Banking, Insurance, Life Insurance and Health Insurance (prudential standards) determination

 No. 1 of 2017

EXPLANATORY STATEMENT

Prepared by the Australian Prudential Regulation Authority

Banking Act 1959, section 11AF

Insurance Act 1973, section 32

Life Insurance Act 1995, section 230A

Private Health Insurance (Prudential Supervision) Act 2015, section 92

APRA may, in writing, determine, vary or revoke a prudential standard that applies to an institution regulated by APRA under:

On 26 July 2017, APRA made the following determination (the instrument):

Banking, Insurance, Life Insurance and Health Insurance (prudential standards) determination No. 1 of 2017, which revokes Prudential Standard CPS 220 Risk Management (CPS 220) made under Banking, Insurance and Life Insurance (prudential standard) determination No. 5 of 2016, and determines a new Prudential Standard CPS 220 Risk Management (CPS 220).

The instrument commences on 1 April 2018.  

1. Background

APRA’s mandate is to ensure the safety and soundness of prudentially regulated financial institutions so that they can meet their financial promises to depositors, policyholders and fund members within a stable, efficient and competitive financial system.

APRA carries out this mandate through a multi-layered prudential framework that encompasses licensing and supervision of institutions. APRA is empowered under the Banking Act, the Insurance Act, the Life Insurance Act and the PHI Act to issue legally binding prudential standards that set out specific prudential requirements with which APRA-regulated institutions in each industry must comply. These standards are supported by prudential practice guides which clarify APRA’s expectations with regard to prudential requirements.

APRA regularly reviews its regulatory regime and amends its prudential requirements as a result of a number of factors including:

• international developments;
• changes in financial market conditions;
• changes in risk management practices, in response to identified weaknesses in the prudential framework; and
• to reduce potential negative impacts of emerging industry issues.

In 2017, following two years of review, including consultation with the private health insurance industry, this instrument will extend coverage of the prudential standard to private health insurers. The instrument does not impose new prudential requirements on general insurers, life companies, ADIs or groups, but includes a small number of minor enhancements to existing prudential requirements to clarify APRA’s expectations of regulated institutions covered by the Banking, Insurance and Life Insurance Acts.

The purpose of the instrument is to continue to promote sound risk management practices in general insurers, life companies, ADIs or groups and to extend this to the private health insurance industry by applying CPS 220 to private health insurers. APRA’s expectations of sound risk management practice have been informed by its experience supervising institutions in multiple financial industries over a number of years, observations of better practice within those industries and domestic and international developments.

The prudential framework contained in CPS 220 will provide a critical tool for identifying, assessing and monitoring risks with the potential to materially affect a private health insurer’s ability to meet its strategic, business and operational objectives, and to assess a private health insurer’s overall risk of failure. Adoption of the risk management framework and practices contained in CPS 220 will support the financial soundness of private health insurers, maintain consumer confidence in the private health system and protect the interests of policyholders.

Key aspects of CPS 220 which will now apply to private health insurers are:

• that the board of every regulated institution:
  • set a clearly articulated risk appetite so that the boundaries within which management may operate are clear;
  • oversee the implementation and ongoing operation of a robust and effective risk management strategy;
  • form a view of the risk culture within the private health insurer and the extent to which the risk culture supports the ability of the institution to operate consistently within the board’s risk appetite;
  • approve a business plan that sets out the approach for the implementation of the strategic objectives of the private health insurer; and
  • make an annual risk management declaration to APRA.

• that every regulated institution:
  • have a designated risk management function appropriate to the size, business mix and complexity of the institution;
  • identify, measure, monitor and report on its material risks;
  • designate a Chief Risk Officer who is involved in, and provides effective challenge to, activities and decisions that may materially affect the risk profile of the regulated institution;
  • establish and maintain an effective management information system;
  • provide periodic reviews to APRA about the appropriateness, effectiveness and adequacy of the risk management framework; and
  • provide an annual risk management declaration confirming that there are systems in place to ensure compliance with legislative and prudential requirements, and that the board of the APRA-regulated institution has satisfied itself as to the adequacy of, and compliance with the risk management framework.

The instrument enables private health insurers that are part of a broader corporate group to meet their risk management obligations on a group basis provided the board of each private health insurer within the group structure can be satisfied that it continues to meet its individual risk management requirements under CPS 220.

