An insurer can price and transfer customer risk while still leaving its own balance sheet, systems, and decisions exposed. Enterprise Risk Management in Insurance helps us connect those exposures to strategy and protect our ability to serve policyholders.
We face risk through our core business and through connected financial, operational, strategic, and compliance exposures. Our approach must join practical governance, assessment, controls, and oversight.
For insurance leaders and senior management, useful risk information can shape strategic decisions before a problem harms customers. We focus on making that information clear enough to guide action across the organization.
Key Takeaways
- Connect risk decisions to the insurer’s objectives and strategy.
- Give material risks clear owners and working controls.
- Use risk appetite and tolerance to guide choices and escalation.
- Test how risks interact across underwriting, investments, and operations.
- Keep risk reporting useful to decision-makers and policyholders.
Our aim is to make risk information useful to decisions, not just a compliance record.
What Does Enterprise Risk Management in Insurance Include?
ERM gives an insurer one coordinated view of exposures that otherwise might be managed in separate functions. Enterprise-wide risk management identifies, assesses, responds to, reports, and monitors material risks.
Risk appetite is the amount and types of risk an organization is willing to pursue or retain in pursuit of its objectives. ERM connects those risks to strategy, objectives, appetite, and the insurer’s overall risk profile.
A useful ERM program makes risk information part of business decisions, not a separate exercise.
The COSO definition treats ERM as a process involving the board, management, and other personnel. It applies during strategy setting and across the enterprise.
That broad view matters because underwriting, investments, operations, and other activities depend on one another. A change in one area can raise or lower exposure elsewhere.
When we consider those links, we can see opportunities as well as threats. For example, better information about claims patterns may help us refine a product or manage an exposure.
A coordinated view also helps us compare risks that compete for capital, staff, or management attention. A risk profile becomes more useful when it reflects dependencies, not just separate department reports.
A useful ERM program makes risk information part of business decisions, not a separate exercise.
Who Owns ERM at an Insurance Company?
The board oversees the insurer’s ERM, while senior management and business-unit leaders make it operational. Clear accountability links oversight with decisions made in daily work.
Each material risk needs a leader who can make or change the decisions that shape it. Our governance structure should fit the insurer’s nature, scale, and complexity.
The board sets oversight and risk direction
The board oversees the risk management framework and asks whether it supports the insurer’s strategy. Senior management turns that direction into policies, procedures, and reporting.
Risk-based supervision assesses an insurer’s risks and helps supervisors direct attention and resources. Supervisors also consider whether the insurer’s risk management works in practice.
Solvency II governance requirements include risk management, compliance, actuarial, and internal audit functions. Their form and scope should reflect the insurer’s nature, scale, and complexity.
Senior management and business units put decisions into practice
Business-unit leaders own the risks and controls tied to their work. They need to explain changes, follow limits, and raise issues when controls fail.
Risk professionals help coordinate the work across teams and give leaders a shared view. Internal audit provides independent assurance; it does not take over management’s responsibilities.
We should make each material risk traceable to a decision-maker who can act on it.
Which Frameworks Guide Insurance ERM?
COSO ERM is a useful choice when an insurer needs to connect risk oversight with strategy and performance. It is a reference for consistent decisions, not a set of rules that fits every insurer.
We should adapt any framework to the insurer’s business and exposures. ISO 31000 offers another general risk management standard.
COSO connects risk with strategy and performance
COSO updated its Enterprise Risk Management Framework in 2017 to address changing risk complexity, emerging risks, and stronger board and executive focus on oversight and reporting.
The COSO ERM framework has five components and 20 principles. In plain terms, the components cover governance and culture, strategy and objective setting, performance, review and revision, and information, communication, and reporting.
Its examples show how organizations can connect mission, vision, and values with strategic goals. We can use that approach to link risk choices to the results our insurer seeks.
A framework should help teams use common terms and roles. It should not force an insurer to copy controls that do not fit its products, systems, or risk profile.
The five C’s are a mnemonic, not a universal rule
The five C’s are a mnemonic, not a universal risk management standard. Different organizations may use the phrase for different ideas or steps.
We should map any local version to the chosen framework’s actual controls and responsibilities. That keeps a convenient memory aid from replacing clear policies and procedures.
Use a framework as a structure for decisions, then tailor its application to the insurer’s actual exposures.
How Does the ERM Process Work?
A practical ERM cycle turns a newly identified exposure into an owned decision and a reviewable action. The working record is often a risk register.
