Insurance (prudential standard) determination No. 1 of 2006 - Prudential Standard GPS 220 - Risk Management

Insurance (prudential standard) determination No. 1 of 2006: Prudential Standard GPS 220 Risk Management

Explanatory Statement

Issued by the authority of the Australian Prudential Regulation Authority (“APRA”)

Insurance Act 1973, paragraph 32(1)(a)

Acts Interpretation Act 1901, subsection 33(3)

Legislative background

Paragraph 32(1)(a) of the Insurance Act 1973 (“the Act”) provides that APRA may determine (in writing) standards relating to prudential matters that must be complied with by general insurers.  Pursuant to subsection 32(5) of the Act and paragraph 6(d) of the Legislative Instruments Act 2003, such Prudential Standards are legislative instruments for the purposes of the Legislative Instruments Act 2003.  Subsection 33(3) of the Acts Interpretation Act 1901 gives APRA power to revoke Prudential Standards so determined.

Prudential Standard GPS 220 Risk Management for General Insurers deals with requirements relating to a risk management framework for general insurers.

The Determination

Insurance (prudential standard) determination No 1 of 2006 will revoke Prudential Standard GPS 220 Risk Management for General Insurers (made on 7 February 2002 under paragraph 32(1)(a) of the Act) (“the old Standard”) and makes the new Prudential Standard GPS 220 Risk Management (“the new Standard”).

The old Standard (and associated Guidance Notes which form part of the old Standard) aims to ensure that an insurer is well managed, has access to appropriate independent expertise and has systems for identifying, managing and monitoring risks that may reduce the ability of the general insurer to meet its obligations to policyholders.  The old Standard also imposes requirements on the Board and senior management of the general insurer relating to internal governance and appropriate systems and controls to address the risks arising from the general insurer’s business activities.  The new Standard will aim to ensure that an insurer has systems for identifying, assessing, mitigating and monitoring the risks that may affect the ability of the general insurer to meet its obligations to policyholders.  Requirements relating to governance and the responsibility of the Board and senior management of the general insurer will be moved from the old Standard to other Prudential Standards.

Background to the Changes

Since 1 July 2002, general insurers have been required to comply with a prudential regime under the Act (involving prudential standards and guidance notes) administered by APRA.  These prudential requirements are complemented by a comprehensive reporting framework for general insurers via reporting standards made under the Financial Sector (Collection of Data) Act 2001.

The prudential regime significantly strengthened and modernised the supervisory framework applying to general insurers in Australia, such that the industry is now subject to much higher operational standards than has been the case in the past.  As with all elements of the prudential framework, APRA intends to update these initial requirements for general insurers as it recognises that it requires greater rigour to adequately protect policyholders.  Sufficient time has now passed to assess the effectiveness of the original framework.

The results of the implementation of the old Standard since July 2002 have been mixed.  While the old Standard and the associated guidance notes, which formed part, were quite prescriptive, APRA observed a wide variation in the application of the old Standard through its supervisory activities.  As a result, the quality of risk management of some general insurers was insufficient to meet APRA’s expectations for a prudently managed institution.  Although the old Standard is prescriptive, it lacks sufficient clarity about APRA’s expectations on risk management. Industry expressed concerns, in particular during on-site supervision activities, that it is difficult for general insurers to implement suitable approaches to compliance.

Inconsistent treatment of prudential requirements between general insurers is an issue.  For example, the quality of risk management documentation and monitoring processes differs greatly between insurers.  The level of prescription in the old standards and guidance notes is such that the requirements cannot be easily tailored to meet the particular circumstances of individual insurers. According to the Insurance Council of Australia (ICA), ‘APRA’s role should be to ensure that each insurer has an appropriate strategy; the details of that strategy could be discussed with each insurer.’  APRA agrees.  Prescribing a set of standards that are ‘one size fits all’ does not achieve the outcome that both the industry and APRA desires.  The tendency with a prescriptive approach is that both insurers and APRA focus too much on compliance with individual elements reducing focus on the effectiveness of the risk management framework in place.

As such, APRA’s supervision of general insurers since 2002 has revealed the following elements as being crucial to the prudent management of an insurer:

• the development of a comprehensive risk management framework (which is clearly documented in a Risk Management Statement, where key risk management functions are properly identified);
• a clarified requirement that an insurer maintain a minimum three-year business plan which incorporates an equally clearly defined capital management plan; and
• greater emphasis on the responsibilities of an insurer’s Board with regards to risk management and the integrity of financial reporting (potentially achieved through an attestation or other declaration from the Board).

More specifically, in April 2003, Justice Owen, Commissioner of the HIH Royal Commission, handed down his findings and recommendations on the failure of HIH Insurance.  In Recommendation 15, Justice Owen stated:

I recommend that both the Australian Prudential Regulation Authority and the Institute of Actuaries of Australia introduce compulsory certification of the completeness and accuracy of data.

