Guidelines on Risk Management Practices for Insurance Business - Core Activities

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS
• CORE ACTIVITIES

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE TABLE OF CONTENTS 1 INTRODUCTION AND FUNDAMENTALS.........................................................1 1.1 Introduction ...................................................................................................1 1.2 Fundamentals ................................................................................................2 2 RISK MANAGEMENT FRAMEWORK ..............................................................2 2.1 Strategy ..........................................................................................................2 2.2 Structure ........................................................................................................2 2.3 Policies and Procedures.................................................................................4 3 RISK IDENTIFICATION, CONTROL AND MONITORING.....................................5 3.1 Risk Management Process.............................................................................5 3.2 Product Development....................................................................................7 3.3 Pricing...........................................................................................................11 3.4 Underwriting................................................................................................13 3.5 Claims Handling............................................................................................16 3.6 Reinsurance Management...........................................................................19

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 1 1 INTRODUCTION AND FUNDAMENTALS 1.1 Introduction 1.1.1 This chapter provides guidance on sound practices in carrying out insurance business and covers the core activities of product development, pricing, underwriting, claims handling and reinsurance management. It articulates broad principles that should be embedded in a risk management framework covering strategy, organisational structure, policies and procedures for managing risks inherent in these activities. The guidelines contained in this chapter are applicable for both life and general insurance business, unless explicitly stated otherwise. 1.1.2 This chapter should be read in conjunction with other relevant Notices and guidelines issued by MAS, in particular “MAS Notice 126 on Enterprise Risk Management”, “MAS Notice 114 on Reinsurance Management”, “MAS Notice 302 on Product Development and Pricing”, “Guidelines on Outsourcing”, “Guidelines on Corporate Governance for Designated Financial Holding Companies, Banks, Direct Insurers, Reinsurers and Captive Insurers which are Incorporated in Singapore”, “Guidelines on Individual Accountability and Conduct”, “Guidelines on Environmental Risk Management (Insurers)” and all the chapters on “Guidelines on Risk Management Practices” . 1.1.3 Insurers are encouraged to adopt the sound practicesrecommended in this chapter and the other guidelines where applicable and to the level that is commensurate with the institutions’ risk and business profiles. 1.1.4 The expressions used in this chapter shall, except where expressly defined in the guidelines or where the context otherwise requires, have the same respective meanings as in the Insurance Act 1966. 1.1.5 For the purposes of this chapter, “Board” refers to: (i) in the case of an insurer incorporated in Singapore, the Board of directors; and (ii) in the case of an insurer incorporated or established outside Singapore, a governing body or committee beyond local management that is charged with oversight and supervision responsibilities for the insurer’s operations in Singapore.

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 2 1.2 Fundamentals 1.2.1 Product development, pricing, underwriting, claims handling and reinsurance management represent the core activities of an insurer. In carrying out these core activities, an insurer will face a wide range of risks which are often interlinked and if not properly managed, could threaten the ability of the institution to achieve its objectives and sustain its viability. An insurer should therefore adopt a holistic approach to adequately identify, measure, control and monitor these risks. 2 RISK MANAGEMENT FRAMEWORK 2.1 Strategy 2.1.1 An insurer should have a sound strategy to manage risks arising from its core activities. The insurer should first determine its risk tolerance, i.e. the level of risk that it is able and prepared to bear, taking into account its business objectives and available resources. In formulating its risk management strategy, the insurer should consider the following: (a) the prevailing and projected economic and market conditions and their impact on the risks inherent in its core activities; (b) the available expertise to achieve its business targets in specific market segments and its ability to identify, monitor and control the risks in those market segments; and (c) its mix of business/type of risks written and the resultant concentration risks which may lead to volatility in profitability. 2.1.2 The insurer should periodically review its risk management strategy taking into account its own financial performance and market developments. When there are material changes to the insurer’s operations or its business strategy, the insurer should review its risk management strategy appropriately to take account of the changes. The strategy should be properly documented and effectively communicated to all relevant staff. There should be a process to approve proposed deviations from the approved strategy, and systems and controls to detect unauthorised deviations. 2.2 Structure

