EIOPA proposal for Regulatory Technical Standards (RTS) on management of sustainability risks including sustainability risk plans – Part 2

Our recent article presented EIOPA’s RTS proposal regarding the requirements of sustainability risk management with respect to ORSA, governance and key functions within the future, significantly broadened Solvency II framework.

This article will focus on materiality and financial assessment of sustainability risks as well as on proposed metrics, targets, and actions described by the RTS draft.

Materiality assessment

The definition of materiality under Solvency II and the European Sustainability Reporting Standards (ESRS) are aligned in their focus on the potential impact of information on decision-making.

  • Under Solvency II, for public disclosure purposes, materiality means that if an issue is omitted or misstated, it could influence the decision-making or judgment of users of the information, including supervisory authorities. As to financial materiality, sustainability risks can translate in a financial impact on the (re)insurer’s assets and liabilities through existing risk categories, such as underwriting, market, counterparty default or operational risk as well as reputational risk or strategic risk. In other words, they are ‘drivers’ to existing risk categories.
  • Similarly, the ESRS defines materiality as the potential for sustainability-related information to influence decisions that users make on the basis of the undertaking’s reporting. In the context of financial materiality, which is relevant for Solvency II purposes, the ESRS specifies that a sustainability matter is considered material if it could trigger or reasonably be expected to trigger material financial effects on the undertaking. This includes material influence on the undertaking’s development, financial position, financial performance, cash flows, access to finance or cost of capital over the short-, medium- or long-term. The materiality of risks is based on a combination of the likelihood of occurrence and the potential magnitude of the financial effects.

The two frameworks are aligned as material financial effects, as defined by the ESRS, would likely influence the decision-making or judgment of users of the information, including supervisory authorities. This alignment enables undertakings to apply a consistent materiality assessment approach across both Solvency II and ESRS reporting requirements.

Both Solvency II and ESRS do not set a quantitative threshold for defining materiality. The RTS do not specify a threshold for materiality either, considering this should be entity-specific. The undertakings should however define and document clear and quantifiable materiality thresholds, taking into account the above and provide an explanation on the assumptions made for the categorisation into non-material and on how the conclusion on the materiality has been reached. The classification of an exposure or risk as material has bearing on its prudential treatment, as it is a factor that determines whether the risk should be further subject to scenario analysis in the undertaking’s ORSA. The RTS require the undertaking to explain its materiality threshold in the plan: the assumptions for classifying risks as (non-) material in light of the undertaking’s risk appetite and strategy.

The materiality assessment should consider that:

  • Sustainability risks are potential drivers of prudential risk on both sides of the (re)insurers’ balance sheet.
  • Sustainability risks can lead to potential secondary effects or indirect impacts.
  • The exposure of undertakings to sustainability risks can vary across regions, sectors, and lines of business.
  • Sustainability risks can materialise well beyond the one-year time horizon as well as have sudden and immediate impact. Therefore, the materiality assessment necessitates a forwardlooking perspective, including short, medium, and long term. For example, certain geographical locations may not be subject to flood risk today but may be so in the future due to sea level rise. The risk assessment should be performed gross and net of reinsurance, to measure the risk of reliance on reinsurance.

The materiality assessment would consist of a high-level description of the business context of the undertaking considering sustainability risks (‘narrative’) and the assessment of the exposure of the business strategy and model to sustainability risk (‘exposure assessment’), to decide whether a risk could be potentially material. Following this, based on the identification of a potentially material risk, the undertaking would perform an assessment of the potential financial impact (i.e., financial risk assessment, as part of ORSA).

The narrative should describe the business context of the undertaking regarding sustainability risks, and the current strategy of the undertaking. It also describes the long-term outcome, the pathway to that outcome, and the related actions to achieve that outcome (e.g., emissions pathways, technology developments, policy changes and socio-economic impacts).

The narrative would include a view on the broader impact of national or European transition targets on the economy, or the effect of a transition risk throughout the value chain. The narrative should include other relevant sustainability risks than climate, such as risks related to loss of biodiversity, or social and governance risks, as well as interlinkages between sustainability risks (e.g., between climate and biodiversity or climate and social) and spill-over and compounding effects looking beyond specific sustainability risk drivers on particular lines of business.

Sustainability narratives, indicators, and interlinkages

  • Narrative: For example, for climate change undertakings may refer to publicly available climate change pathways (i.e., the Representative Concentration Pathways (RCPs) developed by the Intergovernmental Panel on Climate Change (IPCC); Network for Greening the Financial System (NGFS)) or develop their own climate change pathway.
  • Indicators: Macro-prudential risk indicators or conduct indicators may provide additional insights and help the undertaking form its view on the future development of sustainability risks. Especially over a longer horizon, sustainability risk could have a wider and compounding impact on the economy and interactions between the financial and the real economy would need to be considered. For example, indirect impacts of climate change could lead to increase in food prices, migration, repricing of assets and rising social inequalities. All these indirect drivers will, in turn, impact the real economy as well as the financial sector, even more so as they could also trigger political instability. Macroprudential concerns could include, for example, plausible unfavourable forward-looking scenarios and risks related to the credit cycle and economic downturn, adverse investments behaviours or excessive exposure concentrations at the sectoral and/or country level. For example, EIOPA financial stability and conduct ESG risk indicators can be used to assess the external environment and business context in which climate change-related risks/opportunities can arise for the undertakings, the risk indicators will give an indication of macro-prudential risk in the insurance sector, and potential ESG related developments at sector level to the detriment of consumer protection.
  • Interlinkages: For example, increasing temperatures leading to increased mortality risk affecting health business can potentially create underwriting as well as legal transition risk if the conditions for triggering a liability insurance have been met (e.g. a company failing to mitigate/adapt the risk). But also, a sharp increase in physical risks can lead to public policies focusing on a faster economy transition, leading in turn to higher transition risks. Physical and transition risks can impact economic activities, which in turn can impact the financial system. At the same time, the interconnectedness of the financial sector, and more generally of the economy, can create secondary effects: physical risk reducing the value of property, reducing in turn the value of collateral for lending purposes or increasing the cost of credit insurance, leading to economic slowdown; or physical damage caused by extreme weather events to critical infrastructure increasing the potential for operational/IT risks, amplifying supply chain disruption and disruption to global production of goods.

Based on the narrative, through qualitative and quantitative analyses, undertakings should arrive at an assessment of the materiality of their exposure to sustainability risks. A qualitative analysis could provide insight in the relevance of the main drivers in terms of traditional prudential risks. A quantitative analysis could assess the exposure of assets and underwriting portfolios to sustainability risk.

Exposure assessment

The aim is to identify sustainability risk drivers and their transmission channels to traditional prudential risks (i.e. market risk, counterparty risk, underwriting risk, operational risk, reputational risk and strategic
risk). Additionally, the assessment should provide insight into (direct) legal, reputational or operational risks or potential (indirect) market or underwriting risks, which could arise from investing in or underwriting activities with negative sustainability impacts, or from the undertaking misrepresenting its sustainability profile in public disclosure.

  • Qualitative analysis to help identifying the main drivers of climate change risks:
    • Transition risk drivers include changes in policies, technologies, and market preferences as well as the business activities of investees and commercial policyholders and policyholder preferences. At macro level, it may include consideration of failure of national governments to meet transition targets.
    • Physical risk drivers include level of both acute and chronic physical events associated with different transition pathways and climate scenarios. This involves assessing the impact of physical risks to counterparties (investees, policyholders, reinsurers) as well the insurer’s own operations (e.g.to insurer’s business continuity, also for outsourced services). For climate change-related risks, the assessment should consider the evolution of extreme weather-related events for insurers underwriting natural catastrophe risks (incl. in property and health insurance).
  • Geographical exposure: Identify potential exposure of assets or insured objects to sustainability risk based on, for example, the location of operations, assets or insured objects or supply chain dependencies of investee companies in geographical areas, regions or jurisdictions prone to (physical) climate, other environmental or social risks.
    • Natural catastrophe and environmental risk datahubs such as the Copernicus datasets on land (use) or biodiversity can give an indication of relevant environmental risks across regions.
    • Social risk indicators identify countries or regions that are vulnerable to social risk, measure social inequality or development. These can give an indication on potential social risk exposure of assets or liabilities located in those regions.
  • Economic activity/sector-based exposure: Identify potential exposure of assets or lines of business or insured risks to potential sustainability risks based on the impact of the investee (or supply chain dependencies of the investee) or the policyholder’s economic activity, or their dependency on environmental or social factors. Such assessment should however not only focus on for example, exposures to climate related sectors, but also to other sectors which may be indirectly affected by (transition) risks.
    • Alignment of the economic activity with the climate and environmental objectives and screening criteria set out in the Taxonomy Regulation and Climate, Environmental Delegated Regulations, as supported by the taxonomyrelated disclosures.
    • Biodiversity loss, a high-level exposure assessment of could be carried out using the level of premiums written in economic sectors with a high dependence on ecosystem services and/or a high biodiversity footprint (economic exposure) and the probability of occurrence of the associated nature-related risk factors.
    • Social risks, exposure of assets or liabilities to economic activities in ‘high risk social sectors’, can be identified by referring to the Business and Human Rights Navigator (UN Global Compact), which can help mapping exposure to sectors at high risk of relying on child labour, forced labour, or sectors negatively impacting on equal treatment (incl. restrictions to freedom of association) or on working conditions (inadequate occupational safety and health, living wage, working time, gender equality, heavy reliance on migrant workers) or have negative impacts on indigenous people.

Financial risk assessment

Where the exposure is deemed material, based on the thresholds set by the undertaking, a more detailed evaluation of the financial risks combining quantitative and/or qualitative approaches should inform the financial impact on the undertaking’s balance sheet. Here the assessment should aim to identify the key financial risk metrics and provide a view of the expected impact of such risks under different scenarios and time horizons at various levels of granularity.

Scenarios

When assessing the potential financial impact of material sustainability risks, the RTS sets out that undertakings should specify at a minimum two scenarios that reflect the materiality of the exposure and the size and complexity of the business. One of the scenarios should be based on the narrative
underpinning the materiality assessment. Where relevant, the scenarios should consider prolonged,
clustered, or repeated events
, and reflect these in the overall strategy and business model including
potential stresses linked to the

  • availability and pricing of reinsurance,
  • dividend restrictions,
  • premium increases/exclusions,
  • new business restrictions,
  • or redundancies.

For climate change risks, the Solvency II Directive requires undertakings with a material exposure to climate change risks to specify at least two long term climate change scenarios:

(a) a long-term climate change scenario where the global temperature increase remains below two degrees Celsius;

(b) a longterm climate change scenario where the global temperature increase is significantly higher than two degrees Celsius.

Experience to date shows that the most used scenarios are those designed by NGFS43, IPCC Shared Socioeconomic Pathways (SSPs) or tailor-made scenarios (set by regulators, e.g. for nature-related scenarios or for stress testing purposes.

