundamental improvement; f. delegation of authority is very weak or non-existent; g. the Compliance Risk Management strategy is not aligned with risk appetite and risk tolerance; h. there are very significant weaknesses in policies, procedures, and limits for Compliance Risk; i. the Compliance Risk Management process is inadequate in identifying, measuring, controlling, and monitoring Compliance Risk; j. there are fundamental weaknesses in the Compliance Risk Management information system; k. Human Resources are inadequate in quantity and quality for the Compliance Risk Management function; l. the internal control system is ineffective in supporting the implementation of Compliance Risk Management; m. the implementation of independent reviews by the internal audit function and functions conducting independent reviews is less or not adequate, with weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners requiring fundamental improvement; n. there are very significant weaknesses based on independent review results whose corrective actions are beyond management's capability; and o. follow-up on independent reviews is inadequate or non-existent.

Table III.E.1: Parameters or Indicators for Assessing Inherent Risk for Reputation Risk

Parameter or Indicator	Description
1. Reputational influence from management, owners, and company group	a. Credibility of management and owners. b. Reputational events involving management and owners. Credibility is assessed based on, among other things, negative news regarding management, shareholders of the Company, and/or companies related to the Company. Reputational events are assessed based on, among other things, negative events faced by the Company, such as bankruptcy petitions against the Company.
2. Violation of business ethics	Violations of ethics are visible through: a. transparency of financial information; b. business cooperation with other stakeholders; c. transparency of intermediary/consulting services; d. providing intermediary/consulting services without permission from the Financial Services Authority; and e. the Company withholding premiums. What needs to be noted is when the Company violates ethics or general business norms. Example: In providing consulting services, ethical violations can include providing misleading information to consumers. Example of financial information transparency is providing clear information regarding the insurer or reinsurer to the insured/ceding party.
3. Complexity of insurance/reinsurance products	a. Number and level of consumer usage of the Company's complex products and/or services. b. Number and materiality of the Company's cooperation with business partners. Complex products and/or Company activities and cooperation with business partners can expose Reputation Risk in case of misunderstanding of the use of products and/or services mediated by placement or assessed losses, and negative news about business partners, such as providing consulting services for a product by HR who has not received training for that product.
4. Frequency, materiality, and exposure of negative news	a. Frequency and materiality of negative news about the Company in 1 (one) year. b. Type of media and scope of news. The frequency, type of media, and materiality of negative news about the Company, including Company management, are measured during the assessment period.
5. Frequency and materiality of consumer complaints	a. Frequency of consumer complaints. b. Frequency of handling consumer complaint resolutions. c. Materiality of consumer complaints. The frequency of customer complaints can be assessed through the following calculation: Number of consumer complaints in 1 (one) year / Number of customers at year-end.

Table III.E.2: Guidelines for Setting Inherent Risk Levels for Reputation Risk

Rating	Definition	Rating
Rating 1 (Low)	Considering the business activities conducted by the Company, the potential losses the Company faces from Reputation Risk are classified as very low during a certain period in the future. Examples of characteristics of Companies included in Rating 1 (low) include the following: a. generally, there is no negative reputational influence from management, Company shareholders, and related companies; on the contrary, it is expected that management, Company shareholders, and related companies can provide a very positive influence on the Company's reputation; b. violations or potential violations of business ethics are very minimal (not significant); the Company has a reputation as a Company that highly upholds business ethics; c. Company products and/or activities are simple and easy for consumers to understand; d. the number and value of business cooperation with business partners are not significant; e. the frequency, nature, and scope of negative news about the Company are not significant; and f. the frequency and substance of consumer complaints are not material.
Rating 2 (Low-Medium)	Considering the business activities conducted by the Company, the potential losses the Company faces from Reputation Risk are classified as low during a certain period in the future. Examples of characteristics of Companies included in Rating 2 (low-medium) include the following: a. there is a negative reputational influence from management, Company shareholders, and related companies, but the scale of influence is small (less significant) and can be well mitigated; b. violations or potential violations of business ethics are less significant, and the Company has a reputation as a Company that upholds business ethics; c. Company products and/or activities are less simple, but relatively do not require special consumer understanding; d. the number and value of business cooperation with business partners are less significant; e. the frequency, nature, and scope of negative news about the Company are less significant; and f. the frequency and substance of consumer complaints are less material.
Rating 3 (Medium)	Considering the business activities conducted by the Company, the potential losses the Company faces from Reputation Risk are classified as moderately high during a certain period in the future. Examples of characteristics of Companies included in Rating 3 (medium) include the following: a. there is a negative reputational influence from management, Company shareholders, and related companies with a scale of influence that is quite significant but still controllable; b. violations or potential violations of business ethics occur, but the scale of influence is quite significant and requires management attention; c. Company products and/or activities are quite complex, thus requiring a certain level of special consumer understanding; d. the number and value of business cooperation with business partners are quite significant; e. the frequency, nature, and scope of negative news about the Company are quite significant; and f. the frequency and substance of complaints are quite material.
Rating 4 (Medium-High)	Considering the business activities conducted by the Company, the potential losses the Company faces from Reputation Risk are classified as high during a certain period in the future.
Rating 5 (High)	Considering the business activities conducted by the Company, the potential losses the Company faces from Reputation Risk are classified as very high during a certain period in the future.

