Life Insurance (prudential standards) determination No. 4 of 2007 - Prudential Standard LPS 232 Business Continuity Management

Life insurance (prudential standard) determination No. x4 of 2007: Prudential Standard LPS 232 Business Continuity Management

EXPLANATORY STATEMENT

Prepared by the Australian Prudential Regulation Authority

Life Insurance Act 1995, paragraph 230A(1)(a)

Under paragraph 230A(1)(a) of the Life Insurance Act 1995 (the Act), APRA has the power to determine (in writing) standards in relation to prudential matters to be complied with by all life companies, including friendly societies.

Life insurance (prudential standard) determination No. x4 of 2007: Prudential Standard LPS 232 Business Continuity Management makes Prudential Standard LPS 232 Business Continuity Management (LPS 232), which will come into effect on 1 January 2008.

1.      Background

LPS 232 is intended to ensure that life companies prudently manage the risks to their business continuity.  Effective business continuity management helps ensure that a life company can continue to meet financial and service obligations to policy owners in the event of a business disruption.  A life company can incur substantial losses (both in financial and reputational terms), and may even fail, as a result of not being able to recover from business disruptions and restore critical business operations in a timely manner.  LPS 232 sets out APRA’s minimum expectations of life companies in relation to business continuity management.

Together with pPrudential sStandards APS 232 Business Continuity Management (for authorised deposit-taking institutions) and GPS 222 Business Continuity Management (for general insurers), LPS 232 forms part of an approach to business continuity management which is substantially consistent across APRA-regulated institutions (with the exception of superannuation).

2.      Operation of LPS 232

LPS 232 recognises that the ultimate responsibility for the business continuity of a life company lies with its Board of directors.

The key elements of the prudential standard are:

• Business Continuity Management (BCM) — defines business continuity management and sets out certain minimum components thereof:
  • a BCM Policy;
  • a Business Impact Analysis including a risk assessment;
  • recovery objectives and strategies;
  • a Business Continuity Plan  including crisis management and recovery;
  • programs for review and testing of the Business Continuity Plan and training and awareness of staff in relation to BCM.
• Business Continuity Management Policy — a life company must have a policy, approved by the Board, setting out its approach to business continuity management;
• critical business operations — defined as the business functions, resources and infrastructure that have the potential, if disrupted, to impact materially on the business functions, beneficiaries, reputation or profitability of the life company;
• Business Impact Analysis — a life company must conduct a business impact analysis to identify and measure the business impact or loss from a disruption of critical business operations;
• recovery objectives and strategies — a life company must identify and document appropriate recovery objectives, including recovery levels and recovery times, as well as implementation strategies, for each critical business operation;
• Business Continuity Plan — a life company must have a Business Continuity Plan which documents procedures and information to enable the life company to manage a business disruption and recover critical business operations;
• review and testing of the Business Continuity Plan — a life company must review and test its Business Continuity Plan; and
• notification requirements — A life company must notify APRA as soon as possible after a major disruption that has the potential to materially affect the life company’s ability to meet obligations to its beneficiaries or its financial soundness.

3.      Consultation

APRA has undertaken public consultation on the proposed LPS 232, including the release of a discussion paper and discussions with industry representative.  Thirteen submissions were received from industry associations, life companies, professional services firms and other interested parties.  APRA has redrafted LPS 232 to take account of industry concerns as appropriate. 

4.      RIS

A Regulation Impact Statement is required for LPS 232.  It has been prepared and is attached to this Explanatory Statement.

Decision-making Regulation Impact Statement

(Office of Best Practice Regulation reference number 8485)

Executive summary

The Australian Prudential Regulation Authority (APRA) is seeking to move towards consistency of the principles underpinning its prudential framework. In 2006, APRA conducted a review of aspects of the prudential framework applicable to life companies (including friendly societies). The review identified scope for improvement in a number of areas, particularly regarding risk management and business continuity management practices.[1] 

Four options relating to the potential for improvements to risk management and business continuity management in the life insurance industry are discussed in this Regulation Impact Statement (RIS): 

1. Maintain the status quo - under this option no regulatory change would take place. The life insurance industry would continue to be regulated under the existing framework.
2. Develop an industry code of conduct dealing with risk management, reinsurance management, business continuity management and audit and actuarial requirements.
3. Develop a limited set of prudential standards on risk management, backed by a series of non-mandatory and non-legally binding guidance documents called prudential practice guides (PPGs) for life companies and friendly societies.
4. Develop a set of new prudential standards for life insurers separately covering areas such as risk management, reinsurance management, business continuity management, and audit and actuarial requirements for life insurers – these would make greater use of prescriptive requirements, and compliance would be mandatory.

Following a three month period of consultation to 31 December 2006 with life industry participants, APRA recommends progression of Option 3 as it best achieves the desired objectives of improving the regulatory framework. This option is both principles-based and flexible, and provides the optimum cost-benefit relationship. 