Time horizons

The time horizon should ensure that the time horizon for analysing sustainability risks is consistent with the undertaking’s long-term commitments. The time horizon should allow to capture risks which may affect the business planning over a short-to-medium term and the strategic planning over a longer term.

The time horizon chosen for the materiality assessment in sustainability risk plan should also enable the integration of the risk assessment process with time horizons applied for the purposes of the ORSA for risk assessment purposes.

Taking the example of the impact of climate change: its impact can materialise over a longer time horizon than the typical 3-5 years (re)insurers’ strategic and business planning time horizons considered in the ORSA. It is argued that ORSA time horizons are too short to integrate the results of such longer-term climate change scenarios. Nevertheless, the ORSA should allow for the monitoring of the materialisation of risks over a longer term. At the same time, climate change-related risks and opportunities can affect the business planning over a short term and the strategic planning over a longer term.

The RTS specify the time horizons for sustainability risk assessment, to promote supervisory convergence and increase the consistency of risk assessment across undertakings and with decisionmaking. For this purpose, the RTS stipulates that the following time horizons for the sustainability risk assessment apply:

  • Short term projection: 1-5 years
  • Medium term projection: 5-15 years
  • Long term projection: min. 15 years

Documentation and data requirements

The sustainability risk assessment should be properly documented. This would include documenting the methodologies, tools, uncertainties, assumptions, and thresholds used, inputs and factors considered, and main results and conclusions reached.

Undertakings’ internal procedures should provide for the implementation of sound systems to collect and aggregate sustainability risks-related data across the institution as part of the overall data governance and IT infrastructure, including to assess and improve sustainability data quality.

Undertakings would need to build on available sustainability data, including by regularly reviewing and
making use of sustainability information disclosed by their counterparties, in particular in accordance with the CSRD or made available by public bodies.

Additional data can be sourced from interaction with investees and policyholders at the time of the
investment or underwriting of the risk
, or estimates obtained from own analysis and external sources.
Undertakings should, where data from counterparties and public sources is not available or has shortcomings for risk management needs, assess these gaps and their potential impacts. Undertakings
should document remediating actions, including at least the following: using estimates or (sectoral) proxies as an intermediate step – the use of such estimates should be clearly indicated – , and seeking to reduce their use over time as sustainability data availability and quality improve; or assessing the need to use services of third-party providers to gain access to sustainability data, while ensuring sufficient understanding of the sources, data and methodologies used by data providers and performing regular quality assurance.

Frequency

The RTS aim to align the frequency of performance of the materiality and financial risk assessments
with, on the one hand, the cycle of the submission of the regular supervisory report to the supervisor ‘at least every three years’, if not stipulated differently by the supervisor, and the requirement for undertakings to assess material risks as part of their ORSA ‘regularly and without any delay following any significant change in their risk profile’.

Significant changes to the undertaking’s risk profile can include material change to its business environment including in relation to sustainability factors, such as significant new public policies or shifts in the institution’s business model, portfolios, and operations.

In addition, for the frequency of the financial risk assessment, the RTS need to consider that undertakings (except for SNCUs) are required to conduct at regular intervals, at a minimum every three years, the analysis of the impact of at least two long-term climate change scenarios for material climate change risks on the undertaking’s business.

Based on these considerations, the RTS set out that the materiality and financial risk assessment should be conducted at least every three years, and regularly and without any delay following any significant change in their risk profile.

Building on the requirements , the RTS specifies that key metrics and the results of the sustainability risk
plan should be disclosed at least every year
or, for smaller and non-complex undertakings, at least every two years or more frequently in case of a material change to their business environment in relation to sustainability factors.

Metrics

Prescribing a list of metrics in sustainability risk plans can help

  • in promoting risk assessment,
  • improve comparability of risks across undertakings,
  • promote supervisory convergence in the monitoring of the risks and
  • enable relevant disclosures.

At the same time, it is important to allow undertakings flexibility in defining their metrics to avoid missing useful undertaking-specific information. Therefore, the RTS describes the key characteristics of the metrics and provides a minimum list of relevant metrics to compute.

Backward-looking (current view) and forward-looking, can be tailored to the undertaking’s business model and complexity, while following key characteristics apply. Metrics should

  • provide a fair representation of the undertakings’ risks and financial position using the most up-to-date information.
  • be appropriate for the identification, measurement, and monitoring of the actions to achieve the risk management targets.
  • be calculated with sufficient granularity (absolute and relative) to evaluate eventual concentration issues per relevant business lines, geographies, economic sectors, activities, and products to quantify and reflect the nature, scale, and complexity of specific risks.
  • allow supervisors to compare and benchmark exposure and risks of different undertakings over different time horizons.
  • be documented to a sufficient level to provide relevant and reliable information to the undertaking’s management and at the same time be used as part of supervisory reporting and, where relevant for public disclosure, ensuring sufficient transparency on the data (e.g. source, limitations, proxies, assumptions) and methodology (e.g. scope, formula) used.

The RTS requires the following minimum current view metrics:

The following list includes optional metrics which could be considered by the undertaking on a voluntary basis to report on the results of scenarios analysis (financial risk assessment) for material sustainability risks.

Targets

Based on the results of the sustainability risk assessment, the undertaking’s risk appetite and long-term
strategy
, the undertaking should set quantifiable targets to reduce or manage material sustainabilityrelated exposure/risks or limits sustainability-related exposure/risks to monitoring prudential risks over the short, medium, and long term.

The undertaking should, based on its risk appetite, specify the type and extent of the material sustainability risks the undertaking is willing to assume in relation to all relevant lines of business, geographies, economic sectors, activities and products (considering its concentration and diversification objectives) and set its risk management targets accordingly.

Undertakings shall explain the way the target will be achieved or what is their approach to achieve the
target. Intermediate targets or milestones should allow for the monitoring of progress of the undertaking in addressing the risks. The undertakings should specify the percentage of portfolio covered by targets.

The targets should be consistent with any (transition) targets used in the undertaking’s transition plans and disclosed where applicable. The targets and measures to address the sustainability risks will consider the latest reports and measures prescribed by the European Scientific Advisory Board on climate change, in particular in relation to the achievement of the climate targets of the Union.

Relation between targets, metrics, and actions across transition plans, sustainability risk plans and ORSA, applied to an example for transition risk assessment for climate risk-related investments

Actions

Actions to manage risks should be risk-based and entity-specific.

  • Actions set out in undertakings’ transition plans, for example under CSDDD can inform the sustainability (transition) risk to the undertaking’s business, investment, and underwriting. Such transition plan actions typically involve:
  • Limiting investment in non-sustainable activities/companies Introduction of sustainability criteria in the investment decision.
  • Re-pricing of risks.
  • Integrating sustainability into the investment guidelines.
  • Stewardship, impact investing, impact underwriting.
  • Integrating ESG into the underwriting standards and guidelines of the undertaking.
  • Product development considering the impact on climate change.

The measures in the transition plan and actions to address financial risks arising from the transition need to be integrated into the investment, underwriting and business strategy of the undertaking. They need to be measurable and where actions fail to meet their expressed target, these should be monitored and, where necessary, adjusted.

EIOPA proposal for Regulatory Technical Standards (RTS) on management of sustainability risks including sustainability risk plans

Early december 2024 EIOPA has published its consultation paper on management of sustainability risks and the newly created sustainibility risk plans. Very detailed and far reaching standards for the (re)insurance industry that will be added to the ESRS and CSRD framework and significantly enhance existing Solvency II requirements as part of the broader Solvency II reform (Proposal for a Directive of the European Parliament and of the Council amending Directive 2009/138/EC as regards proportionality, quality of supervision, reporting, long-term guarantee measures, macro-prudential tools, sustainability risks, group and cross-border supervision).

This article covers the new requirements for governance (AMSB, Key Functions) and the framework for the sustainability risk plans. An upcoming article will deal with materiality and financial assessments covered by the RTS draft as well as with the new metrics to be integrated in the extended framework.

Background and rationale

The Solvency II Directive requires undertakings to implement specific plans to address the financial risks from sustainability factors and mandates EIOPA to specify the elements of these plans. Article 44 of the amended Solvency II Directive requires undertakings to develop and monitor the implementation of specific plans, quantifiable targets, and processes to monitor and address the financial risks arising in the short, medium, and long-term from sustainability factors. The Directive mandates EIOPA to specify in regulatory technical standards (RTS) the minimum standards and reference methodologies for the

  • identification,
  • measurement,
  • management,
  • and monitoring

of sustainability risks, the elements to be covered in the plans, the supervision and disclosure of relevant elements of the plans.

According to EIOPA, the RTS apply the following approach:

  • First, the proposed RTS build on the existing prudential requirements and integrate the sustainability risk plans into undertakings’ existing risk management practices. The Solvency II Delegated Regulation as amended in 2022 as well as amendments to the Solvency II Directive already require the management of sustainability risks. Existing policy statements and guidance issued by EIOPA set out supervisory expectations on aspects of sustainability risks management. The elements of the sustainability risk plans feed off these requirements and into the own risk and solvency assessment (ORSA) of material financial risks. The sustainability risk plans will be part of undertakings’ regular supervisory reporting.
  • Second, the RTS ensure a read-across between the undertakings’ sustainability and transition plans. While the sustainability risk plans focus on prudential risks for insurers arising from sustainability factors, the undertakings’ actions to mitigate these risks will need to consider their transition efforts.
  • Third, the RTS enable undertakings, including those that are subject to the Corporate Sustainability Reporting Directive (CSRD), to disclose on sustainability risk in a consistent and efficient manner. The RTS specify the minimum standards and methodologies, including selected risk metrics, for performing and disclosing on prudential sustainability risks, as required by the Solvency II Directive. Insurers subject to CSRD can feed the elements identified for public disclosure as part of the Solvency II Solvency and Financial Condition Report (SFCR), into the disclosure required under CSRD.

Own Risk and Solvency Assessment (ORSA)

Insurers shall integrate sustainability risk assessment in their system of governance, risk management
system and ORSA
, as illustrated below:

  • Risk management function and areas: the risk management function shall identify and assess emerging and sustainability risks. The sustainability risks identified by the risk management function shall form part of the own solvency needs assessment in the ORSA. Undertakings shall integrate sustainability risks in their policies. This includes the underwriting and investment policies, but also, where relevant policies on other areas (e.g. ALM, liquidity, concentration, operational, reinsurance and other risk mitigating techniques, deferred taxes risk management). The underwriting and reserving policy shall include actions by the undertaking to assess and manage the risk of loss resulting from inadequate pricing and provisioning assumptions due to internal or external factors, including sustainability risks. The investment risk management policy shall include actions by the insurance or reinsurance undertaking to ensure that sustainability risks relating to the investment portfolio are properly identified, assessed, and managed.
  • Prudent person investment principle: when identifying, measuring, monitoring, managing, controlling, reporting, and assessing risks arising from investments, undertakings shall take into account the potential long-term impact of their investment strategy and decisions on sustainability factors.
  • Actuarial function: regarding the underwriting policy, the opinion to be expressed by the actuarial function shall at least include conclusions on the effect of sustainability risks.
  • Remuneration policy: The remuneration policy shall include information on how it takes into account the integration of sustainability risks in the risk management system.