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 3 2.2.1 An insurer should adopt a risk management structure that is commensurate with its size and nature of its activities. The organisational structure should facilitate effective management oversight and execution of risk management and control processes. 2.2.2 The Board is ultimately responsible for the sound and prudent management of an insurer. The Board should approve the risk management strategy and risk management policies pertaining to core insurance activities. It should ensure that adequate resources, expertise and support are provided for the effective implementation of the insurer’s risk management strategy, policies and procedures. It should also be the approving authority for changes to such policies, and ensure that any exceptions, which can include circumstances where delegation may be proposed, should be escalated and approved by it, where necessary. The reasons for these changes and exceptions should be documented. Such documentation should also be made available upon the request of the internal auditor, external auditor and the regulator. 2.2.3 The senior management, or a committee comprising members of senior management from both the business operations and control functions, should establish the risk management framework. The framework should cover areas such as approval of business and risk management strategy, review of the risk profile, implementation of risk management policies approved by the Board, delegation of authority and evaluation of the business processes. There should be adequate measures to address potential conflicts of interest. For example, the member of senior management approving the base premium rate of a life insurance product should not have marketing responsibilities and there should be proper segregation of underwriting responsibilities from claims handling and settlement responsibilities. Claims should be reported directly to the Claims Department instead of through the Underwriting Department. 2.2.4 The insurer should establish a risk management function, preferably independent from the operational processes, if warranted by the size and complexity of its operations. This function would be primarily responsible for the development of and ensuring compliance with the insurer’s risk management policies and procedures, and for ensuring that these policies and procedures are aligned with the insurer's desired risk culture. The risk management function should also establish, implement, and maintain appropriate mechanisms and activities to consider risks arising from remuneration arrangements and incentive structures. In order to be effective, this function should have the requisite authority, sufficient resources and the ability to raise issues directly to the Board or relevant Board Committees.

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 4 2.3 Policies and Procedures 2.3.1 Risk management policies should set out the conditions and guidelines for the identification, acceptance, monitoring and management of risks. These policies should be well-defined and consistent with the insurer’s risk strategy, as well as adequate for the nature and complexity of its activities. They should also help explain the relationship of the risk management system to the insurer’s overall governance framework and to its corporate culture. Where the insurer is part of a wider insurance group, the insurer should perform regular reviews to ensure that its risk management policies are aligned with the group’s risk management policies. The policies should, at a minimum, cover the following: (a) the identification, measurement and communication of key risks to the Board; (b) the process by which the Board decides on the maximum amount of risk the insurer is able to take, as well as the frequency of review of risk limits; (c) the roles and responsibilities of the respective units and staff involved in acceptance, monitoring and management of risks; (d) the approval structure for product development, pricing, underwriting, claims handling and reinsurance management, including authority to approve deviations and exceptions; (e) the principles and criteria relating to product development, pricing, underwriting, claims handling and reinsurance management; and (f) the management of concentration risk and exposures to catastrophic events, including limits, reinsurance, portfolio monitoring and stress testing. 2.3.2 In order to be effective, policies should be formalised, i.e. they should be properly documented, approved, and communicated regularly throughout the organisation and should be regularly reviewed to take into account changing internal and external circumstances. There should also be regular training on risk management policies. The insurer should review significant or frequent policy exceptions to determine the potential impact on its risk profile as well as the effectiveness of its guidelines.

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 5 2.3.3 The insurer should establish appropriate procedures and processes to implement its risk management policies in the form of controls, checks and monitoring mechanisms. These should be documented and set out in sufficient detail to provide operational guidance to staff. Examples include procedures governing the approval of product launch, significant deviations from standard pricing and terms, ex-gratia claims, and other exception cases. The insurer should also perform regular checks of outputs arising from automated processes to assess whether such processes are working as intended. The operational procedures should be periodically reviewed and updated to take into account new activities, changes in systems and structural changes in the market. 2.3.4 The insurer should have in place proper and effective reporting systems to satisfy the requirements of the Board with respect to reporting frequency, level of detail, usefulness of information and recommendations to address issues of concern. There should be clear guidelines on the type of information to be reported to the Board on a regular basis as well as when certain information or development ought to be communicated immediately to the Board. The head of risk management function should have the authority and obligation to inform the Board promptly of any circumstance that may have a material effect on the risk management system of the insurer. 3 RISK IDENTIFICATION, CONTROL AND MONITORING 3.1 Risk Management Process 3.1.1 An effective risk management process to address risks arising from core insurance activities; namely product development, pricing, underwriting, claims handling and reinsurance management should include the following: (a) Risk Identification and Measurement An insurer should have effective means of obtaining pertinent information to identify and measure its exposure to risks inherent in its core activities. Where a risk is not readily quantifiable, for instance some operational risks, an insurer should undertake a qualitative assessment that is appropriate to the risk and sufficiently detailed so that it can be useful for risk management. (b) Risk Evaluation