Risk scores should support judgment, not replace it. ISO 31000 provides principles and guidelines for risk management, while assessment methods should fit the decision.
Identify and assess material risks
Teams identify risks across strategy, products, processes, systems, and external conditions. They then assess likelihood, impact, interdependencies, and existing controls.
A risk register records the exposure, its owner, assessment, and planned actions. Likelihood-and-impact scoring can help compare issues, while scenario analysis can test how several conditions might interact.
We should record assumptions and evidence beside a score. A risk matrix can support prioritization, but it cannot predict an exact outcome.
Choose a response, assign an owner, and review results
Teams can mitigate, avoid, transfer, or accept a risk. Each choice needs an owner, an action, and a review trigger.
For example, a change in claims frequency may trigger a review of pricing assumptions or underwriting limits. We should document why a risk remains within limits and what new information would change that decision.
- Identify the exposure and the objectives it could affect.
- Assess likelihood, impact, connections, and current controls.
- Respond with a documented choice and accountable owner.
- Implement controls and track the action to completion.
- Monitor changes and report results to the right leaders.
The Missouri Office of Administration offers ERM templates modeled on ISO 31000 for identifying, assessing, treating, and monitoring risks.
Record the reason for accepting a risk so the decision can be revisited when conditions change.
How Should Insurers Set Risk Appetite and Tolerance?
Risk appetite tells an insurer what kinds and levels of risk it is prepared to take in pursuit of its strategy. Risk tolerance turns that broad choice into acceptable limits for specific areas.
A tolerance statement sets quantitative and qualitative limits for material risk categories. We should link those limits to strategy and the insurer’s risk profile.
For example, appetite can guide how much underwriting exposure we seek to retain. Tolerance can set limits for a line of business, geographic concentration, or liquidity measure.
Those limits can shape underwriting authorities, investment decisions, liquidity planning, and escalation routes. Policies and procedures should make the limits part of ongoing operations.
A limit works only when it reflects relationships between risk categories and makes sense to the people making decisions. Separate limits may miss how one event affects several parts of the business.
Senior management should make limits clear enough for teams to use. A limit that staff cannot find or understand will not guide a decision under pressure.
Review limits when the strategy or risk profile changes, not only during an annual policy refresh.
Which Business Risk Categories Should Insurers Track?
Most insurers can start with seven broad categories, then add detail where their business requires it. These categories help us organize the risk register and discuss exposures consistently.
Categories are an organizing tool, not proof that risks are independent. We may track quality or technology risks separately or place them within another category.
Group risks by how they can affect objectives
Strategic risks can affect plans and business goals. Financial risks include currency, default, and liquidity exposures.
Operational risks arise from processes, people, and systems. Compliance risks involve duties under laws, rules, and contracts.
Security risks can affect data or access. Reputational risks can weaken trust, while external risks include events outside the insurer’s control.
Look for concentrations and connections between categories
A system outage can create operational, compliance, financial, and reputational effects at once. A single event may appear in several categories because it affects several objectives.
The register should show those links instead of treating each entry as a separate event. That view helps leaders spot shared drivers and exposures that collect in one area.
| Category | Typical insurer exposure | Potential consequence | Example control |
|---|---|---|---|
| Strategic | Rapid growth in one product line | Capital and staff strain | Board review of growth limits |
| Financial | Bond default or liquidity pressure | Reduced claim-paying capacity | Credit limits and cash forecasts |
| Operational | Claims platform failure | Delayed payments and service | Recovery tests and backup access |
| Compliance | Missed state reporting duty | Regulatory action or added cost | Calendar controls and sign-off |
| External | Severe storm across insured areas | Large, concentrated claims | Exposure limits and event plans |
Review concentrations across categories so separate teams do not mistake one connected exposure for several unrelated risks.
What Risks Are Specific to Insurance Operations?
Insurance risk begins with the promises an insurer makes and continues through the assets, systems, and people needed to meet them. Product choices shape the risk we accept.
Coverage, pricing assumptions, and operating controls must fit together. Poor assumptions can change claims costs and financial results.
Product design and underwriting shape accepted risk
Coverage terms, options, guarantees, and pricing assumptions set what the insurer promises and expects to pay. Distribution choices and underwriting rules affect who buys coverage and which risks enter the pool.
A product can create losses when its assumptions no longer match claims experience. Mismatched system controls can also cause staff to apply terms or prices incorrectly.