APRA acknowledges that the old prudential framework which incorporates the old standard lacks sufficient clarity to provide adequate guidance and minimum requirements to industry with respect to data integrity, business planning and risk management.

The objectives of the proposed amendments to the risk management framework for general insurers are to:

• Foster a stronger and more flexible risk management regime that allows tailoring of requirements according to the size, business mix and complexity of individual insurers, and which is capable of adapting to market developments and improvements in supervisory techniques over time.
• Clarify existing prudential requirements relating to risk management, and provide additional guidance for all general insurers.
• Ultimately, increase the protection provided to policyholders.

Detailed Changes

APRA will revoke the old standard (and associated guidance notes) and determine the new Standard under the Act to govern risk management.  The new standard will incorporate technical appendices to retain the mandatory detail in the guidance notes.  Rather than maintain legally binding guidance notes APRA will release a set of Prudential Practice Guides (“PPGs”).  The PPGs will provide guidance to general insurers in the implementation of good risk management practices and help with their compliance with the new Standard. 

The new Standard will reflect some existing requirements under the old Standard, but will also impose a range of additional obligations on insurers using a more principles-based approach to supervision, but does not attempt to prescribe in all cases how an insurer must operate to comply with the standard.  Specifically, the regime under this prudential standard will do the following:

• clarify APRA’s expectations for the risk management framework comprising a high level Risk Management Strategy, policies and procedures and identified responsible roles;
• require a Business Plan that includes a description of the insurer’s approach to capital management; and
• require Board and management attestations relating specifically to risk management and the quality and integrity of financial information.

The new Standard will reinforce that the prime responsibility for the sound and prudent management of an insurer rests with the Board and senior management of that insurer and will provide a logical structure that requires key management roles identified by the insurer to take ultimate responsibility for risk management within the insurer.

Implementation

The old Standard will be revoked with effect from 1 October 2006.  The new Standard will take effect from 1 October 2006.  Between the date of Insurance (prudential standard) determination No 1 of 2006 and 1 October 2006, an insurer must continue to comply with the old Standard. 

However, there are special transition rules set out in an attachment to the new Standard.  These deal with the submission of various documentation required under the new Standard and other transitional matters.

Consultation

APRA has undertaken a comprehensive and rigorous program of consultation with industry since the release of the initial discussion paper outlining the proposed changes to risk management (among other things) in November 2003.  A large number of submissions were received in response to this discussion paper, many of which expressed concerns about the prescriptive nature of the proposals concerning risk management.

To provide a forum for further discussion about the proposals, APRA and the Insurance Council of Australia (“ICA”) held a Joint Forum in June 2004, where APRA presented its proposals and comments on the submissions received to date.  This also provided an opportunity for members of the industry to voice their concerns and to foster a useful debate about the proposals.  Subsequent to this Joint Forum, APRA also met with insurers on an individual basis to further discuss the specific impact of the proposals on their operations

APRA then released a further discussion paper and draft prudential standards and guidance notes for industry comment in May 2005, incorporating changes based on the submissions received from, and discussions held with, industry.  APRA and ICA held another Joint Forum in June 2005 where further discussions around the detail of the proposals took place.  At both this forum and in the submissions received (during the six-month consultation period), similar concerns about the proposed level of prescription and the lack of relevance of some of the proposals to differing types of general insurers were again raised.

As a result of the cumulative effect of these submissions, APRA decided to propose significant changes to its overall prudential framework for general insurers to allow for greater flexibility with a more tailored and certain supervision framework.  These proposals, including the introduction of PPGs, were presented to the ICA and contributors of significant submissions in October 2005.

Once the proposed standards and PPGs were in a near final form, APRA held a private consultation with an ICA Working Party to ensure that APRA’s approach adequately reflected their input.

Throughout the overall consultation process, APRA also held Auditor Liaison meetings, where the proposals relating to the responsibilities of auditors were discussed with representatives from the profession. 

The response from all participants in the final consultation processes was very positive.  The industry was pleased with option 1 in general terms because of its greater flexibility in structure and the significantly reduced prescription.  The remaining resistance to particular proposals by individual insurers concerned the impact of the particular proposals on those insurers which could not be appropriately addressed while meeting the objectives of the proposals.

Regulatory Impact Statement

A Regulation Impact Statement is attached to this Explanatory Statement.

Regulation impact statement

GPS 220 Risk Management

This Regulation Impact Statement (RIS) addresses APRA’s determination of Prudential Standard GPS 220 Risk Management and the creation of a new prudential framework characterised by the introduction of non-enforceable guidance material.