APRA proposes to release a new set of prudential standards and PPGs on 31 March 2007, to be effective from 1 January 2008. Transitional relief will be made available to allow all life companies to meet the new requirements.

Background

There are currently 35 life companies and 26 friendly societies authorised under the Life Insurance Act 1995 (the Life Act), with total assets as at 30 September 2006 of approximately $229.7 billion and $6.7 billion respectively. The prudential regulation framework aims to ensure that, in all reasonable circumstances, these life companies manage their risks appropriately to meet the financial promises they have made to their beneficiaries.

APRA has already introduced comprehensive risk management requirements in the general insurance and superannuation industries. There are no explicit risk management standards for life companies (other than those for friendly societies), whereas authorised deposit-taking institutions (ADIs), superannuation entities and general insurers are subject to risk management requirements.

The proposal to introduce risk management standards follows the successful introduction of similar reforms in the general insurance and superannuation industries. A consistent set of standards will better enable life companies to meet their minimum risk management requirements (including operational risk management and business continuity management)[2], and will benefit industry and APRA through simplification of the regulatory framework.

Should companies not meet their minimum risk management requirements, this will increase the risk of financial loss or failure, loss of policy holder entitlements, industry instability and reduced consumer confidence. Effective business continuity management will further help to ensure that a life company can continue to meet its financial and service obligations to policy owners in the event of a business disruption. A life company can incur substantial losses (both in financial and reputational terms), and may even fail, as a result of not being able to recover from business disruptions and restore critical business operations in a timely manner.

The proposed standards are drafted in a principles-based and flexible manner to recognise diversity across the regulated companies and minimise the cost of complying.

APRA has consulted with all licensed life insurers, friendly societies, and representative organisations on a draft set of prudential standards and prudential practice guides. Thirteen responses were received from life insurers and industry bodies representing the majority of industry participants (discussed below). As part of the consultation process, APRA requested estimates of the cost of complying with changes to the new standards. Life companies provided a limited response to the question of cost, which APRA has nonetheless used as the basis for qualitative assessment of the costs and benefits of the proposal.

Problem identification

The case for prudential regulation is founded on the prevention of market failure – should there be significant financial losses or failure, this would cause substantial losses to policy holders and lead to further market instabilities. Moreover, the financial system is inevitably subject to a variety of inherent risks – the ultimate source of risk is commercial, which faces all economic activity and cannot be eliminated.

APRA has the mandate to establish and enforce prudential standards and practices. These are designed to ensure, under all reasonable circumstances, that institutions are able to meet their financial promises within a stable, efficient and competitive financial system. The degree of APRA’s supervision and regulation is proportional to the intensity of the potential for market failure, which needs to be adjusted to account for changes to the risk environment and needs of industry. APRA’s role is also designed to meet basic community expectations regarding the safety of regulated institutions.

In the absence of a prudential regulatory framework, life companies may not necessarily maintain minimum standards of practice in the area of risk management and may carry greater risk of financial loss or failure. In the extreme, companies might collapse due to imprudent practices, which would lead to the loss of policy holder benefits.

While there are not currently widespread risk management concerns affecting the APRA-regulated life companies, APRA has identified a number of weaknesses in the regulatory framework.

Difficulties in effectively supervising life companies through a lack of minimum standards for risk management

Under the current framework, APRA experiences difficulty in taking action to ensure that life companies meet minimum standards of practice in the area of risk management. This is largely due to the fact the current framework does not include prudential standards dealing with risk management for all life companies, whereas friendly societies are subject to a range of standards on various aspects of risk management.[3] 

The HIH case prompted a widespread strengthening of risk management practices in the general insurance industry. Through that process, APRA formed views about good risk management practices which are of wider application than the general insurance industry. The life insurance industry is not currently subject to a number of the minimum requirements, which are viewed essential by APRA.

Also, given that business operations have become increasingly complex and vulnerable to disruption from external events, there is an increased risk that life companies may incur substantial losses (and even fail) without proper planning for business continuity. APRA has observed that some life companies have not always given business continuity management adequate attention.

Complexity, unnecessary cost and competitive impacts through inconsistency with other regulated industries 

The life insurance industry is closely related to other regulated industries, including superannuation and general insurance. In 2005, superannuation assets in life office statutory funds represented 88.6 percent of total assets. In addition, a number of life companies operate as part of conglomerate groups, which also include Authorised Deposit-Taking Institutions (ADIs). However, the current framework for life companies is inconsistent with the framework applicable to superannuation entities, the recently reviewed general insurance regulatory framework, and the framework applicable to ADIs. This causes problems, such as:

• higher than necessary costs and levels of complexity for entities which operate across multiple industry sectors (i.e. as part of conglomerate groups);
• unequal competition (advantages and disadvantages) across different industry sectors if the level of regulation differs; and
• restricted ability for entities to consolidate their operations and take advantage of economies of scale.