(Note: The source text ends abruptly after the header for Rating 4 and the start of the definition for Rating 4. The translation reflects the available text.)

Table III.E.3: Guidelines for Determining the Level of KPMR for Reputational Risk

Rating	Definition of Rating
Rating 4 (Medium High)	The likelihood of losses faced by the Company from Reputational Risk is classified as high during a certain period in the future.

Examples of characteristics of Companies included in rating 4 (medium high) include the following:
a. negative reputational influence from the Board of Directors, shareholders, and related companies with significant influence scale requiring special management attention; b. occurrence of violations or potential violations of business ethics with significant influence scale requiring special attention;
c. Company products and/or activities are complex, requiring special consumer understanding;
d. the number and value of business collaborations with significant business partners; e. frequency, nature, and scope of negative reporting on the Company are significant; and f. frequency and substance of consumer complaints are material.

Rating	Definition of Rating
Rating 5 (High)	Considering the business activities conducted by the Company, the likelihood of losses faced by the Company from Reputational Risk is classified as very high during a certain period in the future.

Examples of characteristics of Companies included in rating 5 (high) include the following:
a. negative reputational influence from the Board of Directors, shareholders, and related companies with very significant influence scale requiring immediate follow-up and management; b. occurrence of violations or potential violations of business ethics with very significant scale requiring immediate follow-up and management;
c. Company products and/or activities are very complex, requiring very special consumer understanding;
d. the number and value of business collaborations with business partners are very significant; e. frequency, nature, and scope of negative reporting on the Company are very significant; and f. frequency and substance of consumer complaints are very material.

Table III.E.3: Guidelines for Determining the Level of KPMR for Reputational Risk

Rating	Definition of Rating
Rating 1 (Strong)	KPMR for Reputational Risk is very adequate, there are minor weaknesses that are insignificant, so they can be ignored.

Examples of characteristics of Companies included in rating 1 (strong) include the following:
a. formulation of the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) is very adequate and has aligned with overall strategic objectives and business strategy; b. the Board of Directors and Board of Commissioners have very good awareness and understanding of Risk Management for Reputational Risk, sources of Reputational Risk, and the level of Reputational Risk in the Company;
c. Risk Management culture for Reputational Risk is very strong and has been internalized very well at all organizational levels;
d. the implementation of duties by the Board of Directors and Board of Commissioners is overall very adequate; e. the Risk Management function for Reputational Risk is independent, has clear duties and responsibilities, and has operated very well; f. delegation of authority is controlled and monitored periodically, and has operated very well; g. Risk Management strategy for Reputational Risk is very aligned with the level of Risk to be taken (risk appetite) and risk tolerance (risk tolerance); h. policies, procedures, and limit setting for Reputational Risk are very adequate and available for all areas of Risk Management for Reputational Risk, aligned with implementation, and well understood by employees;
i. Risk Management process for Reputational Risk is very adequate in identifying, measuring, controlling, and monitoring Reputational Risk;
j. Risk Management information system for Reputational Risk is very good, producing comprehensive and integrated Reputational Risk reports to the Board of Directors and Board of Commissioners; k. Human Resources are very adequate in terms of quantity and quality in the Risk Management function for Reputational Risk;
l. internal control system is very effective in supporting the implementation of Risk Management for Reputational Risk;
m. implementation of independent review by internal audit function and functions conducting independent review is very adequate in terms of methodology, frequency, and reporting to the Board of Directors and Board of Commissioners; n. generally, there are no significant weaknesses based on independent review results; and o. follow-up on independent review has been implemented very adequately.