Background

There are currently 133 private sector companies authorised under the Insurance Act 1973 (the Act), managing (as at 30 September 2005) approximately $82 billion in assets. Since 1 July 2002, general insurers have been required to comply with an upgraded prudential regime under the Act (involving prudential standards and guidance notes) administered by the Australian Prudential Regulation Authority (APRA).  These prudential requirements are complemented by a comprehensive reporting framework for general insurers via reporting standards made under the Financial Sector (Collection of Data) Act 2001.

The current prudential regime significantly strengthened and modernised the supervisory framework applying to general insurers in Australia, such that the industry is now subject to much higher operational standards than had been the case in the past.  As with all elements of the prudential framework, APRA intended to update these initial requirements for general insurers as it recognised that it required greater rigor to adequately protect policyholders.  Sufficient time has now passed to assess the effectiveness of  the current framework.

In order to measure the impact on the operating costs of insurers of this updated package we examined the impact on the cost base of insurers of the extensive changes implemented on 1 July 2002.  If the compliance costs of prudential regulation were significant, then the reforms implemented in 2002 should have been accompanied with a large increase in operating costs (other expenses and underwriting expenses).  APRA’s analysis indicates that the added costs of the 2002 reforms were not significant as the inflation in operating costs of the largest four insurers continued at about the same rate as the increase in the assets and the gross written premium of those insurers.  Refer to the graph on the following page which shows the four major insurers’ operating costs and a comparison of operating costs to total assets and gross written premium.  

If operating costs are compared to premium income, then the first year of the implementation of the reforms coincided with a significant decrease in expenses compared to gross written premium.  This effect was caused by a significant increase in premium rates.  There were a number of drivers of increased premiums at that time including: a greater focus on underwriting results due to low inflation and weak equity markets; loss of capacity in the industry particularly due to the exit of HIH; and increased pressure from reinsurance costs following the September 11 terrorist attacks. The result was that in 2003 for the first time in five years the industry made an underwriting profit.

The trend in increasing costs in actual dollar terms from 2001 to 2004 is relatively stable.  Whilst this analysis does not definitively indicate the absence of additional compliance costs, it does demonstrate that a significant reform of the general insurance industry was not accompanied by a significant increase in operating costs.  APRA believes that this is evidence that compliance costs are not significant and any increase in compliance costs as a result of this package of further reforms, which are less comprehensive than those implemented in 2002, will therefore not be significant.

 The standard that is the subject of this RIS, is part of a package of standards known as the General Insurance Stage 2 reform – risk and financial management package.  Other components of that package are reforms to the prudential requirements for reinsurance management and audit and actuarial valuation and reporting.  The reforms implemented as at 1 July 2002 were far more extensive than proposed under the Stage 2 reforms. 

Problem identification

The results of the implementation of GPS 220 Risk Management for General Insurers (the current standard) since July 2002 have been mixed.  While the current standard and the guidance notes, which formed part, were quite prescriptive APRA observed a wide variation in their application through its supervisory activities.  As a result, the quality of risk management of some insurers was insufficient to meet APRA’s expectations for a prudently managed institution.  Although the current standard is prescriptive, it lacks sufficient clarity about APRA’s expectations on risk management. Industry expressed concerns, in particular during on-site supervision activities, that it is difficult for insurers to implement suitable approaches to compliance.

APRA’s supervision of general insurers since 2002 has revealed the issues below with the risk management requirements currently in place:

• There is a focus on the Risk Management Statement (RMS) being a document for regulatory compliance rather than a document that is useful to the Board and management of the company.  The focus on regulatory compliance means that the risk management framework is not necessarily adequate for the effective management of risk within the insurer leading to decisions by the Board and management that are not in the best interests of the insurer or the protection of its policyholders. 
• When an insurer is authorised under the Act, APRA requires evidence of a business plan to be submitted to show that the insurer’s business model is viable and that the projected level of capital will be adequate to support the risks it intends to assume.  Whilst it was APRA’s expectation that insurers would maintain such business plans after authorisation, a few insurers have been reluctant to utilise this basic business practice.  A business plan enables management of an insurer (and APRA) to identify issues, including capital management issues, before they occur. If such ongoing planning is missing this may represent a significant risk to the company’s ongoing viability; and
• Some insurers’ Boards and management do not take sufficient responsibility for risk management, data quality and the integrity of financial reporting.

In Recommendation 15, Justice Owen, the HIH Royal Commissioner stated:

I recommend that both the Australian Prudential Regulation Authority and the Institute of Actuaries of Australia introduce compulsory certification of the completeness and accuracy of data.

APRA acknowledges that the current prudential framework lacks sufficient clarity to provide adequate guidance and minimum requirements to industry with respect to data integrity, business planning and risk management.

