Solvency II:The captive guide to Pillar IIFinding a way to formalise a fit-for-purpose and proportionate Governance and Risk Management System

Aon Risk SolutionsGlobal Risk Consulting

Contents

Introduction 3

The Pillar II context 4

How to address it 7

A structured approach 8

It’s all about consistency 9

Conclusions and Aon catalysts 10

Solvency II: The captive guide to Pillar II Solvency II: The captive guide to Pillar II 1 2

IntroductionInitially the new regulatory requirements coming from the Solvency II Directive were presented as the most significant threat captive owners would ever have to face. A collapse of captive domiciles in the EU was predicted based on various arguments such as inadequacy between the underlying purposes of the new regime and the captives’ specificities; increased capital requirements; uncontrollable and unmanageable governance processes and higher management costs.

From our perspective at Aon, all of these arguments missed a couple of crucial points, the main one being the balancing act between the added value of a captive and the weight of the extra workload introduced by Solvency II.

So, what’s the position a few years on? In Luxembourg and elsewhere, although there are still a lot of uncertainties to be tackled, it is fair to say that it has not resulted in mass captive shut down or exit to less demanding domiciles. There will inevitably be some that do, but from a global perspective the EU captive market has held up well and is working hard to achieve compliance with the Solvency II requirements.

That said, this observation should not mask the lobbying efforts that still have to be undertaken by all captive market stakeholders to ensure a more fit-for-purpose regulatory framework in areas of Pillars 1 and 3.

Pillars I and II are on trackOn January 19th 2011, the European Commission proposed the Omnibus II Directive, suggesting changes to the Solvency II Directive , including:

n Describing the purpose and authority of EIOPA ;

n Enabling the European Commission to introduce transitional periods for specific areas ;

n Postponing the implementation into national law.

In the most recent Directive text, Member States are postponing national implementation to 31st March 2013 with enforceability as at 1st January 2014. Articles relating to supervisory approval would then become effective from 1st July 2013 and regulated entities will need to provide their supervisors with “an implementation plan providing evidence of progress made” by 1st July 2013.

It should be noted, however, that Omnibus II discussions are still in progress and that it is expected to be adopted by the European Council and by the European Parliament in the coming months only following the so called “ex-ante” approach. Indication of a postponement of implementation date to either 2015 or 2016 should be confirmed soon. It is however our understanding that a number of member states are now pushing for a January 1, 2016 implementation date to ensure that industry has sufficient time to prepare.

As the main European Union captive domicile, Luxembourg is obviously at the forefront of this working process and of the development of specific approaches to help captives on their journey towards compliance.

For example, the Luxemburg insurance regulator (Commissariat aux Assurances, “CAA”) has indicated that calculations of the different Pillar I components of Solvency II will be progressively introduced in the annual reporting requirements.

In particular the following requests have been issued:

n In 2011, the completion of a table containing the Best Estimate of reserves based on 2010 accounts was requested for all companies ;

n In 2012, captive undertakings had to prepare a trial balance sheet compliant with Solvency II rules and perform the calculation of the Basic Solvency Capital Requirement (“BSCR”) ;

n In 2013, the CAA will be expecting calculations of the Risk Margin and of the total Solvency Capital Requirement (“SCR”) by adding the operational risk and adjustments for the loss absorbing effect of technical provisions and deferred taxes to the BSCR. In addition, classification of own funds by tiers and determination of the level of eligible own funds will be required.

Similar request around SCR calculation, risk appetite statements, governance clarification, risk management and ORSA have also been issued by regulators across Europe including Ireland, Germany, Netherlands and Malta.

These initiatives are clearly aimed at having a well-prepared market. By increasing the focus on understanding, integrating and implementing the changes required, Solvency II has significantly changed the way (re)insurance undertakings have to assess their risk and solvency position.

However, one must keep in mind that the quantitative aspects of Solvency II are only one part of the challenge. Governance, risk management and reporting issues (as described in the second and third pillars) must also be addressed.

The Pillar II contextSupervisors have started to elevate the significance of Pillar II compliance as a foundation block of Solvency II: firms under this new regulation will need to put in place a governance framework with the processes and controls in order to assess, manage and monitor their risks and related solvency assessment.

The Pillar II requirements are set out in nine articles [Exhibit 1] and describe what an a ppropriate risk and governance system insurance and reinsurance undertakings will be required to implement.