Rating	Definition of Rating
Rating 2 (Fairly Strong)	KPMR for Reputational Risk is adequate although there are some minor weaknesses that can be resolved in normal business activities.

Examples of characteristics of Companies included in rating 2 (fairly strong) include the following:
a. formulation of the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) is adequate and has aligned with overall strategic objectives and business strategy; b. the Board of Directors and Board of Commissioners have good awareness and understanding of Risk Management for Reputational Risk, sources of Reputational Risk, and the level of Reputational Risk in the Company;
c. Risk Management culture for Reputational Risk is strong and has been internalized well at all organizational levels;
d. the implementation of duties by the Board of Directors and Board of Commissioners is generally adequate, there are some weaknesses but not significant and can be repaired immediately; e. the Risk Management function for Reputational Risk has clear duties and responsibilities and has operated well, but there are minor weaknesses that can be resolved in normal business activities; f. delegation of authority is controlled and monitored periodically and has operated well; g. Risk Management strategy for Reputational Risk is aligned with the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance); h. policies, procedures, and limit setting for Reputational Risk are adequate and available for all areas of Risk Management for Reputational Risk, aligned with implementation, and well understood by employees although there are minor weaknesses;
i. Risk Management process for Reputational Risk is adequate in identifying, measuring, controlling, and monitoring Reputational Risk;
j. Risk Management information system for Reputational Risk is good, including Reputational Risk reporting to the Board of Directors and Board of Commissioners, but there are minor weaknesses that can be easily repaired; k. Human Resources are adequate in terms of quantity and quality in the Risk Management function for Reputational Risk;
l. internal control system is effective in supporting the implementation of Risk Management for Reputational Risk;
m. implementation of independent review by internal audit function and functions conducting independent review is adequate in terms of methodology, frequency, and reporting to the Board of Directors and Board of Commissioners; n. there are weaknesses but not significant based on independent review results; and o. follow-up on independent review has been implemented adequately.

Rating	Definition of Rating
Rating 3 (Fair)	KPMR for Reputational Risk is fairly adequate. Although minimum requirements are met, there are some weaknesses that require management attention.

Examples of characteristics of Companies included in rating 3 (fair) include the following:
a. formulation of the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) is fairly adequate but not always aligned with overall strategic objectives and business strategy; b. the Board of Directors and Board of Commissioners have fairly good awareness and understanding of Risk Management for Reputational Risk, sources of Reputational Risk, and the level of Reputational Risk in the Company;
c. Risk Management culture for Reputational Risk is fairly strong and has been internalized fairly well but not always implemented consistently;
d. the implementation of duties by the Board of Directors and Board of Commissioners is generally fairly adequate, but there are weaknesses in some assessment aspects that need management attention; e. the Risk Management function for Reputational Risk is fairly good, but there are some weaknesses including reporting to the Board of Directors and Board of Commissioners that require management attention; f. delegation of authority is fairly good, but control and monitoring are not always implemented well; g. Risk Management strategy for Reputational Risk is fairly aligned with the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance); h. policies, procedures, and limit setting for Reputational Risk are fairly adequate but not always consistent with implementation;
i. Risk Management process for Reputational Risk is fairly adequate in identifying, measuring, controlling, and monitoring Reputational Risk;
j. Risk Management information system for Reputational Risk meets minimum expectations but there are some weaknesses including reporting to the Board of Directors and Board of Commissioners that require management attention; k. Human Resources are fairly adequate in terms of quantity and quality in the Risk Management function for Reputational Risk;
l. internal control system is fairly effective in supporting the implementation of Risk Management for Reputational Risk;
m. implementation of independent review by internal audit function and functions conducting independent review is fairly adequate, but there are some weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners that require management attention; n. there are weaknesses that are fairly significant based on independent review results that require management attention; and o. follow-up on independent review has been implemented fairly adequately.

