Implementation of Risk Management for Insurance Companies, Sharia Insurance Companies, Reinsurance Companies, and Sharia Reinsurance Companies

To:

The Board of Directors of Insurance Companies;
The Board of Directors of Sharia Insurance Companies;
The Board of Directors of Reinsurance Companies; and
The Board of Directors of Sharia Reinsurance Companies,
At their respective locations.

COPY

CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 8 /SEOJK.05/2021

CONCERNING

THE IMPLEMENTATION OF RISK MANAGEMENT FOR INSURANCE COMPANIES, SHARIA INSURANCE COMPANIES, REINSURANCE COMPANIES, AND SHARIA REINSURANCE COMPANIES

In relation to the mandate of Article 25 of Financial Services Authority Regulation Number 44/POJK.05/2020 concerning the Implementation of Risk Management for Non-Bank Financial Service Institutions (State Gazette of the Republic of Indonesia Year 2020 Number 200, Supplement to the State Gazette of the Republic of Indonesia Number 6552), it is necessary to further regulate the implementation of risk management, the organizational structure of the risk management committee, the organizational structure of the risk management function, the relationship between business and operational functions with the risk management function, and the management of risks arising from the development or expansion of business activities for insurance companies, Sharia insurance companies, reinsurance companies, and Sharia reinsurance companies in this Financial Services Authority Circular Letter as follows:

I. GENERAL PROVISIONS

In this Financial Services Authority Circular Letter, the following terms are defined as:

Company means an insurance company, Sharia insurance company, reinsurance company, and Sharia reinsurance company.
Insurance Company means a general insurance company and a life insurance company, including those conducting part of their business based on Sharia principles.
Sharia Insurance Company means a Sharia general insurance company and a Sharia life insurance company.
Reinsurance Company means a company conducting reinsurance business, including those conducting part of their business based on Sharia principles.
Sharia Reinsurance Company means a company conducting Sharia reinsurance business.
Risk is the potential for losses that cannot be controlled and/or can be controlled due to the occurrence of a specific event.
Risk Management is a series of procedures and methodologies used to identify, measure, control, and monitor Risks arising from all business activities of the Company.
Strategic Risk is Risk due to inaccuracies in making and/or implementing strategic decisions and failures in anticipating changes in the business environment.
Operational Risk is Risk due to insufficient and/or non-functioning internal processes, human error, system failures, and/or external events affecting the Company's operations.
Insurance Risk is the Risk of the Company's failure to meet obligations to policyholders, insured parties, or participants as a result of insufficient risk selection (underwriting) processes, premium or contribution setting, use of reinsurance, and/or claims handling.
Credit Risk is Risk due to the failure of other parties to meet their obligations to the Company.
Market Risk is Risk on asset, liability, equity, and/or administrative account positions, and/or derivative transactions due to changes in market conditions.
Liquidity Risk is Risk due to the Company's inability to meet maturing obligations from cash flow funding sources and/or from liquid assets that can be easily converted into cash, without disrupting the Company's activities and financial condition.
Legal Risk is Risk arising from legal claims and/or weaknesses in legal aspects.
Compliance Risk is Risk due to the Company's failure to comply with and/or implement applicable laws and regulations and provisions applicable to the Company.
Reputational Risk is Risk due to a decline in the level of trust of stakeholders stemming from negative perceptions of the Company.
Board of Directors is the corporate organ authorized and fully responsible for the management of the company, in accordance with its purpose and objectives, and representing the company, both inside and outside of court, in accordance with the articles of association for Companies in the form of a limited liability company or equivalent to the Board of Directors for Companies in the form of a cooperative and joint venture legal entity.
Board of Commissioners is the corporate organ tasked with general and/or specific supervision in accordance with the articles of association and providing advice to the Board of Directors for Companies in the form of a limited liability company or equivalent to the Board of Commissioners for Companies in the form of a cooperative and joint venture legal entity.
Sharia Supervisory Board is a board that has the task and function of supervision and providing advice to the Board of Directors regarding the implementation of the Company's activities to ensure compliance with Sharia principles.
Policyholder is a party that binds itself through an agreement with an Insurance Company, Sharia Insurance Company, Reinsurance Company, or Sharia Reinsurance Company to obtain protection or management of risk for themselves, the insured, or other participants as referred to in Law Number 40 of 2014 concerning Insurance.
Insured is a party facing risk as regulated in an insurance agreement or reinsurance agreement as referred to in Law Number 40 of 2014 concerning Insurance.
Participant is a party facing risk as regulated in a Sharia insurance agreement or Sharia reinsurance agreement as referred to in Law Number 40 of 2014 concerning Insurance.

II. STANDARDS AND GUIDELINES FOR THE IMPLEMENTATION OF RISK MANAGEMENT

The implementation of Risk Management by Companies must be adjusted to the Company's objectives, business policies, size, and complexity of business, considering the Company's developing conditions and potential problems faced.
In the implementation of Risk Management as referred to in item 1, the Company must have and implement written Risk Management strategies, policies, and procedures.
The implementation of Risk Management as referred to in items 1 and 2 refers to the standards and guidelines for the implementation of Risk Management as referred to in Appendix I, which is an integral part of this Financial Services Authority Circular Letter.
The written Risk Management strategies, policies, and procedures as referred to in item 2 can be formulated in the form of the Company's internal Risk Management guidelines.
The standards and guidelines for the implementation of Risk Management as referred to in item 2 serve as the minimum reference for Companies in implementing Risk Management, to ensure that all Risks faced by the Company are identified, measured, controlled, and monitored appropriately.
The Risk Management strategies, policies, and procedures as referred to in item 4 must at least cover:
a. the implementation of Risk Management which at least covers:
1. active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board;
2. adequacy of Risk Management policies and procedures and the establishment of Risk limits;
3. adequacy of the risk identification, measurement, control, and monitoring processes, as well as the Risk Management information system; and
4. a comprehensive internal control system;
  b. the implementation of Risk Management for each type of Risk, which covers the implementation of Risk Management for each type of Risk comprising 9 (nine) types of Risk, namely Strategic Risk, Operational Risk, Insurance Risk, Credit Risk, Market Risk, Liquidity Risk, Legal Risk, Compliance Risk, and Reputational Risk; and
  c. risk profile assessment, which covers the assessment of inherent risk and the assessment of the quality of Risk Management implementation reflecting the risk control system for the Company. The assessment is conducted on the 9 (nine) types of Risk as referred to in letter b. The risk profile assessment is conducted by referring to Financial Services Authority Regulations regarding the assessment of the health level of non-bank financial service institutions.
Companies must have an organizational structure that supports the effective implementation of Risk Management, including the organizational structure of the risk management committee and the organizational structure of the risk management function, which are an integral part of the Company's Risk Management organizational structure.
The Company's Risk Management organizational structure as referred to in item 7 must explain the relationship between business and operational functions with the risk management function.
The Risk Management organizational structure as referred to in items 7 and 8 refers to Appendix II, which is an integral part of this Financial Services Authority Circular Letter.
In the context of risk measurement, Companies may use various risk measurement approaches, including the use of models for internal purposes (internal model). Measurement using internal models is intended to anticipate the increasingly complex business activities of the Company and to anticipate the Company's future policies. The implementation of internal models requires various minimum quantitative and qualitative requirements so that risk assessment results can better reflect the Company's actual condition.
In order to implement effective Risk Management, the Company takes preparatory, developmental, and/or refinement steps, including:
a. conducting an analysis of the organization, Risk Management policies, and procedures or internal Risk Management guidelines; b. formulating a plan to refine the Company's Risk Management according to the reference in the standard guidelines for Risk Management implementation, in case there is a mismatch between the Risk Management strategies, policies, and procedures, or internal Risk Management guidelines for the Company, in accordance with the standard guidelines for Risk Management implementation in this Financial Services Authority Circular Letter;
c. socializing the Risk Management strategies, policies, and procedures, or internal Risk Management guidelines to employees so that they understand Risk Management practices, and developing a risk culture among all employees at every level of the Company's organizational structure; and
d. ensuring that the internal audit function participates in monitoring the formulation and refinement of internal Risk Management guidelines and the implementation of Risk Management by the Company, including the risk profile assessment as regulated in Financial Services Authority Regulations regarding the assessment of the financial health level of non-bank financial service institutions.
The implementation of Risk Management by Companies also includes the implementation of anti-money laundering and counter-terrorism financing programs as regulated in Financial Services Authority Regulations regarding the implementation of anti-money laundering and counter-terrorism financing programs in the financial services sector.

III. MANAGEMENT OF RISKS ARISING FROM THE DEVELOPMENT OR EXPANSION OF BUSINESS ACTIVITIES OF COMPANIES

Companies must have written policies and procedures to manage the inherent risks associated with the development or expansion of business activities.
The Risk Management policies and procedures for the development or expansion of business activities must be in line with the Company's business plan.
Business activities of the Company categorized as a form of development or expansion of business activities are business activities that:
a. have never been conducted previously by the Company, such as marketing insurance products in business lines that the Company has never operated; or b. have been implemented previously by the Company, but involve development that changes or increases certain Risk exposures to the Company, such as the addition of new banks that become partners of the Company in bancassurance.
The Risk Management strategies, policies, and procedures, or the Company's internal Risk Management guidelines regarding aspects as referred to in Section II item 6 letters a and b need to be adjusted in the event that the development or expansion of the Company's business activities has a significant impact on the Company's overall business activities.

IV. OTHER PROVISIONS

Companies that already have Risk Management strategies, policies, and procedures or internal Risk Management guidelines, but which are not yet in accordance with the standards and guidelines for Risk Management implementation as referred to in the Appendix of this Financial Services Authority Circular Letter, must adjust and refine their Risk Management strategies, policies, and procedures, or internal Risk Management guidelines by referring to this Financial Services Authority Circular Letter.
Companies may expand and deepen the standard guidelines for Risk Management implementation as referred to in the Appendix of this Financial Services Authority Circular Letter according to the Company's needs.

V. CLOSING

At the time this Financial Services Authority Circular Letter takes effect, Financial Services Authority Circular Letter Number 10/SEOJK.05/2016 concerning Guidelines for the Implementation of Risk Management and Self-Assessment Report on the Implementation of Risk Management for Non-Bank Financial Service Institutions is declared not applicable to Companies.
The provisions in this Financial Services Authority Circular Letter take effect on the date of establishment.

Established in Jakarta on February 5, 2021

EXECUTIVE HEAD OF SUPERVISOR
FOR INSURANCE, PENSION FUNDS,
LENDING INSTITUTIONS, AND
OTHER FINANCIAL SERVICE INSTITUTIONS
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA,

Signed,
RISWINANDI

This copy is in accordance with the original
Director of Legal Affairs 1
Legal Department
Signed,
Mufli Asmawidjaja

APPENDIX I

CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 8 /SEOJK.05/2021

CONCERNING

THE IMPLEMENTATION OF RISK MANAGEMENT FOR INSURANCE COMPANIES, SHARIA INSURANCE COMPANIES, REINSURANCE COMPANIES, AND SHARIA REINSURANCE COMPANIES

TABLE OF CONTENTS

I. IMPLEMENTATION OF RISK MANAGEMENT........................................................ - 1 -
A. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board ............................................................................................ - 1 - B. Adequacy of Risk Management Policies and Procedures and Establishment of Risk Limits...................................................................................... - 8 -
C. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, as well as Risk Management Information Systems ...... - 14 -
D. Comprehensive Internal Control System ............................. - 22 -
II. IMPLEMENTATION OF RISK MANAGEMENT FOR EACH RISK . - 25 -
A. Strategic Risk .............................................................................. - 25 -

Definition....................................................................................... - 25 -
Objective ....................................................................................... - 25 -
Implementation of Risk Management..................................................... - 25 -
B. Operational Risk ......................................................................... - 32 -
Definition....................................................................................... - 32 -
Objective ....................................................................................... - 32 -
Implementation of Risk Management..................................................... - 33 -
C. Insurance Risk.............................................................................. - 41 -
Definition....................................................................................... - 41 -
Objective ....................................................................................... - 42 -
Implementation of Risk Management..................................................... - 42 -
D. Credit Risk .................................................................................. - 50 -
Definition....................................................................................... - 50 -
Objective ....................................................................................... - 50 -
Implementation of Risk Management..................................................... - 50 -
E. Market Risk ................................................................................... - 57 -
Definition....................................................................................... - 57 -
Objective ....................................................................................... - 57 -
Implementation of Risk Management..................................................... - 57 -
F. Liquidity Risk ............................................................................ - 64 -
Definition....................................................................................... - 64 -
Objective ....................................................................................... - 65 -
Implementation of Risk Management..................................................... - 65 -
G. Legal Risk................................................................................ - 71 -
Definition....................................................................................... - 71 -
Objective ....................................................................................... - 71 -
Implementation of Risk Management..................................................... - 71 -
H. Compliance Risk........................................................................... - 75 -
Definition....................................................................................... - 75 -
Objective ....................................................................................... - 75 -
Implementation of Risk Management..................................................... - 75 -
I. Reputational Risk .............................................................................. - 79 -
Definition....................................................................................... - 79 -
Objective ....................................................................................... - 79 -
Implementation of Risk Management..................................................... - 79 -
III. RISK PROFILE ASSESSMENT.................................................................. - 82 -

STANDARDS AND GUIDELINES FOR THE IMPLEMENTATION OF RISK MANAGEMENT FOR INSURANCE COMPANIES, SHARIA INSURANCE COMPANIES, REINSURANCE COMPANIES, AND SHARIA REINSURANCE COMPANIES

I. IMPLEMENTATION OF RISK MANAGEMENT

As regulated in Financial Services Authority Regulation Number 44/POJK.05/2020 concerning the Implementation of Risk Management for Non-Bank Financial Service Institutions, Companies are required to implement Risk Management effectively, which at least covers 4 (four) pillars, namely:

active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board;
adequacy of Risk Management policies and procedures and the establishment of Risk limits;
adequacy of the risk identification, measurement, control, and monitoring processes, as well as the Risk Management information system; and
a comprehensive internal control system.