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 6 The estimated risks should be compared against the insurer’s risk criteria to decide on the priority to be assigned to address each of the risks and the appropriate responses. (c) Risk Control and Mitigation The insurer should implement necessary measures to control and mitigate the identified risks. Risk control/mitigation measures include setting appropriate standards and limits that are clearly documented and assigning limits to relevant staff that are commensurate with the experience and competence of the respective individual. (d) Risk Monitoring and Review There should be an effective monitoring system to track whether any risk indicators have been triggered, and to ensure that risk standards and limits are complied with as intended and any deviation is duly approved and documented. The insurer should also establish clear procedures to investigate non-compliances with the intent of preventing such incidents from recurring. The consequences for non-compliance with established limits should be clear and pre-determined. The insurer should regularly review whether it has correctly assessed the impact and probability of material risks and effectively treated or mitigated the risks, including identification of lessons that could be learned for future assessment and management of risks. For example, the insurer should put in place an effective system to gather underwriting and claims information to identify any emerging trend and provide feedback to the relevant business units so that these can be taken into account in any subsequent marketing, product development, pricing, underwriting, reserving and reinsurance management decisions. 3.1.2 A sound and robust risk management process should include stress testing and scenario analysis to assess the potential impact of probable material adverse events on the insurer’s reputation, liquidity, and overall financial strength. It is also essential to assess the adequacy of reinsurance programmes and other alternative risk transfer arrangements, such as securitisation, that are undertaken to mitigate the impact of possible adverse events on the viability of the insurer.

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 7 3.1.3 Emerging risks relates to risks that do not currently exist but may emerge at some point in time due to changes in the environment, for example, respiratory problems arising from air pollution which could significantly raise the level of medical insurance claims from policyholders. 3.1.4 Sound practices for the management of emerging risks include: (a) identifying emerging risks through an early warning system where information could be gathered either through internal or external sources; (b) assessing the significance of the emerging risks within the insurer’s portfolio by identifying which business class and policies are likely to be affected by the materialisation of the risk. In evaluating the potential financial impact, the insurer needs to take into account the degree of concentration and potential correlation with other risks already present in the portfolio; and (c) defining appropriate responses to emerging risks. For example, a response could be to mitigate the risk with an appropriate reinsurance programme. 3.2 Product Development 3.2.1 Product development is the process of working out the features of a product (which includes ancillary services provided) to be marketed to customers in accordance with the insurer’s business objectives. This includes enhancements or variations to existing products. 3.2.2 The product development process generally involves conducting environment scans, understanding customers’ needs, developing, and refining proposals, obtaining the requisite approvals, implementing the approved proposals and conducting post-implementation reviews. 3.2.3 Risk Identification and Measurement 3.2.3.1 An insurer should analyse the information collected to identify emerging trends, and the associated opportunities and threats they may pose to the insurer’s business. The insurer should document its analysis of the potential influence of the market environment and emerging trends on the level of risks and profitability of the product being developed. The potential risks that the insurer need to consider may include:

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 8 (a) Pricing, Underwriting and Reserving risks The insurer should identify and measure the potential risk arising from pricing, underwriting and case reserving as stated in sections 3.3.3, 3.4.3, 3.5.3 and 3.6.3. (b) Operational Risk The insurer should assess whether all relevant departments are equipped to handle the expected volume of business from the launch of the new product; determine the adequacy of expertise of staff and management; and consider if new systems and procedures need to be put in place. The insurershould consider the operational risks posed by the proposed distribution channel for the product, (c) Legal, Regulatory and Reputational Risks The insurer should identify the applicable regulatory requirements for the introduction of the product, and the best practice standards for the distribution of the product. It should also evaluate the potential risks to its reputation and legal liabilities that it may incur in the event of non-compliance with these requirements and standards. It should assess the need for additional resources and processes to ensure compliance and to mitigate such risks. It should also ensure that the relevant disclosure documents explain the features of the product clearly and consider the risks that it will be exposed to if contract wordings are ambiguous or inconsistent with the intended coverage for both direct policies and reinsurance outward contracts. (d) Credit Risk The insurer should consider the creditworthiness of the reinsurers, intermediaries, policyholders as well as of other counterparties which may give rise to credit risk. 3.2.4 Risk Control and Mitigation 3.2.4.1 An insurer should verify that the proposed product is consistent with the insurer’s risk strategy and policies. In particular for life insurers, the proposed product should be consistent with the insurer’s policies and procedures in respect of the development and pricing of insurance products and investment linked product (ILP) sub-funds that are approved by the insurer’s Board (in accordance with MAS Notice