Problems related to the use of implicit requirements

APRA supervises life insurance companies according to a variety of supervisory expectations that are not always explicitly prescribed under the life industry prudential framework. The lack of clear and established requirements can lead to a number of problems, including increased risk of inconsistency in supervisory response, confusion or misunderstanding of applicable requirements on the part of industry, reduced transparency and accountability on the part of APRA, and reduced enforceability of requirements.

For example, although APRA does not impose a requirement for life companies to have a comprehensive framework to identify and manage risks, it nonetheless expects life companies to have such a framework. APRA’s risk rating of individual life companies, and the subsequent degree of supervisory attention, is impacted by the quality of this framework.

Cost and complexity of scattered requirements

The existing life insurance framework comprises a wide range of rules and regulations, which increase the potential for confusion and increased cost. These include the Life Act, the Life Regulations, prudential rules, prudential standards, prudential practice guides, actuarial standards, letters and circulars. Many of the relevant instruments are legacy rules and regulations from APRA’s predecessor organisations, including the Australian Financial Institutions Commission (AFIC) and the Insurance and Superannuation Commission (ISC).

APRA is moving away from the use of prudential rules towards a broader set of prudential standards, and will issue future guidance primarily in the form of prudential practice guides (as opposed to circulars or letters).

Costs due to different treatment of friendly societies and other life companies

Friendly societies have historically been regulated differently from other life companies – this has involved a number of distinct prudential standards. For instance, seven prudential standards relating to the friendly societies’ risk management requirements are preserved under the Financial Sector Reform (Amendments and Transitional Provisions) Regulation 1999. These are more prescriptive than APRA’s desired principles-based approach to regulation and can result in unnecessarily high costs and a lack of flexibility for friendly societies to pursue their business objectives.

Objectives of APRA’s initiative

APRAs overarching objective in the supervision of life companies are specified in section 3 of the Life Act:

“The principal object of this Act is to protect the interests of the owners and prospective owners of life insurance policies in a manner consistent with the continued development of a viable, competitive and innovative life insurance industry.”

More specifically, any proposed change to the life insurance prudential framework should protect policy owner interests by:

• facilitating the effective supervision of life companies by enabling APRA to ensure that minimum standards for risk management are met, with the aim of reducing the risk of failure of a life company; and
• making explicit APRA’s requirements and expectations of life companies.

Further, changes to the life insurance prudential framework should promote a viable, competitive and innovative life insurance industry by:

• resolving inconsistencies with other regulated industries;
• consolidating and streamlining the range of instruments in the life insurance regulatory framework; and
• removing inconsistencies between the treatment of friendly societies and other life companies unless different approaches are justified by genuine differences between the industries.

Options that may achieve the objectives

Option 1 – maintain status quo

Under this option no regulatory change would take place. The life insurance industry would continue to be regulated under the existing framework.

Option 2 – develop an industry code of conduct

APRA would work with industry to produce a code of conduct (or a number of codes of conduct) dealing with risk management, reinsurance management, business continuity management and audit and actuarial requirements. The code(s) would be a non-enforceable, non-regulatory measure aimed primarily at educating industry – APRA would rely on a combination of voluntary compliance and the ability of the industry to self-regulate.

A key deficiency of an industry code of conduct is that it would not allow the use of enforcement action against life companies who do not comply with the code. An industry code of conduct would be most effective where the industry has the capacity to monitor and self-enforce compliance with the code. However, the extent to which the life insurance industry is in a position to meet these requirements is unclear (and no industry bodies have the ability to discipline industry participants if they violate the code of conduct). A code of conduct might also undermine the capacity for APRA to achieve its regulatory objectives.

APRA considers that this option does not warrant further consideration (and it is not discussed in the following section on impact analysis).

Option 3 – develop a limited set of prudential standards and make use of non-mandatory guidance wherever possible

APRA would develop a limited set of prudential standards on risk management, backed by a series of non-mandatory and non-legally binding guidance documents called prudential practice guides (PPGs). The framework would be implemented with a view to using the least mandatory means of achieving APRA’s prudential aims. The key requirements of the prudential standard would be that a life company would be required to:

• maintain a risk management framework consisting of a documented Risk Management Strategy, risk management policies and procedures, managerial responsibilities and controls and a documented Business Plan; and
• submit a Risk Management Declaration to APRA on an annual basis.

A prudential standard on business continuity management would also be developed, supported by a PPG. The key requirements of the prudential standard on business continuity management would be that life companies must:

• identify, assess and manage potential business continuity risks;
• approve a written Business Continuity Management Policy; and
• develop a written Business Continuity Plan that documents procedures and information that allow the life company to manage business disruptions, and allocates sufficient resources to implement and review the plan.

With respect to audit and actuarial requirements APRA, would rely on the existing requirements in the Life Act. Reinsurance management would be dealt with as a subset of risk management.