The implementation of Risk Management for each of these pillars is elaborated as follows:

A. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board

The Board of Directors, Board of Commissioners, and Sharia Supervisory Board are responsible for the effectiveness of Risk Management implementation in the Company. Therefore, the Board of Directors, Board of Commissioners, and Sharia Supervisory Board must at least:
a. have a good understanding of the types and levels of inherent risk in the Company's business activities; b. provide clear direction in the implementation of Risk Management;
c. conduct active supervision and risk mitigation;
d. develop a Risk Management culture in the Company; e. ensure an adequate organizational structure to support effective Risk Management implementation; f. establish clear tasks and responsibilities in the implementation of Risk Management for each function; and g. ensure the adequacy of the quantity and quality of human resources to support effective Risk Management implementation.
Matters to be considered in the implementation of active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board include the following:
a. Authority and Responsibilities of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
1. The Board of Directors, Board of Commissioners, and Sharia Supervisory Board, within the scope of their respective authorities, are responsible for ensuring that Risk Management implementation is effective in accordance with the Company's characteristics, complexity, and risk profile.
2. The Board of Directors and Board of Commissioners must ensure that each function in the Company implements Risk Management.
3. The authority and responsibility of the Board of Directors at least includes:
  a) formulating written and comprehensive Risk Management strategies, policies, and procedures, including among others:
  i. formulating and updating procedures and tools to identify, measure, control, and monitor Risk;
  ii. determining overall Risk limits and per Risk type, considering the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) in accordance with the Company's condition;
  iii. formulating and establishing transaction approval mechanisms, including those exceeding limits and authority for each job level;
  iv. ensuring that all policies, provisions, systems, and procedures, as well as business activities conducted by the Company, are in accordance with applicable laws and regulations;
  v. after obtaining approval from the Board of Commissioners regarding Risk Management policies, the Board of Directors establishes the Risk Management strategies, policies, and procedures, or internal Risk Management guidelines; and
  vi. evaluating and updating Risk Management strategies, policies, and procedures at least once (1) in one (1) year or at a higher frequency in the event of changes in factors affecting the Company's business activities,

risk exposure, or risk profile significantly, as well as updating risk management strategies, policies, procedures, and frameworks as necessary based on evaluation results; b) be responsible for the implementation of risk management policies and the risk exposure taken by the Company as a whole, including among others:
i. evaluating and providing guidance based on reports submitted by the risk management function, including reports regarding the risk profile;
ii. taking necessary actions in accordance with the Company's risk profile, including by providing guidance regarding the implementation of risk management to each function within the Company;
iii. ensuring that all material risks and the impacts arising from such risks have been followed up on and submitting accountability reports regarding such follow-up to the Board of Commissioners periodically. Such reports include, among others, reports on developments and issues related to material risks, accompanied by improvement steps that have been, are being, and will be taken;
iv. ensuring the implementation of improvement steps for issues or deviations in the Company's business activities found by the internal audit function; and
v. submitting accountability reports regarding the implementation of risk management policies and the risk exposure taken by the Company to the Board of Commissioners and the Sharia Supervisory Board at least once every 6 (six) months.
c) evaluate and decide on transactions and risk limits requiring Board of Directors approval; d) develop a risk management culture at all levels of the organization, including among others adequate communication to all levels of the organization regarding the importance of effective internal controls; e) ensure the improvement of human resource competence related to risk management so that the Company has sufficient resource support to manage and control risks, including through continuous education and training programs related to risk management implementation; f) ensure that the risk management function operates independently, reflected among others by:
i. the separation of functions between the risk management function, which identifies, measures, controls, and monitors risks, and the internal control function; and
ii. the implementation of risk management free from conflicts of interest between functions;
g) conduct periodic reviews to ensure:
i. the accuracy of risk assessment methodologies;
ii. the adequacy of the risk management information system implementation; and
iii. the appropriateness of risk management policies and procedures as well as the establishment of risk limits,
these reviews are conducted to anticipate changes in external and internal factors;
4) Authority and responsibilities of the Board of Commissioners, at a minimum include:
a) Approve and evaluate risk management policies drafted by the Board of Directors. Evaluation is conducted at least once every 1 (one) year or more frequently in the event of changes in factors significantly affecting the Company's business activities. b) Evaluate the accountability of the Board of Directors at least once every 6 (six) months and provide guidance for improvements regarding the implementation of risk management policies periodically. Evaluations are conducted to ensure that the Board of Directors manages the Company's activities and risks effectively and ensures that risk management policies and processes are implemented effectively and integrated into the overall risk management process. In conducting such evaluations, the Board of Commissioners forms a risk monitoring committee tasked with assisting the Board of Commissioners in monitoring the implementation of risk management drafted by the Board of Directors; c) evaluate and decide on requests from the Board of Directors related to transactions and risk limits requiring Board of Commissioners approval. Such transactions and risk limits are business or operational activities that have exceeded the authority of the Board of Directors to do so, in accordance with the Company's internal policies and procedures;
5) Authority and responsibilities of the Sharia Supervisory Board, at a minimum include:
a) evaluate risk management policies related to the fulfillment of Sharia principles at least once every 1 (one) year and at any time in the event of changes in factors significantly affecting the Company's business activities; b) evaluate the accountability of the Board of Directors regarding the implementation of risk management policies related to the fulfillment of Sharia principles at least once every 6 (six) months; c) provide guidance based on the evaluation results of risk management policies and the accountability of the Board of Directors regarding the implementation of risk management, to ensure the effectiveness of policies and risk management processes related to the application of Sharia principles. b. Human Resources (HR) In carrying out the responsibility for implementing risk management related to HR, the Board of Directors must:

establish clear HR qualifications for each job level related to the implementation of risk management;
ensure the adequacy of the quantity and quality of existing HR in the Company and ensure that such HR understands their duties and responsibilities, whether for business and operational functions, risk management functions, internal control functions, or internal audit functions, as well as supporting functions responsible for implementing risk management;
develop employee recruitment, development, and training systems, including managerial succession plans and adequate remuneration, to ensure the availability of competent employees in the field of risk management;
ensure the improvement of competence and integrity of leaders, personnel of business and operational functions, risk management functions, and internal control or internal audit functions, as well as supporting functions, by considering factors such as knowledge, experience, track record, and adequate capabilities in the field of risk management through continuous education and training programs, to guarantee the effectiveness of the risk management process;
place competent employees in each function according to the nature, volume, and complexity of the Company's business activities;
ensure that officials and staff placed in each of these functions have:
a) an understanding of the inherent risk in each business activity of the Company relevant to the field of duty of the respective official/employee; b) an understanding of relevant risk factors and external factor conditions affecting the Company's business activities, and the ability to estimate the impact of changes in such factors on the Company's business continuity; and c) the ability to communicate the implications of the Company's risk exposure to the Board of Directors and the risk management committee in a timely manner, according to their respective authority.
ensure that all HR understand the strategy, the level of risk to be taken (risk appetite) and risk tolerance, and the risk management framework established by the Board of Directors and approved or acknowledged by the Board of Commissioners, and implement it consistently in all business activities of the Company.
c. Risk Management Organization
In order to implement effective risk management, the Company's Board of Directors establishes an organizational structure by considering at least:
The organizational structure drawn up must be accompanied by clarity of duties and responsibilities in general and regarding the implementation of risk management in all functions, adjusted to the business objectives and policies, size, and complexity of the Company's business activities.
The Company has a Risk Management Committee and an independent risk management function.
The organizational structure must be designed to ensure that the internal control or internal audit function and the risk management function are independent of the Company's business and operational functions.
The organizational structure is designed so that the risk management function has direct access and reporting to the Board of Directors, Board of Commissioners, and Sharia Supervisory Board for the following matters:
a) assessment of risks and risk exposure positions as well as steps to be taken to manage such risks; b) assessment of changes in the Company's risk profile; c) assessment of established risk limits; d) risk management related to strategy, such as the Company's investment strategy; and e) assessment of risks that have occurred and identification of appropriate improvement actions for such risks.
The person in charge of the risk management function must have the authority and obligation to inform the Board of Commissioners of any event that may have a material impact on the Company's risk management system.
The adequacy of the framework for delegation of authority is adjusted to the characteristics and complexity of the business line, the Company's risk appetite, and the experience and expertise of the respective personnel. Delegated authority is evaluated periodically to ensure that such authority is appropriate to current conditions and the performance level of the relevant employees.
B. Adequacy of Risk Management Policies and Procedures and Establishment of Risk Limits

Effective implementation of risk management must be supported by a risk management framework that includes risk management strategies, policies, and procedures as well as clearly established risk limits in line with the Company's vision, mission, and strategy.
The formulation of risk management strategies, policies, and procedures is conducted by considering among others the type, complexity of business activities, risk profile, and level of risk to be taken (risk appetite) as well as regulations set by the authority or healthy Company practices.
The implementation of the Company's risk management policies and procedures must be supported by quality human resources and adequate infrastructure.
The policies and procedures owned by the Company must be based on risk management strategy and supplemented with risk tolerance and risk limits.
The Company's risk management policy must explain the relationship between risk management and the Company's current objectives, strategy, and conditions.
Matters to be considered in the establishment of strategies, policies, procedures, and risk limits include the following:
a. Risk Management Strategy

The Company formulates risk management strategy in accordance with the Company's overall business strategy by considering the level of risk to be taken (risk appetite) and risk tolerance.
Risk management strategy is drafted to ensure that the Company's risk exposure is managed in a controlled manner to support the achievement of the Company's business objectives and strategy and in accordance with applicable legislation.
Risk management strategy is drafted based on the following general principles:
a) risk management strategy must be long-term oriented to ensure the Company's business continuity by considering economic conditions or cycles; b) risk management strategy can comprehensively control and manage Company risks; and c) risk management strategy is accompanied by adequate resource allocation.
Risk management strategy is drafted by considering the following factors:
a) the Company's objectives and strategic plans; b) economic and industry developments and their impact on Company risks; c) the Company's organization, including the adequacy of HR and supporting infrastructure; d) the Company's financial conditions, including the ability to manage investments; e) the Company's ability to manage risks arising from changes in external and internal factors; and f) business mix and diversification.
The Board of Directors must elaborate the risk management strategy into risk management policies and procedures.
The Board of Directors must effectively communicate the risk management strategy to all relevant employees so that it is clearly understood.
The Board of Directors must periodically review the risk management strategy, including its impact on the Company's financial performance, to determine whether changes to the Company's risk management strategy are necessary.
b. Level of Risk to be Taken (Risk Appetite) and Risk Tolerance (Risk Tolerance)
In formulating risk management policies, the Board of Directors must provide clear guidance regarding the level of risk to be taken (risk appetite) and risk tolerance of the Company. Furthermore, the Board of Directors must inform the level of risk to be taken (risk appetite) and risk tolerance to all levels of the organization in the Company.
The level of risk to be taken (risk appetite) is the level and type of risk that can be taken by the Company in order to achieve Company objectives. The level of risk to be taken is reflected in the Company's business strategies and objectives, which are formulated in the form of the Company's business plan and established in the form of a risk appetite statement.
The level of risk to be taken (risk appetite) can be in the form of the amount of risk and/or risk characteristics that can be accepted by the Company.
Risk tolerance is the maximum level of risk and amount of risk established by the Company. Risk tolerance is an elaboration of the level of risk to be taken (risk appetite).
Risk tolerance can be in the form of quantitative and/or qualitative limits. An example of a quantitative limit is the range of the rate of decline in investment returns from the target set by the Company. An example of a qualitative limit is a management decision stating zero tolerance for fraud or money laundering practices. If there are conditions deviating from such quantitative and/or qualitative limits, the Company must immediately take action.
The establishment of risk tolerance is conducted by considering the level of risk to be taken (risk appetite), the Company's overall objectives and strategy, and the Company's ability to accept risk (risk bearing capacity).
c. Policies and Procedures
Risk management policy is written guidance in implementing risk management and must be in line with the Company's vision, mission, and strategy, and its formulation must be coordinated with relevant functions.
Risk management procedures are the methods or mechanisms for implementing risk management policies, including policies in identifying, measuring, controlling, and monitoring risks.
Policies and procedures must be designed and implemented by considering the characteristics and complexity of business activities, the level of risk to be taken (risk appetite) and risk tolerance, risk profile, and regulations set by the authority or healthy Company practices.
Risk management policies and procedures are adequately documented and communicated to all employees and are periodically reviewed and updated to accommodate changes in factors impacting Company risks.
The Company's risk management policy must:
a) be relevant to the types of risks determined, both risks related to strategy and those related to daily operational activities of the Company. b) elaborate the relationship between the Company's tolerance limits, regulations regarding capital, and risk monitoring methods. c) explain the relationship between risk management and the Company's current objectives, strategy, and conditions.
Risk management policy must at least contain:
a) the establishment of risks related to the Company's business activities based on the Company's analysis of inherent risks in business activities, including every product and transaction of the Company that has been and will be conducted; b) the establishment of methods and information systems for identifying, measuring, controlling, and monitoring risks in the Company's business activities, including every product and transaction of the Company; c) the establishment of risk appetite, risk tolerance, and risk limits; d) the establishment of data to be reported, report formats, and types of information to be included in reports related to the implementation of risk management so as to reflect risk exposure that is considered in decision-making while still adhering to the principle of prudence; e) the establishment of authority and the magnitude of limits in a hierarchical manner, including transaction limits requiring Board of Directors approval; f) the establishment of risk profile rankings as a basis for the Company to determine improvement steps for the Company's business activities and specific activity areas and to evaluate the results of the implementation of risk management policies and strategies; g) an organizational structure that clearly formulates the roles and responsibilities of the Board of Directors, Board of Commissioners, Sharia Supervisory Board, committees, risk management functions, business and operational functions, internal audit functions, actuarial functions, and other supporting functions; h) a business continuity plan policy for possible worst-case external and internal conditions, so that the Company's business continuity can be maintained, including disaster recovery plans and contingency plans. The formulation of business continuity plan policies meets among other things the following:
i. involves various relevant functions;
ii. is flexible to respond to various unexpected and specific disruption scenarios, i.e., specific conditions and actions required immediately;
iii. periodic testing and evaluation of the business continuity plan; and
iv. the Board of Directors must update the business continuity plan based on testing and evaluation results to ensure the effectiveness of the formulated business continuity plan;
i) the establishment of an internal control system in the implementation of risk management to ensure compliance with applicable external and internal regulations, the effectiveness and efficiency of the Company's operational activities, the effectiveness of risk culture at every level of the Company's organization, and the availability of accurate, complete, useful, and timely management and financial information; j) the establishment of product development, premium rates, underwriting, claim settlement, self-retention, reinsurance, use of derivatives, diversification/specialization, and asset and liability management.
Risk management procedures must at least cover:
a) clear process stages; b) clear accountability and levels of delegation of authority; c) periodic review of procedures at least once every 1 (one) year or more frequently, depending on the type of risk, needs, and Company development; and d) adequate documentation of procedures to facilitate review and audit trails; d. Establishment of Risk Limits
The Company must have risk limits appropriate to the level of risk to be taken (risk appetite), risk tolerance, and the Company's overall strategy by considering the Company's capital ability to absorb risk exposure or losses arising, past loss experience, HR capability, and compliance with applicable external regulations.
The establishment of risk limits must at least cover:
a) clear accountability and levels of delegation of authority; b) periodic review of the establishment of risk limits at least once every 1 (one) year or more frequently, depending on the type of risk, needs, and Company development; and c) adequate documentation of the establishment of risk limits to facilitate review and audit trails;
The establishment of risk limits is conducted comprehensively over all aspects related to risk, covering overall limits, limits per type of risk, and risk limits per Company activity that has risk exposure.
Risk limits must be understood by all relevant parties and communicated well, including in the event of changes.
In the context of risk control, risk limits are used as thresholds to determine the level of risk mitigation intensity to be implemented by management.
The Company must have an approval mechanism in the event of exceeding risk limits.
The magnitude of risk limits is proposed by the relevant business and operational functions, which are then recommended by the risk management function to obtain approval from the Board of Directors or Board of Commissioners through the Risk Management Committee, or the Board of Directors according to their respective authorities as regulated in the Company's internal policies.
C. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems

Risk identification, measurement, control, and monitoring are main parts of the risk management implementation process. Risk identification is proactive, covering all Company activities and is conducted to analyze the sources and likelihood of risk emergence and its impact. Risk measurement is in accordance with the characteristics and complexity of the Company's business activities. The effectiveness of risk management implementation also needs to be supported by risk control by considering the results of risk measurement, including establishing risk mitigation strategies. Subsequently, monitoring is conducted on the results of risk measurement and control.
The Company establishes a function independent of the transaction party to monitor the level and trends and analyze the direction of risk management implementation.
In order to support the risk identification, measurement, control, and monitoring process, the Company also needs to develop a risk management information system adjusted to the characteristics and complexity of the Company's business activities.
Matters to be considered in the implementation of risk identification, measurement, control, and monitoring processes as well as risk management information systems include the following:

a. Risk Identification

The Company conducts periodic identification of all Risks, including the inherent risk attached to the Company's business activities.
The Company has methods or systems to conduct Risk identification across all of the Company's business activities.
The Risk identification process is conducted by analyzing all Risk sources, at least conducted against Risks from the Company's business activities, and ensuring that Risks from business development have undergone an appropriate Risk Management process before being introduced or implemented.