[Exhibit 1] A consistent set of articles

Solvency II: The captive guide to Pillar II Solvency II: The captive guide to Pillar II 3 4

Pillar IIKey articles

Article 49Outsourcing

Article 48Actuarial Function

Article 42 &43Fit &Proper

Requirements

Article 47Internal Audit

Article 44Risk Management

Article 41General Governance

Requirements

Article 46Internal Control

Article 45Own Risk &

Solvency Assessment

Article 41 General Governance RequirementsFirms will be required to have in place an effective system of governance which provides for sound and prudent management of the business. That system shall at a minimum include a transparent organisational structure with a clear allocation of responsibilities and segregation of duties, and an effective system for ensuring the transmission of information across reporting lines. Governance rules shall be documented, approved by the board and regularly reviewed (at least once a year). These requirements are directly related to articles 42 to 49 as detailed in the following sections.

The Principle of Proportionality enables firms to apply these requirements in accordance with the size, nature and level of complexity of their operations.

Articles 42 and 43 Fit & Proper RequirementsFirms shall ensure that all persons who run the undertaking or have other key functions will fulfill the following requirements at all times:

n Their professional qualifications, knowledge and experience are adequate to enable sound and prudent management (fit) ;

and

n They are of good repute and integrity (proper).

Firms will be required to notify the supervisory authority of any changes to the identity of the persons who effectively run the undertaking, along with the information needed to assess whether any new persons appointed to manage the undertaking are fit and proper.

Article 44 Risk ManagementFirms shall have in place an effective risk management system encompassing at least following risk categories:

n Underwriting & reserving ;

n Asset and liability management ;

n Investments ;

n Liquidity & concentration risk management ;

n Operational risk management ;

n Reinsurance & other risk mitigation techniques.

An effective risk management system shall encompass strategies, processes and reporting procedures necessary to identify, measure, monitor, manage and report the risks to which the company could be exposed.

Interdependencies between the risks will need to be taken into account. It should cover the risks included in the calculation of the Solvency Capital Requirement (Pillar I) as well as the risks which are not or not fully included in the calculation thereof.

The system should be documented, regularly reviewed and fully integrated into the decision making process of the undertaking. Solvency II requires a specific Risk Management Function (RMF) to be in charge of ensuring the risk management system remains suitable.

For firms using a partial or full internal model, the risk management function is responsible for the design, implementation and validation of the model.

Article 45 Own Risk & Solvency Assessment (ORSA)As part of its governance and risk management system every (re)insurance undertaking shall conduct its own risk and solvency assessment that shall include at least:

n The current and future solvency needs taking into account the specific risk profile, the business strategy and risk appetite of the firm as defined by the Board ;

n The compliance, on a continuous basis, with the capital and technical provisions requirements as detailed in Pillar I ;

n The significance with which the risk profile of the undertaking deviates from the assumptions underlying the SCR in Pillar I.

The ORSA process shall assess the economic capital requirements for all risks that the firm is exposed to by considering:

n Quantitative capital requirements over a 1-year time horizon (SCR) ;

n Quantitative capital requirements for greater than a 1-year time horizon (to reflect the business planning cycle) ;

n The risks not included in the SCR.

The undertaking shall have in place processes which are proportionate to the nature, scale and complexity of the risks inherent to the business and will enable proper identification and assessment of the risks it faces in the short and long term and to which it is or could be exposed.

The undertaking shall demonstrate the methods used in that assessment. The own-risk and solvency assessment shall be an integral part of the business strategy and shall be taken into account on an ongoing basis in the strategic decisions of the undertaking.

Firms should perform this assessment regularly (at least once a year) and without any delay following any significant change in their risk profile, for example :

n Changes to the business strategy ;

n Large losses during one fiscal year ;

n Shocks to the financial markets.

All stages of the ORSA process shall be clearly documented, and independently peer reviewed.

This documentation must be made available to the regulator. The ORSA is a new specific regulatory requirement. It is therefore unsurprising that there will be a significant gap between current undertakings’ readiness and this new Solvency II item.

Article 46 Internal ControlInsurance and reinsurance undertakings shall have in place an effective internal control system which should include at least:

n Administrative and accounting procedures ;

n Compliance with the law ;

n Impact on any change in the legal environment ;

n Identification and assessment of non compliance risk.

There shall be defined procedures and processes in place with clear designated lines of responsibility and reporting arrangements. The importance of internal control shall be emphasised and demonstrated to all levels of personnel through a detailed written policy approved by the Board.

Articles 47 Internal AuditAn independent internal audit function is required with a remit, of at least, assessing the adequacy and effectiveness of the Internal Control system (Article 46) and the remaining elements of the Governance system (Article 41).