Inconsistent treatment of prudential requirements between insurers is an issue. For example, the quality of risk management documentation and monitoring processes differs greatly between insurers.  The level of prescription in the current standards and guidance notes is such that the requirements cannot be easily tailored to meet the particular circumstances of individual insurers.  According to the ICA, ‘APRA’s role should be to ensure that each insurer has an appropriate strategy; the details of that strategy could be discussed with each insurer.’  APRA agrees.  Prescribing a set of standards that are ‘one size fits all’ does not achieve the outcome that both the industry and APRA desires.  The tendency with a prescriptive approach is that both insurers and APRA focus too much on compliance with individual elements reducing focus on the effectiveness of the risk management framework in place.

The prescriptive approach to general insurance regulation was deemed appropriate in 2002, in light of the failure of HIH and the general consensus that the industry needed to improve its approach to risk management.  Through implementing the prescriptive requirements via the current standard, industry practice has matured and it is now more appropriate to use principles-based supervisory methods. The inflexibility of the prudential framework has caused APRA’s supervision to not recognise recent developments in the insurance industry. 

Objectives

The objectives of amending the risk management framework for general insurers are to:

• Foster a stronger and more flexible risk management regime that allows tailoring of requirements according to the size, business mix and complexity of individual insurers, and which is capable of adapting to market developments and improvements in supervisory techniques over time.
• Clarify existing prudential requirements relating to risk management, and provide additional guidance for all general insurers.
• Ultimately, increase the protection provided to policyholders.

On 12 September 2003, the Treasurer announced the government’s response to the HIH Royal Commission in which it referred implementation of recommendation 15 (among others) to APRA. 

Identification of options

Option 1: Determine a prudential standard to impose new risk management requirements on general insurers

Under this option, APRA would revoke the current standard (and associated guidance notes), and determine a new prudential standard under the Act to govern risk management.  This prudential standard would incorporate technical appendices to retain the mandatory detail in the guidance notes.  Rather than maintain legally binding guidance notes APRA would release a set of Prudential Practice Guides (PPGs).  The PPGs would provide guidance to insurers in the implementation of good risk management practices and help with their compliance with the new prudential standard.  These PPGs would not be legally enforceable, but would be an indication of good practice which could be used as a benchmark by APRA supervisors when assessing the risk management of an insurer.  If an insurer chooses an alternative solution more suited to its business model, it would have to demonstrate how the alternative met the required standard.  A failure by an insurer to implement such practice would be considered in APRA’s holistic assessment of the insurer, via its Probability and Impact Rating System (PAIRS) framework. The determination of APRA’s supervisory stance and allocation of resources is based on the Probability Rating and Impact Rating for each rated institution.

APRA has four supervisory stances: ‘Normal’, ‘Oversight’, ‘Mandated Improvement’ and ‘Restructure’.

• A 'Normal' mode means APRA each quarter collects and analyses data and makes routine regular on-site visits.
• 'Oversight' means a significant step-up in information collection and inspection intensity. APRA may increase minimum capital requirements for ‘Oversight’ institutions, if the additional risk profile warrants such a change.
• 'Mandated Improvement' means the institution is operating in an unsustainable way in the medium term. APRA will direct these institutions to present and execute a remediation plan that addresses the area of identified weakness and restores financial stability. At this level, APRA allows the regulated institution to retain control of its destiny, but clearly signals that improvements must be made. APRA may issue directions and take other enforcement actions at this level.
• 'Restructure' institutions are in serious danger of failure to deliver their financial promises to beneficiaries. To these institutions, APRA applies its full enforcement powers, including issuing directions to replace persons and service providers and/or to restrict business activities. APRA's paramount concern in this situation is to quarantine the entity from further deterioration and minimise losses to depositors, policyholders and superannuation fund members.

APRA’s supervisory stances relate to an institution’s PAIRS Probability and Impact ratings as follows:

Failure to adequately manage risk will lead to an increase in the probability of failure rating.  Depending on how close an insurer is to the threshold for increased supervision will determine the effect on the insurer.  The impact of the quality of the risk management framework on the overall probability of failure rating will depend on the insurer’s inherent risks, its management capabilities and its capital resources available to absorb losses. 

The new prudential standard reflects some existing requirements, but also implements a range of additional obligations for insurers using a more principles-based approach to supervision,  but does not attempt to prescribe in all cases how an insurer must operate to comply with the standard.  Specifically, the regime under this prudential standard would do the following:

• clarify APRA’s expectations for the risk management framework comprising a high level RMS, policies and procedures and identified responsible roles;
• require a Business Plan that incorporates the insurer’s approach to capital management; and
• require Board and management attestations relating specifically to risk management and the quality and integrity of financial information.

This new standard would reinforce that the prime responsibility for the sound and prudent management of an insurer rests with the Board and senior management of that insurer and would provide a logical structure that requires key management roles identified by the insurer to take ultimate responsibility for risk management within the insurer.