b. Risk Measurement

A Risk measurement system is used to measure the Company's Risk exposure as a reference for conducting controls. Risk measurement is conducted periodically for all of the Company's business activities.
The system must at least be able to measure:
a) the sensitivity of the Company's business activities to changes in influencing factors, both under normal and abnormal conditions; b) the tendency of changes in the aforementioned factors based on past fluctuations and their correlations; c) Risk factors individually; d) overall Risk exposure or per Risk type, considering the interrelationship between Risks; and e) all inherent risks attached to all of the Company's business activities, including business development, and can be integrated into the Company's management information system.
The selection of measurement methods is adjusted to the characteristics and complexity of the Company's business activities.
Risk measurement methods can be conducted quantitatively and/or qualitatively. These measurement methods can be those established by the Financial Services Authority (Otoritas Jasa Keuangan) for Risk assessment and capital calculation, or methods developed independently by the Company. Examples of simple qualitative methods include the use of checklists or subjective risk ratings such as low, low-medium, medium, medium-high, and high. Examples of quantitative methods include statistical methods such as Credit Scoring Tools and Value at Risk (VaR).
For Companies using alternative methods in the form of models for internal purposes (internal models) in the measurement of Credit Risk, Market Risk, and Operational Risk, at least the following must be considered:
a) Requirements for the use of internal models, at least including:
i. the content and quality of data created or maintained must comply with generally accepted standards so as to enable reliable statistical results;
ii. the availability of a management information system that allows the system to obtain appropriate and accurate data and information at the right time;
iii. the availability of documentation of the data sources used for the Risk measurement process; and
iv. the database and data storage process must be part of the system design to prevent the interruption of a series of statistical data.
b) In the event the Company conducts back testing against internal models such as Credit Scoring Tools and Value at Risk (VaR), as well as stress testing for exposures containing specific Risks, the Company must use historical data or a series of parameters and assumptions prepared by the Company itself or assumptions required by the Financial Services Authority. c) In order to address weaknesses that may arise from the use of certain Risk measurement models, the Company must conduct validation of such models by independent internal parties against the function that applies the model. d) If necessary, validation is conducted or supplemented with the results of reviews conducted by external parties with technical competence and expertise in the development of Risk measurement models. Model validation is a process:
i. evaluation of the internal logic of a specific model by verifying mathematical accuracy;
ii. comparing model predictions with subsequent events after a certain position date; and
iii. comparing one model with other existing models, both internal and external, if available.
e) Validation must also be conducted against new models, whether developed by the Company itself or provided by external parties. Models used by the Company must be evaluated periodically and ad hoc, especially in the event of significant changes in market conditions. f) Risk measurement methods must be clearly understood by employees involved in Risk control, including the Risk Management Committee, the Risk Management function, and the Board of Directors overseeing the Risk Management function.
The Risk measurement system must be evaluated and improved periodically at least once every 6 (six) months or ad hoc when necessary to ensure the suitability of assumptions, accuracy, fairness, and data integrity, as well as the procedures used to measure Risk.
The Risk measurement process must clearly contain the validation process, validation frequency, data and information documentation requirements, and evaluation requirements for the assumptions used, before a model is applied by the Company.
Stress testing is conducted to complement the Risk measurement system by estimating the Company's potential losses under abnormal market conditions using specific scenarios to view the sensitivity of the Company's performance to changes in Risk factors and to identify influences that have a significant impact on the Company's portfolio.
The Company needs to conduct periodic stress testing and review the results of such stress testing, and take appropriate steps if the estimated conditions to occur exceed the acceptable tolerance level. The results are used as input during the establishment or change of policies and limits.
The Company measures Risk based on the Company's ability to assess its own Risks.

c. Risk Control

The Company must have a Risk control system referring to established policies and procedures.
The Risk control process applied by the Company must be adjusted to the Risk exposure or the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance).
Risk control can be conducted by the Company, including through hedging mechanisms and other Risk mitigation methods to absorb potential losses. Examples of Risk mitigation methods for Companies can include steps for handling potential risks, for example, by using the Accept, Control, Avoid, and Transfer (ACAT) methods. Steps for handling potential risks that can be taken by the Company are as follows:
a) Accept, the Company decides to accept the Risk if the magnitude of impact and potential occurrence of the Risk are still within the Risk tolerance (risk tolerance) established by the Company. Example: Risks categorized as "low" and "low-medium" are decided to be accepted, or Risks categorized as "medium" and "medium-high" are decided to be accepted by taking other preventive steps, for example, requesting Shareholders to cover additional funding. b) Control, the Company decides to reduce the impact or likelihood of the Risk occurring. Example: The Company formulates asset allocation policies adjusted to the maturity of liabilities and conducts periodic monitoring of the suitability of assets and liabilities, as well as formulates and applies an early warning system to monitor Risks with significant potential impact. c) Avoid, the Company decides not to carry out an activity or chooses alternative activities that produce the same output to avoid the occurrence of Risk. Example: investment placement policy in liquid investments to control liquidity risk. d) Transfer, the Company decides to transfer all or part of the responsibility for the implementation of a process to a third party. Example: insuring buildings owned by the Company.
The Company must have a framework that is responsive to changes occurring due to the types of Risks present in the Company.

d. Risk Monitoring

Risks that have been identified, measured, and controlled by the Company are monitored in the form of a risk register. Examples of creating a risk register must at least include:
a) the establishment of all activities in the Company containing Risks that have been conducted in the Risk identification process; b) the ranking of the likelihood of occurrence and impact (inherent risk assessment) obtained from the results of Risk measurement; c) steps for handling potential risks (potential risk treatment), such as Accept, Control, Avoid, or Transfer (ACAT) used in the Risk control process; and d) the ranking of the likelihood of occurrence and impact after the Risk mitigation process.
The Company must have a monitoring system and procedures that include, among others, monitoring of the magnitude of Risk exposure, Risk tolerance (risk tolerance), internal limit compliance, and the results of stress testing as well as the consistency of implementation with established policies and procedures.
Monitoring is conducted by both business and operational functions as well as the Risk Management function.
The results of monitoring are presented in periodic reports submitted to management for the purpose of Risk mitigation and necessary actions.

e. Risk Management Information System

The Risk Management information system is part of the management information system that must be owned and developed according to the Company's needs in order to implement effective Risk Management.
As part of the Risk Management process, the Company's Risk Management information system is used to support the implementation of the Risk identification, measurement, control, and monitoring processes.
The Risk Management information system must ensure:
a) the availability of accurate, complete, informative, timely, and reliable information so that it can be used by the Board of Directors, Board of Commissioners, Sharia Supervisory Board, and related functions in the implementation of Risk Management to assess, mitigate, and monitor the Risks faced by the Company, both overall Risks and per Risk type, or in the context of decision-making by the Board of Directors; b) the effectiveness of Risk Management implementation, including policies, procedures, and the establishment of Risk limits; and c) the availability of information on the results or realization of Risk Management implementation compared to targets established by the Company in accordance with policies and strategies for the implementation of Risk Management.
The Risk Management information system and the information generated must be adjusted to the characteristics and complexity of the Company and be adaptive to changes.
The adequacy of the scope of information generated from the Risk Management information system must be reviewed periodically to ensure that the scope is adequate in accordance with the development of the level of complexity of the Company's business activities.
As part of the Risk Management information system, Risk profile reports are prepared periodically by the Risk Management function, which is independent of business and operational functions as well as internal control functions. The frequency of submission of reports to the relevant Board of Directors must be increased according to needs, especially when market conditions change rapidly.
The Risk Management information system must support the implementation of reporting to the Financial Services Authority.
In developing new information system technology and software, the Company must ensure that the implementation of new information systems and technology will not disrupt the continuity of the Company's information system.
If the Company decides to assign outsourced labor in the development of software and system improvement, the Company must ensure that the decision to appoint third parties is conducted objectively and independently. The outsourcing agreement or contract must include clauses regarding maintenance and updating, as well as anticipatory steps to prevent disruptions that may occur during operation.
Before implementing a new management information system, the Company must conduct testing to ensure that the processes and outputs generated have gone through effective and accurate development, testing, and re-evaluation processes, and the Company must ensure that historical accounting and management data can be accessed well by the new system or software.
The Company must account for and update system documentation, which contains hardware, software, databases, parameters, process stages, assumptions used, data sources, and generated outputs, so as to facilitate inherent control and the implementation of audit trails.
The Company must prepare a backup system and effective procedures to prevent disruptions in the Risk monitoring process and conduct periodic checks and re-evaluations of the backup system.
The Company must ensure that all inherent risks attached to all transactions and products of the Company, including new products and activities, can be integrated into the Company's management information system.

D. Comprehensive Internal Control System

The implementation process of effective Risk Management must be complemented by a reliable internal control system. The effective implementation of an internal control system can help the Company in safeguarding its assets, ensuring the availability of reliable financial and managerial reporting, increasing the Company's compliance with laws and regulations, and reducing the Risk of losses, deviations, and violations of prudential aspects. The implementation of a reliable and effective internal control system of the Company becomes the responsibility of all business and operational functions (risk-taking functions) and supporting functions as well as the internal audit function.
Matters to be considered in the implementation of the internal control system include the following:
a. The Company implements an internal control system effectively in the implementation of the Company's Risk Management by referring to established policies and procedures. Example, the application of the principle of separation of functions (four eyes principle) that is adequate and consistent. b. The internal control system in the implementation of Risk Management must at least include:

the suitability between the internal control system and the type and level of Risk attached to the Company's business activities;
the establishment of authority and responsibility for monitoring compliance with Risk Management policies and procedures as well as the establishment of Risk limits;
the establishment of clear reporting lines and separation of functions from business and operational functions (risk-taking function) to internal control functions or internal audit functions;
an organizational structure that clearly describes the duties and responsibilities of each function and individual;
accurate and timely financial and operational reporting;
adequate procedures to ensure the Company's compliance with internal regulations and legislation;
effective, independent, and objective reviews of the Company's policies, frameworks, and operational procedures;
adequate testing and evaluation of the management information system;
complete and adequate documentation of the scope, operational procedures, audit processes, audit findings, and follow-up of audit results as well as responses from the Board of Directors, Board of Commissioners, and Sharia Supervisory Board of the Company based on audit results; and
periodic and continuous verification and review of the handling of material weaknesses of the Company and the actions of the Company's Board of Directors to correct deviations that occur.
c. Implementation of reviews on the implementation of Risk Management must at least include the following:
periodic review and evaluation at least once (1) a year by the Risk Management function and the internal audit function;
The frequency and intensity of review and evaluation can be increased based on the development of the Company's Risk exposure, changes in market conditions, measurement methods, and Risk management; and
Reviews by internal control functions or internal audit functions include, among others:
a) the reliability of the Risk Management framework, which includes policies, organizational structure, resource allocation, Risk Management process design, information systems, and Risk reporting of the Company; and b) the implementation of Risk Management by business and operational functions (risk-taking functions) or supporting functions, including reviews of the implementation of monitoring by the Risk Management function. c) specifically for reviews and evaluations of Risk measurement, must at least include:
i. the suitability of the Risk Management framework (policies, organizational structure, resource allocation, Risk Management process design, information systems, and Risk reporting of the Company) with the Company's business needs, as well as the development of regulations and best practices related to Risk Management;
ii. methods, assumptions, and variables used to measure Risk and establish Risk exposure limits;
iii. comparison between the results of Risk measurement methods using simulation or future projections with actual results;
iv. comparison between the assumptions used in the aforementioned methods with actual conditions;
v. comparison between established limits with actual exposure; and
vi. determination of the suitability between Risk measurement and exposure limits with past performance and the Company's current capital position.
The results of the review assessment by the Risk Management function are submitted to the Board of Commissioners, internal audit function, risk management committee, audit committee, and other relevant Boards of Directors as input for the improvement of the Risk Management framework and process.
Monitoring by the internal audit function regarding improvements to the results of internal and external audit findings. Audit findings that have not been followed up must be informed by the internal control function or internal audit function to the Board of Directors to take necessary steps.
The Company's responsiveness to weaknesses and deviations that occur regarding applicable internal and external regulations.

II. GUIDELINES FOR THE IMPLEMENTATION OF RISK MANAGEMENT FOR EACH RISK
A. Strategic Risk

Definition
a. Strategic Risk is a Risk due to inaccuracies in the making and/or implementation of strategic decisions as well as failures in anticipating changes in the business environment. b. Strategic Risk can originate from, among others:

The Company establishes strategies that are less aligned with the Company's vision and mission;
The Company conducts a non-comprehensive strategic environment analysis;
there is a mismatch of strategic plans (strategic plan) between strategic levels; and
failure to anticipate changes in the business environment, such as changes in technology, changes in macroeconomic conditions, market competition, and changes in policies of relevant authorities.

Objective
The main objective of Risk Management for Strategic Risk is to ensure that the Risk Management process can minimize the likelihood of negative impacts from inaccuracies in the making and/or implementation of strategic decisions as well as failures in anticipating changes in the business environment.
Implementation of Risk Management
The implementation of Risk Management for Strategic Risk is adjusted to the size and complexity of the Company's business activities. Generally, in the principle of implementation of Risk Management for Strategic Risk must at least include:
a. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In implementing Risk Management through active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board for Strategic Risk, in addition to carrying out active supervision as referred to in Section I letter A, in each aspect of the Company, the following must be added:

Authority and Responsibility of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board, according to the scope of their respective authorities, must ensure that the implementation of Risk Management for Strategic Risk is conducted in an integrated manner with the implementation of Risk Management for other Risks that can impact the Company's overall Risk profile. b) The Board of Directors and Board of Commissioners must formulate and approve strategic plans and business plans according to their respective duties and responsibilities and communicate them to every level of organization within the Company. c) The Board of Directors is responsible for the implementation of Risk Management for Strategic Risk, which includes:
i. ensuring that strategic objectives established are aligned with the vision and mission, culture, and Risk tolerance (risk tolerance) of the Company;
ii. providing clear direction regarding the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) that can be accepted by the Company;
iii. ensuring that the structure, culture, infrastructure, financial conditions, manpower, and managerial competence, including executive officials, as well as systems and controls existing in the Company are adequate to support the implementation of established strategies; and
iv. ensuring that every strategic problem that arises can be resolved effectively by the relevant work units and monitoring of corrective actions by the strategic policy work units.
d) The Board of Directors must monitor internal conditions (weaknesses and strengths of the Company) and the development of internal/external factors/conditions that directly or indirectly

affecting the business activities of the Company.

e) The Board of Directors is responsible for ensuring that Risk Management for Strategic Risk has been implemented effectively and consistently across all related levels of the organization. In the event that the Board of Directors delegates part of its responsibilities to executive officers and management below them, such delegation does not eliminate the obligation of the Board of Directors as the primary party responsible.