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 9 302). It should also scrutinise assumptions made in product proposals about likely consumer behaviour and market reactions and verify these assumptions where appropriate. 3.2.4.2 The insurer should ensure that the premium and compensation structure for intermediaries are consistent between products of similar features/duration and distribution channels so as to minimise possible lapse and re-entry or churning, and channel conflicts. This is particularly relevant for life insurance business. 3.2.4.3 The insurer should ensure that the product proposals include the following information to assist the Board or senior management in making informed decisions: (a) scope and level of coverage proposed for the product including options and guarantees, if any; (b) risk exposure limits (which can be defined by premiums, sum insured, probable maximum loss or other risk measures and may also include interim limits to manage new product growth); (c) reinsurance protection; (d) pricing methodology; (e) delegation of authority for underwriting and claims; (f) underwriting and claims assessment criteria; (g) investment strategy (including use of derivatives, if any); (h) projection of sales, expenses, profitability and solvency under different scenarios to test the sensitivity of results to different operating conditions. For example, life insurance products often contain guarantees, particularly on investment performance, which can significantly add to the risks written; (i) distribution method; (j) additional internal control processes or modifications to existing internal control processes to address any new identified risks; and (k) ability of existing or proposed administrative systems and processes to handle the new or enhanced product.

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 10 3.2.4.4 The insurershould ensure that the potential risks identified in section 3.2.3 are adequately addressed under a risk management framework that would cover the key issues when introducing a new product, such as clarity of contract wordings, accuracy and transparency of promotional materials, skills and expertise of the distribution channels, etc. Where such a framework is not in place, the insurer should ensure that the product proposal itself has adequately addressed the relevant risks identified. 3.2.4.5 The insurer should ensure that there is proper documentation of the detailed product proposal, the product approval authority levels, the decisions made by the authorised personnel or committee as well as the rationale and follow-up actions. In particular, when a decision has been made by the appropriate approval authority to accept a proposal which does not meet the risk tolerance or profit objectives of the insurer, the approval and rationale for such a decision should be clearly documented. 3.2.4.6 The insurer should have clearly articulated procedures for withdrawal and re-pricing of existing products when pre-determined criteria are triggered, such as when it is no longer economically viable to sell the product. 3.2.5 Risk Monitoring and Review 3.2.5.1 An insurer should put in place a structure setting out the reporting lines and roles of business units and personnel involved, and procedures and risk indicators to monitor the product implementation and performance after its launch. These may include: (a) comparing between key performance indicators and business plan, and actual versus expected results; (b) monitoring adherence to the insurer’s policies and procedures as well as regulatory requirements; (c) monitoring changes in risk profiles and analysing loss experience (particularly large and catastrophic losses); (d) monitoring changes in policyholder’s behaviour leading to higher lapse rates or deteriorating claims experience; for example, prolonged economic recession causing more policyholders to lapse/surrender their life insurance policies or to submit fraudulent property related claims;

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 11 (e) monitoring changes in the investment and economic environment which may affect the performance of the portfolio; (f) monitoring the number and nature of complaints; (g) monitoring changes in tax, regulatory reserving and capital requirements; and (h) conducting internal audit reviews and actuarial reviews. 3.3 Pricing 3.3.1 The pricing of an insurance product involves the estimation of claims, operational and financing costs and the income arising from investing the premiums received. 3.3.2 The pricing process typically comprises collecting data on the underlying risks to be covered, determining the pricing assumptions and the base rate, setting the final premium rate, and monitoring and reviewing the appropriateness of pricing. 3.3.3 Risk Identification and Measurement 3.3.3.1 An insurer should identify the probable scenarios which may lead to its revenue from premiums and investment income being insufficient to meet the payment of anticipated benefits and expenses (including cost of capital and taxes). 3.3.3.2 Besides the risk of inadequate pricing, there could also be the risk of inconsistent pricing of the different risk categories within the same product. For example, premium for a risk category which has a higher level of risk for its rating factors should be higher than the premium for a lower risk category. Inconsistency can also occur in the pricing of different types of products that share relatively similar features. For example, the premium for a 20-year limited pay whole of life policy should be reasonably similar to a whole of life policy with premiums payable until age 65 if both policies commence at age 45. Similarly, workmen’s compensation coverage for the same construction project should be charged similar technical rates whether it is offered on a standalone basis or sold together with engineering risk coverage. 3.3.3.3 The insurer should also pay particular attention to any inconsistency between the following related assumptions, where applicable: (a) investment return and inflation; (b) investment return and bonus declaration;