This option would also involve a review of existing prudential requirements for life companies. Letters, circulars, existing prudential standards and prudential rules would be reviewed with a view to removing outdated or redundant requirements.

Please refer to Attachment B, for a more detailed outline of this option.

Option 4 - develop a set of new prudential standards for life insurers

APRA would develop a set of prudential standards for life companies separately covering areas such as risk management, reinsurance management, business continuity management, and audit and actuarial requirements for life insurers – these areas are outlined in the PPGs under Option 3, but would be mandatory and binding under this option.

The standards would make greater use of prescriptive requirements and be less principles-based than would be the case under the proposals in Option 3. Compliance with these prudential standards would be mandatory for all life companies, and would be complemented by a series of non-legally binding PPGs.

The risk management prudential standard would include the standards described in Option 3, and further requirements that a life company must:

• submit its Risk Management Strategy to APRA annually and whenever it is materially amended;
• have its Risk Management Strategy and Business Plan approved by APRA; and
• have a documented Capital Management Plan.

The reinsurance management prudential standard would include key requirements that a life company must:

• have a reinsurance management framework;
• have a documented Reinsurance Management Strategy and submit it to APRA annually and whenever it is materially amended;
• have its Reinsurance Management Strategy approved by APRA; and
• submit a reinsurance declaration to APRA annually.

The audit and actuarial prudential standard would include:

• more extensive audit requirements and actuarial requirements; and
• a requirement that the various actuarial reports be peer reviewed by another actuary.

Where possible, these standards would be harmonised with current and developing general insurance and authorised deposit-taking institution prudential standards. This option would also involve a review of existing prudential requirements as described under option 3 above.

Impact analysis – costs, benefits and risks

Impact group identification

The parties impacted by the identified options are expected to be APRA, life companies and policy owners.

Assessment of costs and benefits

As discussed, APRA does not have sufficiently detailed data available to reliably quantify the costs and benefits of any of the options. However, in consultation process, APRA asked respondents to estimate their assessment of compliance costs and outline any assumptions underlying the calculation. APRA received only two responses to this request, and has incorporated these into the following qualitative analysis.

Option 1 – Maintain status quo

APRA

Benefits 

APRA would not incur any costs associated with reviewing and amending the life insurance prudential framework.

Costs

APRA may continue to experience the problems identified above, including the complexity of existing arrangements, the lack of minimum standards for risk management, inconsistencies between regulated industries, scattered requirements, and differing treatment of friendly societies and life companies.

Life companies

Benefits

Life companies would not face the potential for increased costs associated with adapting to change. In particular, life companies with risk management systems that fall short of APRA’s view of good practice would avoid the added cost of developing new policies and procedures, documenting strategies, and undertaking business continuity planning.

Costs

Life companies may forgo the potential benefits associated with strengthened risk management, including business continuity management, and other processes (these might be achieved through regulatory change). This would primarily be the case for life companies with systems that are currently below the level regarded by APRA as good practice. Strengthened systems for risk management, monitoring and control, and improved systems for business continuity management, might instead result in decreased risk of loss or failure.

Life companies could potentially face the additional costs of being regulated in Australia under a system that is out-of-step with international standards. A recent Financial Sector Assessment Program (FSAP) process undertaken by the International Monetary Fund identified a number of areas in which APRA's supervision of life insurance could be improved. In particular, APRA's compliance was less than "Fully Observed" against risk assessment and management benchmarking because the requirements for risk management are not formally spelt out under APRA’s life supervisory regime. Issuing comprehensive prudential standards on risk management under the Life Insurance Act will address the shortfall and lift APRA’s compliance with international standards.[4] 

While less than full compliance may not impose costs on life companies, if the regulatory framework became out of step with international regulatory standards life companies could face implied costs. These could include:

• overseas regulators paying greater attention to the overseas operations of Australian life companies and the Australian operations of overseas life companies;
• the possible impact on credit ratings of life insurers (due to their operating in a weaker regulatory environment) and, consequently, the cost of raising capital; and
• an adverse impact on corporate reputation due local companies being regulated under a system that is not as well respected internationally.

Should there be no change to the regulatory framework, life companies operating as conglomerates across APRA-regulated sectors (spanning the life insurance industry and other industries) would continue to face the cost of complying with different regulations (involving the maintenance of separate systems). Life insurers may also bear the lost opportunity of not reviewing their outdated or redundant systems, which would otherwise lead to greater efficiencies.

For friendly societies, an absence of regulatory change would imply the loss of potential cost savings and increased flexibility that may be generated if the transitional prudential standards (issued by AFIC) were removed.

Policy owners

Benefits

Policy owners might benefit relative to options 2, 3 or 4 if there are no substantially increased costs for life companies to transition to the proposed arrangements – these costs, subject to competitive and commercial considerations, would potentially be passed to policy owners in the form of increased premiums or fees. However, APRA assesses that it is unlikely that any of the options will result in significantly increased costs.