Rating	Definition of Rating
Rating 4 (Fairly Weak)	KPMR for Reputational Risk is less adequate, there are significant weaknesses in various aspects of Risk Management for Reputational Risk that require immediate corrective action.

Examples of characteristics of Companies included in rating 4 (fairly weak) include the following:
a. formulation of the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) is less adequate and not aligned with overall strategic objectives and business strategy; b. there are significant weaknesses in the awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Reputational Risk, sources of Reputational Risk, and the level of Reputational Risk in the Company;
c. Risk Management culture for Reputational Risk is not strong and has not been internalized well at every organizational level;
d. the implementation of duties by the Board of Directors and Board of Commissioners is generally less adequate, there are weaknesses in various assessment aspects that require immediate repair; e. there are significant weaknesses in the Risk Management function for Reputational Risk that require immediate repair; f. delegation of authority is weak, not controlled and not monitored well; g. Risk Management strategy for Reputational Risk is less aligned with the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance); h. there are significant weaknesses in policies, procedures, and limit setting for Reputational Risk;
i. Risk Management process for Reputational Risk is less adequate in identifying, measuring, controlling, and monitoring Reputational Risk;
j. there are significant weaknesses in the Risk Management information system for Reputational Risk including reporting to the Board of Directors and Board of Commissioners that require immediate repair; k. Human Resources are less adequate in terms of quantity and quality in the Risk Management function for Reputational Risk;
l. internal control system is less effective in supporting the implementation of Risk Management for Reputational Risk;
m. implementation of independent review by internal audit function and functions conducting independent review is less adequate, there are weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners that require immediate repair; n. there are significant weaknesses based on independent review results that require immediate repair action; and o. follow-up on independent review is less adequate.

Rating	Definition of Rating
Rating 5 (Weak)	KPMR for Reputational Risk is not adequate, there are significant weaknesses in various aspects of Risk Management for Reputational Risk whose resolution is beyond management's capability.

Examples of characteristics of Companies included in rating 5 (weak) include the following:
a. formulation of the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) is not adequate and there is no connection with overall strategic objectives and business strategy; b. awareness and understanding of the Board of Directors and Board of Commissioners is very weak regarding Risk Management for Reputational Risk, sources of Reputational Risk, and the level of Reputational Risk in the Company;
c. Risk Management culture for Reputational Risk is not strong or does not exist at all;
d. the implementation of duties by the Board of Directors and Board of Commissioners is not adequate, there are significant weaknesses in almost all assessment aspects and the resolution actions are beyond the Company's capability; e. there are significant weaknesses in the Risk Management function for Reputational Risk that require fundamental repair; f. delegation of authority is very weak or non-existent; g. management strategy for Reputational Risk is not aligned with the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance); h. there are very significant weaknesses in policies, procedures, and limit setting for Reputational Risk;
i. Risk Management process for Reputational Risk is not adequate in identifying, measuring, controlling, and monitoring Reputational Risk;
j. there are fundamental weaknesses in the Risk Management information system for Reputational Risk; k. Human Resources are not adequate in terms of quantity and quality in the Risk Management function for Reputational Risk;
l. internal control system is not effective in supporting the implementation of Risk Management for Reputational Risk;
m. implementation of independent review by internal audit function and functions conducting independent review is less or not adequate, there are weaknesses in methodology, frequency, and/or reporting to the Board of Directors and Board of Commissioners that require fundamental repair; n. there are very significant weaknesses based on independent review results whose repair actions are beyond o. follow-up on independent review is not adequate or non-existent.

Table III.F.1: Matrix for Determining Risk Level.