Sustainability Risk Plans

Considering the relationship with the ORSA, regular supervisory reporting and public disclosure, the figure below sets out the structure of the sustainability risk assessment and key elements of the plan:

The sustainability risk plans should be sufficiently robust to support insurers’ risk management process and the supervisory review of the risk management. Considering the information that is required in the ORSA (for material risks), the sustainability risk plans reported to the National Supervisory Authority should include as a minimum:

a) Governance arrangements and policies to identify, assess, manage, and monitor material sustainability risks.
b) A sustainability risk assessment consisting of:
I. A materiality assessment.
II. A financial risk assessment.
c) Explanation of the key results obtained from the materiality assessment and from the financial risk assessment, where applicable
d) The risk metrics, where relevant, based on different scenarios and time horizons.
e) Quantifiable targets over the short, medium, and long term to address material risks in line with the undertaking’s risk appetite and strategy.
f) Actions by which the undertaking manages the sustainability risks according to the targets set.

Governance

Business model and strategy

Sustainability risks and opportunities can affect the business planning over a short-to-medium term and the strategic planning over a longer term.

The Administrative, Management, and Supervisory Body (AMSB) should set risk exposure limits, targets, and thresholds for the risks that the undertaking is willing to bear with regards to sustainability risks, taking into account:

  • Short-, medium- and long-term time horizon, considering the impact sustainability risks may have soon, but also over the longer term, to be reflected in the business planning over a short-to-medium term and the strategic planning over a longer term.
  • The impact of sustainability risks on the external business environment that will feed into the (re)insurers’ strategic planning.
  • The undertaking’s exposure to material sustainability risk, across sectors and geographies, the transmission channels across risk categories and lines of business.
  • Qualitative and quantitative results from scenario, sensitivity, and stress testing.

Potentially relevant questions which the undertaking can consider when integrating sustainability risk assessment into its governance are:

How does the AMSB expect that sustainability risks might affect its business?

  • Does the AMSB consider sustainability factors as a risk and/or opportunity? If yes, in what ways might environmental, social or governance factors pose risks to the undertaking’s business in economic or financial terms, or create opportunities? If neither risk nor opportunities seem to exist, why not? Has the undertaking elaborated different strategic options to manage the risks and how they have been developed?
  • Has the AMSB implemented or planned any substantive changes to its business strategy in response to current and potential future sustainability impacts? If yes, what are the key risk drivers that it would consider relevant to its strategy? If not, why not?
  • Is the AMSB concerned about secondary effects or indirect impacts of sustainability on the undertaking’s overall strategy and business model (e.g. any systemic repercussions on the industry or the economy)?
  • What is the undertaking’s time horizon for considering environmental, social or governance risks?

Governance

A. The AMSB

Fitness and propriety. The AMSB is responsible for setting undertakings’ risk appetite and making sure that all risks, and therefore also sustainability risks, if material, are effectively identified, managed, and controlled.

For this, the AMSB should collectively possess the appropriate qualification, experience, and knowledge relevant to assess long-term risks and opportunities related to sustainability risks, which may be obtained or improved through appropriate training.

Effectiveness. To ensure the AMSB effectively executes its responsibilities to identify, manage and control sustainability risks, the AMSB should:

  • be aware of their obligations in the context of the long-term impacts of sustainability risks.
  • be capable of identifying sustainability risks as possible key risks for the undertaking.
  • openly discuss within the AMSB sustainability risks and opportunities.
  • effectively communicate on sustainability risks as possible key risks to in the short and long term.
  • interact with the rest of the organisation by putting sustainability risk as a possible key topic in the day-to-day business.
  • plan and deliver results by considering the impact of sustainability risks and opportunities.
  • take sustainability risks into consideration in the decision-making process.

B. Risk Management and other Key Functions

The risk management function has a vital role in:

Risk identification and measurement: The risk management function will need to ensure that the undertaking effectively identifies how sustainability risks could materialise within each area of the risk management system. It also sets the approach used by undertakings to measure and quantify their exposure to sustainability risks, including understanding the limitations of the methods used, and any gaps the undertaking faces in data and methodologies to assess the risks. Undertakings need to apply relevant tools to identify risks in a proportionate way depending on the nature, scale, and complexity of the risks.

Given the forward-looking nature of the risks and the inherent uncertainty associated with sustainability risks, undertakings will need to use appropriate methodologies and tools necessary to capture the size and scale of the risks. This would imply going beyond using only historical data for the purposes of the risk assessment and depending on the materiality of risk at stake, implement forward-looking technique (i.e. stress testing and scenario analysis), for example by considering also future trends in catastrophe modelling or environmental risk assessment. Science, data, or tools may not yet be sufficiently developed to estimate the risks accurately. As undertakings’ expertise and practices develops, the expectation should be that the approach to identifying and measuring the sustainability risks will mature over time. Hence, the risk management function will need to establish the following:

  • clear policies and procedures for identifying, measure, monitor, managing and report sustainability risks, and the review and approval by the AMSB.
  • qualitative, quantitative or a mix of both approaches to appropriately identify and measure the risks, and any limitations to data and tools.
  • forward-looking analysis of underwriting liabilities or investment portfolios under different future (transition) scenarios, setting out the key data inputs and assumptions as well as gaps and barriers (information, data, scenarios) which complicate undertaking’s efforts to undertake scenario analysis.
  • oversight of any activities performed by the external service providers (e.g. ESG rating providers).

Risk monitoring: The risk management function will need to establish the methodologies, tools, metrics and suitable key risk or performance indicators to monitor the sustainability risks and ensure that risks are consistent with internal limit and its risk appetite. These quantitative and qualitative tools and metrics would aim, for example, at monitoring exposures to climate change-related risk factors which could result from changes in the concentration of the investment or underwriting portfolios, or the potential impact of physical risk factors on outsourcing arrangements and supply chains. The tools and metrics need to be updated regularly to ensure that risks underwritten, or investments made remain in line with undertakings’ risk appetite and support decision making by the AMSB. In addition to that, a list of circumstances which would trigger a review of the strategy for addressing the sustainability risks can be considered as a good practice.

Risk management/mitigation: Risk management measures should be proportionate to the outcome of the materiality assessment. Where material potential impacts of the sustainability risks have been identified, undertaking(s) should identify risk management and mitigating measures. The written policies on the investment and underwriting strategy should include such potential measures. Based on the double materiality principle, the investment and underwriting policy will also consider the financial risks to the balance sheet arising from the impact posed by the underwriting and investment strategy and decisions on sustainability factors. Risk management measures can therefore include measures to help reducing risks caused by climate change, through premium incentives, for example.

The actuarial function shall also consider sustainability risks in its tasks. This would include:

  • concluding on the effect of sustainability risks in the opinion on the underwriting policy. For example, considering the increasing expected losses from physical damage due to increasingly severe and frequent natural catastrophes, the choice of underwriting certain perils, but also the pricing of the perils will need to be considered in a forward-looking manner, having regard to the sustainability of the business strategy.
  • an opinion on the adequacy of the reinsurance arrangements of the undertaking taking special account of the sustainability risks of the undertaking, the undertaking’s reinsurance policy and the interrelationship between reinsurance and technical provisions. The undertaking may consider that in times of increasing losses due to climate change, the reinsurance market may ‘harden’ and increase the cost for primary reinsurance.
  • contributing to the effective implementation of the risk management system, providing the necessary support to the risk management function. For example, considering increasing losses for natural catastrophes due to climate change, the actuarial function will need to contribute to the assessment of the risk and opportunity of underwriting certain natural perils. The actuarial pricing of climate change risks can inform the overall risk management strategy and contribute to the underwriting policy by informing on the risks of underwriting certain perils and the opportunity to invest in prevention measures to reduce the losses. The consideration of climate change in an actuarial risk-based manner should allow for the consideration of incentives in the pricing and underwriting of certain natural hazards, with the view to potentially reduce losses over a longer-term perspective.
  • coordinating the calculation of technical provisions and overseeing the calculation of technical provision, including referring to risks to technical provision driven by sustainability factors.
  • assessing the sufficiency and quality of the data used in the calculation of technical provisions including the validation of relevant sustainability risk input data and comparison of best estimates against experience. The assessment may include expressing a view on data limitations as well as considerations on how to implement a forward-looking view on the risks.

The role of the compliance function regarding sustainability risks would imply, as part of establishing and implementing the compliance policy:

  • assessing legal and legal change risks related to sustainability regulation. Especially as regulatory requirements are building up on sustainability risk management, reporting and disclosure, the compliance with new legal requirements will require attention.
  • providing information on the high-risk areas within the undertaking as regards to the transition policy of the company and legal risk attached to implementing (or not) the transition targets, from a prudential and conduct perspective.
  • identifying potential measures to prevent or address non-compliance. This may require addressing the risk of misrepresentation at entity or product level on the sustainable nature of its risk management or of its product offer.

The internal audit function should consider, where relevant sustainability risks in the preparation and maintaining of internal audit plan. This may include:

  • highlighting high-risk areas to requiring special attention. The potentially increased reliance on external parties as data providers on sustainability risks, or for verification of the sustainability of investments regarding environmental or social objectives, may need particular attention to ascertain the quality of the outsourced activity.
  • coping with follow-up actions in particular recommendations in areas, processes, and activities subject to review.

Functions or committees with special responsibility for sustainability risks. The AMSB may decide to delegate the task of addressing sustainability matters to specific committee(s). Such committees discuss and propose matters to the AMSB for it to take appropriate actions and pass resolutions. It is important to highlight that the responsibility about decisions about material sustainability risks remains with the AMSB. If a (re)insurance undertaking has or intends to set up a function with special responsibility for sustainability risks, its integration with existing processes and interface with key and other functions must be clearly defined. A dedicated sustainability unit or function would therefore be involved, in addition to the risk management function, actuarial function and/or compliance function, whenever the insured risk or investment is sensitive to sustainability risk, e.g., by virtue of the economic sector in which the investment was made, or the geographical location of the insured object.

Misunderstandings regarding the role or extent of the assessment to be made by the sustainability function must be avoided. In other words, it needs to be ascertained whether the function has a mere corporate/communication role (e.g. in dealing with corporate responsibility and reputational risks) or is also intended and equipped for sustainability materiality and financial risk analysis.

Remuneration

Remuneration can be used as a tool for the integration of sustainability risks and incentives for
sustainable investment or underwriting decisions
. The Solvency II Delegated Regulation stipulates that the remuneration policy and remuneration practices shall be in line with the undertaking’s business and risk management strategy, its risk profile, objectives, risk management practices and the long-term interests and performance of the undertaking. It further stipulates that the remuneration policy shall include information on how it takes into account the integration of sustainability risks in the risk management system.