Option 2: Amend existing prudential standard and guidance notes

Under this option, APRA would amend only the content of the existing prudential framework.  That is, the current standard and its associated enforceable guidance notes would be updated to clarify the new risk management framework and relevant responsibilities, impose requirements for both an ongoing business plan and Board attestations.  Insurers would have to comply with these new requirements, as the character of the enforceable framework surrounding these requirements would not change.  Basically, the existing prudential framework would be modified to include the requirement for a risk management framework, business plan and financial information declaration.

Option 3: Retain existing risk management requirements without amendment

Under this option, the current standard would remain unchanged.  Insurers would continue to manage their risks as they have done since 2002 without having to meet any new or clarified requirements.

Impact analysis

Impact group identification

It is expected that APRA, insurers and policyholders would be affected by the implementation of the options relating to risk management outlined above.

Assessment of costs and benefits

APRA does not have data to perform a detailed quantitative cost-benefit analysis.  The following analysis is based on anecdotal evidence provided from within APRA which is influenced by information supplied by the industry.  Some general views on costs and benefits have been recorded but this does not indicate an ability to accurately determine a quantitative estimate.  Any attempt to provide a quantitative estimate would be misleading.

The impact groups are not mutually exclusive because there are mechanisms to pass costs from one impact group to another.  Costs imposed on APRA are passed to insurers via the levies imposed on insurers that fund APRA.  If costs are to be incurred by either insurers or APRA then an issue to consider is which would be the most effective and efficient at carrying out that task.

Insurers operate in a relatively competitive market.  There is potential, where costs are imposed on all insurers equally, for costs to be passed on to policyholders via increased premiums.  If  some costs are incurred disproportionately by some insurers more than others the likely effect is that those costs will be retained by insurers as the competitive environment they operate in would not allow these costs to be passed on.

As shown in the background section analysis, compliance costs for insurers is not significant when compared to the overall operating costs of an insurer.  This is based on the experience of implementing very significant reforms in 2002 when no significant trend in increased costs emerged.

Option 1: Determine a prudential standard to impose new risk management requirements on general insurers

Benefits

APRA

Under this option, insurers would be subject to more stringent risk management requirements than currently exist.  The most important benefit flowing from this is that APRA’s supervision methodology would better target supervision of individual insurers, whilst retaining sufficient rigor.  The new standard would impose the set of standardised requirements with which all insurers must comply.  Rather than having to apply only a prescriptive set of prudential requirements that may not be relevant to the operations of an insurer, however, APRA would also be able to rely on guidance material which can be interpreted in the context of the insurer’s business.  This approach would also provide a structure that allows for a better focus on the real risks facing an insurer, rather than simply taking a ‘one-size-fits-all’ approach to compliance and supervision.  The introduction of the new standard and separate PPGs would clarify those elements of APRA’s supervision framework that are enforceable and those that are purely guidance.  The tailoring of the prudential framework would also create closer ties between APRA’s supervision activities and the current PAIRS assessment framework for risk-based supervision of regulated entities.

The rigor of the prudential framework would not be diminished as all insurers would have to comply with standard requirements across the industry.  Further, insurers would also be expected to explain how their practices meet the requirements.  

On a more practical level, the replacement of guidance notes with PPGs would provide sufficient flexibility for APRA to update this guidance material as required.  This would allow the PPGs to appropriately respond to industry developments without having to redetermine new legislative instruments.

The new Board attestations would meet APRA’s obligations in fulfilling Recommendation 15 of the HIH Royal Commission, and assist Government policy in this area.

APRA would derive benefits from specific proposals in the following ways:

• Those insurers who do not provide business plans (as they are not currently compelled) are typically considered by APRA to pose a higher net risk to their policyholders.  These entities are therefore subject to more intense supervision processes.  If APRA had information on the projected business positions of these insurers some risks may be mitigated.  Where the risks are not mitigated, the better information will enable more effective targeting of supervision resources.
• The financial information declaration will result in APRA having greater confidence in the data submitted by insurers.  APRA’s analysis of risks across the industry will have a sounder basis leading to more effective targeting of supervision resources.

Insurers

Under the new standard and PPGs, insurers should incur a lesser compliance burden as the requirements would better reflect the structures and operations of individual insurers.  Further, the majority of insurers are now in a position to comply with the new requirements as they have been subject to close prudential supervision for the past three years, where APRA has encouraged insurers to improve their practices even though the framework lacks some of these elements. 

Insurers would benefit from the provision of clearer and more appropriate requirements in the new standard, and would be able to use the PPGs as the basis for their risk management frameworks, if appropriate, without having to comply with unnecessary elements.  This option would remove some of the existing prescription and inflexibility in the application of the risk management requirements through the creation of the principles based set of minimum criteria.  This flexibility would ensure that any increase in compliance costs are kept to a minimum by reducing legal/compliance risk for insurers. 