Inherent Risk Level	Quality Level of Risk Management Implementation
	Strong	Fairly Strong	Fair	Fairly Weak	Weak
Low	1	1	2
Medium	2	2	3
High	3	3	4	5	5

Table III.G.1: Format for Determining Composite Risk Profile Rating

Risk Type	Inherent Risk Level	KPMR Level	Risk Level
Strategic Risk
Operational Risk
Legal Risk
Compliance Risk
Reputational Risk
Composite Rating			Risk Profile Rating

Table III.G.2: Guidelines for Determining Risk Profile Rating

Rating	Definition
Rating 1	The Company's Risk Profile included in this rating generally has characteristics as follows:
a. considering the business activities conducted by the Company, the likelihood of losses faced by the Company from Inherent Risk in composite is classified as very low during a certain period in the future; and b. KPMR in composite is very adequate, in case there are minor weaknesses, such weaknesses can be ignored.

Rating	Definition
Rating 2	The Company's Risk Profile included in this rating generally has characteristics as follows:
a. considering the business activities conducted by the Company, the likelihood of losses faced by the Company from Inherent Risk in composite is classified as low during a certain period in the future; and b. KPMR in composite is adequate, in case there are minor weaknesses, such weaknesses need to receive management attention.

Rating	Definition
Rating 3	The Company's Risk Profile included in this rating generally has characteristics as follows:
a. considering the business activities conducted by the Company, the likelihood of losses faced by the Company from Inherent Risk in composite is classified as fairly high during a certain period in the future; and b. KPMR in composite is fairly adequate, although minimum requirements are met, there are some weaknesses that require management attention and improvement.

Rating	Definition
Rating 4	The Company's Risk Profile included in this rating generally has characteristics as follows:
a. considering the business activities conducted by the Company, the likelihood of losses faced by the Company from Inherent Risk in composite is classified as high during a certain period in the future; and b. KPMR in composite is less adequate, there are significant weaknesses in various aspects of Risk Management that require immediate corrective action.

Rating	Definition
Rating 5	The Company's Risk Profile included in this rating generally has characteristics as follows:
a. considering the business activities conducted by the Company, the likelihood of losses faced by the Company from Inherent Risk in composite is classified as very high during a certain period in the future; and b. KPMR in composite is not adequate, there are significant weaknesses in various aspects of Risk Management whose resolution is beyond management's capability.

Determined in Jakarta on April 12, 2021

EXECUTIVE HEAD OF SUPERVISOR
OF INSURANCE, PENSION FUNDS,
FINANCING INSTITUTIONS, AND
OTHER FINANCIAL SERVICES INSTITUTIONS
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA,

Signed,
RISWINANDI

APPENDIX II
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 13 /SEOJK.05/2021 CONCERNING IMPLEMENTATION OF RISK MANAGEMENT FOR INSURANCE BROKERAGE COMPANIES, REINSURANCE BROKERAGE COMPANIES, AND INSURANCE LOSS ASSESSORS

ORGANIZATIONAL STRUCTURE OF RISK MANAGEMENT FOR INSURANCE BROKERAGE COMPANIES, REINSURANCE BROKERAGE COMPANIES, AND INSURANCE LOSS ASSESSORS

A. General Guidelines
In the implementation of Risk Management, the Company must have an organizational structure and Risk Management function in accordance with the Financial Services Authority regulations regarding the implementation of Risk Management for non-bank financial service institutions. The organizational structure and function mentioned above can be developed in accordance with the Company's business characteristics and complexity of business activities.

B. Risk Management Committee Organizational Structure

The Risk Management Committee is a non-structural unit with membership that can be permanent and non-permanent, in accordance with the Company's policy.
Permanent members are the Board of Directors and executive officials designated to exercise authority and responsibilities permanently for a certain period, such as directors overseeing the Risk Management function, while non-permanent members are the Board of Directors and executive officials related to topics discussed and recommended in the Risk Management Committee, such as the head of the compliance division for topics regarding the Company's activity compliance with applicable regulations.
The Risk Management Committee consists of at least half of the Board of Directors members and relevant executive officials. Half of the Board of Directors members means 50% (fifty percent) of the total number of Board of Directors members. For example, if the number of Directors is 2 (two), then half is 1 (one) Director. The membership of executive officials in the Risk Management Committee refers to number 2.
The authority and responsibility of the Risk Management Committee are to provide recommendations to the Chief Director, which at least include:
a) formulation of policies and guidelines for the implementation of Risk Management, including recommendations regarding the level of Risk to be taken and Risk tolerance in determining the Company's business strategy; b) improvement and/or refinement of Risk Management implementation based on the results of Risk Management implementation evaluation; and c) consideration and/or determination of matters related to operational decisions that deviate from normal procedures.