Any findings and recommendations from internal audit shall be reported to the administrative, management or supervisory body which shall determine what actions to be taken with respect to each of the internal audit findings and recommendations and shall ensure that those actions are carried out.

Article 48 Actuarial FunctionThis article has been designed to ensure that undertakings’ decisions are based on expert actuarial advices.

The actuarial function shall provide the Board at least annually a report which not only contains details of the appropriateness of the underlying methodologies, models and assumptions used in the calculation of technical provisions, but which enables the Board to judge the impact and adequacy of the underwriting policy, reinsurance arrangements and the management of the identified risks.

Article 49 OutsourcingUnder Solvency II (re)insurance undertakings shall remain fully responsible for discharging all of their obligations when they outsource functions or activities.

All functions or activities can be outsourced, either internally (parent or sister company) and externally bearing in mind the Fit & Proper Requirements and the need for independence (Internal Audit). Only the mind and management of the company i.e. the Board of Directors cannot be outsourced.

The supervisory authorities shall be notified prior to the outsourcing of critical or important functions or activities as well as of any subsequent material developments with respect to those functions or activities.

Solvency II: The captive guide to Pillar II Solvency II: The captive guide to Pillar II 5 6

Taking each article individually:

How to address itDefine a target operating modelConsequently, the key principles underlying these requirements can be summarised as follows:

n Set a transparent organisational structure ;

n Clearly assign roles and responsibilities within the organisation ;

n Document policies to identify, measure, monitor and mitigate the risks the company is exposed to ;

n Clarify key processes and the Internal Control System ;

n Provide effective internal audit, risk management, actuarial and compliance functions ;

n Ensure the organisation is adequately capitalised both now and over the business planning period.

Whilst compliance with these new requirements sounds straightforward the difficulty for captives in particular is that there is no roadmap detailing what has to be done in practice and how it should be approached. Contrary to Pillar I and the calculation of SCR, Pillar II is principles based and the exact way it is implemented in insurance and reinsurance undertakings relies essentially on the individual Board’s decisions.

More than a gap analysisAon has performed numerous gap analyses against the Pillar II requirements for (re)insurers in the past.

Whilst the resulting action plan did bring clarity on the missing pieces of the puzzle, we have learnt that it is not easy for a captive to take a long list of gaps and implement solutions without a structured framework.

Simplifying without reducingFirst and foremost, the implementation of Solvency II should respect the principle of proportionality which states that the Solvency II requirements should be implemented according to the nature, size and complexity of the undertaking. Proportionality will be applied by supervisors on a case by case basis. A more prescriptive definition of proportionality at an EU level would be counter-productive as it would effectively hinder the ability of regulators to deal with the specific circumstances of each undertaking.

Obviously, the extent of flexibility that each national regulator has still needs to be clarified, however there is no doubt that the principle of proportionality will be applied to captives.

That said, proportionality is hard to define and does not mean fewer requirements but a potential simplification of how an undertaking achieves the objectives of the Solvency II articles. In other words: captive undertaking must comply with all requirements but should simplify their approach in the way they fulfill them collectively.

As such, the motto should be “simplifying without reducing”. The success factors of an efficient implementation are to define a clear target operating model and to adopt a structured approach.

Solvency II: The captive guide to Pillar II Solvency II: The captive guide to Pillar II 7 8

[Exhibit 2] What are the challenges?

A structured approachIn order to meet the aforementioned challenges, captives need to schedule and clearly define a structured approach. In this way captive owners can ensure a cost efficient and proportional implementation plan which matches their operational requirements. The proportional approach Aon has developed over the last three years in working with captive owners is an efficient tool for achieving this.

Creating a compliant but proportionate System of Governance is achievable in many ways but in our experience one sound and efficient methodology is to structure the approach around four key deliverables [Exhibit 3] addressing all aspects of the Pillar II articles:

1. An overall strategy and governance framework summarising the undertaking’s strategic objectives, the related governance principles and including an adequate and transparent organisational structure proportionate to the size and complexity of the company.

2. A risk management system which defines, details and formalises the Risk Appetite of the undertaking, the consecutive risk policies and relevant roles and responsibilities.

3. A process & control architecture defining the high-level processes required to manage the undertaking. This architecture will underpin the principles and functioning of the internal control system embedded within the operations through a clear mapping of key processes and related controls.

[Exhibit 3] Four key deliverables

4. A risk register listing the material risks to which the undertaking is exposed to and which threaten its strategic objectives as well as how they are measured and mitigated. The Risk Register will also be the main trigger to the ORSA process.