Human Resources (HR)
Adequacy of Human Resources for Strategic Risk refers to the provisions as referred to in Roman I letter A number 2 letter b.
Risk Management Organization for Strategic Risk
a) All business and operational functions and support functions in the Company are responsible for assisting the Board of Directors in formulating strategic planning, and implementing strategies effectively. b) Business and operational functions and other support functions are responsible for ensuring at least:
i. Risk Management practices for Strategic Risk and controls in business and operational functions are consistent with the overall Risk Management framework for Strategic Risk; and
ii. business and operational functions and other support functions have policies, procedures, and resources to support the effectiveness of the Risk Management framework for Strategic Risk.
c) The Board of Directors overseeing the Risk Management function leads the change programs required in the implementation of the established strategy. d) The Risk Management function in the Strategic Risk Risk Management process at least:
i. coordinates with business and operational functions in the strategic planning process;
ii. monitors the development of strategic plan implementation, and provides input regarding opportunities and options available for continuous strategy development and improvement; and
iii. ensures that all strategic issues and their impact on the achievement of strategic goals have been followed up on in a timely manner.

b. Adequacy of Risk Management Policies and Procedures and Risk Limit Setting In implementing Risk Management policies and procedures and risk limit setting for Strategic Risk, in addition to implementing Risk Management policies and procedures and risk limit setting as referred to in Roman I letter B, in each aspect of the Company, the following applications must be added:

Risk Management Strategy
a) In formulating strategy, the Company evaluates the Company's position in the industry as a whole. In this regard, the Company needs to:
i. understand the environmental, economic, and industry conditions of the Company where the Company conducts its business activities, including how environmental changes affect business activities, technology, and office networks;
ii. measure the strengths and weaknesses of the Company related to competitive position, the Company's business position in the financial industry, financial performance, organizational structure, and Risk Management, infrastructure for current and future business needs, managerial capabilities, and the availability and limitations of the Company's resources;
iii. analyze all available strategy alternatives after considering strategic goals and the Company's risk tolerance.
The depth and scope of the analysis must align with the scale and complexity of the Company's business activities.

b) The Company must establish strategic plans and business plans in writing and implement these policies. c) The strategic plans and business plans must be evaluated and adjusted in the event of deviations from targets to be achieved due to significant external and internal changes. d) In the event that the Company plans to implement long-term and sustainable strategies, the Company must have adequate managerial succession plans to support the effective implementation of strategies on a sustainable basis. e) The Company has adequate capital to support strategic plans. f) The Company's Risk Management strategy must at least cover the setting of 4P (product, price, position, and promotion or products/services, price, position, and promotion).

Risk Appetite and Risk Tolerance
The setting of risk appetite and risk tolerance for Strategic Risk refers to the provisions as referred to in Roman I letter B number 6 letter b.
Policies and Procedures
a) The Company must have and apply policies and procedures to formulate and approve strategic plans. b) The Company must have adequate procedures to identify and respond to changes in the business environment. c) The Company must have procedures to measure progress achieved from the realization of business plans and performance according to the established schedule.
Limit Setting
Strategic Risk limits generally relate to limitations on deviations from the established strategic plans, such as budget deviation limits and target completion time deviation limits.

c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems for Strategic Risk
In implementing Risk Management through the processes of risk identification, measurement, control, and monitoring, as well as the Risk Management information system for Strategic Risk, in addition to implementing the processes as referred to in Roman I letter D, in each process, the Company must add the following applications:

Strategic Risk Identification
a) The Company must identify and account for deviations as a result of the non-realization or ineffectiveness of the implementation of business strategies or established business plans, especially those that have a significant impact on the Company's business activities. b) The Company must conduct Risk analysis, primarily on strategies that require many resources or are high-risk, such as entering a new market share strategy, acquisition strategy, or offering new products/services, or attracting new customers.
Strategic Risk Measurement
a) In measuring Strategic Risk, among others, indicators/parameters such as the alignment of strategy with business environment conditions, high-risk and low-risk strategies, the Company's strategic position in the insurance industry, and the realization of business plans can be used. b) The Company can conduct stress testing on strategy implementation to identify any events or changes in the business environment that could have a negative impact on the fulfillment of initial assumptions of strategic plans and measure the potential negative impact of such events on the Company's business activities, both financially and non-financially. c) Stress testing results must provide feedback to the strategy planning process. d) In the event that stress testing results produce a Risk level higher than the Risk tolerance or the Company's ability to absorb Risk, the Company develops contingency plans or strategies to mitigate the Risk in question.
Strategic Risk Control
a) The Company must have systems and controls to monitor strategy implementation, business decision-making, and the Company's response to external changes to ensure that the Risk taken remains within tolerance limits and to report significant deviations to the Board of Directors. These Risk control systems must be approved and reviewed periodically by the Board of Directors to ensure their continuous suitability. b) The Company must have a good strategy formulation and setting process and have a good part monitoring the implementation of the Company's strategic plans so that it can ensure the conditions after the implementation of such strategies on the Company's business activities.
Strategic Risk Monitoring
a) The Company must have a process to monitor and control the development of strategy implementation periodically. Monitoring is carried out, among others, by considering past loss experiences caused by Strategic Risk or deviations in the implementation of strategic plans. b) Strategic issues arising from operational and business environment changes that have a negative impact on business activities or the Company's financial conditions are reported to the Board of Directors in a timely manner, accompanied by an analysis of the impact on Strategic Risk and necessary corrective actions.
Risk Management Information System for Strategic Risk
a) The Company must ensure that the management information systems owned are adequate to support the strategic planning and decision-making process and are reviewed periodically. b) The Risk Management function is responsible for ensuring that all material Risks arising from changes in the business environment and strategy implementation are reported to the Board of Directors in a timely manner.

d. Comprehensive Internal Control System
The adequacy of the internal control system in the implementation of Risk Management for Strategic Risk refers to the provisions as referred to in Roman I letter D.

B. Operational Risk

Definition
a. Operational Risk is Risk due to the inadequacy and/or malfunction of internal processes, human error, system failure, and/or the occurrence of external events that affect the Company's operations. b. Operational Risk can originate, among others, from weaknesses in human resources, weaknesses in internal processes, inadequate systems and infrastructure, and external events that have a bad impact on the Company.
c. Operational Risk also includes risks arising from the inadequacy of liabilities caused by weaknesses in the process of setting actuarial assumptions and/or the inability of actuaries to set actuarial assumptions appropriate to the conditions faced.
d. These sources of Risk can cause events that have a negative impact on the Company's operations, so the emergence of Operational Risk event types is one of the measures of success or failure of Risk Management for Operational Risk. Some examples of Operational Risk events can be classified, among others, as internal fraud, external fraud, physical asset damage, system failure, process and execution errors, including fraud arising from money laundering and terrorism financing activities.
Objective
The main objective of Risk Management for Operational Risk is to minimize the likelihood of negative impacts from the malfunction of internal processes, human error, system failure, including information systems used by the Company, or events originating from outside the Company's environment.
Implementation of Risk Management
The implementation of Risk Management for Operational Risk is adjusted to the size and complexity of the Company's business activities. Generally, in the principle of implementing Risk Management for Operational Risk, it must at least cover:

a. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In implementing Risk Management through active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board for Operational Risk, in addition to implementing active supervision as referred to in Roman I letter A, in each aspect of the Company, the following applications must be added:

Authority and Responsibilities of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board, according to the scope of their respective authorities, must ensure that Risk Management for Operational Risk is carried out in an integrated manner with other Risk Managements that can impact the Company's overall Risk profile. b) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board are responsible for developing an organizational culture aware of Operational Risk and fostering commitment in managing Operational Risk in accordance with the Company's business strategy. c) The Company's Board of Directors creates a culture of objective disclosure of Operational Risk across all organizational elements so that Operational Risk can be identified quickly and mitigated appropriately. d) The Board of Directors establishes effective reward policies, including remuneration and punishment, for Company employees, which are integrated into the performance evaluation system in order to support the implementation of optimal Risk Management. e) The Board of Directors must ensure that the exercise of authority and responsibilities delegated to service providers has been carried out well and responsibly. f) The Board of Commissioners ensures that the Company's remuneration policies are in accordance with the Company's Risk Management strategy.
Human Resources (HR)
a) The Company must have a code of ethics applied to all employees at every level of the organization. b) The Company must impose sanctions consistently on officials and employees proven to have committed deviations and violations. c) All Company employees become part of the implementation of Risk Management for Operational Risk.
Risk Management Organization for Operational Risk
a) Management of the Company's business and operational functions or support functions are risk owners responsible for the daily Risk Management process for Operational Risk and reporting specific problems and Operational Risks in their functions according to the reporting level. b) In the Risk Management function, the Company can form an independent function or appoint an official responsible for carrying out the Risk Management function for Operational Risk comprehensively. This function or official is tasked with assisting the Board of Directors in managing Operational Risk and ensuring that Risk Management policies for Operational Risk run at all levels of the organization. c) To facilitate the Risk Management process for Operational Risk in the Company's business and operational functions or support functions and to ensure the consistent implementation of Risk Management policies for Operational Risk, a dedicated operational risk officer can be appointed who has a dual reporting line, namely directly to the head of the business and operational function or support function and to the Risk Management function. The responsibilities of the dedicated operational risk officer include the development of specific Risk indicators for the Company's business and operational functions or support functions, determining escalation limits, and compiling Risk Management reports for Operational Risk.

b. Adequacy of Risk Management Policies and Procedures and Risk Limit Setting In implementing Risk Management policies and procedures and risk limit setting for Operational Risk, in addition to implementing Risk Management policies and procedures and risk limit setting as referred to in Roman I letter B, in each aspect of the Company, the following applications must be added:

Risk Management Strategy
Strategy formulation for Operational Risk refers to the provisions as referred to in Roman I letter B number 6 letter a.
Risk Appetite and Risk Tolerance
The setting of risk appetite and risk tolerance for Operational Risk refers to the guidelines as referred to in Roman I letter B number 6 letter b.
Policies and Procedures
a) The Company has an adequate operational system. b) The Company has an early warning system when there is a mismatch between actual data and data held by the Company. c) The Company must establish Risk Management policies for Operational Risk that must be internalized into the business processes of all business activities and support activities of the Company, including Operational Risk policies that are unique according to the needs of business activities and support activities. d) The Company must have procedures that are derived from Risk Management policies for Operational Risk. These procedures can be:
i. general controls, namely operational controls that are general in nature for all business activities and support activities of the Company, such as separation of functions or the requirement to take leave; and
ii. specific controls, namely operational controls that are specific in nature for each business activity and support activity of the Company, such as the accounting of Policyholders, Insureds, and Participants' documents.
e) The Company must have business continuity management, namely an integrated and comprehensive management process to ensure the continuity of the Company's operations. Some policies that can be implemented include, among others, conducting business impact analysis and recovery strategies implemented by the Company for each type of disturbance that occurs. f) The Company has early warning procedures to handle unexpected changes in information technology systems that increase the likelihood of Operational Risk occurring. g) To mitigate Operational Risk arising from the complexity of internal processes, the Company must have policies that at least cover:
i. controls to prevent Operational Risk for both all internal processes and those related to external parties;
ii. procedures for settling a transaction from the internal process, among others, to ensure the effectiveness of the transaction settlement process;
iii. accounting execution procedures to ensure accurate accounting records, among others, by the suitability of accounting methods used, the accounting process carried out, and the accounting of supporting documents;
iv. asset storage procedures, among others, asset documentation, controls needed for physical asset security, and periodic checks regarding asset conditions;
v. procedures for the execution of product provision and other activities carried out by the Company; and
vi. fraud prevention and settlement procedures.
h) To reduce the likelihood of Operational Risk arising from HR, the Company's Risk Management policies must at least contain policies on recruitment and placement according to organizational needs, effective rewards and punishments for Company employees, competitive remuneration and incentive structures, training and development, periodic rotation, career planning and succession policies, and handling of employment termination issues. i) To reduce the likelihood of Operational Risk arising from systems and infrastructure, the Company's Risk Management policies must at least be supported by procedures for access to management information systems, accounting information systems, Risk management systems, document room security, and data processing rooms. j) To reduce the likelihood of Operational Risk arising from external events, the Company's Risk Management policies must be supported, among others, by insurance protection for the Company's physical assets and backup systems. k) To reduce the likelihood of Operational Risk arising from the profile of Policyholders, Insureds, and Participants and prospective Policyholders, Insureds, and Participants, the Risk Management policy must contain the Company's obligation to conduct Customer Due Diligence (CDD) or Enhanced Due Diligence (EDD) periodically and consistently in accordance with Operational Risk exposure. The implementation of CDD/EDD refers to all requirements and guidelines as regulated in applicable provisions regarding anti-money laundering and terrorism financing prevention. CDD/EDD must be supported by an effective internal control system, particularly the Company's efforts to prevent internal crimes (internal fraud).
Limit Setting
Limit setting for Operational Risk refers to the guidelines as referred to in Roman I letter B number 6 letter d.

c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems for Operational Risk
In implementing Risk Management through the processes of risk identification, measurement, control, and monitoring, as well as the Risk Management information system for Operational Risk, in addition to implementing the processes as referred to in Roman I letter C, in each process, the Company must add the following applications:

Operational Risk Identification
a) The Company must identify and measure parameters that affect Operational Risk exposure, among others, the frequency and impact of:
i. system failures and errors;
ii. weaknesses in information technology systems;
iii. failure of relationships with Policyholders, Insureds, or Participants;
iv. accounting calculation errors;
v. delays and errors in benefit payment settlement;
vi. fraud;
vii. accounting manipulation; and
viii. natural disasters.
b) The Company develops a database regarding:
i. types and impacts of losses, caused by Operational Risk based on Risk identification results, in the form of loss data that can be predicted and those that are difficult to predict;
ii. violations of control systems; and
iii. other operational issues that can cause losses in the future.
c) The Company considers various internal and external factors in conducting Operational Risk identification, among others:
i. the Company's organizational structure, Risk culture, HR management, organizational changes, and employee turnover;
ii. the characteristics of Policyholders, Insureds, or Participants, products, as well as the complexity of business activities and transaction volume;
iii. the design and implementation of systems and processes used; and
iv. the external environment, including social and political conditions.
Operational Risk Measurement
a) In measuring Operational Risk, among others, indicators/parameters such as the characteristics and complexity of the Company's business activities, HR, infrastructure and information technology systems, fraud risk, external events, administrative systems, the level of interaction and dependence of the Company, the process of setting actuarial assumptions, and the ability of actuaries to set actuarial assumptions appropriate to the conditions faced by the Company can be used. b) The Company considers various internal and external factors in conducting Operational Risk measurement. c) Methods that can be used by the Company to conduct Operational Risk measurement, among others, scorecards, risk mapping, and frequency matrices. d) For Companies that have not yet developed special methods for conducting Operational Risk measurement, the main source of Operational Risk information is internal audit findings related to Operational Risk.
Operational Risk Control
a) Risk control is carried out consistently in accordance with the risk appetite, results of identification, and measurement of Operational Risk.

b) In implementing Operational Risk controls, the Company may develop programs to mitigate Operational Risk, including securing information technology processes and outsourcing certain operational activities while maintaining the confidentiality and security of the Company's data in Outsourcing Cooperation Agreements (PKS). c) In the event the Company develops information technology process security, the Company must ensure the security level of electronic data processing. d) The Company must have a support system, which at a minimum covers:
i. early identification of errors;
ii. efficient, accurate, and timely processing and settlement of all transactions; and
iii. confidentiality, truthfulness, and security of all transactions.
e) The Company must periodically review procedures, documentation, data processing systems, contingency plans, and other operational practices to reduce the likelihood of human error.