This option would give insurers a new ability to operate within a stronger risk management framework (that better aligns with existing benchmarks for risk management in other Australian industries) without an unnecessary level of prescription.  Insurers would be subject to clarified risk management practices with better information about the context for regulation: insurers should undertake continual processes for monitoring risk rather than focusing only on the outputs of risk management (for example, the RMS and Board Declarations).

For a minority of insurers, who have not implemented a risk management framework, there will be significant benefits from the better decision making that will flow from this proposal.

Most insurers will have processes in place to enable senior management to make the financial information declaration required. Processes in place for the declaration will improve the reliability of all other forms of financial information as well.  Those insurers without such processes in place currently will benefit from more reliable information available for management decision making and less legal risk from making false disclosures.

Policyholders

Policyholders with those insurers with poor current risk management frameworks would benefit from better arrangements for managing the risks inherent in the insurers’ businesses.  A sound framework for the risk management of an insurer would minimise the risk of unforeseen events materially affecting the operations of the insurer, even causing it to fail.  Further, it should encourage the development of better systems for identifying, managing and monitoring the risks that may improve the ability of the insurer to meet its obligations to policyholders, including systems surrounding underwriting and claims processing.  This should ensure that policyholder interactions with the insurer are more consistent and equitable.

The benefits experienced by insurers from the streamlining of compliance requirements may be passed on to policyholders.

Costs

APRA

Implementing the proposed changes would only impose minimal additional costs on APRA.  APRA would use existing resources to train supervisory staff to implement the altered framework.  Frontline supervisors may be required to expend some additional effort during the transition period to supervise the transition by companies to the new standards.    As industry would be unfamiliar with the structure, supervisors may also have to respond in the short term to a higher number of queries from regulated entities than is currently the case.  However, existing resources would be used to carry out these tasks and no additional resources would be employed.   This one-off cost will divert existing supervisory resources, however there will be an offsetting reduced focus on supervising current requirements.

Any additional supervisory effort required for monitoring compliance with the new requirements will be built into the existing supervisory methodology and review processes.  The financial information declaration will typically not require significant administration other than recording its receipt.  Significant resources may be required where there is qualification of the declaration which indicates a risk of poor information being provided to APRA.  This will divert existing supervisory resources but is linked to the benefit of better targeting of supervisory resources.  As indicated in the benefits section, many insurers already provide business plans to APRA regularly so the additional effort will be minimal.

Insurers

As with any new regulatory approach, it is anticipated that insurers would face increased compliance costs under this option associated with amending their internal systems to meet the new risk management requirements.  APRA does not, however, expect that any increase in compliance costs would be onerous longer term.  There will be a trade-off between the costs of complying with new more flexible requirements compared to cost savings from a lesser compliance burden with prescriptive requirements.  This trade-off will differ among insurers.     

Changes to the RMS to be a description of a risk management framework covering specific minimum requirements largely reflect existing arrangements in place by those insurers that are appropriately addressing their risk management.  APRA anticipates that only a significant minority of insurers are not fully meeting APRA’s requirements about risk management at present. This significant minority is concentrated among the smaller specialist insurers who often have not yet appropriately developed their risk management frameworks.  The majority of the major insurers largely meet the new requirements.  So, only those insurers with inadequate frameworks commensurate with the risks faced by their business would incur initial costs to set up additional systems.

Under the new standard, insurers would be required to designate specific risk management functions, with responsibility for managing the framework and reporting to the Board.  The majority of insurers already have a distinct risk function.  Only those insurers that are lacking such a function would incur a cost to comply with the new requirements.  Training costs for new employees would be incurred as a one-off cost, but the salary and related on-costs associated with these new staff members would be ongoing.   

The imposition of the new Board attestation would result in a one-off set-up cost to create a document or other reporting mechanism to the Board.  APRA would expect the majority of insurers to already have in place adequate processes for managing this information and filtering it to the Board.  A minority of insurers would experience some costs associated with fulfiling these requirements.  If an insurer has limited risk management controls and processes in place, APRA would anticipate that significant costs would be incurred associated with hiring and training staff, creating internal systems to feed information through the correct channels and educating the Board about the details of the insurer’s risk management framework.  These would also be largely initial set-up costs, with only some costs incurred on an ongoing basis.

Insurers that are managing their business appropriately would already have in place processes for completing a three-year business plan incorporating the insurer’s approach to capital management.  Whilst the existing prudential framework contains no explicit continuing requirements for insurers to maintain a business plan, insurers were required to demonstrate that they held adequate capital upon re-authorisation in 2002 and submit a 3 year business plan.  A number of insurers have continued to record this information internally, so, the expected costs associated with this requirement should be minimal for those insurers.  A number of smaller insurers are not currently preparing internal business plans, so they would incur significant costs, associated with employing additional resources and training, the creation of new systems to feed information from various sections of the insurer into the business plan and processes for regularly monitoring the quality of the completed plan.