Furthermore, undertakings within the scope of the Sustainable Finance Disclosure Regulation shall include in their remuneration policies information on how those policies are consistent with the integration of sustainability risks, and to publish that information on their websites.

Undertakings will need to take into account both financial and non-financial criteria when assessing
an individual’s performance at certain point of time
: the consideration of sustainability factors is an example of non-financial (or increasingly financial) criteria that could be considered when assessing individual performance. For example, increasingly, for investment professionals, the risk framework should include an assessment of sustainability risks.

From a sustainability perspective, the alignment of the remuneration policy with the institution’s
long-term risk management framework and objectives, seems relevant. In addition, a number of studies concluded that, although it is difficult to prove that short-term strategies result in the destruction of long-term values, in some cases the short-term orientations of managers and investors become self-reinforcing. Therefore, incentives to shift the overall business strategy towards more long-term goals (e.g. promoting ‘patient capital’, increasing the long-term commitments of shareholders or tie managers’ remunerations to long-term performances through training and disclosure of long-term oriented metrics) are relevant in view of the long-term horizon of sustainability risks and opportunities.

The impact of the remuneration policies on the achievement of sound and effective long-term risk
management objectives may be especially relevant when it comes to the variable remuneration of
categories of staff whose professional activities have a material impact on the institution’s risk profile
, taking into account their roles and responsibilities in relation to its sustainability strategy.

Among the currently existing practices across the EU, variable remuneration of employees of (re)insurance undertakings is based on performance and mostly on short-term basis – annual bonuses, or bonuses linked to the business strategy over 3-5 years. The performance of employees would therefore need to be aligned with the longer-term horizon of sustainability risks.

For example, long-term strategy goals such as reducing financed emissions in the investment portfolio or limiting losses in the underwriting of natural catastrophes can be aligned with the remuneration goals horizon, as for example through:

  • Medium-to-short term remuneration incentives linked to achieving set targets in reducing CO2 emissions of investments or linked to reduction of losses through risk prevention initiatives for climate adaptation purposes.
  • Longer-term incentives linked to payment with shares in the company, nudging the executive to take decisions in the long-term interest of the company.

Where the remuneration strategy of the undertaking refers to vague discretionary measures of progress such as ‘improving sustainability’ or ‘driving a robust ESG program’, these should be supported by specific goals or commitments and be measurable, meaningful, and auditable.

Prudential Treatment of Sustainability Risks

December 13, 2023, EIOPA has published a Consultation Paper regarding potential amendments of the prudential treatment of sustainibility risks (EIOPA-BoS-23-460). The expected Article 304a of the Solvency II Directive mandates EIOPA to assess the potential for a dedicated prudential treatment of assets or activities associated substantially with environmental or social objectives, or harm to such objectives, and to assess the impact of proposed amendments on insurance and reinsurance undertakings in the European Union. EIOPA is required to submit a corresponding report to the Commission.

A discussion paper outlining the scope, methodologies, and data sources for the analysis has been published in 2022 as the first outcome of EIOPA’s work under this mandate. This consultation paper is the second outcome, based on the discussion paper’s public feedback received, together with the feedback received from the Platform on Sustainable Finance and the European Banking Authority (EBA). It will form the basis of the report envisaged to be submitted to the Commission after consulting the European Systemic Risk Board (ESRB).

EIOPA decided to focus its analyses on the following three conceptual areas that are considered to be appropriate for a risk-based analysis:

  • The first area of the analysis is dedicated to the potential link between prudential market risks in terms of equity, spread and property risk and transition risks.
  • The second area of the analysis focuses on the potential link between non-life underwriting risks and climate-related risk prevention measures, since the prudential treatment of assets or activities as referred to in the mandate includes insurance undertakings’ underwriting activities.
  • The third area of the analysis is related to the potential link between social risks and prudential risks, including market and underwriting risks.

As a kind of « disclaimer » EIOPA states that « since sustainable finance is an area characterized by an ongoing progress regarding data availability and risk modelling, certain natural limitations of the analysis exist at this stage« :

  • Firstly, the sample size of certain asset portfolios for the analysis is relatively small due to general data constraints that can hardly be overcome. Further to this, the limited sample size covered in the present analysis might not reflect the overall insurers’ exposure to transition risks, which could also materialize from indirectly held assets.
  • Secondly, since legally binding transition plans of firms, for instance in relation to the Corporate Sustainability Reporting Directive (CSRD), are not yet available, reliable firm-specific characteristics affecting the (long-term) transition risk exposures of firms are difficult to obtain as further input data for the analysis. In this respect, a sectoral classification approach is generally not able to model firm-specific transition risk characteristics, which would require a firm-level approach instead.
  • Thirdly, technical challenges for the analysis exist in isolating transition risks from other risk drivers, such as the impact of the Covid-19 shock on asset prices, which is an important determinant for the backward-looking analysis, but not for the forward-looking analysis.
  • Fourthly, the exact extent to which credit ratings reflect transition risks remains unclear at this stage, making it challenging in the case of the prudential treatment of spread risk in the Standard Formula whether a dedicated treatment would be justified.

By acknowledging the methodological limitations in the context of assessing sustainability risks from a prudential perspective, EIOPA, at this stage, does not recommend policy options in all areas studied in this consultation paper, and does not express a preference between the options proposed as regards equity and spread risk in relation to transition risk exposures.

Potential link between prudential market risks in terms of equity, spread and property risk and transition risks

The challenging question arises as to whether to rely on historic asset price data to conduct an empirical risk analysis (backward-looking) or to use model-based risk assessments, typically in terms of stress scenarios (forward-looking), or a combination of both.

The feedback EIOPA received to its 2022 discussion paper (« Discussion paper on physical climate change risks ») overall support for the methodologies outlined regarding the forward-looking analysis. Some respondents mentioned that the use of a model-based assessment can be subject to technical bias due to the model assumptions taken, and corresponding findings should be treated with caution regarding the conclusion on potential prudential implications. Several respondents suggested focussing only on a forward-looking assessment, since historic time series data might not be able to show a potential materialization of transition risks.

EIOPA considers forward-looking model-based risk assessments to offer valuable insights into the potential impact of transition risks on asset prices, particularly since historical asset price data may not fully reflect the dynamic nature of environmental externalities and the complexities of transitioning to a low-carbon economy. Market sentiment, technological advancements, regulatory changes, and societal awareness of climate issues can significantly influence transition risks in the future. A comprehensive model-based approach can complement historical data analysis and provide a holistic view of how transition risks may materialize in asset prices.

A forward-looking assessment requires models and assumptions regarding the future developments of climate change and the transition to a carbon neutral economy. In particular, uncertainty surrounds the nature and timing of policy actions, technological change and the extent to which financial markets are already reflecting a transition scenario in asset prices. In other words, the results and conclusions obtained can be quite sensitive to the choices adopted for such parameters and assumptions. To capture such uncertainty, researchers make use of scenario analysis to analyse a broad range of future states of the world.

A number of supervisory authorities – both at national and European level – have developed climate change scenarios to assess the exposure of financial institutions to climate risks in terms of transition risks. EIOPA studied several analyses of climate transition scenarios developed by ACPR/Banque de France, DNB, ECB/ESRB as well as EIOPA/2DII to build a conceptual framework for the forward-looking analysis presented in this section. EIOPA’s discussion paper in 2022 briefly summarised these studies21, whereof the main conclusions are:

  • The assessments make use of different scenarios. ECB/ESRB and ACPR/Banque de France use as a basis the climate scenarios developed by the Network for Greening the Financial System (NGFS), DNB developed its own bespoke shock scenario and the EIOPA/2DII sensitivity analysis makes use of transition scenarios developed by the International Energy Agency (IEA);
  • The analyses use two ways to measure the impact of disorderly transition scenarios by either comparing them with the baseline results for an orderly transition or with the current, no policy change pathways;
  • The forward-looking assessments employ several models to translate high-level climate scenarios into pathways for equity and corporate bond prices at sector level using either the NACE breakdown of economic activities or – in case of the EIOPA/2DII sensitivity analysis – fifteen climate-policy relevant activities;
  • The assessments exhibited substantial differences in exposures to transition risk for the various economic activities and technologies. On the one hand, equity exposures to mining and power generation would be fully stranded in the DNB combined policy and technology shock scenario. On the other hand, equity exposures to renewable energy would double in value in the EIOPA/2DII late and sudden policy shock scenario.

A mapping of the Transition Vulnerability Factors (TVFs) developed by the DNB on the NGFS’s transition risk scenarios to assess the potential exposure of economic activities to transition risks from a forward-looking and risk-oriented perspective. The TVFs capture the sensitivity of stock returns to forward-looking scenario-specific excess market returns, for instance in case of a rise in carbon prices or a technological shock. Based on this mapping exercise, the economic activities that seem to be particularly exposed to transition risk from a forward-looking perspective are the following:

  • B05-09 – Mining and quarrying (coal, lignite, crude petroleum, natural gas, etc.);
  • C19 – Petrochemical;
  • C22 – Manufacture of rubber and plastic products;
  • C23 – Manufacture of non-metallic mineral products;
  • C24 – Manufacture of basic metals;
  • D35 – Utilities (electricity, gas, steam and air conditioning supply);
  • H50 – Water transport and
  • H51 – Air transport.

It is important to differentiate economic activities that might be able to follow a transition to a low carbon economy in the future from those which might not. Indeed, in terms of carbon footprint, sectors related to the extraction, production, processing, transportation and reselling of fossil fuels will hardly be able to reduce their carbon emission levels as it is directly linked with their activity. In this regard, the Platform on Sustainable Finance (PSF) states that “the Platform recognizes there are other economic activities for which no technological possibility of improving their environmental performance to avoid significant harm exists across all objectives and which might be thought of as ‘Always Significantly Harmful’ activities”, referring particularly to economic activities B5 (Mining of coal and lignite), B8.92 (Extraction of peat) and D35.11 (Power generation from solid fossil fuels). According to article 19(3) of the taxonomy regulation, power generation activities that use solid fossil fuels do not qualify as environmentally sustainable economic activities.

Three possible types of transition scenarios can be envisaged in the coming decade:

  • An orderly type of transition scenario in which there is no or little impact on the real economy and financial sector. This type of scenarios consists of a timely and predictable path to a carbon-neutral economy with companies gradually adjusting their business models and capital stock to this new reality. An orderly transition is considered to be the baseline scenario in the ACPR and ECB/ESRB transition stress tests.
  • A disorderly type of transition scenario where there is a substantial impact on the real economy and – through their asset exposures to carbon-intensive sectors – the financial sectors. This type of scenarios tends to be characterised by unexpected, sudden and delayed actions to achieve carbon-neutrality. A disorderly scenario is generally considered to be a low probability, but yet plausible event.
  • A type of scenario where there is no transition or an insufficient transition to a carbon-neutral economy. Such a type of scenarios is also bound to have substantial negative impacts on the real economy and financial sector. Not due to transition risk, but as a consequence of a further increase in (acute) physical risks, like floods, fires and storms that may damage production facilities and disrupt supply chains.26 However, such risk differentials will materialise in another dimension, i.e. depending on the geographical location of companies rather than their carbon sensitivity.