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 12 (c) investment return and policy discontinuance rates; and (d) new business volumes and expense allowance. 3.3.4 Risk Control and Mitigation 3.3.4.1 An insurer should collect adequate data to validate the reasonableness of the underlying assumptions used for deriving the base rate of the product. The base rate (also known as the technical rate) should represent the amount required to meet the value of anticipated benefits, expenses, and margins for risks and/or profit, independent of the supply and demand in the insurance market and any competitive consideration. Data should primarily relate to the insurer’s own historical experience and that of the industry where relevant. These may be supplemented by other internal and external data (such as mortality or morbidity rates from reinsurers, or industry motor insurance statistics), and could include trends observed in claims costs and expenses. 3.3.4.2 The insurer should ensure that the assumptions chosen to derive the base rate are appropriate, after considering the internal and external experience studies and the financial impact of sensitivity testing of each of the assumptions. Assumptions with significant financial impact (“financially significant assumptions”) should be monitored more frequently and comprehensively than non-financially significant assumptions. Where the insurer has no or little past experience data, it should monitor the assumptions, especially the financially significant ones, more closely with a view to updating the assumptions once credible past experience has been built up. It should also seek to resolve any inconsistency identified under paragraphs 3.3.3.2 and 3.3.3.3. 3.3.4.3 The insurer should also have adequate buffers in the premiums to cushion against the risk that actual experience may turn out to be worse than expected. 3.3.4.4 Pricing should be done by modelling all identified risks, using appropriate methodologies depending on the complexity of the risks and available data. These could vary from simple deterministic scenario testing to stochastic modelling on the pricing assumptions. For example, for complex benefit structures such as embedded options including but not limited to guaranteed insurability options, conversion options, options to renew policy etc., an insurer should evaluate the risk arising from such options through stochastic modelling and stress testing. 3.3.4.5 The insurer should not restrict itself to using only a single pricing methodology. In particular, where there is little historical experience to base the pricing on or where the nature of business does not lend itself to extensive statistical

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 13 analysis (e.g. longevity studies on Singapore annuitants or studies on many casualty lines), multiple pricing models should be used as a cross check for reasonableness. 3.3.4.6 The insurer should conduct profit testing based on cash flow projection of sample key model points, together with the anticipated portfolio profitability of the product. The insurer should ensure that there is clear documentation that the base rate has been approved at the requisite level of authority. Where the premium rate that an insurer intends to offer differs from the base rate, the insurer should obtain the requisite approval and ensure the justification and approval obtained are properly documented. Should the profit testing results of the product deviate from the profit requirements in the insurer’s policies and procedures in respect of the development and pricing of insurance products and ILP sub-funds, the insurer should also ensure that appropriate authorisation is obtained and proper documentation of the approval is maintained. 3.3.5 Risk Monitoring and Review 3.3.5.1 An insurer should analyse the profit and loss of its business, including monitoring the effect of premium rate adjustments on its bottom line. There should be procedures in place to monitor emerging trends and changes to the external environment, and risk indicators to trigger a pricing review when there are indications that the insurer’s objectives are not likely to be achieved. For example, a trigger may be based on whether the hurdle rate or other target return measures have been met. Another example would be when an experience analysis shows that the key risk driver for a product has deviated significantly from its pricing assumptions. 3.3.5.2 The insurer should also review the actual results against the anticipated benefits and expenses that have been factored into the computation of the base rate to ensure continued appropriateness in future pricing. 3.3.5.3 The insurer should involve actuaries in the pricing process and subsequent reviews especially for life insurance business and, where relevant, undertake specific independent reviews of pricing for larger or more complex risks. 3.4 Underwriting 3.4.1 Underwriting is the process by which the insurer makes an assessment of the risks to be accepted and determines the terms on which the risks would be acceptable to the insurer. In the case of life insurance, this relates mainly to the assessment of the medical and financial condition of the prospective insured.

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 14 3.4.2 The underwriting process generally involves obtaining and managing essential underwriting information on the risks, assessing, and accepting risks according to underwriting guidelines and authority levels, and monitoring and reviewing the risks accepted. The insurer should involve actuaries in the evaluation and provision of advice on underwriting matters. 3.4.3 Risk Identification and Measurement 3.4.3.1 An insurer should consider the implications associated with selecting, accepting and retaining risks which may deviate from what was envisaged during the product development and pricing stages. Such risks may include: (a) accepting risks without imposing adequate loading or conditions; (b) accepting risks which should have been declined given the insurer’s risk tolerance; (c) accepting non-homogeneous risks under the same risk category; (d) accepting and retaining risks in excess of the resources available to the insurer (risk accumulation); (e) accepting lives/risks whose experience is worse than that envisaged when pricing the product; (f) adverse impact on its financial position due to material correlations between the current macroeconomic conditions and its underwritten insurance portfolio; (g) inadequate reinsurance protection or discrepancies/ inconsistencies between the coverage and terms offered under the direct policies and that under the reinsurance outward contracts; and (h) in the case of life insurance, allowing policyholders to take on more coverage than they can reasonably afford. 3.4.4 Risk Control and Mitigation 3.4.4.1 As the proposal or application form is commonly the main source of underwriting information, it should be reviewed regularly to ensure that the questions remain reasonably clear and pertinent. It is also important to remind policyholders and the intermediaries of the need to keep the insurer informed of material changes

