Dr. Onur ACAR Risk Manager Mapfre Genel Insurance

1. Risk Management Practices in Solvency II Dr. Onur ACAR Risk Manager Mapfre Genel Insurance

2. What is Solvency II? • It is the proposed new EU legislation which will govern the capital requirements of insurance companies. • Disadvantages of Solvency I which entered into force in 1970s: • Capital is not adequately directed to risks • Rules conflict with good risk management • A lack of harmonisation across the EU • Solvency II is an opportunity for a better and more appropriate risk based solvency regime 2

3. Solvency II : 3 Pillars • It is not only a capital calculation system but it is based on 3 Pillars: • Pillar I, which focuses on quantitative requirements • Pillar II, which focuses on qualitative requirements and supervisory activities • Pillar III, which addresses supervisory and public disclosure of financial and other information 3

4. Solvency II: 3 Pillar Approach 4

5. Aims of Solvency II Strong, effective policyholder protection with optimal capital allocation Proportionate, risk-based approach to supervision with appropriate treatment both for small and largecompanies To incentivise more sophisticated risk management tools To increase competition within the EU insurance markets and the global competitiveness of the EU insurers 5

6. Industry gets prepared Where do we stand in the Solvency II process? 2005 2006 2007 2008 2009 2010 2011 2012 Directive Adoption (Council & Parliament) Level 2 & 3 (EC & CEIOPS) Directive Development (Commission) CEIOPS advice on Proportionality & Groups CEIOPS advice on Implementing Measures CEIOPS work on L3 CEIOPS work on Pillar I CEIOPS work on Pillars II and III QIS 1 QIS 2 QIS 3 QIS 4 QIS5 Transposition 1 Jan 2014 ?

7. Risk-based economic model • A risk-based economic model implies an increased accuracy of the solvency assessment, closer to the true risk profile of the insurance company. • The main principles of a true economic risk-based model are: • A Total Balance Sheet approach: market consistent valuation of all assets and liabilities in the balance sheet • Addressing risk diversification effects: within the same risk, between risks, between companies, between geographical areas • Addressing risk mitigation effects: reinsurance and ART 7

8. Solvency II: Capital Requirement Levels • Solvency Capital Requirement (SCR) • Target Capital that an entity should aim to meet under normal operating conditions • Dropping below SCR does not necessarily require immediate supervisory intervention • Minimum Capital Requirement (MCR) • Reflects a level of capital below which ultimate supervisory action could be triggered • Ladder of Intervention • An appropriate ladder of intervention if the available capital falls below SCR Internal Model Level of SCR Ladder of Intervention Standard Approach Level of MCR Market -consistent Value of Liabilities 8

9. NLLapse NLCAT Mktilliq Mktconc LifeCat LifeRev SCR CALCULATION SCR BSCR SCRop Adj. SCRnon-life SCRintang SCRmarket SCRhealth SCRdef SCRlife LifeMort Mktfx LifeMort Health SLT Health NonSLT Health CAT NLPrem&Res Mktprop LifeLong HealthMort Health CAT Health Prem&Res Mktint LifeDis/Morb HealthLong Health NSLTLapse Mkteq LifeLapse Health DisMorb =adjustment for the risk mitigatingeffect of future profit sharing Mktsp LifeExp Health SLTLapse HealthExp HealthRev

10. System of Governance in Solvency II System of Governance Management body Fit and properrequirements Risk Management Risk management function Internal Control Compliance function Internal Audit Internal audit function Actuarial Function The functions included in the system of governance are considered to be key functions and consequently also important and critical functions. Own Risk and Solvency Assessment (ORSA)

11. System of Governance in Solvency II • The system of governance should: • be proportionate to the nature, scale and complexity of the operations of the insurer • include an adequate transparent organisational structure with a clear allocation and appropriate segregation of responsibilities and an effective system for ensuring the transmission of information • be subject to regular internal review • Governance is crucial because: • Solvency II is a flexible system • There are risks that cannot be properly quantified • There are internal models

12. Governance – Management Body Management Body • Managementbody has theultimateresponsabilityto establish an effective system of governance which provide for sound and prudent management of thebusiness. Fit andProperRequirements Internal Control Internal Audit Actuarial Function Risk Management

13. Governance – Fit andProperRequirements Management Body • All persons who effectively run the undertaking or have other key functions shouldbe fit and proper. • Their professional qualifications, knowledge and experience should be adequate to enable sound and prudent management (fit) • They should be of good repute (proper) Fit andProperRequirements Internal Control Internal Audit Actuarial Function Risk Management

14. Governance – InternalControl Management Body • Companiesshould have an effective internal control functionthatshouldinclude: • administrative and accounting procedures • appropriate reporting arrangements at all levels of the company • a compliance function • Compliance function should include: • advising the management body on compliance with laws, regulations and administrative provisions • an assessment of the possible impact of any changes in the legal environment on the operations of the company Fit and Proper Requirements InternalControl Internal Audit Actuarial Function Risk Management