Markets, credit, liquidity, and operations affect the whole insurer
Market risk can reduce investment value, while asset-liability mismatch can leave assets out of step with expected obligations. Credit risk affects counterparties, and liquidity pressure can limit funds available for claims.
Fraud, IT failure, legal duties, compliance issues, and business continuity can also affect the insurer’s financial condition. Non-life pricing and profitability cycles typically average five to seven years.
Competition, claims experience, and catastrophic events can shift conditions during those cycles. Our insurance portfolio risk management should connect underwriting exposures with investments and claim-paying capacity.
| Exposure | Where it arises | Possible signal | Management response |
|---|---|---|---|
| Market | Interest-rate or equity changes | Asset value moves against plan | Review portfolio limits and scenarios |
| Credit | Reinsurer or issuer failure | Late payment or weaker credit | Track counterparties and exposure |
| Liquidity | Claims outpace cash inflows | Falling liquid asset coverage | Update cash forecasts and plans |
| Operational | Claims system or staff failure | Backlogs or missed service targets | Test recovery and backup processes |
Test whether product assumptions still fit actual claims, market conditions, and the insurer’s capacity to service policies.
How Do Underwriting, Reinsurance, and Investments Control Risk?
Insurers control accepted exposure through clear underwriting limits, deliberate reinsurance, and disciplined balance-sheet management. Documented controls help teams act within agreed authority.
Reinsurance can transfer exposure, but the insurer remains responsible for its own asset-liability management. That duty still applies when outside managers handle investments.
Underwriting and reinsurance manage accepted exposure
Underwriting assesses an application and decides whether to accept the risk and on what terms. Guidelines, authority levels, and retention limits set the boundaries for those decisions.
Treaty reinsurance covers risks under agreed terms for a defined group or portfolio. Facultative reinsurance addresses a specific risk or policy when the insurer seeks separate cover.
We should assess counterparty strength, concentration, and recoverability. A written reinsurance strategy should show which exposures exceed retention limits and how the insurer expects protection to respond.
Investments, claims, and asset-liability management protect capacity
Asset-liability management aligns assets with expected policy obligations, including timing and liquidity needs. Outsourcing investment decisions does not transfer the insurer’s responsibility for that alignment.
Claims controls include validation, case reserves, approval levels, and periodic reserve updates. Together, they help the insurer pay valid claims while keeping estimates current.
| Practice | Main decision | Control to document | Review signal |
|---|---|---|---|
| Underwriting | Accept, price, or decline an application | Guidelines and authority limits | Exceptions or loss trends rise |
| Reinsurance | Choose coverage above retention | Treaty terms and counterparty checks | Recoveries slow or concentration grows |
| Investments and ALM | Match assets to policy obligations | Mandates, limits, and cash forecasts | Duration or liquidity gap widens |
| Claims | Validate and settle a claim | Reserve reviews and approval records | Backlogs or reserve changes increase |
Check that reinsurance protection and claims reserves remain adequate as exposures and experience change.
What U.S. Insurance Filings Support Risk Oversight?
U.S. insurer filing obligations depend on state law, because each state decides whether to enact NAIC model laws and regulations. Applicability varies by state and adoption status.
The ORSA Summary Report filing date varies by state, while the Corporate Governance Annual Disclosure is due June 1 in adopting states.
State insurance regulators oversee insurers under their own laws. The NAIC develops model laws and regulations, but a model applies only when a state adopts it.
The Own Risk and Solvency Assessment, or ORSA, is an insurer’s own risk and solvency review. The NAIC ORSA Guidance Manual guides reporting, and each state requires an ORSA Summary Report.
Form F is an Enterprise Risk Report used in states that adopted the updated Holding Company Model Act. Corporate Governance Annual Disclosure applies in states that adopted its Model Act.
| Filing | Applicability | Deadline |
|---|---|---|
| ORSA Summary Report | Required by each state | Filing date varies by state |
| Form F Enterprise Risk Report | States adopting the updated Holding Company Model Act | Filing date varies by state |
| Corporate Governance Annual Disclosure | States adopting its Model Act | June 1 |
For the 2025 data-year calendar, June 1 is the Corporate Governance Annual Disclosure deadline in states that adopted the respective Model Act. The date does not apply to every state.
Verify the applicable state’s calendar and adoption status before setting a filing control.
How Should Insurers Govern AI and Vendor Risk?
An AI tool can create customer and compliance exposure even when a vendor built or operates it. Traceability helps us understand what a system does and who is accountable.
