Risk management in an insurance company
An insurer's reliability depends not only on capital, but also on its ability to identify, measure and limit risks in good time. In Kazakhstan, the procedure for building a risk management and internal control system is established by regulatory requirements.
Why risk management became mandatory
Financial crises have shown that liquidity and solvency problems at a single organisation can quickly affect customers, shareholders and the whole financial group. The link is especially close when a bank and an insurance company belong to the same holding, use shared infrastructure or have significant transactions with each other.
In the original 2012 publication, this problem was considered through the interaction of the international approaches Solvency II and Basel III. Their models differ because banks and insurers run different businesses, but the common principle remains: the risks taken on must correspond to capital, liquidity and the quality of management.
The main elements of the system
Strategy
The board of directors sets objectives, risk appetite, limits and the responsibilities of management bodies.
Processes
Risks are identified, assessed, controlled and regularly reflected in reporting.
Control
Compliance and internal audit independently verify adherence to the rules and the effectiveness of the measures.
Which risks an insurer manages
- Insurance risk — losses and expenses turn out higher than allowed for in the rates and reserves.
- Underwriting risk — a risk is accepted on the wrong terms because of insufficient assessment.
- Reserving risk — the reserves set aside are not enough for future claim payments.
- Market risk — the value of assets changes because of interest rates, exchange rates and prices.
- Credit risk — a bank, issuer, reinsurer or other counterparty fails to meet its obligations.
- Liquidity risk — the company cannot convert assets into cash in time to pay claims.
- Operational risk — errors in processes, people or systems, fraud or cyber incidents.
- Compliance risk — a breach of legislation, the licence or internal requirements.
- Reputational risk — loss of the trust of customers and partners.
- Strategic risk — a flawed business model, product or concentration.
The role of capital
Capital is a financial buffer, but it does not replace management. A company with formally sufficient capital may run into trouble if it misjudges large risks, concentrates its assets, under-reserves or fails to monitor its counterparties.
Risk appetite must be translated into measurable limits: the maximum amount for a single object, industry, territory, bank, issuer and reinsurer. When a limit is approaching, management must take a decision before the risk materialises.
Underwriting and rates
Underwriting is the set of procedures for accepting an object for insurance or reinsurance. The specialist assesses the probability and size of loss and determines the insurance cover, exclusions, deductible, limit and rate within the bounds of the actuarial calculation.
Price undercutting or widening cover without calculation creates a deferred problem: the premium comes in today, while large claims arise later. The system must therefore monitor deviations from rates, employees' authority, data quality and accumulation of risks.
Reinsurance as a capital tool
The original material stressed a new assessment of the role of the reinsurer. Reinsurance can indeed increase an insurer's capacity to accept large risks, but the quality of protection depends not only on the amount ceded.
The following must be assessed:
- the financial strength and rating of the reinsurer;
- the legal force of the contract and the jurisdiction;
- exclusions, limits and the notification procedure;
- concentration with a single partner;
- recovery times and currency risk;
- the reinsurer's own capital;
- the effectiveness of protection in a catastrophe scenario.
The original interview noted that professional reinsurers with their own models and sufficient capital do not necessarily cut their risk appetite during a crisis. However, for CIS markets, complex extensions of cover and political and legal risks are additionally important.
Three lines of responsibility
| Level | Who | Task |
|---|---|---|
| First line | Business units | Manage risk in day-to-day operations |
| Second line | Risk management and compliance | Set methodologies and monitor limits |
| Third line | Internal audit | Independently assesses the whole system |
Responsibility of the board of directors
The board of directors approves the strategy, policies, risk appetite and key limits, and reviews reports and plans for remedying breaches. The management board organises day-to-day implementation. Control functions must have independence, access to information and the ability to report a material problem directly to the board.
An annual assessment of the risk system ratios makes it possible to identify deviations from the standard range. If there are several deviations, an action plan or a reasoned decision of the board of directors is required.
Stress testing
Ordinary statistics do not show rare but severe events. An insurer must model catastrophes, mass losses, a sharp fall in asset values, counterparty default, devaluation and a simultaneous rise in customer claims.
The result of a stress test is not just a report. It must influence capital, reinsurance, limits, the liquidity plan and management's actions in a crisis.
Digital and emerging risks
Modern risk management includes cybersecurity, protection of personal data, the resilience of online sales and claims handling, dependence on external IT providers and model risk. When artificial intelligence is used, data verification, explainability of decisions, control of discrimination and human oversight are necessary.
Who benefits from good management
- policyholders — their risks are accepted on clear and sustainable terms;
- insurers — understand their portfolio, capital and real profitability better;
- the state — gets a more stable financial market;
- shareholders — reduce the likelihood of an unexpected loss of capital;
- society — gets predictable payments after major events.
Practical takeaway
A good system does not eliminate risk entirely. It makes risk visible, measurable and manageable — before a contract is concluded and before a loss occurs.
Conclusion
Mandatory risk management requirements protect not only the regulator but, above all, customers and the insurance company itself. Capital, reserves, reinsurance, internal control and a risk culture must work as a single system.
This material is for information purposes. To assess a specific organisation, use the current ARDFM rules, its financial statements and professional analysis.