Operational Risk Monitoring
a) The Company must conduct continuous monitoring of Operational Risk across all Operational Risk exposures and losses that may arise from the Company's business activities, including by implementing an internal control system and providing periodic reports on losses caused by Operational Risk. b) The Company must periodically review, adjusted to the risk level of operational activities and/or potential changes in the environment impacting operational activities, the factors causing Operational Risk and the impact of its losses.
Risk Management Information System for Operational Risk
a) The management information system must be able to generate complete and accurate reports to detect and correct deviations in a timely manner. b) The Company must have a reporting mechanism for Operational Risk that can provide information according to the Company's needs, including as follows:
i. Operational Risk profile and losses caused by Operational Risk;
ii. results from various Operational Risk measurement methods and trends, and a summary of internal audit function findings;
iii. report on the status and effectiveness of the implementation of action plans for operational risk issues;
iv. deviation reports;
v. fraud incident reports, for example in the form of a whistleblowing system; and
vi. recommendations from the Risk Management function regarding reviews conducted on the Company's Operational Risk assessment.

d. Comprehensive Internal Control System
In implementing Risk Management through the implementation of an internal control system for Operational Risk, in addition to implementing internal controls as referred to in Roman I letter D, the Company needs to have a routine rotation system to avoid the potential for self-dealing, collusion, or concealment of documentation or transactions that are not normal.

C. Insurance Risk

Definition
a. Insurance Risk is the Risk of the Company's failure to fulfill obligations to Policyholders, Insureds, or Participants as a result of insufficient risk selection (underwriting) processes, premium setting (pricing), use of reinsurance, and/or claims handling. b. Insurance risks faced by the Company can originate from various business activities of the Company, including the types of products owned, product duration, risks covered, and benefits provided by the Company to Policyholders, Insureds, or Participants.
c. Insurance risk can cause direct or indirect financial losses and opportunity cost losses (loss of opportunity to obtain profit).
Objective
The main objective of Risk Management for Insurance Risk is to ensure that the Company's business activities are not exposed to Insurance Risks that can cause significant losses or even disrupt the Company's business continuity.
Implementation of Risk Management
The implementation of Risk Management for Insurance Risk is adjusted based on the characteristics, business scale, and complexity of the Company's business activities. Generally, in the principle of implementing Risk Management for Insurance Risk, it covers at least:

a. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In implementing Risk Management through active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board for Insurance Risk, in addition to implementing active supervision as referred to in Roman I letter A, each aspect of the Company must add the following implementation:

Authority and Responsibilities of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board, according to the scope of their respective authorities, must ensure that Risk Management for Insurance Risk is carried out in an integrated manner with other Risk Management that can impact the Company's Insurance Risk profile. b) The Board of Directors must ensure that every issue with the potential to cause Insurance Risk can be effectively resolved by the relevant work unit and that monitoring is conducted over corrective actions for such potential. c) The Board of Directors ensures that marketed products have been analyzed and adjusted to market needs. d) The Board of Directors must establish a product development strategy plan and product evaluation. e) The Board of Directors must ensure that standard operating procedures applicable in the Company comply with best practices, including the underwriting process, claims handling, and product distribution.
Human Resources (HR)
a) Adequacy of HR for Insurance Risk refers to the scope of general implementation as described in operational risk. b) The Company needs to have effective underwriting and claims functions, as well as an actuarial function capable of evaluating and providing recommendations to the Company at least regarding technical provisions and premium rate setting in accordance with applicable regulations. A healthy actuarial function is one that places appropriate HR with sufficient understanding in the actuarial field so that the Company can carry out its activities properly.
Risk Management Organization for Insurance Risk
In the Risk Management function for Insurance Risk, the Company can form work units or committees that can support Insurance Risk mitigation, including the marketing unit, actuarial work unit, and insurance product development committee.

b. Adequacy of Risk Management Policies and Procedures and Risk Limit Setting In implementing Risk Management policies and procedures and setting Risk limits for Insurance Risk, in addition to implementing Risk Management policies and procedures and setting Risk limits as referred to in Roman I letter B, in each aspect of the Company, the following implementations need to be added:

Risk Management Strategy
a) The Risk Management Strategy for Insurance Risk must cover strategies for all activities with significant Insurance Risk exposure. This strategy must clearly contain the risk selection process, premium setting, use of reinsurance, and claims handling. b) The Risk Management Strategy for Insurance Risk must align with the Company's objective to fulfill its obligations to Policyholders, Insureds, or Participants. c) The Company has adequate management and control of Insurance Risk for product design/development, premium setting, underwriting, claims, liability valuation, reinsurance, and distribution. d) The Company provides educational opportunities to the Board of Directors and management to enhance their understanding of Insurance Risk. e) The Company implements a strategy regarding the business lines/product types to be selected/marketed. f) The Company has a specific work unit handling claims.
Risk Appetite and Risk Tolerance
The setting of Risk Appetite and Risk Tolerance for Insurance Risk refers to the guidelines as referred to in Roman I letter B number 6 letter b.
Policies and Procedures
a) The Company has policies and procedures regarding product development. b) Product development is adjusted to the Company's policies and procedures and applicable regulations. c) Policies and procedures related to product design and new products involve employees with adequate expertise and experience, among others. d) The Company maps the impact created by the dominance of Insurance Risk on the overall business lines. e) The Company has policies regarding the underwriting process. f) Premium setting procedures comply with the underwriting process so that there is no failure to fulfill obligations to policyholders. g) Policies regarding the selection of covered risks and marketed products comply with the underwriting process. h) Formal procedures for monitoring Insurance Risk become part of the Company's framework and include among others the Risk Management strategy, and the Company's Risk Management procedures and policies. i) The Company periodically evaluates factors from products assessed as part of Insurance Risk, such as the type of risk covered, benefit payment methods, and product types.
Limit Setting
a) The Company must set Risk limits, including product composition and product distribution that can increase Insurance Risk. b) Limits for Insurance Risk are used to reduce risks arising, including those from the types of products marketed and the types of distribution used.

c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information System for Insurance Risk
In implementing Risk Management through risk identification, measurement, control, and monitoring processes, as well as the Risk Management information system for Insurance Risk, in addition to implementing processes as referred to in Roman I letter C, each process in the Company must add the following implementation:

Identification of Insurance Risk
a) The Company identifies the nature, type, and complexity of business activities, including the Company's new products and activities. b) In identifying Insurance Risk, it is necessary to consider guidelines, regulations, procedures, and policies contained in the Company. c) In identifying Insurance Risk, factors that can affect the level of Insurance Risk in the future must be considered, such as the possibility of changes in economic conditions and the possibility of natural disasters. d) In identifying Insurance Risk, several factors must be considered, including:
i. differences between incurred claim burdens and estimated claim burdens;
ii. insufficient premiums or reserves due to setting investment return assumptions too high compared to investment returns that can be obtained by the Company;
iii. the inability of reinsurers to fulfill the liability to pay claims; and
iv. failures in the production process, inability of HR or systems to perform well, or other adverse events.
Measurement of Insurance Risk
a) The Company must have measurement tools that can quantify insurance risk in a timely and comprehensive manner. These measurement tools must include at least:
i. Net premium to equity ratio;
ii. Claims ratio;
iii. Technical reserves to net premium ratio;
iv. Lapse ratio;
v. Cession ratio;
vi. Retention ratio;
vii. New business growth ratio;
viii. Technical reserves growth ratio;
ix. Insurance risk growth (from MMBR);
x. Loss ratio from core business; and
xi. Ratio of the highest guaranteed return/average return of the last 3 (three) years.
b) The selection of measurement methods is adjusted to the characteristics and complexity of business activities. c) The Risk measurement system must be evaluated and improved periodically or as needed to ensure the suitability of assumptions, accuracy, fairness, and data integrity, as well as the procedures used to measure insurance risk. d) Stress testing is conducted to complement the risk measurement system by estimating the Company's potential losses under abnormal market conditions using specific scenarios to see the sensitivity of the Company's performance to changes in insurance risk factors. e) The Company needs to conduct periodic stress testing and review the results of such stress testing, taking appropriate steps if estimated future conditions exceed the acceptable level of tolerance. These results are used as input when setting or changing policies and limits.
Control of Insurance Risk
a) The Board of Directors and management monitor Insurance Risk so that the Board of Directors and management know the current condition regarding the Insurance Risk profile. b) The Company updates underwriting procedures, claims procedures, policy provisions, liability valuation, product distribution, and the scope of reinsurance. c) The Company receives input from third parties regarding premium setting, for example, from actuaries. d) The Company provides training to enhance the Board of Directors' understanding of Insurance Risk. e) The Company develops product design by first analyzing market needs. f) The Company sets premiums based on several criteria, for example, actuarial assumptions and claim estimates. g) The Company conducts the underwriting process as a form of control over Insurance Risk. h) Independent parties conduct reviews of the Company, including reviews of technical reserves and insurance risk profiles. i) Underwriting procedures have been applied and implemented well in the Company. j) The Company's business work units or the Company's actuarial personnel monitor new business and the underwriting function periodically.
Monitoring of Insurance Risk
a) The work unit performing the Risk Management function for Insurance Risk monitors and reports Insurance Risk that occurs to the Company's Board of Directors, both immediately when Insurance Risk occurs and periodically. b) The Company must have a monitoring system and procedures that include among others monitoring of the magnitude of insurance risk exposure, insurance risk tolerance, internal limit compliance, and stress testing results, as well as consistency in implementation with established policies and procedures. c) Monitoring is conducted by both the implementing work unit and the work unit performing the Risk Management function.
Risk Management Information System for Insurance Risk
In implementing Risk Management for Insurance Risk, in addition to implementing the management information system, the Company also needs to implement the following:
a) The Risk Management information system for Insurance Risk must be able to provide accurate, complete, informative, timely, and reliable data regarding the total number of policyholders/insureds, product portfolios, and reports on Insurance Risk limit exceptions, including information on coverage or portfolios exceeding the set risk limits, so that it can be used by the Board of Directors to identify the existence of Insurance Risk. b) The owned information system must be able to accommodate Insurance Risk mitigation strategies through various methods or policies, such as limit setting, policy agreements, underwriting processes, liability valuation, claims handling, opinions on reviews by independent parties, and others. c) The Company has a management information system that can ensure the integrity of data used in calculating obligations. d) The Risk Management information system owned by the Company can present data regarding the claims handling process, including among others, claim receipt and claim investigation.

d. Comprehensive Internal Control System
In implementing Risk Management through the implementation of an internal control system for Insurance Risk, in addition to implementing internal controls as referred to in Roman I letter D, the Company also needs to implement the following:

An independent and continuous review system regarding the effectiveness of the implementation of the Risk Management process for Insurance Risk, which at a minimum contains the evaluation of the premium setting process, product development, assessment of the accuracy of Risk measurement method implementation or Risk level assessment, and the effectiveness of the implementation of work units or officers who monitor the Company's business activities or operations;
An internal review system by individuals independent of the Company's business work units to help evaluate the overall business process;
An efficient and effective reporting system to provide adequate information to the Board of Commissioners, Board of Directors, Sharia Supervisory Board, and audit committee; and
Internal audit of the Insurance Risk process is conducted periodically, which includes among others identifying whether:
a) business activities are in line with established policies and procedures; b) all authorizations are carried out within the guidelines provided; and c) there are weaknesses in the Risk Management process for Insurance Risk, policies and procedures, including any exceptions to policies, procedures, and limits.

D. Credit Risk

Definition
a. Credit Risk is the Risk due to the failure of other parties to fulfill obligations to the Company, including in Credit Risk, namely Credit Risk due to the concentration of investment placements (Investment Concentration Risk), Credit Risk due to counterparty failure (counterparty credit risk), Credit Risk due to settlement failure (settlement risk), and Credit Risk due to country risk. b. Credit risk is generally present in all insurance business processes whose performance depends on the performance of counterparties such as issuers of investment instruments, Policyholders, Insureds, or Participants in premium payments, as well as reinsurers.
c. Investment concentration risk is the Risk caused by investments concentrated on specific parties or groups, industries, sectors, or specific geographical areas, specific products or types of investments, or specific fields of business.
d. Credit Risk due to settlement failure (settlement risk) arises from the failure to deliver cash and/or financial instruments on the agreed settlement date from the transaction of sale and/or purchase of financial instruments.
Objective
a. The main objective of Risk Management for Credit Risk is to ensure that the Company's investment management activities/business activities are not exposed to Credit Risk that can cause losses to the Company. b. Generally, Credit Risk exposure must be controlled in order to maintain the Company's condition in a fully funded state. Generally, Credit Risk exposure is one of the main Risk exposures, so the Company's ability to identify, measure, control, and monitor Credit Risk, as well as provide sufficient capital for such Risk, is very important.
Implementation of Risk Management
The implementation of Risk Management for Credit Risk is adjusted to the business scale, business complexity, and the Company's business strategy. Generally, in the principle of implementing Risk Management for Credit Risk, it covers at least:

a. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In implementing Risk Management through active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board for Credit Risk, in addition to implementing active supervision as referred to in Roman I letter A, each aspect of the Company must add the following implementation:

Authority and Responsibilities of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board, according to the scope of their respective authorities, must ensure that Risk Management for Credit Risk is carried out in an integrated manner with other Risk Management that can impact the Company's overall Risk profile. b) The Board of Directors is responsible for ensuring that all investment management activities, Company operations, and placement and/or acceptance of reinsurance can be carried out in accordance with the Credit Risk strategy and policies approved by the Board of Commissioners. c) The Board of Directors must ensure that the implementation of Risk Management is carried out effectively in the execution of investment management activities, including monitoring developments and issues in the Company's investment management activities. d) The Board of Commissioners and Sharia Supervisory Board monitor the implementation of investment management by the Board of Directors to ensure compliance with legislation and Sharia principles according to the scope of their respective authorities.
Human Resources (HR)
The Company must have adequate HR in the field of investment management or Risk Management. In addition, the Company must have HR capable of developing relevant models for the mitigation of Credit Risk.
Risk Management Organization for Credit Risk
In the implementation of Risk Management for Credit Risk, the Company must have an investment management function. In cases where needed,

Companies may form a special management committee to handle investment management.

b. Adequacy of Risk Management Policies and Procedures and Risk Limit Setting

In implementing Risk Management policies and procedures and setting Risk limits for Credit Risk, in addition to implementing Risk Management policies and procedures and setting Risk limits as referred to in Roman I letter B, in each aspect, the Company must additionally apply:

Risk Management Strategy
a) The Risk Management Strategy for Credit Risk must cover strategies for all activities with significant Credit Risk exposure. b) The Risk Management Strategy for Credit Risk must align with the Company's objectives to maintain Company growth.
Risk Appetite and Risk Tolerance
a) Risk Appetite must reflect the Company's perspective on Credit Risk, such as investment management, investment diversification, actuarial assumptions used, and capital quality. b) Risk Tolerance for Credit Risk must reflect the Company's overall strategy in achieving its goals and be consistent with the established Risk Appetite.
Policies and Procedures
a) In the Credit Risk policy covering the implementation of Risk Management for Credit Risk for all Company activities, a sound investment management framework must be established, including policies and procedures for controlling credit concentration risk. b) Credit Risk Risk Management policies are reflected in written policies related to fund or investment management, containing the nature, role, and level of fund or investment management activities and how the Company complies with applicable regulations. c) The Company must develop and apply policies and procedures appropriately to support:
i. healthy investment management activities or activities; and
ii. monitoring and control of Credit Risk.
d) The Company must have early warning procedures to handle unexpected and significant changes in Credit Risk in fund or investment management activities. e) The Company must account for, document, and update all quantitative and qualitative information and material evidence in fund or investment management archives.
Risk Limit Setting
a) The Company must set Risk limits for all activities related to fund or investment management activities containing Credit Risk. b) The Company must set Risk limits for Credit Risk. c) Risk limit setting must be documented in writing and completely to facilitate audit trail setting for internal and external auditors.