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 15 in underwriting information for yearly renewable policies where variable premiums are determined during the annual underwriting process. 3.4.4.2 An insurer should ensure that the proposal or application form is duly completed and the information relied on are relevant, current and unambiguous in order for the underwriters to form an accurate assessment of the risks to be insured and to better identify emerging risks. The insurer should bear in mind its marketing, distribution and pricing strategies, as well as policyholders’ behaviour when reviewing such underwriting information. 3.4.4.3 The insurer should have an efficient insurance information system in place that links all key information on underwriting, claims and reinsurance, preferably on the same electronic platform. For example, the system should contain essential and updated underwriting information, claims information, reinsurance limits, underwriting authority limits and risks accumulation information. It should also help to facilitate the peer review and approval process. Proper access and editing rights should also be set to protect the integrity of the information system. 3.4.4.4 The insurer should ensure that the information captured in the insurance information system, including the rationale for the underwriting decision, is up-to￾date and accurate to facilitate monitoring of the progress of the underwriting process and validating the quality of the underwriting decision. Proper access and editing rights should be set to protect the integrity of the information system. 3.4.4.5 The insurer should have clearly documented underwriting guidelines for each of the key types of benefits or products it underwrites so as to provide sufficient guidance to the underwriters. There should also be clear guidelines on when the underwriters should refer to the reinsurer for underwriting support. 3.4.4.6 As an illustration, the underwriting guidelines for life insurance business could cover rules on how various types of benefits are being aggregated for purposes of determining the additional medical and financial requirements and underwriting authority limits, the details of such additional requirements, types of restrictions imposed (such as in age, sum assured, type of plans or riders allowed), and proposed loadings. 3.4.4.7 The underwriting guidelines for general business could include business objectives, risk selection criteria, rating factors, declined risks, referred risks, reinsurance limits and discount policies. Senior management should approve the policy for granting discounts on premium rates, have clear delegation of the authority to grant the discounts, and review the policy and delegation arrangement regularly.

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 16 3.4.4.8 The insurer should ensure that any significant deviation of the underwriting decision from the guidelines should be duly approved and the rationale for approval properly documented. No risks should be accepted before the necessary reinsurance protection is finalised and effected. 3.4.5 Risk Monitoring and Review 3.4.5.1 An insurer should conduct regular reviews to ensure that the underwriters continue to be competent in the area of their delegated authority and the quality of the underwriting decisions made remains satisfactory. 3.4.5.2 The insurer should have a systematic method to monitor its accumulation of risks across product types and geographical areas so that the overall risks underwritten by the insurer are always within itsreinsurance protection limits and risk appetite. Itshould also ensure that facultative reinsurance is obtained when necessary. 3.4.5.3 The insurer should conduct audits or checks of underwriting files regularly. These reviews should be conducted with clear and pre-defined terms of reference – for example, to check for adherence to underwriting guidelines or underwriting authorities. There should also be an appropriate system to select the files to be reviewed. 3.4.5.4 The insurer should monitor risk indicators like claims experience – for example when an experience analysis shows that claims experience is worse than what was envisaged during pricing. Another example of an indicator would be the number of complaints against the insurer with respect to the underwriting decisions made or the timeliness of the decisions. 3.5 Claims Handling 3.5.1 Claims handling is the process by which an insurer processes and pays claims in accordance to the terms and conditions specified in the insurance contracts. 3.5.2 The process generally comprises registering new claims, setting and revising reserves, obtaining essential information to assess, manage and settle the claim, making reinsurance and other recoveries, and reviewing and closing claim files. 3.5.3 Risk Identification and Measurement 3.5.3.1 An insurer should put in place measures to identify the risks associated with poor claims handling and case reserving, which may include:

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 17 (a) making claim settlement decisions which are not in accordance with the policy terms and conditions, thereby either incurring liability that is not considered in the pricing or failing to fulfil its contractual obligations to policyholders; (b) inefficient handling of claims leading to slow responses or higher cost overheads, thereby impeding its market competitiveness; and (c) setting inadequate reserves, or delay in revising case reserves for reported claims resulting in under provision of claims liabilities and time lag in adjusting premiums for new policies in the case of general business. 3.5.4 Risk Control and Mitigation 3.5.4.1 An insurer should have a clear processin place for the notification of claims by the intermediaries or the policyholders. The process should ensure that all claims are reported to the insurer at the earliest opportunity and that relevant information is captured in the insurer’s information system in a timely manner. These guidelines are particularly pertinent for general insurance business. 3.5.4.2 The insurer should review the claims form regularly to ensure that questions remain reasonably clear, unambiguous and pertinent to enable the claims staff to form an accurate assessment of the validity of the claim. 3.5.4.3 The insurer should have an efficient information system in place as elaborated in paragraph 3.4.4.3. Information captured in respect of claims should be up-to-date and accurate so that the insurer can monitor the progress of the claim handling process and validate the quality of the claim settlement decisions. 3.5.4.4 The insurer should also have clearly documented claims handling guidelines for each of the key types of claims to provide sufficient guidance to the claims staff. The claims handling guidelines could cover the documents required for verifying the claim, references to warranties or restrictions imposed at acceptance (for example maintaining the car in a roadworthy condition for motor policy and cap on the payout, exclusions, lien for life policy), methodology for calculating the settlement amount, settlement options available and policies on large or ex-gratia claims. The insurer should also have clear guidelines on when claims should be referred to the reinsurer or other parties such as lawyers, for claims support or decision. The claims handling guidelines should be regularly reviewed and updated to factor in new developments and trends.

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 18 3.5.4.5 The insurer should have a clear control process for the payment of large claims, for example, getting an official sign-off from a member of the management team and the reinsurer, where applicable. 3.5.4.6 The insurer should endeavour to set case reserves accurately for each claim in a timely manner, especially in respect of general insurance business. The components of case reserves should also be captured in sufficient detail to provide useful statistics for in-depth analysis. For example, a single claim file could have separate components for own property damage, third party liabilities and fees payable to external parties. 3.5.4.7 The insurer should have a clear policy, approved by senior management, with regards to ex-gratia claim payments. The authority to approve such payments should also be clearly specified and the rationale for the approval should be properly documented. 3.5.5 Risk Monitoring and Review 3.5.5.1 An insurer should conduct regular reviews to ensure that the claims assessors continue to be competent in their area of delegated authority and quality of the claims decisions made remains satisfactory. The insurer should also monitor whether the authority for granting ex-gratia payment is exercised sparingly and appropriately, and review the appropriateness of the limits regularly. 3.5.5.2 The insurer should conduct reviews of claim files regularly. These reviews should be conducted with clear and pre-defined objectives – for example, to check for adherence to claims settlement authority limits and file closure procedures or to assess the adequacy of the case reserves set, or that case reserves are reviewed and revised on a timely basis. There should also be a systematic way to identify files for review and clear guidelines for follow-up actions and closure of files. 3.5.5.3 The insurer should perform quality reviews of claims to assess whether they are handled professionally and resolved appropriately. One of the performance measures could be the number and nature of complaints against the insurer with respect to their claims settlement decisions. The insurer should also monitor the level of claims which should not have been paid or are overpaid and the severity of delays in claims registration and case reserves revision. 3.5.5.4 The insurer should have in place regular claims reporting to senior management so as to raise awareness of key claim exposures and losses, especially where a single claim, loss event or series of losses could in aggregate have an impact on its balance sheet.

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 19 3.6 Reinsurance Management 3.6.1 Reinsurance management refers to the control of the reinsurance programme where a portion of the risks assumed by an insurer is ceded to other insurers. Risk transfer mechanisms include traditional reinsurance as well as other alternative risk transfer approaches, such as securitisation where the insurance risk is transferred to the capital market. 3.6.2 The process generally involves the review of the insurer’s reinsurance management strategy and assessment of whether its existing reinsurance programme and reinsurance counterparties continue to provide adequate, appropriate and secured risk transfer. 3.6.3 Risk Identification and Measurement 3.6.3.1 An insurer should analyse its risk profile in conjunction with the legal, economic, social and political environment in which it operates, to identify the potential sources of risk and estimate the probability and consequence of each risk. Such risks may include: (a) Underwriting Risk The insurer has to decide what and how much risks to retain taking into consideration its risk appetite, and the availability and cost of reinsurance. It should identify the source and magnitude of concentration of risks and assess the impact of likely adverse events. It also has to be mindful of possible gaps in the reinsurance programme, resulting in more risks being retained than intended. In alternative risk transfer mechanisms, such as insurance securitisation, the insurer may also face basis risk whereby the losses recoverable under the arrangement may not exactly match the actual losses suffered by the insurer. (b) Legal Risk Another material risk faced by the insurer is the risk that the contract wordings do not accurately reflect the intent for the purchase of the reinsurance cover or the contract is not legally enforceable. (c) Credit Risk