Policyholders

Policyholders will only suffer direct costs if insurers increase premiums to offset the expense of complying with the new formalised requirements.  Note that this would mean that the costs borne by insurers would reduce or be offset if this occurred so the costs to insurers and policyholders are alternatives and are not to be added together.  APRA expects, however, that insurers will not increase their premiums and will instead fund any increased compliance from their profits, due to market forces.   However, if insurers did choose to pass on the costs, compliance costs are a small part of an insurer’s overall costs and the impact on premiums would be negligible.  Given market forces, APRA expects that premiums would not increase in a material way, if at all.

Option 2: Amend existing prudential standard and guidance notes

Benefits

APRA

This option would allow the prudential framework for risk management to be updated to clarify APRA’s expectations for a strong risk management framework and fulfil APRA’s obligations under Recommendation 15 of the HIH Royal Commission.  APRA would also benefit from merely having to amend the existing framework, rather than create a new structure.  The familiarity of the standard and guidance notes under this option would also mean that training costs for supervision staff, and the time spent educating the industry about the new requirements would be kept to a minimum.

The benefits identified for option 1 with respect to the specific proposals would apply under this option as well.

Insurers

The only benefit to insurers under this option would be that they would operate under a more robust risk management framework with the features outlined above.

Policyholders

Policyholders would have the benefit of better prudential protection under this option than currently in place (similar to Option 1 outlined above).  This should minimise the chance of losses arising through unforseen events.

Costs

APRA

APRA would incur similar direct costs as those outlined for Option 1 above as this option would involve amendments to the prudential framework of a similar scale.  The staff training costs associated with this option would not be as great as the framework would retain the same essential character. 

APRA would, however, incur significant indirect costs under this option.  Essentially, APRA’s costs under this option are the benefits derived from the new framework for prudential standards and guidance noted under Option 1.  Most importantly, the inefficiencies in the existing framework that have been identified would remain in place.  This means that APRA would continue to face the problems associated with imposing a fixed structure framework onto insurers with often vastly different operations.   The framework would remain unresponsive to developments in the industry and APRA’s framework would continue to reflect an overly prescriptive approach to regulation.

Insurers

This option would result in the greatest increase in compliance costs for insurers as they would have to comply with additional risk management requirements in a system that has been identified as being prescriptive, inefficient and inflexible.  The costs of complying with this new framework would be associated with the development of new systems and training of staff and the provision of additional material to APRA.  These increased costs would, arguably, not be commensurate with the level of regulation that APRA feels is necessary to protect the interests of policyholders.  Essentially, the difference between this option and option 1 is that any offsetting benefits in terms of cost reductions through streamlining of compliance would not be realised.

Policyholders

The increased compliance costs faced by insurers under this option could flow through to increased premiums, which would impose a cost that is disproportionate to the level of increased protection that policyholders would receive through the more rigorous framework.  Increased compliance costs among insurers is likely to be more prevalent under this option and therefore it is more likely that market forces would allow some of that cost to be passed on to policyholders through higher premiums.

Option 3: Retain existing risk management requirements without amendment

Benefits

APRA

APRA would not incur the staff training costs or any potential costs from administering the requirement for business plans and the financial information declaration.

Insurers

As the existing risk management requirements would remain unchanged under this option, insurers would not have to expend extra resources complying with new requirements.

Policyholders

There is no real benefit to policyholders under this option beyond the benefits offered by the current environment.

Costs

APRA

Whilst APRA would incur no direct policy development and implementations costs associated with this option, as the prudential framework would remain unchanged, it would actually experience significant ongoing indirect costs.  Firstly, APRA would not be able to improve the targeting of its supervision resources as the information supplied to it would remain the same.  Further, Recommendation 15 of the HIH Royal Commission would not be implemented, contrary to the Government’s decision to implement this recommendation.  APRA would continue to apply an inflexible and partially inadequate supervisory framework.

The benefits to APRA of the specific measures noted would not be realised if this option was implemented.

Insurers

Insurers would be disadvantaged under this option as the existing inflexible and prescriptive risk management framework would continue to operate.  This is in spite of the fact that APRA’s consultation about the proposals has revealed that the current framework does not appropriately reflect the developing and varied nature of insurance company operations.  Existing inefficiencies arising from APRA’s framework would remain in place meaning that insurers would continue to expend resources on compliance measures that have insufficient direct benefit in terms of their safety and soundness.

Policyholders

Whilst policyholders would not face additional financial costs if the framework remained in its current form, they would not benefit from improved security in the supervisory arrangements that would result from improved risk management requirements.  Necessary levels of protection would not be provided to policyholders as the identified inadequacies in the current framework would continue.