Proportionality is arrived at through a strong focus on content by mapping all of the requirements to the real but simple organisational framework and operating processes of the undertaking.

By following this approach, captive undertakings are able to ensure consistency [Exhibit 4 on next page] and proportionality; structure the implementation and documentation process; reach a full Solvency II compliant operating model including the ORSA process, Internal Control System, Risk Management, Internal Audit, Compliance and Actuarial functions as well as all of the other requirements of Solvency II. In addition, this approach will facilitate the on-going monitoring and maintenance requirements once implemented.

Compliance

Internalcontrolsystem

Overallstrategy &

governance

Risk management

system

Process &control

architecture

Riskregister

Existing situation Target situation

Implementation process

Businessobjectives Risk policies

Etc.

Risk management

Internal auditOperational procedures

The key objectives underlying our methodology are to:n

Ensure consistency and proportionalityn

Avoid overlapping workstreamsn

Identify and create missing parts (policies, procedures, etc.)n

Structure the implementation and documentation processn

Reach a full Solvency II compliant operating model including the ORSA process, Internal Control System, Risk Management, Internal Audit, Compliance and Actuarial functions as well as all other compulsory items required by the upcoming regulationn

Facilitate monitoring and updates

n Consistency between

the strategy, risk processes and day to day operationsn

Embedded risk management systemn

Sound formalisation and documentationn

Clear and efficient reporting channelsn

Strong management oversightn

Segregation of dutiesn

In-depth control environment

n Ensure consistency

n Avoid endless writing of

policies and guidelinesn

Escape labyrinthine and uncontrollable implementation programmesn

Use a structured approachn

Be cost efficientn

Apply the principle of proportionalityn

Easy ongoing maintenance

Functionsn

Internal auditn

Actuarial functionn

Risk managementn

Compliance

Systemsn

Internal controln

Risk management

Principlesn

Fit and propern

Segregation of dutiesn

Management oversight

Documentation and formalisationn

Policiesn

Guidelines

Processesn

Business processesn

ORSA

Key features Key challengesNumerous and various requirements

Aon catalystsPractical experienceHaving already been involved in more than 50 Pillar II implementation projects, we have gained strong experience and identifi ed a number of ineffi cient tracks to be avoided.

TemplatesBased on our numerous projects, we have produced several templates enabling us to accelerate the formalisation process.

Outsourcing solutionsAon will provide captive companies with fi t-for-purpose outsourcing solutions with regard to Risk Management, Actuarial and Internal Audit functions.

Governance, Risk Management and Compliance platform (GRC)Based on the framework described in this document, Aon’s captive management division is currently developing a GRC platform to ease the ongoing management and maintenance of the governance system for our captive clients.

LobbyingSince the very beginning, Aon has been strongly involved in lobbying activities both directly and in close co-operation with ECIROA and FERMA. Within this context, we have put forward the captive sector’s need for proportionality and have gained a deeper understanding of European regulators’ expectations.

It’s all about consistencyThe cornerstone of success in achieving such a scalable, proportionate, cost-eff ective and compliant implementation is really to focus on consistency across the System of Governance.

Solvency II is intended to result in a “system”, and not a specifi c set of documents. A system is a group of interacting, interrelated, or interdependent elements forming a complex whole, which need to be consistent in order to be effi cient.

Our methodology provides consistency in the following ways:

n Defi ning explicitly the key components in order to gain uniformity across the whole system ;

n Both the setting-up and day-to-day functioning of the system are based on logical chains to ensure effi ciency ;

n Specifying the high-level business process architecture which recognises the way all parts of the system interact with each other ;

n Maintaining consistent defi nitions across all components.

In our view, this approach is the only way to avoid unnecessary expense and keep the project under control.

[Exhibit 4] It’s all about consistency

Key insightsn Keep it proportionate and fi t-for-purpose

n Focus on consistency

n Set up a System of Governance, not an endless set of policies and procedures

n Think about business constraints and ongoing maintenance

Aon’s methodology helps you ton Have a governance framework which is fi t-for-purpose and compliant with all Solvency II governance requirements

n Develop a Solvency II framework which is proportionate to the scale, nature and complexity of the captive company

n Reduce the operational workload due to Solvency II implementation and monitoring by adopting this functional and pragmatic approach linked to corporate needs

n Ensure that any evolution of the company (moving towards an internal model, changes in regulation or strategy, etc.) can be easily incorporated into the governance framework already implemented

ConclusionsOne of the main pitfalls in launching a Pillar II implementation plan is to consider all of the requirements separately and attempt to manage the complexity of multiple projects and sub-projects and their interdependencies. In our view, such an approach creates unnecessary expense, an unwieldy overall plan which is diffi cult to complete.