Costs

Policy owners would incur opportunity costs relative to the other options if the potential decrease in risk of loss or failure through regulatory change is not achieved. In APRA’s view, however, the benefits associated with the proposed prudential standards and practice guides is significant (particularly for life companies, with risk management practices that fall well short of good practice).

Policy owners may also incur intangible costs under this option if out-of-date and prescriptive prudential standards prevent innovation in the life insurance industry – this might ultimately result in a product mix that fails to meet the needs of policy owners.

Option 3 – Develop a limited set of prudential standards and make use of non-mandatory guidance wherever possible

APRA

Benefits

The implementation of more comprehensive and robust risk management systems will increase the resilience of life companies to internal or external events, and thereby reduce the risk of loss or failure – this will also reduce the risk of adverse impacts on the interests of policy owners.

APRA would benefit by removing outdated regulatory material and by simplifying the regulatory framework, which could potentially result in reduced monitoring costs and greater consistency in regulatory outcomes. APRA would also benefit by raising the minimum standard of industry practice to a level which represents good practice and which provide a higher level of comfort that life companies are being prudently managed. As a result, APRA might be in a position to lower the intensity of its ongoing supervisory activity or, alternatively, direct its attentions to other regulatory priorities.

APRA’s reputation would benefit as a result greater industry compliance with relevant international standards. The reputational impacts could be expected to be minimal in this instance, but consistent non-compliance with international standards may ultimately lead to material cost.

Costs

In general, the direct costs to APRA associated with this option are likely to be minimal. APRA would incur the sunk costs associated with the development of a new regulatory framework for life insurers. These include the cost of research, drafting the new prudential standards and guidance materials, consulting with industry and other interested parties, and training APRA staff in applying the new requirements. Planning documentation indicates initial development costs of around $350,000 – these costs would be largely recoverable in the long-run due to the expected savings to be generated through increased administrative and training efficiencies.

Given that APRA already monitors the risk management systems of life companies, it is expected that the cost of ongoing monitoring is unlikely to be materially increased over current levels.

Life companies

Benefits

Life companies operating across various APRA-regulated sectors (most life companies operate in at least one other sector) would benefit through the better alignment of life insurance regulation with other APRA-regulated industries – this would result in reduced duplication and decreased compliance costs, which is expected to be quite significant.

There would be further benefits for life companies should they become rated as less risky by APRA and face decreased supervision costs as a result of better systems for managing risks. Should the proposed review of current requirements be progressed, the life companies might also benefit through the potential removal of outdated regulatory instruments, which should result in lower costs. In particular, friendly societies would benefit from the removal of the preserved transitional prudential standards, which would result in decreased prescription, increased flexibility and accordingly reduced costs (these benefits are expected to be material).

Costs

It is expected that life companies would incur a range of costs associated with introducing new policies and procedures, reviewing their risk management systems, documenting risk management and reinsurance management procedures, and making certain declarations to APRA. One major life insurer has estimated the net additional cost at around $60,000 (including $20,000 in on-going costs). Life insurers may also incur additional costs associated with the implementation of improved business continuity management arrangements.

It is important to note that well run life companies are likely to already meet most of the requirements as part of normal business operations, and APRA already expects life companies to have systems for managing risks. Having such systems is an integral part of the business of being a life insurer. It is highly unlikely that life companies would attempt to operate without any risk management systems, although APRA has observed that the level of adequacy and sophistication of these systems is variable. As such, much of the cost associated with this option would not be correctly characterised as true compliance costs. Instead, they should be seen as costs which are essential to running a life insurance business and that would be incurred even in the absence of new regulatory requirements. Much of the industry already meets the minimum levels that would be put in place as requirements, although not under a recognised formal framework.

Some life companies would be expected to incur limited additional costs as a result of this option. Others might need to adapt their systems or raise them up to the minimum standard. Any requirements imposed by APRA in this area would be drafted in a principles-based way so as to avoid the need, as far as possible, for life companies to restructure their affairs for reasons relating to form rather than substance.

Many life companies have recently been involved in the process of superannuation licensing, which involved meeting risk management requirements in relation to their superannuation business. As such, the cost of compliance with this option should be further reduced as it primarily amounts to an extension, to cover the remainder of the life company’s business, of the risk management process that has already been undertaken.

Overall, APRA expects that the majority of industry participants will not incur material costs under this option. There may be a small number of cases where life companies are required to significantly increase the quality of their risk management systems. These companies could incur significant costs. These costs, however, would not be due to APRA establishing standards; rather they would be the usual costs of investing in systems to properly run a life company.

Policy owners

Benefits

Policy owners would benefit from reduced risk of loss or failure associated with a regulatory framework that is more enforceable and which seeks to ensure that life companies achieve a minimum standard regarded by APRA as good practice. This should benefit policy owners by reducing the risk of loss or failure and increasing confidence in the industry.