Given that a disorderly transition poses the biggest transition risk, a prudential forward-looking VaR-analysis should focus on transition risk differentials relating to a disorderly scenario. Since it is difficult to estimate the probability of such a scenario, it is proposed to assess its impact under various annual probabilities of occurrence, e.g. ranging from 0.5% to 4.5% per year. To put these annual probabilities into a longer-term perspective, assume for example that the probability of an orderly transition amounts to 50% during the coming decade. The annual probabilities of 0.5-4.5% will then translate in a cumulative probability of 5-30% after 10 years, leaving a cumulative probability of no (or insufficient) transition of 20-45%.

Equity Risk: Backward-Looking Results

Results of the Broad Portfolio Allocation Approach

Results of the Narrow Portfolio Allocation Approach : CPRS (Climate Policy Relevant Sectors) – based Portfolio Allocation)

Overall, the fossil fuel sector shows a differentiated risk profile relative to the other sectors in terms of the highest VaR (-56.5%) in the relevant time period from 2010-2021. This sector includes the following NACE codes: B5, B6, B8.92, B9.1, C19, D35.2, H49.5, G46.71, which mainly relate to activities associated with the extraction of crude oil, natural gas and the mining of coal. A large number of studies underline that these activities, due to their inherent carbon intensity and limited potential to transition, tend to be more exposed to transition risks, as European economies gradually converge towards the objectives set out by the 2015 Paris Climate Agreement and the EU Green Deal.

Equity Risk: Forward-Looking Results

The forward-looking analysis uses the projected equity shocks for the different economic sectors being distinguished in:

  • the sudden (1) and delayed (2) transition scenarios of ACPR;
  • the policy shock (3), technology shock (4) and double (or combined) shock (5) scenarios of DNB;
  • the delayed transition (6) scenario of ESRB/ECB;
  • the disorderly transition (7) and ‘too little, too late’ (8) scenarios of IAIS.

In the Monte Carlo simulations, if a disorderly transition scenario materialises, a probability of 1/8 is attached to each of these eight specific scenarios occurring.

Equity Risk Differentials (Monte Carlo)

Spread Risk: Backward-Looking Results

Since the aggregation of various different economic activities into high-level portfolios as regards transition risk exposures appears suboptimal for assessing the potential for a risk differential, the assessment focuses on the narrow portfolio approach, in particular regarding fossil fuel-related bonds.

Spread Risk: Forward-Looking Analysis

In line with the forward-looking analysis for equity risk, the transition return shocks for corporate bonds for the different economic activities are derived from the disorderly transition scenarios of ACPR (sudden and delayed transition scenarios), DNB (policy, technology and double shock scenarios), ESRB/ECB (delayed transition scenario) and IAIS (disorderly and ‘too little, too late’ scenarios). In the Monte Carlo simulations, if a disorderly transition scenario materialises, a probability of 1/8 is attached to each of these eight specific scenarios occurring.

Spread Risk Differentials (Monte Carlo)

Stocks and Bonds: EIOPA’s Potential Policy Options

Based on the detailed analysis, EIOPA describes and evaluates three potential options for both asset classes:

Equity Risk (options and EIOPA’s evaluation)

  • Option 1: “no change”-option
  • Option 2: treating fossil fuel-related stocks as Type II (stocks listed outside EEA and OCDE markets) equity, i.e., a capital charge of 49% rather than 39% for Type I equities;
  • Option 3: a dedicated supplementary capital requirement to the current equity risk calibration with supplementary capital charge to the current Standard Formula’s risk charge of 39%, in case of Type I equities, could lie in the range up to 17% in additive terms, i.e., 39%+17%=56%. Regarding the role of participations or long-term equity, exclusion criteria for fossil fuel-related activities or a potentially higher capital requirement may be needed to limit incentives to re-classify Type I/II stocks as participations for the sake of SCR reduction.

Spread Risk (options and EIOPA’s evaluation)

  • Option 1: no change option.
  • Option 2: a rating downgrade of bonds related to fossil fuel activities,
  • Option 3: a dedicated supplementary capital requirement to the current spread risk calibration, up to 5% in additive terms, which corresponds to an increase in the capital requirements of up to 40% relative to the bond portfolio’s current capital requirement.

An impact assessment conducted by EIOPA shows a very low impact of the proposed policy options on the solvency ratio of the undertakings (cumulated range equity and spread on Germany’s and France’s solvency ratios from -0.21 to -1.71%p) mainly due to the undertakings’ limited exposure to directly held fossil fuel-related assets. The low impact on the undertakings’ solvency ratio thereby suggests a limited impact on the asset allocations of undertakings in terms of potentially triggering fire-sales of fossil fuel-related assets that could contribute to systemic risks in the financial system. Moreover, it is important to note that besides capital charges, insurers take further criteria for their investment decisions into account, such as objectives in terms of duration and cash flow matching between assets and liabilities, further limiting the potential of the proposed policy options to trigger material re-allocations in the undertakings’ asset portfolios. It is therefore concluded that the proposed policy options would not materially contribute to systemic risks in the financial system.

Property Risk and Energy Efficiency

Regarding property risk, the Standard Formula in Solvency II currently foresees a shock to the market value of buildings of 25%. The shock has been calibrated as the annual 99.5%-Value-at-Risk (VaR) of monthly total return real estate indices and does not distinguish between commercial or residential real estate.

To study the potential effect of energy efficiency on property risk, EIOPA proposed in its discussion paper to construct property price indices based on samples of buildings with the same energy performance level, while controlling for major property characteristics typically driving the market value of a building. The energy performance-related price indices track the average price series of a specified reference building over time, and allow to calculate the corresponding annual returns. From a prudential perspective on property risk, a comparison of the annual Value-at-Risk values at the 99.5% confidence level across the energy performance-related price indices can provide evidence on a potential energy performance-related risk differential for property risk.

The two main variables of interest for the analysis are the building’s energy performance and its market value. EIOPA suggested in its discussion paper to use the building’s energy performance certificate (EPC) as a categorical measure of its level of energy efficiency. In this regard, the energy performance of a building is defined as the amount of energy needed to meet the building’s energy demand associated with a typical use of the building in terms of heating, cooling, ventilation, hot water and lighting. The EPCs typically range from A+ (most efficient) to H (least efficient), and using EPCs as a determinant for transition risk exposures was broadly supported in the public consultation. Moreover, energy performance certificates are also used as measure for the energy performance of buildings under the corresponding technical screening criteria of the EU Taxonomy.

The building’s market value, measured for the analysis as a building’s advertised sales price, is scaled by the building’s size (typically the square meter of living area for residential buildings) to reduce selection bias and to raise comparability of prices across buildings. Due to the impact of inflation on the market value of buildings, the building’s sales price in a given year is deflated for the analysis.

A range of factors can typically influence a building’s market value, such as location and age, and should be controlled for when grouping comparable buildings together to construct the house price indices. Generally, grouping data in relation to multiple house characteristics to reach homogeneous groups for comparison can materially limit the number of available price observations to construct respective price indices. In particular, residential buildings are typically infrequently sold during their lifetime, constraining materially the scope of building-specific time series data that could be used to track pricing effects. Therefore, a general tradeoff between complexity (granularity) in terms of building characteristics to construct homogeneous groups of buildings and the sample size arises, and a sufficient balance needs to be found.

To study the effect of a building’s level of energy efficiency on property risk from a backward-looking perspective, energy performance-specific property price indices based on the German residential housing market and advertisement data have been constructed.

The findings of EIOPA’s backward and forward-looking analysis together with a risk differentials based sensitivity study show an inconsistent effect of the level of energy efficiency on property risk in terms of the 99.5% Value-at-Risk of annual property returns. In contrast, the forward-looking analysis finds an increase in the riskiness of properties with energy labels F and G, i.e. the two least energy-efficient classes of property.

Since the quantitative findings from a backward- and forward-looking perspective show mixed evidence, EIOPA cannot conclude whether a dedicated prudential treatment of energy efficiency under the property risk sub-module in Solvency II’s Standard Formula could be justified.

As the analysis is subject to various data limitations that could not have been overcome by means of the public consultation of EIOPA’s discussion paper in 2022, EIOPA suggests a repetition of the analysis, particularly in context of the developments of the Energy Performance of Buildings Directive (EPBD), which aims for a consistent assessment of the energy efficiency of buildings in the EU and for improving corresponding data availability. It can therefore be expected that more data suitable for a property risk analysis as regards energy efficiency will be available in future.

Non-Life Underwriting and Climate Change Adaptation

The expected growth in physical risk exposures and insurance claims due to climate change will increase risk-based premium levels over time, potentially impairing the mid- to long-term affordability and availability of insurance products with coverage against climate-related hazards. Moreover, the increased frequency and severity of natural disasters and extreme weather events associated with climate change can make it more difficult for insurers to predict the likelihood of future losses accurately and to price insurance products appropriately.

Climate-related adaptation measures are defined as structural and non-structural measures and
services that are implemented by (re)insurance undertakings or policyholders ex-ante to a loss event, which reduce the policyholder’s physical risk exposure to climate-related hazards through

  • lowering the frequency of climate-related losses or
  • lowering the intensity of climate-related losses in an underwriting pool.

Climate-related adaptation measures can differ substantially regarding their form and ability to protect against climate-related hazards. Specific examples of climate-related adaptation measures discussed in the insurance context comprise:

  • measures related to a building’s structure like water-resistive walls, windows and doors or non-return valves on main sewer pipes against flood risk,
  • external building measures such as sandbags against flood risk,
  • heat- and fire-resistive construction materials for buildings against exterior fire exposures,
  • the irrigation of crop fields against drought risk and heat waves and
  • non-structural measures such as forecasting and warning systems (e.g., SMS) to enable policyholders to protect their goods in advance of severe weather events.

From a risk-based perspective, a clear link between climate-related adaptation measures and insurance premiums is given, as adaptation measures aim to reduce the policyholders’ physical risk exposures and insured losses associated with climate change, and thereby contribute directly to reducing the actuarial fair premium of an insurance contract. In contrast, climate-related mitigation measures focus on actions to reduce greenhouse gas emissions, for which a direct risk-based link to the actuarial fair premium does not necessarily exist. For instance, while motor insurance products focusing on electric vehicles contribute to reducing the emission levels associated with an underwriting pool, the lower emission levels do not directly affect the loss profile of the underwriting pool in terms of the frequency and intensity of claims. Therefore, climate-related mitigation measures are excluded from the scope of this analysis.

