Paul Hopkin. Fundamentals of Risk Management
Подождите немного. Документ загружается.
284 Risk response
The handling of insurance claims can be a detailed and forensic exercise. Sometimes claims
handling involves complex legal processes involving specialist engineers and accountants.
Property damage claims may be easier to quantify, but claims associated with the business
interruption element of the loss can be very diffi cult to measure and agree.
If an organization has devised adequate business continuity plans, the disruption to the busi-
ness and the size of the insurance claim will be much reduced. In risk management terms,
depending fully on insurance to make good all losses is not suffi cient. Every organization
should look to its business continuity plans to ensure that arrangements are in place to guar-
antee minimum disruption should an adverse event materialize.
There is increasing concern about compliance issues in relation to insurance policies. Most
countries have introduced insurance premium taxes and these must be paid on a national
basis where an organization has assets in several countries. Sometimes, the requirement to pay
taxes may be on a city or regional basis, with the payment going to the local fi re brigade. Com-
pliance issues have also extended to the production of the insurance contract before the policy
period commences. Timely issuance of insurance policies is often referred to as ‘contract cer-
tainty’.
There are also compliance concerns related to whether a policy is admitted/approved/accepted
within every country where the organization has operations. This can sometimes form a
restriction on the operations of captive insurance companies. Certain countries may not
accept the validity of an insurance policy written by a non-admitted insurer, including a
captive insurance company.
Captive insurance companies
A captive insurance company is an insurance company owned by an organization that is not
otherwise involved in insurance. The purpose of a captive insurance company is to provide
insurance capacity for the organization by using its internal fi nancial resources to fund certain
types of anticipated losses or insurance claims. The organization that owns a captive insurance
company is often referred to as the parent of the captive, or simply the parent organization.
In general, captive insurance companies are domiciled in a location that has a favourable reg-
ulatory and accounting regime that encourages the establishment of captive insurance compa-
nies. Domiciles for captive insurance companies include Guernsey, the Isle of Man, Gibraltar,
Malta, Luxembourg, Bermuda and Ireland. The nature of captive insurance companies can
vary quite widely. In theory, such a company may write insurance business directly into other
countries, although compliance issues surrounding non-admitted policies may need to be
carefully considered.
It is more common for a captive insurance company to operate as a re-insurer, providing
insurance cover to the main insurance company appointed by the organization. This arrange-
Insurance and risk transfer 285
ment provides the insurance company of the organization, often referred to as the fronting
insurer, with the means of receiving reimbursement for certain types of claims up to the fi nan-
cial limits or risk retention levels agreed with the captive insurance company.
A typical fi nancial structure for a complex insurance programme is illustrated in Figure 30.1.
The organization will accept deductibles or excesses on its different classes of insurance, and
these may vary by class of insurance. The captive insurance company then accepts the next
level of loss up to an agreed limit for any individual loss and also up to an agreed limit for total
or cumulative losses during the policy year.
The primary or fronting insurer will then be responsible for payment of that part of larger
losses that exceeds the captive insurance company limit. The fronting insurer will be respon-
sible for payment of all losses once the cumulative totals for the captive have been breached.
For statutory classes of insurance, the primary or fronting insurer will be responsible for the
payment of the total claim.
Level of
cover
Type of
insurance
Property
Insurance
Liability
Insurance
Motor
Insurance
Deductible
Deductible
Captive
Insurance
Company
Primary Insurer
providing cover to
full property values
Primary Insurer
acting as fronting
insurer
Excess insurance
layer(s) up to required
level of cover
Figure 30.1 Role of captive insurance companies
286 Risk response
The fronting insurer will then reclaim the money from the captive insurance company to the
extent that the captive insurance company is liable. This can present a credit risk for the front-
ing insurance company, although this is usually overcome by the fronting insurance company
not making any payment until it has received funds from the captive insurance company.
Some captive insurance companies accept business from third parties as well as providing
insurance for the parent company. A typical example of a captive insurance company provid-
ing third-party insurance is extended warranty insurance policies offered by the retailers of
electrical goods. Another example is that travel agents may set up a captive to provide travel
cancellation insurance to customers. The customer will purchase a policy issued by a well-
known insurance company, but the funding of the insurance will be provided by the captive
by way of reinsurance of the fronting insurer. By setting up this arrangement, the travel agent
should earn extra income and profi t from its customers.
The advantages of captive insurance companies are as follows:
Savings may be achieved in overall insurance costs because lower premiums are often •
set by captive insurance companies.