Policy owners would benefit relative to Option 4 through lower costs associated with adhering to the new framework – any increased costs could potentially be passed from the life company’s policy owners in the form of increased premiums or fees. Policy owners would also benefit from participating in an industry that is more flexible and innovative, and that can adapt more readily to new market developments (which is more likely under this option than under Option 4).

Costs

Policy owners could face increased costs if the proposal results in increased costs that life companies choose to pass on in the form of increased premiums or fees. APRA does not believe that this is a likely outcome given the principles-based drafting of the proposed requirements and the use of non-mandatory guidance.

Option 4 - Develop a set of new prudential standards for life insurers

APRA

Benefits

APRA would benefit in many of the same ways as under option 3. Additionally, APRA would administer a framework that has increased enforceability and clarity of interpretation. By being more prescriptive and less principles-based, APRA could more easily take action against life companies that are non-compliant with the requirements. In the case of life companies that do not currently maintain their risk management systems at a prudent level, the benefits would be significant.

Costs

In general, the direct costs to APRA associated with this option are very unlikely to be material (many of these costs are discussed under option 3). APRA may, however, be seen to be imposing excessive costs on industry, which is inconsistent with APRA’s statutory mandate and contrary to APRA’s stated aim of being a principles-based regulator. The costs associated with this option may also draw criticism from industry and other interested parties (which will, in-turn, harm APRA’s reputation).

Life companies

Benefits

Life companies would receive similar benefits to those outlined under option 3. Minor additional benefits might be achievable if the increased prescriptive measures lead to greater certainty over APRA’s requirements.

Costs

This option is more likely to result in increased costs to life companies, but would be less flexible than the other options. The potential costs would be similar to Option 3 but would be significantly multiplied due to the larger number of standards and requirements, as well as by the increased level of prescription.

Policy owners

Benefits

Beneficiaries would receive similar benefits to those identified under Option 3, although there would be the potential benefit of an even lower risk of loss or failure.

Costs

Given that there may be increased costs than under the other options, there is a risk that life companies might pass on those costs to policy owners (APRA does not expect, however, that this option will result in substantially increased costs). Policy owners could also incur unquantifiable costs if the more prescriptive (and less flexible) regime results in less innovation and less product development to meet the needs of policy owners.

Consultation

APRA has undertaken 3-months of public consultation with industry and other interested stakeholders in the period to 31 December 2006 and invited comment from industry. This involved the release of a discussion paper on aspects of proposed changes to the prudential framework applicable to life companies, and a number of seminars and meetings. In addition, the proposed standards and guidance materials were made available for viewing and comment on the APRA website. 

Thirteen responses were received from life insurers and industry bodies representing the majority of industry participants. In general, the respondents welcomed the proposed new prudential standards and practice guides for life insurers and friendly societies, and considered they were reasonable and placed appropriate requirements on industry. The respondents strongly supported the move towards a framework that is more consistent with other APRA regulated industries, noting that differences would ideally only occur where there are unique differences in industry structure

As part of the consultation process, to ensure APRA had data on expected costs from companies in a uniform manner, respondents were asked to use the Business Cost Calculator (BCC) to outline their assessment of compliance costs of adhering to the proposed new standards. The BCC was developed by the Office of Small Business, and is the preferred tool of the Commonwealth Government in calculating business compliance costs. APRA also asked respondents to communicate separately any costs (and underlying assumptions) not covered by cost categories in the BCC. 

The responses provided an insufficient level of data, however, to enable any reliable estimation of the monetary value of costs and benefits associated with transitioning to the proposed standards. One large life insurer estimated the expected cost of adhering to the proposed changes as $59,250 (this includes a net additional start-up cost of around $40,000 and ongoing costs of around $20,000). This is a very small amount when compared with the total costs of running a large life company. However, APRA was not surprised by this estimate, because it showed that this particular life company considered that, by-and-large, it already met the requirements that would be imposed by the proposed standards.

A submission from friendly societies outlined concern that the benefits may not justify the costs of compliance for small-to-medium friendly societies, although no Business Cost Calculator (BCC) results or other analysis on potential costs were supplied. One small/medium friendly society suggested the additional cost to develop and initiate the required policy would be in the region of $30,000. This was of more concern to APRA, in that this cost would be proportionally more significant for a small friendly society, than for a large life company. APRA considers, however, that risk management and business continuity management are of sufficient importance to justify such a cost.

APRA expects that the costs of these changes would be similarly small for most of the 35 life companies and 26 friendly societies. The estimated cost of $60,000 per life insurer and $30,000 per friendly society multiplied by the number of industry participants amounts to a cost in the vicinity of $2.9 million to meet the new arrangements. This represents a small percentage of combined industry assets, which are now in excess of $240 billion.

In regard to the submission from friendly societies, APRA also noted that the purpose of a principles-based approach was to enable regulation to be applied appropriately to different entities in different circumstances. APRA observed that there seemed to be some misunderstanding in parts of the response and noted that further explanation would be necessary in helping friendly societies comply with the proposed standards without unnecessary cost.