C. Risk Management Function Organizational Structure

The Risk Management Function is a structural function in the Company that is directly responsible to the Board of Directors member who oversees the Risk Management function. The Risk Management Function can be structurally combined with the unit handling the compliance function. The Risk Management Function must be independent, i.e., it does not handle business and operational functions (risk taking unit) and does not carry out internal audit functions.
The authority and responsibility of the Risk Management Function include:
a) Monitoring the implementation of Risk Management policies and guidelines approved by the Board of Directors.
Monitoring the implementation of Risk Management policies and guidelines can be done, for example, through impact tests or simulations. This is to determine the impact of the implementation of Risk Management policies and strategies on the Company's portfolio or overall performance. b) Monitoring the overall Risk position, by Risk type, and by functional activity type. The monitoring mentioned includes compliance with established Risk tolerance and limits, as well as Risk position trends. c) Assessment of product proposals and/or implementation of new activities. The assessment of product proposals and/or new activities aims to evaluate the Company's ability to run/manage products/services and/or new activities, including studies of changes in systems and procedures related to products/services and/or implementation of new activities, and to see the impact on the Company's overall Risk exposure. d) Submission of recommendations to business and operational functions as well as the Risk Management Committee according to the authority possessed.

Business and operational functions are employees who handle intermediary services, consulting services, and/or other operational activities. Recommendations submitted by the Risk Management function include information regarding the magnitude or maximum Risk exposure that the Company must maintain. These recommendations are submitted to the Board of Directors members who oversee the Risk Management function and the Risk Management Committee.

e) Preparation and submission of periodic Risk profile reports to the Board of Directors members who oversee the Risk Management function and the Risk Management Committee.

The Risk Profile is a comprehensive overview of the magnitude of potential Risks inherent in the Company's entire portfolio or exposures. Periodic submission of reports is at least once (1) in one (1) year. The Risk Profile report is submitted to the Board of Directors members who oversee the Risk Management function and the Risk Management Committee. The aforementioned report is evaluated and used as a basis for providing guidance to the Board of Directors in formulating Risk Management policies and guidelines.

The authority and responsibilities of the Risk Management function can be adjusted according to the business characteristics and complexity of the Company's business activities.

D. Relationship between Business and Operational Functions and the Risk Management Function

Information Submission

a) Business and operational functions (risk-taking function) as the first line of defense (1st lines of defense) within the Company in managing Risks are required to inform the Risk Management function of inherent risk exposures on a periodic basis.

b) The frequency of submitting inherent risk exposure information is adjusted according to the characteristics of the type of Risk. If inherent risks faced by the business and operational functions (risk-taking function) are handled daily, information submission to the Risk Management function can be more intensive.

Examples of Relationships between Functions in the Risk Management Organizational Structure

The organizational structure, which is the Risk Management function, is adjusted according to the size and complexity of the Company's business as well as the relevant and inherent Risks in the Company's functional activities. Several examples of the forms or formats of the Risk Management organization and function in the Company can be described as follows:

a) Format 1
The Risk Management function is under a director other than the Chief Executive Director.

b) Format 2
The Risk Management function is under the Chief Executive Director.

This copy is consistent with the original
Legal Director 1
Legal Department signed
Mufli Asmawidjaja

c) Format 3
The Risk Management Committee has a reporting line or membership line to the Risk Management group of the Company's business group.

Established in Jakarta on 12 April 2021
EXECUTIVE HEAD OF SUPERVISOR
OF INSURANCE, PENSION FUNDS,
LENDING INSTITUTIONS, AND
OTHER FINANCIAL SERVICE INSTITUTIONS
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA, signed
RISWINANDI

Implementation of Risk Management for Insurance Brokerage Companies, Reinsurance Brokerage Companies, and Insurance Loss Assessors

Lineage: In force