The captive insurance company can gain access to reinsurance markets, where premium •
rates and risk capacity can be favourable.
By being exposed to the cost of insurance claims, a greater risk awareness and greater •
concern about loss control can be achieved.
Greater insurance cover can be offered by the captive insurance company than is avail- •
able in the commercial market.
Certain tax benefi
ts may be available from having a captive insurance company, •
although these have reduced in recent times.
The disadvantages of captive insurance companies are as follows:
The captive will be exposed to insurance claims that would otherwise have been paid •
by the commercial insurance market.
The parent organization has to allocate capital to ensure adequate solvency of the •
captive insurance company.
When large losses are paid by the captive, these are consolidated to the parent balance •
sheet and the organization ultimately pays these losses.
Captives writing business in other territories will probably do so on a non-admitted •
basis and this may create compliance diffi culties.
Signifi
cant administrative cost, time and effort can be involved in the management of •
the captive by parent head offi ce
personnel.
Case study
Intercontinental Hotels Group – loss-control
strategy
Process and framework
Intercontinental Hotels Group (IHG) has an established risk management process and frame-
work. Long-term strategic goals are aligned with the IHG core purpose and include these key
elements:
safety and security of guests, employees and other third parties; •
brand strength supported by operational excellence in risk management at all hotels •
and corporate locations;
maintenance and promotion of the reputation of the company. •
IHG’s approach has been to enable and support hotel owners, staff and corporate functions to
manage risk effectively. This is accomplished by giving them a systematic approach and frame-
work to follow and by providing them with tools to do the job. The risk management function
aims to share specialist knowledge and capability globally.
A strategic framework for hotel safety and security has been designed for owned and managed
hotels and shows the identifi
ed groups of risks and describes the management activities carried
out to mitigate the risks. There are safety and security risk managers around the world who
work with IHG general managers and their management teams in order to minimize the risks
and keep the hotels safe.
Over the years IHG has developed risk management strategies to assess and treat individual
types of risk. This has involved developing policies, standards and guidelines, raising aware-
ness levels, training staff on the controls and systems which have been developed for their use
and reviewing and reporting upon progress and continued risks.
287
288 Risk response
Security risks, particularly the threat of terrorism, have increased. In recent years, IHG has
developed an increasingly sophisticated response that is intelligence-led and risk-based. The
security risk environment is highly dynamic and needs to be managed both centrally and
locally in hotels. In common with all risk strategies, there are three elements that must be
developed and maintained: physical and technical systems, people capabilities and processes
and procedures.
The management activities are being adapted and applied to manage corporate risks. This ini-
tiative is led by the Executive Committee, facilitated by the Risk Management function and
integrated with quarterly strategic reviews.
Business Review 2008
Part 6
Risk assurance and reporting
Learning outcomes for Part 6
describe the nature and purpose of internal control and the contribution that internal •
control makes to risk management;
outline the importance of the control environment in an organization and provide a •
structure for evaluating the control environment (CoCo);
describe the activities of a typical internal audit function and the relationship between •
internal audit and risk management;
describe the activities involved in an ERM initiative and how these can be allocated to •
internal audit, risk management and line management;
outline the importance of risk assurance and identify the sources of risk assurance that •
are available to the board/audit committee;
discuss the importance of risk reporting and the range of risk reporting obligations •
placed on companies, including Sarbanes–Oxley;
provide examples of risk reporting approaches adopted by different types of organiza- •
tions, including companies, charities and government agencies;
289
290 Risk assurance and reporting
describe the importance of corporate social responsibility as a component of corporate •
governance and outline the range of topics covered;
describe the steps involved in the successful implementation of a risk management ini- •
tiative, together with the barriers and actions.
Part 6 Further reading
Cabinet Offi ce (2009) National Risk Assessment, www.cabinetoffi ce.gov.uk.
Canadian Institute of Chartered Accountants (1995) Criteria of Control, www.cica.ca.
COSO Internal Control – Integrated Framework (1992) www.coso.org.
Institute of Chartered Accountants in England and Wales (2002) Risk management for SME’s,
www.icaew.com.
Institute of Internal Auditors (2004) The Role of Internal Auditing in Enterprise-wide Risk Management,
www.theiia.org.
Offi ce of Government Commerce (2007) Management of Risk: Guidance for Practitioners,
www.tsoshop.co.uk.
