Internal control system and risk model

Internal control system

The internal control system is overseen by the Group Board of Directors and the Group Executive Committee. It aims to provide reasonable oversight and assurance in achieving three objectives:

• Reliability of reporting – addressing the preparation of reliable reporting arrangements as well as related data covering significant financial, economic, regulatory and other reporting risks.
• Compliance with applicable laws and regulations − addressing legal and regulatory requirements which Swiss Re is subject to, including compliance, legal and tax risks
• Effectiveness and efficiency of operations − addressing basic business objectives, including performance and profitability goals, and the safeguarding of assets covering significant market, credit, liquidity, insurance, technology and other risks

Operationally, the internal control system is based on Swiss Re’s three lines of control and comprises five components:

Risk tolerance and appetite assessment of plan

Risk oversight of planning aims to ensure that the Group and major legal entities fully understand the risk implications of the business and financial plan, and that the planning approach is based on sound assumptions. The plan represents the implementation of Swiss Re’s strategy under the baseline scenario. It is used to assess the risk and capital implications of the plan within the expected economic and business environment.

Risk Management provides both input into and risk oversight of the business and financial planning process. It does so by reviewing and challenging key assumptions supporting the plan as well as by assessing potential risks and threats that may arise from its implementation. Risk Management also provides transparency on detailed risk implications of the plan and works with Finance to test its adherence to risk appetite and risk tolerance, and determine whether it complies with the relevant capital and liquidity limits and targets. Adherence of the plan to risk tolerance is also subject to quarterly review based on updated plan information. Execution of the plan is subject to the risk control framework.

The implications of the business and financial plan are further assessed against selected sensitivities, as well as by projecting the risk, capital and liquidity positions under alternative scenarios. The insights gained from scenario analysis enable senior management to prepare a response to adverse events as they occur. In some cases, this may lead to preventative actions being carried out in advance, while in other cases management may react to events as they unfold, taking into consideration the insights gained during the planning process.

Risk identification

Risk identification is an ongoing process to establish transparency around all potentially material risks in order to make those risks controllable and manageable. This provides a basis for exposure monitoring, risk measurement, monitoring of capital requirements and reporting. All quantifiable risks must be reflected in costing, underwriting, reserving, capital and steering models.

Based on internal and external information, Swiss Re identifies risks such as:

• Previously unidentified risks
• Known non-material risks that have become material risks
• Known material risks that have changed following a re-assessment or increased understanding of the nature of the risk
• Changes in risk exposure from increased understanding of interdependencies between risks

Risk takers have primary responsibility for identifying risk, including emerging risks, by assessing all risk exposures arising from active positions (ie assets and underwriting) and operational processes as well as the risk factors underlying these exposures. Risk takers are also charged with providing Risk Management with all relevant information about their risk factors and exposures. Where the risk is relevant for multiple Swiss Re entities, this assessment is generally performed in cooperation with Group Risk Management.

Risk measurement

Risk measurement enables Swiss Re to assess the magnitude of its risk exposures and set quantitative controls that limit risk-taking.

Swiss Re uses a full internal risk model to determine the economic capital required to support the risks on the company‘s books, as well as to allocate risk-taking capacity to the different lines of business. The model also provides the basis for capital cost allocation in Swiss Re‘s Economic Value Management framework, which is used for pricing, profitability evaluation and compensation decisions. In addition to these internal purposes, the model is used to determine regulatory capital requirements under economic solvency frameworks such as the Swiss Solvency Test (SST) and Solvency II.

The internal risk model provides a meaningful assessment of the risks to which the company is exposed and is an important tool for managing the business. Swiss Re‘s model has a history of more than 20 years of development and continuous improvement driven both by the company‘s specific risk profile and by changing requirements as a globally operating reinsurer.

While economic solvency regimes such as SST and Solvency II offer standard models for calculating regulatory requirements, such models are generally geared towards regulating the local or regional re/insurance market and thus do not take sufficient account of Swiss Re‘s broad geographic and diversified portfolio structure. Swiss Re‘s model uses the Monte Carlo simulation method to estimate a joint multivariate distribution of all relevant risk factors, rather than a limited set of deterministic scenarios and factors. It therefore provides more detailed results than standard formulas, which are often based on simplified industry-wide common denominators.

Swiss Re‘s internal model is based on two important principles. First, it applies an asset-liability management approach, which measures the net impact of risk on the economic value of both assets and liabilities. Second, it adopts an integrated perspective, recognising that a single risk factor can affect different sub-portfolios and that different risk factors can have mutual dependencies. Swiss Re’s internal model is fully stochastic and is based on a separation of risk factors and exposure functions.

The model generates a probability distribution for economic profit and loss, specifying the likelihood that the outcome will fall within a given range.

In line with the SST, the Group measures its economic risk capital requirement at the 99% shortfall (or tail value at risk) level. This represents an estimate of the average annual loss likely to occur with a frequency of less than once in one hundred years, thus capturing the potential for severe, but rare, aggregate losses.

In addition, the model is used to calculate value at risk (VaR) measures including 99.5% VaR, which is used in other regulatory regimes such as Solvency II. 99.5% VaR represents the loss likely to be exceeded in only one year out of two hundred and is thus more severe than the 99% VaR measure, which estimates the loss likely to be exceeded in one year out of one hundred. For Swiss Re‘s loss distribution, the 99% shortfall (tail VaR) measure is generally larger than the 99.5% VaR measure.