c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems for Credit Risk

In implementing Risk Management through the processes of risk identification, measurement, control, and monitoring, as well as the Risk Management information system for Credit Risk, in addition to meeting the guidelines as referred to in Roman I letter C, in each process, the Company must additionally apply:

Credit Risk Identification
a) The system for identifying Credit Risk must be able to provide adequate information, including regarding investment portfolio composition. b) In identifying Credit Risk, factors that may affect the level of Credit Risk in the future must be considered, such as the possibility of changes in economic and political conditions and the assessment of Credit Risk exposure in stressed conditions. c) In identifying Credit Risk with Credit Risk exposure due to counterparty failure (counterparty credit risk), the credibility of the counterparty and other factors impacting the counterparty's ability to pay its obligations must be considered.
Credit Risk Measurement
a) In measuring Credit Risk, indicators/parameters such as the following can be used:
i. risk from receivables management;
ii. concentration of investment placements and counterparty rating (where investments are placed);
iii. reinsurer failure risk;
iv. investee concentration; and
v. reinsurance concentration.
b) Measurement tools must be able to measure Credit Risk exposure quantitatively. This measurement must be monitored periodically according to the Company's needs. Examples of Credit Risk measurement tools include using statistical methodologies, such as credit scoring tools. c) The Company must conduct stress testing routinely to support Credit Risk measurement analysis. Stress testing results must be reviewed periodically and reflected in the Credit Risk policies and limits established by the Board of Directors and Board of Commissioners. d) Companies that develop and use internal rating systems in Credit Risk management must adjust to the portfolio characteristics, size, and complexity of the Company's business activities. e) Companies using risk measurement techniques with an internal rating approach must update data periodically. f) Basic principles in the use of internal ratings are:
i. the procedure for using the internal rating system must be formalized and documented;
ii. the internal rating system must be able to identify early changes in the Risk profile caused by potential or actual declines in Credit Risk;
iii. the internal rating system must be evaluated periodically by the Risk Management function; and
iv. the results of the internal rating system must be reported periodically to the Board of Directors.
g) The Company must document assumptions, data, and other information used in Credit Risk measurement, including changes thereto, as well as data and information updates conducted periodically.
Credit Risk Control
a) The Company must ensure that the fund or investment management function and other functions related to fund or investment management activities function adequately and that Credit Risk exposure is kept consistent with established limits and meets prudential standards. b) Credit Risk control can be done in several ways, including risk mitigation, active portfolio position and risk management, setting concentration risk limits in the Company's investment plan, setting authority levels in the investment management approval process, and periodic concentration analysis at least once (1) per year. c) The Company must have an effective system to detect problematic investments or other problematic transactions. Each strategy and result of handling problematic investments or other problematic transactions must be accounted for and subsequently used as input for the fund or investment management function.
Credit Risk Monitoring
In implementing Credit Risk exposure monitoring, the Risk Management function must prepare reports on the development of Credit Risk periodically or as needed, including the causes thereof, and submit them to the Risk Management Committee and the Board of Directors.
Risk Management Information System for Credit Risk
The information system owned must be able to accommodate Credit Risk mitigation strategies through various methods or policies, such as limit setting and hedging.

d. Comprehensive Internal Control System

In implementing Risk Management through the implementation of the internal control system for Credit Risk, in addition to implementing internal controls as referred to in Roman I letter D, the Company must also apply:

an independent and continuous review system regarding the effectiveness of Risk Management implementation for Credit Risk;
for Companies with Credit Risk exposure due to counterparty failure (counterparty credit risk), an independent and continuous review system regarding the effectiveness of Risk Management implementation for Credit Risk due to counterparty failure must at least contain an evaluation of the risk measurement model approval process and validation of significant changes in the Credit Risk measurement process due to counterparty failure; and
an efficient and effective reporting system to provide adequate information, including information regarding significant Credit Risk exposure, to the Board of Directors, Board of Commissioners, and Sharia Supervisory Board.

E. Market Risk

Definition
a. Market Risk is the Risk on asset, liability, equity, and/or administrative account positions, including derivative transactions, due to overall changes in market conditions. b. Market Risk can originate from traded assets, held-to-maturity assets, available-for-sale assets, and consists of Interest Rate Risk, Exchange Rate Risk, and Equity Risk.
c. Risk Management implementation for Equity Risk is applied by Companies that consolidate with subsidiaries.
Objective
The main objective of Risk Management is to manage portfolios exposed to Market Risk well so that the Company is able to achieve established business goals and minimize losses caused by Market Risk.
Risk Management Implementation
Risk Management implementation for Market Risk is adjusted to the size and complexity of the Company's business activities. Generally, in the principle of implementing Risk Management for Market Risk, it must at least cover:

a. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board

In implementing Risk Management through active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board for Market Risk, in addition to implementing active supervision as referred to in Roman I letter A, in each aspect, the Company must additionally apply:

Authority and Responsibility of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must ensure that Risk Management implementation for Market Risk is carried out integrated with Risk Management implementation for other Risks that can impact the Company's overall Risk profile. b) The Board of Directors and Board of Commissioners must ensure clarity of authority and responsibility for Market Risk management, adequacy of systems to measure Market Risk, adequate limit structures for Risk taking, effective internal controls, and comprehensive, periodic, and timely reporting systems. c) The Board of Directors must ensure that assets exposed to market risk are placed in investments or non-investments in accordance with the Risk Management policies applied by the Company. d) The Board of Directors must ensure that the Company has technical reserves that can meet obligations to Policyholders, Insureds, or Participants. e) The Board of Directors must ensure that the Company will not experience mismatches between assets and liabilities as a result of changes in exchange rates and interest rates.
Human Resources (HR)
The Company ensures the adequacy of HR for Market Risk with reference to the provisions as referred to in Roman I letter A number 2 letter b.
Risk Management Organization for Market Risk
The Company must have an adequate Risk Management function for Market Risk with clear authority and responsibility for each work unit carrying out the Risk Management function for Market Risk. In addition, the Company must have a special committee handling the management of investments exposed to Market Risk, for example, an Investment Committee.

b. Adequacy of Risk Management Policies and Procedures and Risk Limit Setting

In implementing Risk Management policies and procedures and setting Risk limits for Market Risk, in addition to implementing Risk Management policies and procedures and setting Risk limits as referred to in Roman I letter B, in each aspect, the Company must additionally apply:

Risk Management Strategy
a) The Company conducts periodic recording and evaluation of investments exposed to Market Risk owned by the Company. b) The Board of Directors and management monitor investments exposed to Market Risk owned by the Company. c) The Company establishes valuation strategies for investments not listed on the exchange. d) The Company diversifies investments to avoid possible risks occurring due to investment failure. e) The Company periodically calculates technical reserves to avoid differences between incurred claim expenses and estimated claim expenses. f) The Company maps owned assets to know which assets are more liquid/illiquid than liabilities. g) The Board of Directors and management are quick to respond to issues regarding Market Risk.
Risk Appetite and Risk Tolerance
a) The statement of risk appetite must reflect the Company's perspective on Market Risk. As an example, the Company's statement regarding investment placement diversification, investment income, liquidity ratios, and profit acquisition. In addition, the statement of risk appetite must support the achievement of the Company's established targets or goals. b) Risk Tolerance for Market Risk must reflect the Company's efforts to achieve its goals and be consistent with the established statement of risk appetite, such as the percentage of the Company's asset portfolio, the percentage of securities to be placed, target profit for the upcoming period, and insurance product marketing targets.
Policies and Procedures
a) The Company has an adequate work plan for managing investments exposed to Market Risk. b) The Company reports periodically on investments exposed to Market Risk to the Board of Commissioners. c) Investment management policies and procedures for investments exposed to Market Risk must at least include:
i. composition of investments exposed to Market Risk with total investments;
ii. level of investments exposed to Market Risk maintained by the Company;
iii. investment diversification; and
iv. Risk limits.
d) Risk Management in the Company is supported by appropriate policies and procedures, making it more directed and comprehensive. e) The Company involves third parties in monitoring and managing investments with Market Risk exposure in the Company, for example, investment managers. f) In choosing investment placements in instruments not traded on the stock exchange or in well-regulated financial markets, the Company conducts a procedure, for example, feasibility testing. g) The Company has procedures in the selection of securities, for example:
i. whether there is clear documentation, approval of policies, and an approach for stock selection;
ii. experts owned by the Company related to the securities selection function; and
iii. supervision applied to ensure that securities selected for the investment portfolio are in accordance with the investment objectives.
h) The Company has clear procedures in assessing hidden and non-standard risks related to the Company's asset placement in the form of investments that may cause the Company to incur losses. i) The Company implements valuation policies for each type of investment exposed to Market Risk. j) The Company's Risk Management policy explicitly mentions the asset-liability management (ALM) policy, which specifically explains the nature, role, and scope of ALM activities and its relationship with product development, pricing, and investment management. k) The Company's Risk Management policy is reflected in explicitly stated investment policies, containing:
i. the nature, role, and level of investment activities exposed to Market Risk and how the Company complies with applicable regulations regarding investments; and
ii. Risk Management procedures in accordance with the Company's investment policies, for example, the type of complex or less transparent investment placements.
Risk Limit Setting
a) The Company must ensure consistency in setting limits for various types of instruments with Market Risk exposure. b) The Company can set limits based on grouping types of instruments with similar characteristics. c) Market Risk limits can include, among others, the amount of investments exposed to risk conducted by the Company, the calculation of the time gap difference between assets and liabilities exposed to Market Risk, and measurement methods in forming technical reserves.

c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems for Market Risk

In implementing Risk Management through the processes of risk identification, measurement, control, and monitoring, as well as the Risk Management information system for Market Risk, in addition to implementing processes as referred to in Roman I letter C, in each process, the Company must additionally apply:

Market Risk Identification
a) In order to identify market risk, the Company must analyze all sources of Market Risk. Sources of Market Risk include, among others, investment management exposed to Market Risk. b) The Company must conduct analysis to know the influence of Market Risk on asset and liability Risk. c) The Company must conduct asset valuation in the form of investments and non-investments. d) The Company must form technical reserves using appropriate methods and assumptions so that the Company can meet obligations to Policyholders, Insureds, Participants, and ceding companies.
Market Risk Measurement
a) In measuring Market Risk, indicators/parameters such as the following can be used:
i. Asset Risk;
ii. Liability Risk;
iii. Asset and liability mismatch risk; asset and liability portfolio risk in foreign currency;
iv. Product Risk;
v. Investment objectives;
vi. Investment strategy;
vii. Availability of fair market prices;
viii. Use of independent valuation; and
ix. Assets in foreign currency and liabilities in foreign currency.
b) The Company must have a system or model for measuring Market Risk to measure positions and sensitivities related to Market Risk in both normal and stress conditions. c) The Company must conduct quantitative measurement of Market Risk. Some examples of measurement methods that can be conducted include sensitivity analysis, earnings at risk, value at risk, and economic value of equity. d) The Company must be able to measure potential profits or losses periodically on fund or investment management activities with Market Risk exposure. e) The Company must document every assumption, data, and information used in Market Risk measurement. f) The Company must understand the weaknesses of the methods used, and consider and mitigate the impact of the weaknesses of those methods. g) The Company must review Market Risk measurement models, including conducting back testing and improvements as necessary.
Market Risk Control
a) The Company must take control steps, including preventing the occurrence of greater Market Risk losses. b) Companies that have securities and bonds must conduct periodic reviews of the condition, credibility, and repayment ability of the issuers of securities and bonds. Such reviews must be documented and conducted at least every 6 (six) months. c) In the event that the Company has securities and bonds listed or traded on the capital market and based on the review results there is a possibility of increased failure of securities and bond issuers, the Company must conduct controls, including closely monitoring the credit spread of such securities and bonds and taking necessary actions to reduce losses, for example, by forming reserves.
Market Risk Monitoring
The Company must monitor limit compliance periodically and follow up to address cases of limit breaches. Such reports are submitted to interested parties in accordance with the Company's internal policies.
Risk Management Information System for Market Risk
a) The Risk Management information system for Market Risk must at least be able to quantitatively measure Risk exposure and monitor changes in market factors (interest rates, exchange rates, and equity prices) on a real-time basis. b) In the event that the Company's fund or investment management instruments are very varied, the Risk Management information system for Market Risk must be able to be used to estimate potential future losses for each of those instruments. c) The Risk Management information system for Market Risk must be able to facilitate stress testing, especially to identify Risks quickly, so that corrective actions can be taken immediately, including as a response to changes in market factors that can negatively impact the Company's health level.

d. Comprehensive Internal Control System

In implementing Risk Management through the implementation of the internal control system for Market Risk, in addition to implementing internal controls as referred to in Roman I letter D, the Company must also apply:

The Company must have an adequate internal control system to ensure that transactions and processes related to market risk taking are conducted with reference to established policies, procedures, and limits.
The application of segregation of duties must be adequate and implemented consistently so that there are no conflicts of interest.
The Company may have a function that performs trading position valuation and validates Market Risk measurement models. This function must be independent of the business and operational functions (risk taking function).

F. Liquidity Risk

Definition
a. Liquidity Risk is the Risk due to the Company's inability to meet obligations due from cash flow funding sources and/or from liquid assets that can be easily converted into cash, without disrupting the Company's activities and financial condition. b. Liquidity Risk can be caused by the Company's inability to liquidate assets without incurring a discount that

material because of the absence of an active market or severe market disruption, referred to as market liquidity risk.