31
Evaluation of the control
environment
Nature of internal control
The system of internal control within an organization plays an important part in the successful
management of its risks. Internal control is concerned with the methods, processes and checks
that are in place to ensure that a business or organization meets its objectives. There are alter-
native defi nitions of internal control and some of the key defi nitions are set out in Table 31.1.
Internal controls can be considered to be the actions taken by management to plan, organize
and direct the performance of suffi cient actions to provide reasonable assurance that objec-
tives will be achieved.
Table 31.1 Defi nitions of internal control
Organization Defi nition of internal control
CoCo
(Criteria of Control)
Internal control is all the elements of an organization that, taken
together, support people in the achievement of the organization’s
objectives. The elements include resources, systems, processes,
culture, structure and tasks.
COSO A process, effected by an entity’s board of directors, management
and other personnel, designed to provide reasonable assurance
regarding the achievement of objectives in the following categories:
Effectiveness and effi
ciency of operations
•
Reliability of fi nancial reporting •
Compliance with applicable laws and regulations. •
IIA
(Institute of Internal
Auditors)
A set of processes, functions, activities, sub-systems, and people
who are grouped together or consciously segregated to ensure the
effective achievement of objective and goals.
291
292 Risk assurance and reporting
British Standard BS 31100 defi nes a control as a ‘measure to modify risk’. It also states that con-
trols include any process, policy, device, practice or other actions designed to modify risk. Inter-
nal control incorporates the organizational and hierarchical structure, as well as planning and
objective setting. The scope of internal control extends to evaluation of controls designed to
support the organization in achieving objectives and executing strategy, but it also applies to the
control of actions to ensure that the organization does not miss business opportunities.
When designing effective internal controls, the organization should look at the arrangements
in place to achieve the following:
maintenance of reliable systems; •
timely preparation of reliable information; •
safeguarding of assets; •
optimum use of resources; •
preventing and detecting fraud and error. •
Effective fi
nancial controls, including maintenance of proper accounting records, are an
important and well-established element of internal control. These fi
nancial controls help
ensure that the company is not unnecessarily exposed to fi nancial risks and that fi nancial
information used within the business and for public reporting is reliable.
Purpose of internal control
The primary purpose of internal control activities is to help the organization achieve its objec-
tives. Typically, internal controls have the following purposes:
safeguard and protect the assets of the organization; •
ensure the keeping of accurate records; •
promote operational effectiveness and effi ciency; •
adhere to policies and procedures, including control procedures; •
enhance reliability of internal and external reporting; •
ensure compliance with laws and regulations; •
safeguard the interests of shareholders/stakeholders. •
The internal control system includes internal control activities and the structure and respon-
sibilities that relate to internal control activities. The purpose of this internal control system is
to enable directors to drive the organization forward with confi
dence, in both good and bad
times. A further purpose of the internal control system and internal control activities is to safe-
guard resources and ensure the adequacy of records and systems of accountability.
Evaluation of the control environment 293
Control environment
The Criteria of Control framework, otherwise known as CoCo, produced by the Canadian Institute
of Chartered Accountants (CICA) is a structured means of measuring the quality of the control
environment within an organization. The control environment, which the COSO ERM framework
labels as the ‘internal environment’, is a measure of the risk culture within the organization. The
view taken by the CoCo framework is that if the control environment is satisfactory, risk manage-
ment and internal control activities will be successfully and appropriately undertaken.
The structure of the CoCo framework is set out in Figure 31.1. The framework has four components,
which are represented as a continuous cycle. The components are based on a sense of direction of the
organization, a sense of identity and values, a sense of competence and a sense of evolution.
A number of organizations use the CoCo framework as a means of benchmarking compliance
with the internal control component of the COSO ERM framework. This approach will, there-
fore, be based on a framework that is a combination of CoCo and the remaining seven com-
ponents of the COSO ERM framework. Table 31.2 gives more information on the specifi c
requirements of each of the four components of the CoCo framework, as set out below:
purpose; •
commitment; •
capability; •
monitoring and learning. •
Purpose
A sense of direction.
What are we here for?
Capability
A sense of competence.
What action do we
need to take?
Monitoring and
Learning
A sense of evolution.
What progress?
What next?
Commitment
A sense of identity
and values.
Do we want to do
a good job?
ACTION
Figure 31.1 Criteria of Control (CoCo) framework
Reproduced with permission from Guidance on Control, The Canadian Institute of Chartered
Accountants (1995, Toronto, Canada).