Aon’s approach sets out to demonstrate that with a sound and consistent methodology, the various Solvency II requirements can in many cases be met without having to go signifi cantly beyond current best practices. In addition, we have seen a number of companies gain additional benefi ts by implementing a System of Governance due to the enhanced insight it derives which in turn strengthens their business strategy. In essence, the perceived threat of Solvency II compliance has resulted in unexpected advantages.

Pillar II implementation should not be about…n Piling up endless policies and procedures ;

n Considering the various requirements in isolation ;

n Building on existing internal control or risk management processes without a clear target operating model ;

n Juggling control of multiple projects and sub-projects ;

n Creating over complicated risk management procedures and processes.

… but without any doubt, it must be aboutn Defi ning a target Governance operating model ;

n Improving Risk Management and Governance principles at undertaking level ;

n Improving the visibility of the Board on the operations of the entity and the risks it faces ;

n Linking risk and capital management to ensure solvency in the future ;

n Keeping the necessary fl exibility in business operations ;

n Mixing top-down and bottom-up approaches ;

n Developing practical processes, nothing more, nothing less.

Solvency II: The captive guide to Pillar II Solvency II: The captive guide to Pillar II 9 10

Risk register

Risk appetite

Operational - Support - Monitoring ORSA

Risk policies Internal control

Roles & responsibiltiesInternal

auditProcesses� Key functions� Fit & proper� Outsourcing

Governance

Strategy

Contact informationTo receive additional information please contact:

LuxembourgFabrice FrèreManaging Director +352.22.34.22.402fabrice.frere@aon.lu

IrelandMichael SpellmanAssociate Director +353.12.66.60.45michael.spellman@aon.ie

NetherlandsMichiel van KlingerenSenior Consultant +31.10.44.87.748 michiel.van.klingeren@aon.nl

SwedenMartin PerssonManaging Director +46 8 614 17 19martin.persson@aon.se

SwitzerlandBenjamin JacobDirector +41.61.206.06.72 benjamin.jacob@aon.ch

AuthorsLaurent NihoulAssociate Director +352.22.34.22.404laurent.nihoul@aon.lu

Jean-Michel BriotAssociate Director +352.22.34.22.401 jean-michel.briot@aon.lu

About AonAon plc (NYSE: AON) is the leading global provider of risk management, insurance and reinsurance brokerage, and human resources solutions and outsourcing services. Through its more than 61,000 colleagues worldwide, Aon unites to empower results for clients in over 120 countries via innovative and effective risk and people solutions and through industry-leading global resources and technical expertise. Aon has been named repeatedly as the world’s best broker, best insurance intermediary, reinsurance intermediary, captives manager and best employee benefits consulting firm by multiple industry sources. Visit www.aon.com for more information on Aon and www.aon.com/manchesterunited to learn about Aon’s global partnership and shirt sponsorship with Manchester United.

Aon UK Limited is authorised and regulated by the Financial Services Authority in respect of insurance mediation activities only.

Registered Office: 8 Devonshire Square, London, EC2M 4PLRegistered in London No.210725 VAT Registration No.480 48

© Copyright 2012 by Aon Global Risk Consulting. All rights reserved.

FP 7695

About Aon Global Risk ConsultingWith more than 2,000 risk professionals in 50 countries worldwide, Aon’s Global Risk Consulting practice delivers a fully integrated range of risk management solutions designed to optimise the risk profile of our clients. Our risk consulting professionals deliver actuarial & analytics, enterprise risk management, forensic accounting, crisis management consulting and risk financing solutions. Our risk control, claims and engineering practice provides expertise in property and casualty risk control, claims consulting, fire protection and energy risk engineering. Our captive & insurance management experts are widely recognised as one of the leading captive managers, with local capabilities in over 30 countries.

Within the Solvency II context, we provide highly advanced and specialised advice in the areas of risk management, risk and capital modelling, corporate governance, operational efficiency and actuarial services.

We have performed more than 80 Quantitative Impact Studies (QIS5), and subsequently more than 100 SCR calculations according to the Draft Level 2 Implementation Measures.

We have also supported many insurance and reinsurance companies in designing and implementing relevant actuarial, risk and governance processes. The development of our proportional approach outlined during this presentation is based on more than 50 Pillar II implementation projects throughout European Union countries.