Private health insurers are not impacted by provisions of CPS 220 which relate specifically to other APRA-regulated industries. For example, references to:

• Level 2, Level 3 and Category C insurers, EFLICs and NOHCs - these terms apply to authorised deposit-taking institutions, life insurers and/or general insurers;
• Head of group references –a reference to a ‘Head of group’ in CPS 220 is a reference to a Level 2 Head or Level 3 Head, as relevant;
• reinsurance management strategy or run-off insurer – terms applicable only to the general insurance industry; and
• foreign institution requirements - not applicable to the PHI industry as all registered private health insurers are required to be companies within the meaning of the Corporations Act 2001.

The instrument makes no material changes to CPS 220 for general insurers, life companies and ADIs, but includes a number of minor enhancements to existing prudential requirements, to clarify APRA’s expectations of regulated institutions under the prudential standard. These changes include:

• replace the word ‘system’ with ‘systems’ in paragraph 23(g) to reflect that an institution may use multiple systems depending on the size, scale or type of risk being reported upon;
• paragraph 30(e) has been reworded to reflect that individuals need to have an awareness of the risk management framework ‘as it relates to their role’; and
• paragraph 47 has been amended to clarify that it references the comprehensive review, not the annual review.

The instrument provides a consistency in terminology and expectations across APRA-regulated institutions. Similar risks will be treated in a similar way and compliance will be simplified, particularly for groups that operate across APRA-regulated industries.

In CPS 220, unless the contrary intention appears, a reference to an Act, Regulations or Prudential Standard is a reference to the Act, Regulations or Prudential Standard as in force from time to time.

In 2015, following the transfer of prudential regulation of the private health insurance industry to APRA, a detailed review of the risk management arrangements and practices of the 33 private health insurers commenced. Undertaken over 20 months, the reviews found a range of governance, risk culture and risk management practices in the industry – some good and some concerning[1]. During that period APRA also attended industry meetings to answer questions on its plans to review the regulatory framework, of which the risk management review represented the first priority.

In December 2016, APRA commenced a formal four month consultation on the proposal to include private health insurers under its cross-industry risk management prudential standard. APRA received submissions from a range of stakeholders including the two PHI industry associations, 12 APRA-regulated institutions and the Actuaries Institute. The insurer submissions represented a broad cross-section of the industry (approximately 83 per cent by market share).

All submissions supported the introduction of a risk management standard for the industry. There was agreement that the core principles of CPS 220 were appropriate for the private health insurance industry and that the proposed modifications to the standard to incorporate private health insurers were appropriate. Most observed that the requirements of CPS 220 represented sensible business practice, which will replace or enhance other processes currently in place.

The consultation process raised questions about the role of the Chief Risk Officer, group governance requirements, the identification and assessment of material risks, and transition and reporting requirements.  APRA responded to submissions in a July 2017 response paper.

5.      Regulation Impact Statement

The Office of Best Practice Regulation advised that a Regulation Impact Statement was not required for this determination.

A Statement of compatibility prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011 is provided at Attachment A to this Explanatory Statement.

ATTACHMENT A

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Banking, Insurance and Life Insurance (prudential standards) determination

No. 1 of 2017

This Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011 (HRPS Act).

Overview of the Legislative Instrument

The legislative instrument revokes Prudential Standard CPS 220 Risk Management (CPS 220) made under Banking, Insurance and Life Insurance (prudential standard) determination No. 5 of  in 2016 and replaces it with a new CPS 220. The instrument extends the coverage of CPS 220 to private health insurers under the Private Health Insurance (Prudential Supervision) Act 2015.

The instrument promotes sound risk management practices. The prudential framework contained in CPS 220 provides a critical tool for identifying, assessing and monitoring risks with the potential to materially affect a regulated institution’s ability to meet its strategic, business and operational objectives, and to assess its overall risk of failure.

The instrument does not impose new prudential requirements on existing APRA-regulated institutions covered by the 2016 CPS 220 determination, but does include a number of minor variations to the 2016 determination to improve the clarity of the prudential standard.

Human rights implications

APRA has assessed this Legislative Instrument and is of the view that it does not engage any of the applicable rights or freedoms recognised or declared in the international instruments listed in section 3 of the HRPS Act. Accordingly, in APRA’s assessment, the instrument is compatible with human rights.

Conclusion

Prudential Standard CPS 220 Risk Management is compatible with human rights as it does not raise any human rights issues.

[1] http://www.apra.gov.au/PHI/Documents/PHI_Industry_Report_Risk_Management_July_2017.pdf