Separate risk modules are used to model the individual risk factors of Swiss Re’s core risks (see Swiss Re’s risk landscape). Depending on the underlying risk and available historic experience, Swiss Re applies different modelling approaches:

• Swiss Re’s model for non-life insurance risks consists of several components: One main contributor is costing and reserving risk. This risk is modelled based on a statistical model approach which derives its assessment of future uncertainty from the observation of past volatility. Another key risk of non-life insurance risks are natural catastrophes. Swiss Re’s has developed its own proprietary nat cat model, which is used for costing as well as risk assessment. In addition to those, Swiss Re uses a number of so called threat scenario models, which are used to describe large but rare events (ie, events that are not well represented in historical observations). Events involve the accumulation of simultaneous losses from different parts of the portfolio at the same time. Swiss Re also models claims inflation risk evolving from the Group’s property and casualty business. Since economic inflation changes the value of a liability or an asset, it induces changes in claims payment, in general. Inflation risk is modelled by applying a probabilistic set of future inflation scenarios based on expert judgement about future inflation.
• Swiss Re’s life insurance risk model quantifies potential economic losses from our L&H business generated by non-financial risks. The model comprises separate sub-models based on the nature of Swiss Re’s product offerings: mortality, longevity, critical illness, hospital cash and income protection. Each sub-model is a cashflow model based on actuarial valuation models with a consistent structure, identifying the underlying risk factors. Some risk factors, such as the prevalence to certain diseases, can influence mortality as well as critical illness products, hence the model captures the dependency here.
• In Swiss Re’s financial market and credit risk models risk factors are external realisations of market parameters that enter the economic valuation. In the financial market risk model, risk factors are simulated based on general market practices, mainly by price volatilities that are updated on a quarterly basis. Swiss Re’s financial market risk model pays specific attention to tail dependencies, which reflect correlations between risk factors in adverse market situations. Changes in risk factors are evaluated on assets and liabilities simultaneously.
• The credit risk model generates credit default and migration scenarios for all modelled companies following a rating based, modified Merton-type model. Given these scenarios, it calculates the economic impacts using the exposure information. In the Merton approach, the dynamics of each company is modelled by the dynamics of its assets, and default is defined as the state in which assets are insufficient to cover liabilities.

In order to assess the risk and provide solvency information for individual financial reporting entities within a network of entities, it is necessary to consider the impact of intra-group relationships. For this purpose, the Group‘s internal risk model takes the following items into account:

• Intra-group transactions (including loans, guarantees and retrocessions)
• Intra-group credit risk and (for SST) potential limited liability toward subsidiaries
• Secondary effects resulting from the potential insolvency of other reporting entities

Swiss Re’s risk model assesses the potential economic loss at a specific confidence level. There is thus a possibility that actual losses may exceed the selected threshold. In addition, the reliability of the model may be limited when future conditions are difficult to predict. For this reason, the model and its parameters are continuously reviewed and updated to reflect changes in the risk environment and current best practice. In addition, Swiss Re complements its risk models by ensuring a sound understanding of the underlying risks within the company and by applying robust internal controls.

The risk model is governed by Swiss Re‘s Model and Tool Assurance Framework. This includes an independent end-to-end validation process that comprises specification, algorithms, calibration, implementation, results and testing.

As it is used for regulatory reporting purposes, Swiss Re’s risk model is subject to regulatory scrutiny. In 2017, the Swiss regulator, FINMA, approved Swiss Re’s internal model for use for the SST report (step one approval) following the new FINMA approval process that was initiated in 2016. Furthermore, the model has been approved by the Luxembourg regulator, Commissariat Aux Assurances, for the Solvency II reporting of Swiss Re's legal entities established in the EEA.

Risk limit framework

Swiss Re aims to carefully control exposure from active risk-taking decisions, the passive risk it is exposed to through its operations, as well as the cumulative impact of its risk exposures on capital and liquidity adequacy. Risk exposures are controlled in all activities to:

• Facilitate informed business steering decisions
• Ensure that the Group operates within its risk tolerance
• Ensure that operational risks are managed to an acceptable level

The following controls govern all risk-taking decisions across the Group:

• Clearly established authorities and delegations governed by referral triggers (eg quantitative and qualitative limits to delegated risk-taking authority)
• Capital and liquidity adequacy limits
• Risk and capacity limits

Risk reporting

Regular internal risk and issue reporting ensures transparency at all stages. For the Group and key legal entities, holistic risk reports are produced and provided to the respective management and Board members. These reports cover qualitative and quantitative risk topics across all areas of Swiss Re’s risk landscape:

• Reporting of material risks and control issues including mitigation actions and recommendations; this is based on Swiss Re’s Group-wide risk matrix methodology, in which key operational risks are classified based on a standard taxonomy, and assessed for probability and residual risk impact.
• Monitoring and analysis of adherence to risk tolerance, including adequacy of capital and liquidity, as well as the usage of risk limits.
• Monitoring of exposure and other risk-related developments within Swiss Re, for underwriting, financial and operational risk, as well as assessment of external developments with a potential impact on Swiss Re, such as economic and insurance market trends, regulatory, legal and political developments.