The friendly society submission also proposed lengthier transition periods for the introduction of the standards (18 months for larger friendly societies and 36 months for small/medium). Other submissions proposed an effective date of 1 Jan 2008 rather than an earlier implementation date of 1 July 2007. APRA has amended the proposed implementation date to 1 January 2008 in response to those concerns. APRA also proposes to consider requests for extensions, in certain circumstances.

Several submissions urged that the standards should be as consistent as possible across industries, and that inconsistencies remain in terms of terminology between the draft life standards and PPGs and those applicable to other industries. In response, APRA re-checked to the wording of the draft prudential standards and PPGs, to ensure that any differences in wording were necessary.

Originally (in 2004) APRA proposed that a common business continuity management standard would apply to ADIs, general insurers and life companies. At that time there was also extensive consultation with industry on the subject of business continuity management. At that time, however, APRA decided not to proceed with a life insurance business continuity management standard. This was because APRA wished to present a more coherent range of risk management proposals for the life insurance industry, rather than introducing business continuity management requirements in isolation. This means that the current proposed business continuity management standard for life companies (LPS 222 Business Continuity Management) will be broadly harmonised with the previously established prudential standards for ADIs and general insurers (APS 232 Business Continuity Management and GPS 222 Business Continuity Management), albeit somewhat restructured to account for APRA’s new style of guidance material – the prudential practice guide. The proposed business continuity management standard for life companies, however, will be in the context of a broader framework of risk management regulation.

Conclusion and recommended option

Option 3 is the recommended option

APRA’s considers that Option 3 best achieves the desired objectives as it is both principles-based and flexible (this is not achievable under Option 4). Option 3 best meets the objectives stated in this RIS – on balance, it is the least costly to all stakeholders while allowing APRA’s prudential objectives to be met.

There are currently no formal prudential standards covering APRA’s expectations for risk management and business continuity management for life companies (excluding friendly societies). These organisations currently manage their affairs according to internal governance mechanisms, under the supervision of their Board, and in compliance with the prevailing accounting and actuarial standards. APRA’s judgements about the quality of risk management systems are fed into the risk ratings given to the institutions and supervisory response. It is better to make these implicit principles open and explicit in prudential standards and prudential practice guides.

For friendly societies, the existing standards are outdated and overly prescriptive, and arguably in need of replacement with the proposed principles-based standards (common to the whole life insurance industry).

The new standards will require institutions to develop their own risk management and business continuity management frameworks and policies. The prudential practice guides will provide non-mandatory guidance on how to comply with the minimum requirements in the prudential standards. They are principles-based and provide flexibility to institutions to adopt practices appropriate to their circumstances. In the case of friendly societies, the new standards are significantly less prescriptive than the existing standards.

The combination of enforceable minimum requirements and guidance material under Option 3 keeps costs to industry at a minimum level while achieving APRA’s prudential objectives. Moreover, it does not impose enforceable requirements where guidance material can achieve the same result. By comparison, Option 2 does not provide sufficient enforceability and coverage for the minimum requirements (which APRA believes as essential), whereas Option 4 imposes unnecessary requirements where desired outcomes are achievable through guidance and education.

Based on APRA’s feedback from life companies during consultation, and noting that the cost of risk management and business continuity management are intrinsic to life insurance business (and not due to requirements of standards), we consider that Option 3 would not impose substantial additional costs on industry. In fact, APRA expects that the costs of adhering to the new framework will be insignificant for most life companies given that the life insurance industry generally meets higher standards than those proposed under Option 3. By comparison, Option 4 would impose additional cost with limited marginal benefit.

Implementation and review

APRA intends to release the final prudential standards and PPGs in advance of their effective date to enable industry to meet the requirements in an orderly way. The proposed release date for the final prudential standards and PPGs is 31 March 2007, with the prudential standards taking effect from 1 January 2008. Further transitional relief will be made available, if required, to allow all life companies to meet their requirements (and at the least cost).

A 12-month transition period is proposed in relation to the requirements of LPS 232 Business Continuity Management. During this period, it is proposed that life companies will be required to report on their compliance with LPS 232 Business Continuity Management and submit a plan and timetable for rectifying areas of non-compliance prior to the end of the transitional period.

Once implemented, APRA will monitor the operation of the new requirements to ensure that they operate as intended and remain relevant to industry.
Attachment A - Comparisons with international practice and APRA’s observations of good practice

Risk management

Internationally respected regulators such as the United Kingdom Financial Services Authority (FSA), the Monetary Authority of Singapore (MAS) and the Canadian Office of the Superintendent of Financial Institutions (OSFI) recognise the importance of effective risk management in various requirements and guidance instruments.