15. Governance – InternalAudit Management Body • Companiesshouldhavean effective internal audit functionthatshould: • includean evaluation of the adequacy and effectiveness of the internal control system and other elements of the system of governance. • be objective and independent from the operational functions. • Any findings and recommendations of the internal audit should be reported to the management body which should determine what actions are to be taken. Fit and Proper Requirements Internal Control InternalAudit Actuarial Function Risk Management

16. Governance – ActuarialFunction Management Body • Companiesshouldhave an effective actuarial function to: • ensure the appropriateness of the methodologiesandmodels used in the calculation of technical provisions • inform the management body regarding the reliability and adequacy of the calculation of technical provisions • express an opinion on the overall underwriting andreinsurancepolicy • contribute to the effective implementation of the riskmanagement system Fit and Proper Requirements Internal Control Internal Audit Actuarial Function Risk Management

17. Governance – Risk Management Management Body • Companiesshould have an effective risk management system comprising strategies, processes and procedures necessary to identify, measure, monitor, manage and report the risks they face. • Itneeds to be integrated into the decision making process of thecompany. • The management body shouldhavetheultimateresponsibility for ensuring • that the implemented risk management system is suitable, effective and • proportionate to the nature, scale and complexity of the risks. Fit and Proper Requirements Internal Control Internal Audit Actuarial Function Risk Management

18. Tasks of the RiskManagementFunction • Assisting the management body in the effective operation of the risk management system • Monitoring the risk management system • Maintaining an organisation-wide and aggregated view on the risk profile of the company • Reporting details on risk exposures and advising themanagement body with regard to risk management matters • Identifying and assessing emerging risks

19. Operational Risk Liquidity Risk Underwriting Risk Market Risk Credit Risk Concentration Risk The risk of loss arising from inadequate or failed internal processes, personnel or systems, or from external events The risk that the company is unable to realise investments and other assets in order to settle its financial obligations when they fall due The risk of loss in the value of insurance liabilities, due to inadequate pricing and provisioning assumptions The risk of loss in the financial situation resultingfrom fluctuations in the level and in the volatility of market prices of assets, liabilities and financial instruments The risk of loss in the financial situation, resulting from fluctuations in the credit standing of counterparties or issuers of securities All risk exposures with a loss potential which is large enough to threaten the financial position of the company RisksTo Be Covered by Risk Management

20. Effective Risk ManagementSystem Clearlydefinedandwell documented • Riskmanagement strategy shouldinclude: • risk management objectives • key risk management principles • general risk appetite • assignment of risk management responsibilitiesacross all the activities of the company • Itshould be consistent with thecompany’soverallbusinessstrategy. Adequatewrittenpolicies Appropriateprocessesand procedures Appropriateproceduresand feedbackloops Appropriatemanagement reporting

21. Effective Risk Management System Clearlydefinedandwell documented • Written risk management policiesshould include: • definition and categorisation of thematerial risks faced by the company • definition of acceptable risk limits • implementationof riskstrategy and control mechanisms • Writtenpoliciesshould at leastcover: • underwritingandreserving • asset–liabilitymanagement (ALM) • investments • liquidityandconcentration risk management • operational risk management • reinsurance Adequatewrittenpolicies Appropriateprocessesand procedures Appropriateproceduresand feedbackloops Appropriatemanagement reporting

22. Effective Risk Management System Clearlydefinedandwell documented • Main risk management strategies and policiesshould be approvedbythemanagement body. • Processes and procedures shouldinclude: • risk identification • risk assessment • risk measurement • risk monitoring • risk reporting Adequatewrittenpolicies Appropriateprocessesand procedures Appropriateproceduresand feedbackloops Appropriatemanagement reporting

23. Effective Risk Management System Clearlydefinedandwell documented • Information on the risk management systemshould be activelyandcontinuouslymonitored andmanaged bythemanagement body andby all relevant staff Adequatewrittenpolicies Appropriateprocessesand procedures Appropriatereportingand feedbackloops Appropriatemanagement reporting

24. Effective Risk Management System Clearlydefinedandwell documented • Material risksfaced by the company and the effectiveness of the risk managementsystemshould be reportedto the management body Adequatewrittenpolicies Appropriateprocessesand procedures Appropriateproceduresand feedbackloops Appropriatereportingto themanagement

25. Supervision of the Risk Management System • The company is required to demonstrate to the supervisor that it has an effective risk management system which is: • capable of identifying, monitoring and mitigating both current and future risks in line with its risk tolerance levels. Stress testing and scenario analysis can be used to determine the effect of these risks. • an integral part of its business strategy • subject to regular internal review by the management body • proportionate to the nature, scale and complexity of its business

26. Supervision of the Risk Management System • The disclosure to the supervisor could include: • material risks and their potential effects • any perceived emerging risks to the company’s solvency position • the scope and nature of risk and capital measurement systems • the structure and organisation of the relevant risk and capital management systems • details of organisational structure and staff responsible for the risk management system • qualitative measures for risks which are not quantifiable, such as liquidity risk and operational risk

27. Thank you … Onur Acar, Ph.D. Mapfre Genel Sigorta Risk Manager