The prudential requirements for non-life underwriting risks in Solvency II’s Standard Formula comprise three main modules:

  • the premium – refers to future claims arising during and after the period of the solvency assessment (covered but not incurred, e.g., in relation to the provision for unearned premiums) – and reserve – refers to past risks and claims that have already materialized (provision for outstanding claims) – risk module,
  • the catastrophe module – potential losses from extreme and rare tail events, which are expected to happen more frequently and becoming more intense due to climate change – and
  • the lapse – instantaneous loss of 40% of the in-force business – risk module.

As per EIOPA, Particularly the first two modules can be considered materially sensitive to climate change and its impact on the frequency and intensity of severe weather- and natural catastrophe events. This statement can be challenged as we believe that increasing non affordability of insurance might well have an impact on lapse risk and feed-back on the consultation paper might well add it as being material.

Premium Risk

Premium risk in the Standard Formula is treated by means of a factor-based approach. In particular, the standard deviation of the underwriting pool’s loss ratio, which basically relates to the ratio of claims incurred to premiums earned, is driving the premium risk from a prudential perspective. The capital charge is determined to be consistent with the 99.5% percentile of the loss ratio’s distribution to cover unexpected shocks to the claims and premiums of the insurance undertaking in a given year.

Since climate change and its impact on physical risks materializes dynamically over time, for instance due to the dependance on changes in (global) temperature levels which in turn depend on greenhouse gas emission levels, historic data might not be an appropriate predictor of future trends, making it difficult for insurers to accurately predict the likelihood of future claims.

Climate-related adaptation measures can reduce the frequency and severity of weather- and climate-related losses in an underwriting pool and thereby smooth the claim’s distribution and lower the standard deviation of the loss ratio. In that regard, the risk of mispricing insurance policies due to climate change could be reduced, as the adaptation measures limit the potential for claims realizing in a given year to deviate materially from the expected outcome on which the premium level of the underwriting pool has been set before. The volume measure in terms of the net premiums earned is the second factor in the Standard Formula to determine premium risk from a prudential perspective and can be interpreted as a measure to scale the overall level of premium risk and the corresponding capital charge for the individual insurance undertaking. As the premium level of an underwriting pool is based on the expected volume of claims in a given year, the volume measure covers the expected losses.

Reserve Risk

Reserve risk captures the risk that the absolute level of claims provisions for an underwriting pool could be mis-estimated, i.e., that reserves are not sufficient to settle down the claims that occurred already in the past. As for premium risk, reserve risk is supposed to cover small to medium loss events and not tail events.

The prudential reserve risk is measured by means of a volume measure (net provisions for claims outstanding) and a parameter for standard deviation for the claim payments. Climate-related adaptation measures are expected to reduce the volume measure in terms of the net provisions for claims outstanding. Hence, the expected effect of adaptation measures on insurance reserves will be captured by the volume measure. The variation of costs to settle down claims that have already occurred in the past, however, does not seem to be materially affected by the fact of implementing climate-related adaptation measures in insurance products. Therefore, it is not expected that climate-related adaptation measures will have an impact on the standard deviation parameter driving reserve risk and is therefore studied only qualitatively.

Natural Catastrophe Risk

Under Solvency II, undertakings can take the risk reducing effect of climate-related adaptation measures into account when applying a suitable internal natural catastrophe model for estimating the corresponding capital requirements, but not under the Standard Formula. However, the effects of climate-related adaptation measures on the solvency capital requirements for natural catastrophe risk are difficult to predict, as they depend substantially on the catastrophe model used, the climate-related hazard considered, the risk characteristics of the adaptation measure modelled and the localisation of the risk exposure. Moreover, for example large-scale and expensive adaptation measures like flood-resistant walls might raise materially the value of a building, and thereby raise the sum insured, which in turn will raise the corresponding solvency capital requirement for natural catastrophe risk.

EIOPA focus un Premium Risk

Given the early stage of the EU insurance market regarding the implementation of adaptation measures in insurance products, particularly since current measures usually implemented are rather small-scale measures less effective against tail events captured by the natural catastrophe risk charge, but more effective against small and medium loss events captured by the premium risk charge EIOPA focuses its quantitative analysis on premium risk. Reserve risk and natural catastrophe risk are studied by means of qualitative questions that have been raised in the data collection with insurance undertakings in 2022. Future work could look more deeply into the quantitative influence of adaptation measures on the solvency capital requirements for natural catastrophe risk given further market progress in implementing adaptation measures in insurance products has been achieved providing sufficient data as regards their impact on claims related to tail events.

In order to study the influence of climate-related adaptation measures on premium risk, the annual loss ratios are calculated, both for portfolios with and without adaptation measures based on the 33 responses including data for 15 million policyholders of EIOPA’s 2022 consultation. Data is grouped into three main categories of climate-related adaptation measures for illustrative reasons:

  • Hail nets, tempered glass and garages, which have a conceptually similar effect against hail risk – referred to as the “Hail protection”-group
  • Weather warning systems (e.g. SMS, e-mail, etc.) – referred to as the “Warning systems”-group
  • Other adaptation measures (e.g. building codes) – referred to as the “other adaptation”-group

Standard deviation on Premium Risk

EIOPA’s Summary and Policy Recommendation

The sample for the analysis is very small, as it comprises only eleven underwriting pools. The EU insurance market is at a relatively early stage regarding the implementation of climate-related adaptation measures as defined in this exercise, which naturally limits the amount of potential data to be studied. In this regard, the Standard Formula’s requirement of at least five years of data for the assessment of the standard deviation parameter further constrained the scope of underwriting pools eligible for the analysis. Therefore, it is likely that the data sample studied does not fully capture the effects of adaptation measures, particularly in context of potential variations in terms of adaptation measures, climate perils, spatial exposures, etc.

At this stage, EIOPA does not recommend changing the prudential treatment of premium risk in context of climate-related adaptation measures. Due to the importance of climate-related risk prevention to ensure the long-term availability and affordability of non-life insurance products, EIOPA suggests a repetition of the analysis, provided that the availability of data has improved resulting from further market developments in this regard. In addition, an extension of the prudential analysis to the solvency capital requirements for natural catastrophe risk is suggested.

Social Risks and Impacts from a Prudential Perspective

EIOPA provides an initial analysis of the Pillar II and III requirements under Solvency II, to identify potential areas for further work. Given the material lack of social-related data and risk models regarding the social aspects of investment and underwriting activities of insurers, EIOPA did not conduct a Pillar I-related assessment in response to the mandate.

Social sustainability factors.

Social sustainability factors are commonly referred to in respect of “social and employee matters, respect for human rights, and anti-corruption and anti-bribery matters”.

SFDR (Sustainable Finance Disclosure Regulation) lists the following families of factors also used in the ESRS (European Sustainable Reporting Standards):

Social Impacts

The SFDR social adverse impacts include aspects as gender pay gaps between female and male employees, lack of workplace accident prevention policies, human rights policy or of a diligence process to identify, prevent, mitigate and address adverse human rights impacts.

The Social Taxonomy Report issued by the Platform on Sustainable Finance identifies as examples of socially harmful economic activity the involvement with certain kinds of weapons or the production and marketing of cigarettes.

Social Risks

Social risks refer to (financial) risks including those deriving from dependencies on human and social resources and those affecting working conditions and living standards, communities and consumers / end-users.

Social risks can arise from (macro-level) socio-economic developments as well as from entities or individual behaviour.

They can transmit into society

  • directly (e.g. events causing unemployment, health or security issues (such as pandemics, cyber threats)),
  • indirectly (‘second order’, e.g. rising price levels leading to financial distress, the risk of unemployment spreading into health or safety risks) and
  • through spill-over impacts (‘contagion’) affecting, for example, the financial system (e.g. unemployment leading to mortgage defaults, resulting in increased mortgage insurance pay outs and causing potential financial sector stability issues).

These risks can then transmit into risks for (re)insurance activities. For example, economic difficulties could lead to a decrease in the ability of citizens and companies to insure themselves or to pay their premiums.

Social Transition and Physical Risks

Social transition risk can result from the misalignment of economic activities with changes in policy, technology, legal requirements or consumer preferences which aim at addressing social negative impacts, such as for example inadequate working conditions or discrimination.

While social risks are primarily non-physical in nature, they can also give rise to physical / mental health consequences, especially when they affect working, safety and living conditions. Social risks related to inequality, discrimination, or human rights abuses can also for example lead to social conflicts which may have physical consequences in the form of property damage resulting from violence.

Social Risks for Insurers from a Prudential Perspective

Social risks can translate into prudential risks in the form of underwriting, market, operational (incl. legal) or reputational risks.

Pillar I Prudential Treatment

To perform a quantitative analysis to assess the potential for dedicated capital charges related to social risks, in line with risk- and evidence-based principles, would require large (international) consensus on appropriate definitions of risk channels as well as comprehensive and granular data on social risk factors in conjunction with appropriate risk models, which are not available to date. Hence, EIOPA does not conduct a Pillar I-related analysis in response to the expected mandate.

Pillar II Prudential Treatment

This chapter of EIOPA’s consultation clearly favours ORSA as being today’s most appropriate tool to deal with Social Risk Management. We agree with this initial strategy as it will enable regulators to build a real framework potentially impacting Pillar I and III within the next two to three years. However, based on the recent experience with ORSA, it would be useful to guide (re)insurance undertakings once the first ORSA reports including these issues filed to NCA. A Dry Run ORSA including these new criteria – like the one we experienced prior to 2016 – could be a good strategy to meet expectations.

High level social risk materiality assessment

(Re)insurers can conduct a high level (qualitative) social risk materiality assessment based on exposure to geographies, sectors or lines of business. The materiality of the exposure would form a proxy to vulnerability and materiality of the risk, in a first step of a risk materiality assessment.

  • Social risk – geographical exposure. For example, the Allianz social risk index118 identifies countries that are most vulnerable to systemic social risk. Indicators providing measures for social inequality or development can also provide indications on geographical exposure to social risks, such as the World Bank’s World Development Indicators featuring among others social indicators on labor, health, gender; the Gini index measures the distribution of income across a population; the UNDP human development indicator summarizes achievement in key dimensions of human development across countries.
  • Social risk – sectoral exposure. The exposure of assets or liabilities to economic activities in ‘high social risk sectors’. For example, the Business and Human Rights Navigator (UN Global Compact) can help mapping exposure to sectors at high risk of relying on child labour, forced labour, or sectors negatively impacting on equal treatment (incl. restrictions to freedom of association) or on working conditions (inadequate occupational safety and health, living wage, working time, gender equality, heavy reliance on migrant workers) or have negative impacts on indigenous people. For these issues, the Navigator identifies industry-specific risk factors, aiming to illustrate the issue for certain sectors such as agriculture, fashion & apparel, mining, travel & tourism. The navigator also identifies due diligence steps that companies can take to eliminate the specific social risks in their operations and supply chains. Information on the social sustainability of the economic activity the insurer is underwriting or investing in, can be sourced from companies’ corporate reporting on social risks and impacts under the Corporate Sustainability Reporting Directive (CSRD), as will be implemented by the European Sustainability Reporting Standards.
  • Social risk – insurance lines of business exposure. Some insurance lines of business may be particularly exposed to social risks. For example, the PSI ESG Underwriting Guide for Life and Health Insurance123 and the Geneva Association’s heat map of potential ESG risks in property and casualty underwriting124 identify social factors that may (negatively/positively affect) health or life and non-life insurance risks. Social adversity and lifestyle behaviour is known to affect health and with it, potential health insurance claims. Workers’ compensation claims are likely to be at risk of an employer’s poor work force policies. Other social/societal factors, such as housing insecurity or lack of education can influence (in)directly the outcome of workers’ compensation claims.