Consultation

APRA has undertaken a comprehensive and rigorous program of consultation with industry since the release of the initial discussion paper outlining the proposed changes to risk management (amongst others) in November 2003.  These proposals were essentially option 2 above.  A large number of submissions were received in response to this discussion paper, many of which expressed concerns about the prescriptive nature of the proposals concerning risk management.

To provide a forum for further discussion about the proposals, APRA and the ICA held a Joint Forum in June 2004, where APRA presented its proposals and comments on the submissions received to date.  This also provided an opportunity for members of the industry to voice their concerns and to foster a useful debate about the proposals.  Subsequent to this Joint Forum, APRA also met with insurers on an individual basis to further discuss the specific impact of the proposals on their operations.  Again all the discussion was essentially about option 2.

APRA then released a further discussion paper and draft prudential standards and guidance notes for industry comment in May 2005, incorporating changes based on the submissions received from, and discussions held with, industry.  The discussion paper represented option 2.  APRA and the ICA held another Joint Forum in June 2005 where further discussions around the detail of the proposals took place.  At both this forum and in the submissions received (during the six-month consultation period), similar concerns about the proposed level of prescription and the lack of relevance of some of the proposals to differing types of insurers were again raised.

As a result of the cumulative effect of these submissions, APRA decided to propose significant changes to its overall prudential framework for general insurers (refer Option 1 above) to allow for greater flexibility with a more tailored and certain supervision framework.  These proposals, including the introduction of PPGs, were presented to the ICA and contributors of significant submissions in October 2005.

Once the proposed standards and PPGs were in a near final form, APRA held private consultation with an ICA Working Party to ensure that APRA’s approach adequately reflected their input.

Throughout the consultation process, APRA also held Auditor Liaison meetings, where the proposals relating to the responsibilities of auditors were discussed with representatives from the profession. 

The response from all participants in the final consultation processes was very positive.  The industry was pleased with option 1 in general terms because of its greater flexibility in structure and the significantly reduced prescription.  The remaining resistance to particular proposals by individual insurers concerned the impact of the particular proposals on those insurers which could not be appropriately addressed while meeting the objectives of the proposals.

Conclusion and recommended option

Option 1 is the preferred option

Option 1 fulfils APRA’s stated objective of a balanced prudential framework which accommodates both increased protection to policyholders and fosters a flexible regime for insurers. 

This option increases protection to policyholders by emphasising that rigorous risk management should be an ongoing and central part of business for general insurers, and that the Board and senior management must be fully cognisant of the risks facing the insurer at all times.  This awareness would be exhibited via the new attestations and the requirement to develop and implement a risk management framework.  These requirements would combine to provide better protection for policyholders without a significant increase in cost for the industry.

It remedies the significant concerns expressed by the insurance industry about the overly prescriptive nature of the original proposals which are represented by option 2 and the high associated compliance costs.  APRA would be able to tailor its supervisory practices to the particular nature of an insurer’s business, and insurers would be able to refer to significant guidance in developing and maintaining their risk management framework, without having to prove compliance with elements that are irrelevant to their business. 

The regime characterised by the new standard and PPGs provides APRA with an opportunity to clarify those elements of the risk management framework that represent a minimum requirement, and moves guidance material to the non-enforceable elements of the framework.  Finally, it allows APRA to implement, in principle, Recommendation 15 of the HIH Royal Commission.

Option 2 does not entirely meet the objective stated above.  Whilst the additional risk management elements are added to the existing framework, under this option, the framework would retain the current inflexibility which prevents appropriate tailored supervision of insurers.  Policyholders would be adequately protected under the risk management framework, but would run the risk of having to pay higher premiums flowing from increased compliance costs for insurers.

Option 3 falls short of meeting APRA’s stated objectives.  It neither fulfils APRA’s obligation to implement recommendations of the HIH Royal Commission nor provides sufficient levels of protection for policyholders.  It retains inefficiencies in the framework that have been acknowledged as limiting the appropriate supervision of insurers, and which impose an unacceptable compliance burden on the industry.

The table on the following pages shows the analysis of all the benefits and costs from option 1 to each impact group.  It also shows where significant costs can be passed from one impact group to another.

Implementation and review

APRA intends that the new GPS 220 (and relevant PPGs) will be released in February 2006, with an effective date of 1 October 2006.  In the intervening months, insurers will have the time to put in place internal changes to comply if they are not already operating at a level that would meet the requirements of the new standard.

APRA will assess the adequacy of the prudential supervisory requirements proposed under the GPS 220 on an ongoing basis, to ensure that they effectively address the rapidly developing risk profiles of insurers.  APRA expects that the current arrangements will undergo a formal review after three years of operation, with the next review due to commence in late 2009.