Objectives
The main objective of Risk Management for Liquidity Risk is to minimize the possibility of the Company's inability to meet its obligations to Policyholders, Insured Parties, or Participants.
Implementation of Risk Management
The implementation of Risk Management for Liquidity Risk is adjusted to the size and complexity of the Company's business activities. Generally, in the principle of implementing Risk Management for Liquidity Risk, it must at least include:

a. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In implementing Risk Management through active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board for Liquidity Risk, in addition to carrying out active supervision as referred to in Appendix I letter A, in every aspect of the Company, the following implementation must be added:

Authority and Responsibilities of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board, according to the scope of their respective authorities, must ensure that the implementation of Risk Management for Liquidity Risk is carried out in an integrated manner with the implementation of other Risks that can impact the Company's overall Risk profile. b) The Board of Directors must periodically monitor the position and Liquidity Risk in both normal situations and unfavorable market situations. c) The Board of Directors must ensure that the Company does not experience difficulties in meeting its obligations to Policyholders, Insured Parties, or Participants. d) The Board of Directors must adjust Risk Management policies and strategies for Liquidity Risk based on the results of evaluations of the position and Liquidity Risk. e) The Board of Directors must submit reports to the Board of Commissioners regarding the position and profile of Liquidity Risk as well as the implementation of policies and procedures for Risk Management for Liquidity Risk.
Human Resources (HR)
The Board of Directors must ensure that every function responsible for risk management has HR with adequate competence.
Risk Management Organization for Liquidity Risk
The adequacy of the Risk Management organization for Liquidity Risk depends on the guidelines as referred to in Appendix I letter A number 2 letter c.

b. Adequacy of Risk Management Policies and Procedures and Risk Limit Setting In implementing Risk Management policies and procedures and setting Risk limits for Liquidity Risk, in addition to implementing Risk Management policies and procedures and setting Risk limits as referred to in Appendix I letter B, in each aspect of the Company, the following implementation needs to be added:

Risk Management Strategy
The Company must have a Risk Management Strategy for Liquidity Risk that implements Assets and Liabilities Management (ALMA).
Risk Appetite and Risk Tolerance
a) The Risk Appetite is reflected in the Company's asset and liability composition and the gapping strategy carried out by the Company. b) Risk Tolerance for Liquidity Risk must consider every factor affecting Liquidity Risk exposure, the Company's business strategies and objectives, and the Company's ability to take risks (risk bearing capacity).
Policies and Procedures
a) Liquidity management policies and procedures must at least include:
i. asset and liability composition;
ii. the level of liquid assets that must be maintained by the Company;
iii. the determination of the type and allocation of assets classified as high-quality liquid assets;
iv. stability of funding sources;
v. liquidity management across various funding sources; and
vi. Liquidity Risk limits.
b) The Company must establish indicators that serve as early warning indicators for Liquidity Risk as a tool for identifying problems and determining Liquidity Risk mitigation. c) Early warning indicators include internal and external indicators. Internal indicators include, among others, deteriorating asset quality, increased concentration in certain assets, increased overall costs, and/or worsening cash flow positions as a result of large maturity mismatches, especially in the short-term time scale. External indicators include negative information related to the Company that can impact the Company's liquidity. d) The Company must conduct stress testing for Liquidity Risk that is adjusted to the fund management or investment strategy, so that it can accurately depict the Company's Liquidity Risk profile.
Limit Setting
a) Liquidity Risk limits must be consistent and relevant to the Company's business activities. In addition, Liquidity Risk limits must also be adjusted to the Company's conditions, including to limit investments made by the Company. b) Liquidity Risk limits can include, among others, the amount of investments made by the Company, the calculation of the time gap difference between assets and liabilities, and measurement methods in the formation of technical reserves.

c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems for Liquidity Risk
In implementing Risk Management through risk identification, measurement, control, and monitoring processes, as well as Risk Management information systems for Liquidity Risk, in addition to carrying out processes as referred to in Appendix I letter C, in each process, the Company must add the following implementation:

Liquidity Risk Identification
a) In order to identify Liquidity Risk, the Company must analyze all sources of Liquidity Risk, such as all Company activities that affect the asset and liability position. b) The Company must conduct analysis to understand the impact of investment risks on Liquidity Risk, value assets in the form of investments and non-investments, and form technical reserves using appropriate methods and assumptions so that the Company can meet its obligations to Policyholders, Insured Parties, or Participants, or ceding companies.
Liquidity Risk Measurement
a) In measuring Liquidity Risk, indicators/parameters can include, among others:
i. quantity, quality, diversification, and sales of assets and liabilities;
ii. Risk of mismatch between the amount and maturity date of assets with the amount and maturity date of liabilities;
iii. Risk regarding lock-up periods;
iv. cash flow;
v. short-term asset profile;
vi. short-term liability profile;
vii. long-term asset profile;
viii. liability projections in the business plan; and
ix. liability valuation in the latest actuarial report.
b) The Company must have measurement tools that can measure Liquidity Risk quantitatively, accurately, and comprehensively in a timely manner. These measurement tools must also be able to measure Liquidity Risk arising from assets, liabilities, and administrative accounts. c) These measurement tools must at least include:
i. current asset or liability profile, which must at least include the minimum liquidity ratio, current asset ratio, and current liability ratio; and
ii. cash flow profile, which is cash inflow from investment, operational, and financing activities compared with cash outflow from investment, operational, and financing activities.
d) The approach taken in measuring Liquidity Risk can be simulation-based and more dynamic, supported by various relevant assumptions. e) The Company must periodically conduct stress testing on Liquidity Risk, which is testing of the Company's ability to meet liquidity needs under specific stress conditions for the Company or stress conditions in the market.
Liquidity Risk Control
a) Liquidity Risk control is carried out through diversification strategies, hedging mechanisms, high-quality liquid assets, and other Risk mitigation methods such as increasing the Company's capital to absorb potential losses. b) Active management of liquidity positions and periodic Liquidity Risk aims to meet the Company's obligations on time. c) The Company must analyze changes in liquidity positions resulting from claim payments to Policyholders, Insured Parties, and Participants. This analysis is carried out, among others, based on cash flow projections prepared periodically. d) The Company must have high-quality liquid assets in sufficient quantities and composition adjusted to the Liquidity Risk profile in order to meet liquidity needs for both the short term and long term.
Liquidity Risk Monitoring
a) Liquidity Risk monitoring must consider early warning indicators to know the potential increase in the Company's Liquidity Risk. b) Monitoring of Liquidity Risk is carried out periodically considering the implementation of Asset and Liability Management (ALMA). c) The Company must always maintain its liquidity level in order to meet its obligations to Policyholders, Insured Parties, or Participants.
Risk Management Information System for Liquidity Risk
a) The Company must have adequate and reliable Risk Management information systems to support the implementation of identification, measurement, control, and monitoring processes, as well as reporting Liquidity Risk exposure in normal and crisis conditions completely, accurately, currently, wholly, and continuously. b) The Risk Management information system must be able to provide information related to Liquidity Risk, including:
i. cash flow and maturity profile of assets and liabilities;
ii. compliance with Risk Management policies, strategies, and procedures for Liquidity Risk, including limits and liquidity ratios;
iii. Risk profile reports and liquidity trends for management purposes in a timely manner;
iv. information that can be used for stress testing purposes; and
v. other related information, such as the position and valuation of high-quality liquid asset portfolios and the concentration of unstable funding sources.

d. Comprehensive Internal Control System
In implementing Risk Management through the implementation of the internal control system for Liquidity Risk, in addition to carrying out internal controls as referred to in Appendix I letter D, the Company must also implement:

The Company must implement internal controls effectively and independent review adequately regarding the implementation of Risk Management for Liquidity Risk carried out by the internal audit function together with the Risk Management function.
Weaknesses identified in internal controls and independent reviews must be reported to relevant parties for follow-up action.

G. Legal Risk

Definition
a. Legal Risk is Risk arising from legal claims and/or weaknesses in legal aspects. b. Legal Risk can originate, among others, from the absence or change in legislation, weaknesses in agreements or cooperation, and litigation processes arising from third-party lawsuits against the Company or the Company against third parties, such as the non-fulfillment of the validity requirements of contracts between the parties. Legal risk does not only originate from the main activities of Insurance Companies (underwriting and claims) and does not rule out the possibility that legal problems of Insurance Companies arise from additional activities carried out by the Company, such as investment activities.
Objectives
The main objective of Risk Management for Legal Risk is to ensure that the Risk Management process can minimize the possibility of negative impacts from the absence or change in legislation, weaknesses in agreements or cooperation, and litigation processes.
Implementation of Risk Management
The implementation of Risk Management for Legal Risk is adjusted to the size and complexity of the Company's business activities. Generally, in the principle of implementing Risk Management for Legal Risk, it must at least include:

a. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In implementing Risk Management through active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board for Legal Risk, in addition to carrying out active supervision as referred to in Appendix I letter A, in every aspect of the Company, the following implementation must be added:

Authority and Responsibilities of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board, according to the scope of their respective authorities, must ensure that Risk Management for Legal Risk is carried out in an integrated manner with other Risk Management that can impact the Company's overall Risk profile. b) The Board of Directors must establish effective communication mechanisms, including involving Company employees, regarding legal problems faced with relevant functions so that Legal Risk can be prevented and controlled immediately. c) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must implement legal governance, which is a governance system to form, execute, and interpret regulations and internal provisions, including the standards of agreements used. d) The Board of Directors must ensure legal consistency in all its business activities, namely the alignment between business activities or operations carried out with regulations and not causing ambiguity in agreements made by the Company. e) The Board of Directors must ensure legal completeness, so that all matters regulated by regulations, whether national or international, can be implemented well by the Company, including prohibitions in regulations, which are clearly regulated in the Company's internal regulations.
Human Resources (HR)
The Company must consistently apply sanctions to Company employees proven to have deviated from and violated regulations, both external and internal, as well as the Company's internal code of ethics.
Risk Management Organization for Legal Risk
a) The Company must have a function that acts as a legal watch or a function that oversees the legal field, providing analysis or legal advice to all employees at every level of the organization. This must also be supported by HR with knowledge in the legal field related to the Company. b) The Risk Management function, business and operational functions, and the function overseeing the legal field must jointly assess the impact of changes in specific regulations on Legal Risk exposure. c) The Risk Management function must analyze Legal Risk exposure when the Company develops or expands its business activities.

b. Adequacy of Risk Management Policies and Procedures and Risk Limit Setting In implementing Risk Management policies and procedures and setting Risk limits for Legal Risk, in addition to implementing Risk Management policies and procedures and setting Risk limits as referred to in Appendix I letter B, in each aspect of the Company, the following implementation needs to be added:

Risk Management Strategy
The Risk Management Strategy for Legal Risk is an inseparable part of the Company's Risk Management Strategy as referred to in Appendix I letter B number 6 letter a.
Risk Appetite and Risk Tolerance
The determination of Risk Appetite and Risk Tolerance for Legal Risk refers to Appendix I letter B number 6 letter b.
Policies and Procedures
a) The Company must have and implement analysis of legal aspects regarding the development or expansion of the Company's business activities. b) The Company must periodically evaluate and update policies and procedures for Legal Risk control, in accordance with external and internal Company developments, such as changes in regulations.
Risk Limit Setting
The setting of limits for Legal Risk refers to Appendix I letter B number 6 letter d.

c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems for Legal Risk
In implementing Risk Management through risk identification, measurement, control, and monitoring processes, as well as Risk Management information systems for Legal Risk, in addition to carrying out processes as referred to in Appendix I letter C, in each process, the Company must add the following implementation:

Legal Risk Identification
The implementation of identification for Legal Risk refers to Appendix I letter C number 4 letter a.
Legal Risk Measurement
a) The Company must have adequate measurement methods for Risk for Legal Risk that are integrated with the Company's Risk Management framework, using either quantitative or qualitative approaches. b) In measuring Legal Risk, indicators/parameters can include, among others, the absence or change in legislation, weaknesses in legal aspects, and litigation or dispute resolution.
Legal Risk Control
The function overseeing the legal field must periodically review contracts and agreements between the Company and other parties, among others by re-evaluating the effectiveness of the enforceability process to check the validity of rights in the contracts and agreements.
Legal Risk Monitoring
The implementation of monitoring for Legal Risk refers to the general implementation scope referred to in Appendix I letter C number 4 letter d.
Risk Management Information System for Legal Risk
The Company must document and account for every incident, including litigation processes related to Legal Risk, along with the amount of potential losses caused by the incident in an administration or data management system so that it is easy to update, monitor, manage, and use.

d. Comprehensive Internal Control System
The implementation of the internal control system for Legal Risk refers to Appendix I letter D.

H. Compliance Risk

Definition
a. Compliance Risk is Risk due to the Company not complying with and/or not implementing regulations and provisions applicable to the Company. b. Compliance Risk can originate, among others, from:
1. legal behavior, namely the Company's behavior or activities that deviate from or violate regulations or legislation; and
2. organizational behavior, namely the Company's behavior or activities that deviate from or contradict standards generally applicable.
Objectives
The main objective of Risk Management for Compliance Risk is to ensure that the Risk Management process can minimize the possibility of negative impacts from the Company's behavior that deviates from or violates standards generally applicable, provisions, or legislation.
Implementation of Risk Management
The implementation of Risk Management for Compliance Risk is adjusted to the size and complexity of the Company's business activities. Generally, in the principle of implementing Risk Management for Compliance Risk, it must at least include:

a. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In implementing Risk Management through active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board for Compliance Risk, in addition to carrying out active supervision as referred to in Appendix I letter A, in every aspect of the Company, the following implementation must be added:

Authority and Responsibilities of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board, according to the scope of their respective authorities, must ensure that Risk Management for Compliance Risk is carried out in an integrated manner with other Risk Management that can impact the Company's overall Risk profile. b) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must ensure that every compliance problem that arises can be resolved effectively by the relevant work unit and that monitoring of corrective actions is carried out by the compliance function. c) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board, according to the scope of their respective authorities, must ensure that all policies, provisions, systems, and procedures, as well as business activities carried out by the Company, are in accordance with regulations and Sharia principles.
Human Resources (HR)
Employees placed in the compliance function are not placed in positions vulnerable to conflicts of interest in carrying out the responsibilities of the compliance function.
Risk Management Organization for Compliance Risk
The Company must have a compliance function as regulated in provisions regarding Company governance. This function must support the implementation of Risk Management for Compliance Risk.

b. Adequacy of Risk Management Policies and Procedures and Risk Limit Setting In implementing Risk Management policies and procedures and setting Risk limits for Compliance Risk, in addition to implementing Risk Management policies and procedures and setting Risk limits as referred to in Appendix I letter B, in each aspect of the Company, the following implementation needs to be added:

Risk Management Strategy
The formulation of strategies for Compliance Risk refers to Appendix I letter B number 6 letter a.
Risk Appetite and Risk Tolerance
Basically, the Company must meet applicable regulations and legislation. This causes the Company to have absolutely no tolerance (zero tolerance) for Compliance Risk and to take quick and precise steps in handling Risk.
Policies and Procedures
a) The Company must have an adequate compliance work plan. b) The Company must ensure the effectiveness of the implementation of Risk Management for Compliance Risk, especially the formulation of policies and procedures to be in accordance with standards generally applicable, provisions, and legislation.
Risk Limit Setting
The setting of limits for Compliance Risk refers to Appendix I letter B number 6 letter d.

c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems for Compliance Risk
In implementing Risk Management through risk identification, measurement, control, and monitoring processes, as well as Risk Management information systems for Compliance Risk, in addition to carrying out processes as referred to in Appendix I letter C, in each process, the Company must add the following implementation:

Compliance Risk Identification
The Company must conduct identification and analysis of several factors that can increase Compliance Risk exposure, including:
a) the type and complexity of the Company's business activities, including the development or expansion of business activities; and

b) the quantity and materiality of non-compliance by the Company with internal policies and procedures, provisions or legislation, as well as healthy business ethics practices and standards.

Compliance Risk Measurement
In measuring Compliance Risk, indicators/parameters may include:
a) the type and significance of violations committed; b) the frequency of violations (including sanctions) or the Company's compliance track record; c) violations of applicable business provisions or standards; and d) follow-up actions on violations.
Compliance Risk Control
The implementation of controls for Compliance Risk refers to the general scope of application mentioned in Roman I letter D number 4 letter c.
Compliance Risk Monitoring
The Risk Management function or compliance function must monitor and report Compliance Risk occurrences to the Board of Directors, both ad hoc at the time of occurrence and periodically.
Risk Management Information System for Compliance Risk
The implementation of the risk management information system for Compliance Risk refers to Roman I letter C number 4 letter e.

d. Comprehensive Internal Control System
In implementing Risk Management for Compliance Risk, in addition to implementing internal controls as mentioned in Roman I letter D, the Company must have an internal control system for Compliance Risk, including to ensure the Company's responsiveness level to deviations from generally applicable standards, provisions, or legislation.