Practices for Mitigating Social Risks & Impacts: The Investment Strategy and Decisions

  • Limiting investment in or divesting from socially non-sustainable activities/companies: The exclusion of an investee harming social objectives from the investment portfolio can follow the identification of a socially harmful activity, based on two sources: internationally agreed conventions (e.g., certain kinds of weapons) or research on the detrimental effects of certain activities (e.g., detrimental effect of tobacco use). Thresholds for investments in such companies can be set, or exclusions from investments in these sectors pursued. Minimum social safeguards can serve as a guiding principle.
  • Impact investing and stewardship:
    • The (impact) investment strategy would direct investments at economic activities aiming to achieve explicitly social goals. For example, the funding of health research, through targeted investments in dedicated undertakings or investment in financial literacy programs may contribute to social objectives to improve living standards or access to relevant products to secure financial safety.
    • Engagement and voting on sustainability matters (as part of a stewardship approach) can aim to influence firms of which (re)insurers are shareholders. This supposes the (re)insurer can persuade the investee to act on social objectives and requires a certain degree of influence or leverage that the (re)insurer can reasonably exercise. (Re)insurers can use their engagement and voting rights to improve performance of those companies against the social objectives.
    • A ‘best-in-class strategy’ would consist in selecting investee companies with excellent social performance, regardless of the sector which they belong to. Such an investment approach can support companies to transition to a more socially sustainable business model. (Re)insurers can seek to ensure that those firms they invest in measure up to social objectives, especially in ‘high risk’ sectors, ensuring, for example that they provide appropriate wages, or that they operate safe working environments.
    • Such risk mitigating or adaptation actions can be informed by considering the SFDR principal adverse impacts of the investee companies’ activities. The so-called ‘minimum social safeguards’ as referred to in the Taxonomy Regulation can also provide a minimum standard for implementing a social prudent person principle for investments, in line with Solvency II.

Practices for Mitigating Social Risks & Impacts: The Underwriting Strategy and Decisions

  • Limiting underwriting of socially non-sustainable activities: Similar to investments, insurers could opt not to insure companies (belonging to a sector) known for unsustainable or harmful social practices in its own operations or value chain, or negatively impacting communities or consumers.
  • Impact underwriting and services: Through targeted underwriting activity, products and services, insurers could bring additional social benefits that directly contribute to the realization of social objectives for end-users and consumers as well as for affected communities (directly or through the value chain). There may be scope for insurers, through their underwriting strategy and decisions, to incentivize policyholders to manage losses arising from social risks. This may be through the provision of services or the potential reduction of premia for risk reducing measures taken by the policyholder, consistent with actuarial risk-based principles. Via underwriting, insurers could also ensure their product offerings and distribution practices consider the demands and needs of a diverse range of clients. Through their underwriting they need to ensure exclusions do not unfairly target and discriminate consumers with non-normative traits and/or vulnerable consumers.
    • For example:
      • The integration of social risk mitigants into, for example, surety bond underwriting for infrastructure projects can also contribute to reducing losses from underwriting due to social risks.
      • Risk mitigants can be part of underwriting conditions for workers’ compensation policies requiring companies to impact on the health of their workers through the pay they provide, the security of contracts they offer, and through the provision of benefits such as sick pay, parental leave, health insurance and other health-related schemes.
      • The establishment of sectoral risk sharing capacities at local, regional or national level, where applicable with government involvement, can contribute to social risk mitigation, for example by improving risk assessment for communities and societies and reducing losses from socio-economic risk events.

Pillar III Prudential Treatment

Considering the nascent reporting requirements on social risks and impacts under SFDR and CSRD, EIOPA is not proposing at this stage to develop additional (prudential Pillar III) reporting or disclosure requirements regarding social risks and impacts in Solvency II. Further analysis would be required as to whether quantitative prudential reporting requirements could inform the corresponding prudential treatment of (re)insurers assets and liabilities.

The CEO’s Dilemma – Building Resilience in a Time of Uncertainty

Global disruptions and an increasingly complex macroeconomic outlook will be key elements of the strategic environment for the foreseeable future. For leaders, the only certainty is that waiting for clarity is a losing move. The best organizations know how to turn uncertainty into opportunity. Their playbook relies on two critical elements:

  • a shared and clear view of the world and the strategic challenges/opportunities it presents
  • and a resilient and adaptable plan to win.

A view of the world

Today’s global disruptions (e.g., geopolitical tensions, supply chain and economic headwinds (e.g., soaring inflation, rising interest rates, decelerating growth, and currency fluctuations)) have created a complex, once in a generation, competitive environment with significant variations across geographic areas and sectors.

Navigating this unprecedented complexity requires business leaders to develop a dynamic perspective not only on the most likely scenarios for how their operating and economic environments will evolve, but also on the distinct opportunities and risks these scenarios present for their organizations.

This research shows that “winners” in economic uncertainty do not just sit back and wait for recovery instead, they are proactive and turn ambiguity into opportunity.

A plan to win

There is no “one size fits all” solution to today’s complex strategic challenges. But this research suggests that the best companies do two things well in crafting their unique plans to win:

  • First, they have a clear understanding of their strategic starting point that takes into account nuanced and deaveraged perspectives on the economic and operational stability of the markets in which they operate as well as on their own organizations’ financial strength (e.g., profit volatility, free cash flow to debt ratio) ultimately falling into four high level starting point archetypes
  • And second, they embed a “dynamic strategy” mindset into their planning, comprising three elements:
    • Sensing: Observing trends, defining and monitoring critical uncertainties, and outlining a set of scenarios against which to assess business decisions
    • Adapting: Building operational and financial stability by shaping and reshaping strategies based on market trends and data driven forecasts
    • Thriving: Moving rapidly from assessment to action to seize growth opportunities and strengthen competitive advantage

Increasing uncertainty driven by a set of global disruptions and exacerbated by macroeconomic headwinds needs to be met head on.

Dramatic shifts in inflation drivers vary across regions and countries with energy emerging as one of the strongest drivers

Different sectors are affected differently by macro uncertainties

Sectors like agriculture are typically less vulnerable to business cycle shifts, while other sectors (e.g., media, tech, fashion) tend to be more affected. But this varies by recession depending on drivers.

Some sectors (e.g., retail), which were less vulnerable in the early 2000s recessions, are showing greater vulnerability in the current environment.

Top performers in economic uncertainty do not just wait for recovery; instead, they build competitive advantage and turn ambiguity into a source of opportunity.
Business leaders must balance contrasting priorities amid strong macroeconomic headwinds
Understanding the “starting point” is critical to successfully navigate this uncertainty

With the current disruptions and uncertainties, it is imperative for business leaders to reevaluate:

  1. The stability of their portfolio against economic downturns & market disruption
  2. The internal financial stability to cope with uncertainty

Each business context is distinct, but four starting-point archetypes can help leaders understand the moves most relevant for their organizations.

How to navigate uncertainty: Enhance resilience and secure clear pathway for sustained growth
The time to act is now

Take 3 key steps to navigate uncertainty and win in a downturn:

  1. Sensing macroeconomic and disruptive trends to shape (and reshape) future scenarios that guide strategic decisions
  2. Adapting business and functional strategies in response to new insights and to market, economic, and competitive developments
  3. Thriving by building competitive advantage to turn adversity into opportunity

Actions should be based on the specific business context.

EIOPA Financial Stability Report July 2020

The unexpected COVID-19 virus outbreak led European countries to shut down major part of their economies aiming at containing the outbreak. Financial markets experienced huge losses and flight-to-quality investment behaviour. Governments and central banks committed to the provision of significant emergency packages to support the economy, as the economic shock, caused by demand and supply disruptions accompanied by its reflection to the financial markets, is expected to challenge economic growth, labour market and the consumer sentiment across Europe for an uncertain period of time.

Amid an unprecedented downward shift of interest rate curves during March, reflecting the flight-to-quality behaviour, credit spreads of corporates and sovereigns increased for riskier assets, leading effectively to a double-hit scenario. Equity markets dramatically dropped showing extreme levels of volatility responding to the uncertainties on virus effects and on the status of government and central banks support programs and their effectiveness. Despite the stressed market environment, there were signs of improvement following the announcements of the support packages and during the course of the initiatives of gradually reopening the economies. The virus outbreak also led to extraordinary working conditions, with part of the services sector working from home, which rises the potential of those conditions being preserved after the virus outbreak, which could decrease demand and market value for commercial real estate investments.

Within this challenging environment, insurers are exposed in terms of solvency risk, profitability risk and reinvestment risk. The sudden reassessment of risk premia and the increase of default risk could trigger large-scale rating downgrades and result in decreased investments’ value for insurers and IORPs, especially for exposures to highly indebted corporates and sovereigns. On the other hand, the risk of ultra-low interest rates for long has further increased. Factoring in the knock on effects of the weakening macro economy, future own funds position of the insurers could be further challenged, due to potential lower levels of profitable new business written accompanied by increased volume of profitable in-force policies being surrendered or lapsed.

Finally, liquidity risk has resurfaced, due to the potential of mass lapse type of events and higher than expected virus and litigation related claims accompanied by the decreased inflows of premiums.

EIOPA1

For the European occupational pension sector, the negative impact of COVID-19 on the asset side is mainly driven by deteriorating equity market prices, as, in a number of Member States, IORPs allocate significant proportions of the asset portfolio (up to nearly 60%) in equity investments. However, the investment allocation is highly divergent amongst Member States, so that IORPs in other Member States hold up to 70% of their investments in bonds, mostly sovereign bonds, where the widening of credit spreads impair their market value. The liability side is already pressured due to low interest rates and, where market-consistent valuation is applied, due to low discount rates. The funding and solvency ratios of IORPs are determined by national law and, as could be seen in the 2019 IORP stress test results, have been under pressure and are certainly negatively impacted by this crisis. The current situation may lead to benefit cuts for members and may require sponsoring undertakings to finance funding gaps, which may lead to additional pressure on the real economy and on entities sponsoring an IORP.