The International Association of Insurance Supervisors (IAIS) has published a document titled Insurance Core Principles and Methodology (Insurance Core Principles). The IAIS membership includes a large number of insurance supervisory authorities and the Insurance Core Principles serve as a basic benchmark for life and non-life insurance supervisors in all jurisdictions.

Insurance Core Principle (ICP) 18 states:

“The supervisory authority requires insurers to recognise the range of risks they face and to assess and manage them effectively.”

Essential criteria a. of that Core Principle states:

“The supervisory authority requires and checks that insurers have in place comprehensive risk management polices and systems capable of promptly identifying, measuring, assessing, reporting and controlling their risks.”

Essential criteria b. states:

“The risk management polices and risk control systems are appropriate to the complexity, size and nature of the insurer’s business. The insurer establishes an appropriate tolerance level or risk limit for material sources of risk.”

Essential criteria c. states:

 “The risk management system monitors and controls all material risks.”

APRA does not currently have explicit requirements for all life companies to have comprehensive systems for managing risk, and relies on implicit requirements to meet this principle. Conversely, the general insurance regulatory framework has been subject to an intense period of reform since 2002, and APRA has introduced an explicit requirement for a comprehensive risk management framework for general insurers. The general insurance framework generally represents APRA’s view of good practice in risk management and has been developed in extensive consultation with industry.

Finally, APRA has, in conducting its supervisory processes over a period of time, observed a range of industry practices in the area of risk management area and been able to form a view as to which are the most robust. APRA has observed that not all life companies have risk management frameworks which are up to the standard observed in well run companies.

Business Continuity Management

APRA is not currently fully compliant with the operational risk requirements contained in the IAIS Insurance Core Principles. As noted above the Insurance Core Principles include a statement that: “The risk management system monitors and controls all material risks”.

The supporting material to the IAIS Insurance Core Principles provides further guidance on what constitutes material risks. In the Guidance Paper on Stress Testing, business continuity management is included as a basic component of operational risk. In recent years, many offshore prudential regulators have introduced, as APRA has already done for the general insurance and ADI sectors, comprehensive guidance material and/or regulations relating to business continuity management.

The Joint Forum (constituted of the Basel Committee on Banking Supervision, the International Organisation of Securities Commissions and, relevantly for this purpose, the International Association of Insurance Supervisors) released, in December 2005 a document titled High-level principles for business continuity. This document further evidences the importance placed by regulators internationally on measures to address this area of risk.

Attachment B – detailed outline of Option 3

Under Option 3, APRA proposes to introduce Prudential Standard LPS 220 Risk Management, and Prudential Standard LPS 232 Business Continuity Management. These standards set out minimum requirements for life companies. The associated PPGs provide non-mandatory guidance to help life companies comply with the minimum requirements in the prudential standards. The PPGs will also contain material on APRA’s views of good practice in the risk management area, including business continuity management.

For friendly societies, the introduction of new requirements on risk management will enable the removal of a series of existing prescriptive prudential requirements. The removal of these historical requirements will reduce the level of prescription applying to friendly societies. The resulting framework will be more flexible and compliance costs should be reduced. As a result of these proposals, the prudential requirements applicable to life companies and friendly societies will be significantly harmonised and modernised, and APRA will be able to tailor supervision approaches more flexibly to the circumstances of individual entities.

The proposed changes to the life industry prudential framework will not affect the responsibility of the Board, which is charged with prime carriage of risk management and business continuity management. APRA does not propose to dictate a detailed approach to risk management in life companies. Instead, a series of principles-based requirements will be introduced, leaving the individual approach to risk management in the hands of each company.

Five PPGs relate to Prudential Standard LPS 220 Risk Management: LPG 200 Risk Management; LPG 230 Operational Risk; LPG 240 Life Insurance Risk and Life Reinsurance Management; LPG 250 Asset and Liability Management Risk; and LPG 260 Conflicts of Interest under Section 48. One PPG further relates to LPS 232 Business Continuity Management and the associated PPG LPG 232 Business Continuity Management.

Life companies will have the flexibility to configure their risk management and business continuity structures in the way that best suits their business objectives, while meeting the minimum requirements of the prudential standards. Prudential Practice Guide LPG 260 Conflicts of Interest under Section 48 draws directors’ attention to their duty to policy owners under section 48 of the Life Insurance Act 1995.

[1]  Throughout this paper, “life companies” includes friendly societies unless expressly noted otherwise.

[2]  On 1 April 2006 APRA introduced new minimum standards for business continuity management for general insurers (GPS 222 Business Continuity Management) and authorised deposit-taking institutions (APS 232 Business Continuity Management).

[3]  Life companies (and friendly societies) are also subject to the requirements of Circular to Life Companies C.I.1 Derivatives – Use, Management and Control which deals with risk management issues as they relate to use of derivatives.

[4]  The results of the FSAP process have not yet been made publicly available.  As such, if the information is not public as at the time of tabling this RIS, this information may have to be removed.