I. Reputational Risk

Definition
a. Reputational Risk is Risk resulting from a decrease in the level of trust of stakeholders (stakeholders) stemming from negative perceptions of the Company. b. Reputational Risk may stem from, among others, negative media coverage or rumors regarding the Company, as well as the Company's less effective communication strategy.
Objective
The primary objective of Risk Management for Reputational Risk is to anticipate and minimize loss impacts resulting from the Company's Reputational Risk.
Implementation of Risk Management
The implementation of Risk Management for Reputational Risk is adjusted to the size and complexity of the Company's business activities. Generally, the principles of implementing Risk Management for Reputational Risk must at least include:
a. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In implementing Risk Management through active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board for Reputational Risk, in addition to implementing active supervision as mentioned in Roman I letter A, each aspect of the Company must add the implementation of:

Authority and Responsibility of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must ensure that the implementation of Risk Management for Reputational Risk is integrated with the implementation of Risk Management for other Risks that can impact the overall Pension Fund Risk profile. b) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must pay attention to the implementation of Risk Management for Reputational Risk by relevant functions within the Company, particularly functions related to interactions with external parties. c) The Board of Directors, Board of Commissioners, and Sharia Supervisory Board must behave professionally and maintain business ethics so as to serve as an example for all elements of the Company's organization in efforts to build and maintain reputation. d) The Company must establish information flow channels to Policyholders, Insured Parties, Participants, and other external parties regarding the Company's business activities to control Reputational Risk.
Human Resources (HR)
The Company needs to provide centralized services to handle questions, suggestions, or complaints from Policyholders, Insured Parties, and Participants, for example, in the form of a call center service.
Organizational Structure for Risk Management for Reputational Risk
All employees, including business and operational function management, supporting functions, and the Company's supporting functions, must be part of the implementation structure for Risk Management for Reputational Risk.

b. Adequacy of Risk Management Policies and Procedures and Risk Limit Setting In implementing Risk Management policies and procedures and setting Risk limits for Reputational Risk, in addition to implementing Risk Management policies and procedures and setting Risk limits as mentioned in Roman I letter B, in each aspect of the Company, the following implementations must be added:

Risk Management Strategy
The Risk Management Strategy for Reputational Risk is an inseparable part of the Company's Risk Management Strategy as mentioned in Roman I letter B number 6 letter a.
Risk Appetite and Risk Tolerance
The setting of Risk Appetite and Risk Tolerance for Reputational Risk refers to Roman I letter B number 6 letter b.
Policies and Procedures
a) The Company must have written policies and procedures that meet transparency principles in the implementation of good corporate governance. These policies must also align with legislation governing consumer protection. b) The Company must have and implement appropriate communication policies to face negative news or publications or prevent counterproductive information, including by applying effective media usage strategies to face negative news.
Limit Setting
Reputational Risk limits are generally not limits that can be quantified financially. Examples include time limits for following up on complaints from Policyholders, Insured Parties, or Participants.

c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information System for Reputational Risk
In implementing Risk Management through risk identification, measurement, control, and monitoring processes, as well as the Risk Management Information System for Reputational Risk, in addition to implementing processes as mentioned in Roman I letter C, each process within the Company must add the implementation of:

Reputational Risk Identification
The Company can use several information sources to identify Reputational Risk, including mass media coverage, social network analysis results, Policyholder complaints via call center services, or Policyholder satisfaction questionnaires.
Reputational Risk Measurement
Reputational Risk measurement can be conducted based on internal and external information sources, using indicators/parameters such as the impact of the Company's and Group's reputation, business ethics violations, product complexity and business cooperation, materiality of Policyholder, Insured Party, or Participant complaints, materiality and exposure of negative Company news, credibility of owners and related Companies, the quantity and level of customer usage of the Company's products, the quantity and materiality of the Company's cooperation with complex business partners, and the type of media and scope of coverage.
Reputational Risk Control
a) The Company must immediately follow up on and address complaints from Policyholders, Insured Parties, or Participants, including if there are legal lawsuits that can increase Reputational Risk exposure. b) The Company must develop reliable mechanisms for effective Reputational Risk control actions, such as providing information whenever there are changes to Company regulations to Policyholders, Insured Parties, and Participants. c) Reputational Risk control actions are also followed by improvements to control weaknesses and procedures that trigger Reputational Risk.
Reputational Risk Monitoring
The implementation of monitoring for Reputational Risk refers to the general scope of application mentioned in Roman I letter C number 4 letter d.
Risk Management Information System for Reputational Risk
The Company must have an early warning system mechanism to provide signals to management, so that necessary follow-up and mitigation can be performed.

d. Comprehensive Internal Control System
The implementation of the internal control system for Reputational Risk refers to Roman I letter D.

III. RISK PROFILE ASSESSMENT
The Risk Profile is one of the results of the Risk Management Information System. The Company assesses Risk across all business activities of the Company, including main business activities and other business activities, covering 9 (nine) Risks, namely Strategic Risk, Operational Risk, Insurance Risk, Credit Risk, Market Risk, Liquidity Risk, Legal Risk, Compliance Risk, and Reputational Risk. The assessment is conducted by the Company based on a comprehensive and structured analysis of:

This copy is consistent with the original
Legal Director 1
Legal Department signed
Mufli Asmawidjaja

Risks inherent in the Company's business activities (inherent risk); and
the quality of Risk Management implementation, which reflects the assessment of the adequacy of the Risk control system.
Based on this assessment, a Risk Profile is generated containing the Risk level for each Risk and the Company's Risk Profile rating. The assessment mechanism refers to the Financial Services Authority Regulation regarding the assessment of the health level of non-bank financial service institutions.

Established in Jakarta on 5 February 2021

EXECUTIVE HEAD OF SUPERVISOR FOR INSURANCE, PENSION FUNDS, LENDING INSTITUTIONS, AND OTHER FINANCIAL SERVICE INSTITUTIONS FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA, signed RISWINANDI

APPENDIX II
LETTER OF THE FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA
NUMBER 8 /SEOJK.05/2021
REGARDING
IMPLEMENTATION OF RISK MANAGEMENT FOR INSURANCE COMPANIES, SHARIA INSURANCE COMPANIES, REINSURANCE COMPANIES, AND SHARIA REINSURANCE COMPANIES

ORGANIZATIONAL STRUCTURE OF RISK MANAGEMENT
FOR INSURANCE COMPANIES, SHARIA INSURANCE COMPANIES, REINSURANCE COMPANIES, AND SHARIA REINSURANCE COMPANIES

I. General Guidelines
A. The Risk Management organizational structure must be adjusted to the size and complexity of the Company's business.
B. The Risk Management organizational structure also considers Risks relevant and inherent in each business activity of the Company.
C. The Risk Management organizational structure must continue to follow good corporate governance practices as regulated in the Financial Services Authority Regulation regarding corporate governance.

II. Risk Management Committee Organizational Structure
A. Risk Management Committee Membership

The Risk Management Committee is non-structural, with members being part of the structure within the Company.
Risk Management Committee members may be permanent or non-permanent. Permanent members are the Board of Directors and executive officials designated to be members of the Risk Management Committee permanently for a certain period, such as Board of Directors members and executive officials overseeing compliance or Risk Management functions. Non-permanent members are Board of Directors members and executive officials related to topics discussed and/or recommended in the Risk Management Committee, such as Board of Directors members and executive officials overseeing investment functions for topics regarding investment management and placement.
The Risk Management Committee must consist of at least:
a. half of the number of Board of Directors members, one of whom is a Board of Directors member overseeing the Risk Management function. For example, if the number of Board of Directors members is 3 (three) or 4 (four) people, the Board of Directors members who are members of the Risk Management Committee must consist of at least the Board of Directors member overseeing the Risk Management function and 1 (one) other Board of Directors member; and b. relevant executive officials, namely executive officials from the Company related to Risks present in the Company's business activities.

B. Authority and Responsibility of the Risk Management Committee The authority and responsibility of the Risk Management Committee are to evaluate and provide recommendations to the Chief Executive regarding Risk Management, including at least:

the formulation of policies, strategies, and guidelines for implementing Risk Management and its amendments, including Risk Appetite and Risk Tolerance, the Risk Management framework, and contingency plans to anticipate abnormal conditions;
improvements or adjustments to Risk Management implementation based on the results of Risk Management implementation evaluations, including refining Risk Management processes periodically or incidentally as a result of changes in external and internal Company conditions affecting funding adequacy, the Company's Risk profile, and the ineffectiveness of Risk Management implementation based on evaluation results; and
the determination of matters related to business decisions deviating from normal procedures, such as exceeding investment placement amounts significantly compared to previously established business plans, or taking positions or Risk exposures exceeding established limits.

III. Risk Management Function Organizational Structure
A. Organizational Structure

The Risk Management function organizational structure is adjusted to the size and complexity of the Company's business.
The Risk Management function as mentioned in number 1 can be carried out by officials specifically assigned to perform the Risk Management function or by a work unit specifically performing the Risk Management function.

B. Independence of the Risk Management Function

The Risk Management function must be independent from business and operational functions and from internal control functions to create 3 (three) lines of defense within the Company for managing Risk (3 lines of defense).
The implementation of Risk Management with the 3 (three) lines of defense principle within the Company for managing Risk (3 lines of defense), namely:
a. First line of defense (1st lines of defense), namely business and operational functions (risk-taking function); b. Second line of defense (2nd lines of defense), namely Risk Management function (risk management function); and
c. Third line of defense (3rd lines of defense), namely internal control functions implemented by the internal audit function (internal audit function).
In the implementation of Risk Management, each function as mentioned in number 2 has authority and responsibility:
a. Business and Operational Function (Risk-Taking Function) The business and operational function (risk-taking function) is the Company's frontline in implementing Risk Management, with authority and responsibility including:

reporting inherent risk exposures present in each business and operational unit to the Risk Management function periodically;
ensuring a conducive Risk control environment in each business and operational unit;
implementing established Risk Management policies in conducting business and operational activities; and
executing recommendations from the Risk Management function for Risk control in each business and operational unit.

b. Risk Management Function
The Risk Management function (risk management function) has the following authority and responsibility:

identifying Risks, including inherent risks, in the Company's business activities;
formulating Risk measurement methods appropriate to the size and complexity of the Company's business, including designing and implementing necessary tools for implementing Risk Management;
monitoring the implementation of Risk Management strategies formulated by the Board of Directors, including monitoring Risk Management strategies in business and operational functions;
monitoring overall (composite) Risk positions, by Risk type, and by functional activity type against established Risk Tolerance (risk tolerance) and limits, and performing:
a) testing using abnormal condition scenarios/assumptions (stress testing), to determine the impact of implementing Risk Management policies and strategies on the Company's overall performance; and b) testing using historical data (back testing), to determine how accurate the Risk measurement method is based on historical data held by the Company against established Risk Management policies and strategies;
periodically reviewing Risk Management processes, including:
a) developing necessary tools for implementing Risk Management, from risk identification, measurement, monitoring, and control processes; b) ensuring the adequacy of the Risk Management framework; c) ensuring the accuracy of Risk assessment methods; and d) ensuring the adequacy of the Risk Management Information System.
reviewing proposals for the Company's business development or expansion, focusing on the Company's ability to manage the development or expansion of business activities, and its impact on the Company's overall Risk exposure;
evaluating the accuracy of models and validity of data used to measure Risk, for Companies using internal models (internal model) in Risk measurement;
providing recommendations to:
a) business and operational functions (risk taking function), including in determining acceptable Risk exposure limits; and/or b) the Risk Management Committee, including in formulating policies, strategies, and Risk Management frameworks, according to their authority; and
formulating and submitting Risk Profile reports to the Chief Executive or Board of Directors overseeing the Risk Management function and the Risk Management Committee periodically, where report frequency can be increased if market conditions change rapidly.

c. Internal Audit Function
The internal audit function (internal audit function) in implementing Risk Management has authority and responsibility including:

evaluating the compliance of all levels of the Company's organization with established Risk Management policies and procedures;
evaluating the effectiveness of Risk Management implementation in accordance with Risk Management strategies and policies; and
evaluating the effectiveness of the Company's overall Risk culture (risk culture).

IV. Relationship between Business and Operational Functions and Risk Management Functions
A. Information Submission

The business and operational function (risk-taking function) as the first line of defense (1st lines of defense) within the Company for managing Risk must inform inherent risk exposures to the Risk Management function periodically.
The frequency of submitting inherent risk exposures is adjusted to the characteristics of the Risk type. If inherent risks in the business and operational function (risk-taking function) are faced daily, information submission to the Risk Management function can be more intensive.

B. Examples of Relationships between Functions in the Risk Management Organizational Structure

Format 1
The Risk Management function within the Company becomes a separate work unit directly responsible to the Board of Directors overseeing compliance or Risk Management functions. The scope of Risk Management as the main focus is related to investment management activities, so members of the Risk Management Committee are the Board of Directors overseeing the Risk Management function, Board of Directors members overseeing the investment function, head of the Risk Management work unit, head of the internal audit work unit, and head of the work unit overseeing the investment function.

Board of Commissioners
Chief Executive Director Board of Directors Members Risk Monitoring Committee Finance Function, Strategic Planning Function Compliance Function, MR Function, and AI Function Risk Management Committee SK1 SK Finance SK MR SK2 B/O (finance) B/O Managerial Line Reporting Line Membership Line MR : Risk Management AI : Internal Audit B/O : Business and Operational F : Function SK : Work Unit Board of Directors Members Capital and Investment Functions Executive Official Level F AI F Kep SK Capital SK Investment

Format 2
The Risk Management function within the Company is within a work unit overseeing the Risk Management function and other functions, but the Risk Management function is directly responsible to the Chief Executive or Board of Directors overseeing compliance or Risk Management functions. The scope of Risk Management as the main concern is related to capital adequacy, so members of the Risk Management Committee are the Chief Executive, head of the work unit overseeing the Risk Management function, head of the internal audit work unit, and head of the work unit overseeing the capital function.

Board of Commissioners
Chief Executive Director Board of Directors Members Risk Monitoring Committee Compliance Function; MR Function; Finance Function; and AI Function Capital and Investment Functions Risk Management Committee SK1 SK AI SK2 SK3 F MR F B/O F AI F B/O (Capital) B/O (Investment) Managerial Line Reporting Line Membership Line MR : Risk Management AI : Internal Audit B/O : Business and Operational F : Function SK : Work Unit F Kep Executive Official Level Board of Directors Members Business Functions

This copy is consistent with the original
Legal Director 1
Legal Department signed
Mufli Asmawidjaja

Format 3
The Risk Management function within the Sharia Insurance Company is within a work unit overseeing the Risk Management function and other functions, but the Risk Management function is directly responsible to the Chief Executive. The focus of Risk Management implementation for the current year is related to capital adequacy, so members of its Risk Management Committee are the Chief Executive, head of the work unit overseeing the Risk Management function, and head of the internal audit work unit.

Established in Jakarta on 5 February 2021

EXECUTIVE HEAD OF SUPERVISOR FOR INSURANCE, PENSION FUNDS, LENDING INSTITUTIONS, AND OTHER FINANCIAL SERVICE INSTITUTIONS FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA, signed RISWINANDI

Implementation of Risk Management for Insurance Companies, Sharia Insurance Companies, Reinsurance Companies, and Sharia Reinsurance Companies

Lineage: In force

Similar documents from other regulators