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 20 The insurer also faces credit risk arising from potential defaults by its reinsurers as it is contractually obligated to pay all claims in respect of the underlying policies in full. (d) Liquidity Risk The insurer is particularly exposed to liquidity risk in the event of large losses whereby it may have to pay the claims prior to receiving all the reinsurance recoverables. 3.6.4 Risk Control and Mitigation 3.6.4.1 An insurer’s risk tolerance level should be clearly defined so that the Board and senior management will be able to assess the expected maximum impact of one or more major catastrophes on the financial position of the insurer. The insurer’s risk tolerance level should be reviewed by senior management annually and approved by the Board. 3.6.4.2 When designing the reinsurance programme to mitigate risk, the insurer should take into account relevant factors including the following: (a) business plans and strategies; (b) underwriting philosophy and capabilities; (c) size and profile of each line of business; (d) frequency and size of loss by line of business; (e) geographical distribution of the business; and (f) financial strength. 3.6.4.3 The insurershould ensure that its reinsurance contracts cover all applicable lines of business and the limits of cover are adequate. The terms, conditions and exclusions stipulated in the reinsurance contracts should also be aligned with those of the underlying business. The insurer should also assess the impact of likely adverse events through stress testing and realistic disaster scenario analysis to ensure that its catastrophe reinsurance cover can be relied upon to reduce the impact of most conceivable calamities to a magnitude that will not threaten its viability. 3.6.4.4 The insurer should not adopt a “deal now, detail later” philosophy as lack of contract certainty could lead to potential legal disputes and unintended assumption

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 21 of liabilities. It should put in place appropriate systems and processes to facilitate achieving contract certainty, including prompt commencement of review of the reinsurance programme and vetting of contract wordings. 3.6.4.5 The insurer is also encouraged to adopt the industry definition, guidance and best market practices and standards, where suitable, in the areas of contract certainty. 3.6.4.6 The reinsurance management guidelines should spell out clear criteria for the selection of reinsurers and outline the information that is required to assess the financial soundness of a reinsurer. The insurer should maintain an up-to-date list of reinsurers that meet its criteria and the appropriate level of exposure for each approved reinsurer or group of related reinsurers. 3.6.4.7 In the event that any previously approved reinsurer no longer meets the insurer’s criteria, there should be clear guidance on the follow up actions required. Should there be an exceptional circumstance that merits a deviation from the original approved limits or guidelines, the endorsement of the appropriate approving authority should be obtained. 3.6.4.8 If an insurer relies on the recommendation of a reinsurance broker in respect of the design of the reinsurance program and selection of reinsurance counterparties, it should satisfy itself that the advice given is sound. It should always maintain sufficient oversight and control over the design and placement of its reinsurance programme, regardless of whether an intermediary is involved. 3.6.4.9 The insurer should render reinsurance statements and perform reconciliation of accounts regularly and promptly as failure to do so may cause balances due from reinsurers to build up or result in disputes over the outstanding balances, thereby increasing credit/asset risk. 3.6.4.10 The insurer should ensure that there is good communication between the different business units in the institution to facilitate early identification of any potential liquidity strain, such as large claims triggering cash calls to reinsurers. Staff involved should be familiar with and adhere to clear procedures spelled out to facilitate prompt collection of reinsurance recoverables. 3.6.5 Risk Monitoring and Review 3.6.5.1 An insurer should monitor that only approved reinsurers are used and track aggregate exposures to individual reinsurers or groups of related reinsurers against exposure limits established. It should also monitor the outstanding balances from its

GUIDELINES ON RISK MANAGEMENT PRACTICES FOR INSURANCE BUSINESS JANUARY 2024

• CORE ACTIVITIES MONETARY AUTHORITY OF SINGAPORE 22 reinsurance counterparties and the credit standing of the reinsurers on its panel on an ongoing basis. The amount and ageing of reinsurance recoverables and/or amount of doubtful debts and write-offs can be some of the performance measures to ascertain the effectiveness of its selection of reinsurance counterparties. The insurer should also review whether its reinsurance programme has, over a period of time, supported its business objectives and strategies, and helped to mitigate its losses to within its risk tolerance level.