EIOPA2

Climate risks remain one of the focal points for the insurance and pension industry, with Environmental, Social and Governance (ESG) factors increasingly shaping investment decisions of insurers and pension funds but also affecting their underwriting. In response to climate related risks, the EU presented in mid-December the European Green Deal, a roadmap for making the EU climate neutral by 2050, providing actions meant to boost the efficient use of resources by

  • moving to a clean, circular economy and stop climate change,
  • revert biodiversity loss
  • and cut pollution.

At the same time, natural catastrophe related losses were milder than previous year, but asymmetrically shifted towards poorer countries lacking relevant insurance coverages.

Cyber risks have become increasingly relevant across the financial system in particular during the virus outbreak due to the new working conditions that the confinement measures imposed. Amid the extraordinary en masse remote working arrangements an increased number of cyber-attacks has been reported on both individuals and healthcare systems. With increasing attention for cyber risks both at national and European level, EIOPA contributed to building a strong, reliable, cyber insurance market by publishing its strategy for cyber underwriting and has also been actively involved in promoting cyber resilience in the insurance and pensions sectors.

Click here to access EIOPA’s detailed Financial Stability Report July 2020

Implementing combined audit assurance

ASSESS IMPACT & CREATE AN ASSURANCE MAP

The audit impact assessment and assurance map are interdependent—and the best possible starting point for your combined assurance journey. An impact assessment begins with a critical look at the current or “as is” state of your organization. As you review your current state, you build out your assurance map with your findings. You can’t really do one without the other. The map, then, will reveal any overlaps and gaps, and provide insight into the resources, time, and costs you might require during your implementation. Looking at an assurance map example will give you a better idea of what we’re talking about. The Institute of Chartered Accountants of England and Wales (ICAEW) has an excellent template.

Galv4

The ICAEW has also provided a guide to building a sound assurance map. The institute suggests you take the following steps:

  1. Identify your sponsor (the main user/senior staff member who will act as a champion).
  2. Determine your scope (identify elements that need assurance, like operational/ business processes, board-level risks, governance, and compliance).
  3. Assess the required amount of assurance for each element (understand what the required or desired amount of assurance is across aspects of the organization).
  4. Identify and list your assurance providers in each line of defense (e.g., audit committee or risk committee in the third line).
  5. Identify your assurance activities (compile and review relevant documentation, select and interview area leads, collate and assess assurance provider information).
  6. Reassess your scope (revisit and update your map scope, based on the information you have gathered/evaluated to date).
  7. Assess the quality of your assurance activities (look at breadth and depth of scope, assurance provider competence, how often activities are reviewed, and the strengths/quality of assurance delivered by each line of defense).
  8. Assess the aggregate actual amount of assurance for each element (the total amount of assurance needs to be assessed, collating all the assurance being provided by each line of defense).
  9. Identify the gaps and overlaps in assurance for each element (compare the actual amount of assurance with the desired amount to determine if there are gaps or overlaps).
  10. Determine your course of action (make recommendations for the actions to be taken/activities to be performed moving forward).

Just based on the steps above, you could understand how your desired state evolves by the time you reach step 10. Ideally, by this point, gaps and overlaps have been eliminated. But the steps we just reviewed don’t cover the frequency of each review and they don’t determine costs. So we’ve decided to add a few more steps to round it out:

  1. Assess the frequency of each assurance activity.
  2. Identify total cost for all the assurance activities in the current state.
  3. Identify the total cost for combined assurance (i.e., when gaps and overlaps have been addressed, and any consequent benefits or cost savings).

DEFINE THE RISKS OF IMPLEMENTATION

Implementing combined assurance is a project, and like any project, there’s a chance it can go sideways and fail, losing you both time and money. So, just like anything else in business, you need to take a risk-based approach. As part of this stage, you’ll want to clearly define the risks of implementing a combined assurance program, and add these risks, along with a mitigation plan and the expected benefits, to your tool kit. As long as the projected benefits of the project outweigh the residual risks and costs, the implementation program is worth pursuing. You’ll need to be able to demonstrate that a little further down the process.

DEFINE RESOURCES & DELIVERABLES

Whoever will own the project of implementing combined assurance will no doubt need dedicated resources in order to execute. So, who do we bring in? On first thought, the internal audit team looks best suited to drive the program forward. But, during the implementation phase, you’ll actually want a cross-functional team of people from internal control, risk, and IT, to work alongside internal audit. So, when you’re considering resourcing, think about each and every team this project touches. Now you know who’s going to do the work, you’ll want to define what they’re doing (key milestones) and when it will be delivered (time frame). And finally, define the actual benefits, as well as the tangible deliverables/outcomes of implementing combined assurance. (The table below provides some examples, but each organization will be unique.)

Galv1

RAISE AWARENESS & GET MANAGEMENT COMMITMENT

Congratulations! You’re now armed with a fancy color-coded impact assessment, and a full list of risks, resources, and deliverables. The next step is to clearly communicate and share the driving factors behind your combined assurance initiative. If you want them to support and champion your efforts, top management will need to be able to quickly take in and understand the rationale behind your desire for combined assurance. Critical output: You’ll want to create a presentation kit of sorts, including the assurance map, lists of risks, resources, and deliverables, a cost/benefit analysis, and any supporting research or frameworks (e.g., the King IV Report, FRC Corporate Governance Code, available industry analysis, and case studies). Chances are, you’ll be presenting this concept more than once, so if you can gather and organize everything in a single spot, that will save a lot of headaches down the track.

ASSIGN ACCOUNTABILITY

When we ask the question, “Who owns the implementation of combined assurance?”, we need to consider two main things:

  • Who would be most impacted if combined assurance were implemented?
  • Who would be senior enough to work across teams to actually get the job done?

It’s evident that a board/C-level executive should lead the project. This project will be spanning multiple departments and require buy-in from many people—so you need someone who can influence and convince. Therefore, we feel that the chief audit executive (CAE) and/or the chief revenue officer (CRO) should be accountable for implementing combined assurance. The CAE literally stands at the intersection of internal and external assurance. Where reliance is placed on the work of others, the CAE is still accountable and responsible for ensuring adequate support for conclusions and opinions reached by the internal audit activity. And the CRO is taking a more active interest in assurance maps as they become increasingly more risk-focused. The Institute of Internal Auditors (IIA), Standard 2050, also assigns accountability to the CAE, stating: “The chief audit executive should share information and coordinate activities with other internal and external assurance providers and consulting services to ensure proper coverage and minimize duplication of effort.” So, not only is the CAE at the intersection of assurance, they’re also directing traffic—exactly the combination we need to drive implementation.

Envisioning the solution

You’ve summarized the current/“as is” state in your assurance map. Now it’s time to move into a future state of mind and envision your desired state. What does your combined assurance solution look like? And, more critically, how will you create it? This stage involves more assessment work. Only now you’ll be digging into the maturity levels of your organization’s risk management and internal audit process, as well as the capabilities and maturity of your Three Lines of Defense. This is where you answer the questions, “What do I want?”, and “Is it even feasible?” Some make-or-break capability factors for implementing combined assurance include:

  1. Corporate risk culture Risk culture and risk appetite shape an organization’s decision-making, and that culture is reflected at every level. Organizations who are more risk-averse tend to be unwilling to make quick decisions without evidence and data. On the other hand, risk-tolerant organizations take more risks, make rapid decisions, and pivot quickly, often without performing due diligence. How will your risk culture shape your combined assurance program?
  2. Risk management awareness If employees don’t know—and don’t prioritize— how risk can and should be managed in your organization, your implementation program will fail. Assurance is very closely tied to risk, so it’s important to communicate constantly and make people aware that risk at every level must be adequately managed.
  3. Risk management processes We just stated that risk and assurance are tightly coupled, so it makes sense that the more mature your risk management processes are, the easier it will be to implement combined assurance. Mature risk management means you’ve got processes defined, documented, running, and refined. For the lucky few who have all of these things, you’re going to have a much easier time compared to those who don’t.
  4. Risk & controls taxonomy Without question, you will require a common risk and compliance language. We can’t have people making up names for tools, referring to processes in different ways, or worst of all, reporting on totally random KPIs. The result of combined assurance should be “one language, one voice, one view” of the risks and issues across the organization.
  5. System & process integrations An integrated system where there is one set of risks and one set of controls is key to delivering effective combined assurance. This includes: Risk registers across the organization, Controls across the organization Issues and audit findings, Reporting.
  6. Technology use Without dedicated software technology, it’s extremely difficult to provide a sustainable risk management system with sound processes, a single taxonomy, and integrated risks and controls. How technology is used in your organization will determine the sustainability of combined assurance. (If you already have a risk management and controls platform that has these integration capabilities, implementation will be easier.)
  7. Using assurance maps as monitoring tools Assurance maps aren’t just for envisioning end-states; they’re also critical monitoring tools that can feed data into your dashboard. They can inform your combined assurance dashboard, to help report on progress.
  8. Continuous improvement mechanisms A mature program will always have improvement mechanisms and feedback loops to incorporate user and stakeholder feedback. A lack of this feedback mechanism will impact the continued effectiveness of combined assurance.

We now assess the maturity of these factors (plus any others that you find relevant) and rank them on a scale of 1-4:

  • Level 1: Not achieved (0-15% of target).
  • Level 2: Partially achieved (15-50%).
  • Level 3: Largely achieved (50-85%).
  • Level 4: Achieved (85-100%).

This rating scale is based on the ISO/IEC 15504 that assigns a rating to the degree each objective (process capability) is achieved. An example of a combined assurance capability maturity assessment can be seen in Figure 2.

Galv2

GAP ANALYSIS

Once the desired levels for all of the factors are agreed on and endorsed by senior management, the next step is to undertake a gap analysis. The example in Figure 2 shows that the current overall maturity level is a 2 and the desired level is a 3 or 4 for each factor. The gap for each factor needs to be analyzed for the activities and resources required to bridge it. Then you can envision the solution and create a roadmap to bridge the gap(s).

SOLUTION VISION & ROADMAP

An example solution vision and roadmap could be:

  • We will use the same terminology and language for risk in all parts of the organization, and establish a single risk dictionary as a central repository.
  • All risks will be categorized according to severity and criticality and be mapped to assurance providers to ensure that no risk is assessed by more than one provider.
  • A rolling assurance plan will be prepared to ensure that risks are appropriately prioritized and reviewed at least once every two years.
  • An integrated, real-time report will be available on demand to show the status, frequency, and coverage of assurance activities.
  • The integrated report/assurance map will be shared with the board, audit committee, and risk committee regularly (e.g., quarterly or half-yearly).
  • To enable these capabilities, risk capture, storage, and reporting will be automated using an integrated software platform.

Figure 3 shows an example roadmap to achieve your desired maturity level.

Galv3

Click here to access Galvanize’s Risk Manangement White Paper