Controls should match each system’s use and potential impact. An insurance chatbot, for example, can create accuracy, privacy, fairness, and vendor risks.
In 2026, the NAIC Model AI Bulletin had been adopted in more than 24 U.S. states. In those settings, insurers were expected to maintain a formal, documented AI systems program.
That program includes model traceability and governance, proactive fairness and bias monitoring, and third-party vendor oversight. These controls help us see how a model works and whether its results create unfair effects.
Vendor oversight matters because a supplier may change a system, its data, or its security practices. We need clear records of system purpose, testing, approvals, and changes.
A chatbot that shares general policy information may need different checks than a model that affects coverage or pricing. Privacy safeguards and human review should reflect the system’s role.
Keep an accountable insurer owner for AI systems, including those supplied by outside vendors.
How Do Stress Tests and Scenario Analysis Improve Decisions?
A stress test asks what happens to the insurer’s capacity when conditions move beyond the assumptions in its current plan. Scenario analysis helps us consider several connected events.
Test results should challenge assumptions and inform action, not predict one exact outcome. Stress testing and scenario analysis can use both quantitative and qualitative methods.
Sensitivity analysis changes one factor, such as interest rates, to see how results move. Stress testing measures the effect of severe conditions, while scenario analysis connects several events into a plausible story.
For example, one scenario can combine market disruption, catastrophe claims, liquidity pressure, and an operational interruption. The combined effect may differ from each event tested alone.
Continuity analysis looks beyond the longer horizon often used in regulatory capital calculations. It asks whether the insurer can keep operating and meet its strategic plans as its future financial position changes.
We can use results to adjust limits, plans, or resources. A scenario also helps show when an existing response may fail or when leaders need to act sooner.
Give each material scenario a decision threshold and a named owner for the response.
How Can an Insurer Build an ERM Program?
An insurer can build ERM by starting with its objectives and current decisions, then adding only the structure needed to improve them. A workable program fits the insurer’s nature, scale, complexity, and risk profile.
Start with decisions the organization needs to make, not a complex scoring system. A documented risk management policy can connect categories, tolerance limits, capital requirements, and monitoring methods.
Establish governance, objectives, and a baseline
We should set objectives, name accountable leaders, and inventory current controls and reporting. That baseline shows which parts already work and where gaps affect decisions.
Choose an ERM framework suited to the insurer’s scale and complexity. The structure should clarify responsibility without adding steps that do not improve oversight.
Embed the process in business decisions
Assign risk owners and connect policies and procedures to tolerance limits. Define escalation routes so staff know when an issue needs attention beyond their team.
Training should use real work, not just policy summaries. We can test the process through a product, investment, or underwriting decision and adjust it based on what happens.
- Establish governance and name accountable leaders.
- Map objectives, exposures, and existing controls.
- Set appetite and tolerances that guide decisions.
- Assign controls, owners, and escalation routes.
- Review evidence and improve the process.
Pilot the process on a material business decision before extending it across the organization.
How Should Insurers Monitor and Report Risk?
Risk reporting only supports a decision when the information is timely, reliable, and matched to the reader’s role. Good monitoring gives teams a way to act as the risk profile changes.
Operational teams need actionable detail, while the board needs material exposures, changes, and decisions. A useful feedback loop joins data, management processes, and objective assessment.
Key risk indicators can show whether exposures approach a threshold. Control testing, incident and near-miss reports, and trend reviews add evidence about how the insurer’s controls work.
Escalation thresholds should prompt timely action. Board reporting should stay concise and show the material change, its effect, and any decision required.
Internal audit evaluates governance and control effectiveness independently. It offers assurance, but management retains ownership of controls and corrective actions.
- Confirm that the data is accurate and current.
- Compare indicators with approved thresholds.
- Test controls and record any failures.
- Escalate material changes through agreed routes.
- Record decisions, owners, and follow-up dates.
Record the action taken after each material escalation so the feedback loop can be tested.
What Do Insurance Risk Management Examples Look Like?
An insurer’s ERM becomes tangible when leaders can trace a business decision from exposure to control and review. Hypothetical examples can help us test that path without claiming they describe real companies.
Insurance ideas for new products should be screened against appetite and operating capacity, not just market opportunity.
- Coastal property concentration: A rise in policies along one coast could exceed underwriting limits. Leaders can review those limits and test whether reinsurance still matches the exposure.
- Claims-system outage: A system failure could delay claim payments and service. Leaders can check continuity controls, escalation steps, and recovery testing.
- New insurance product: A proposed product can prompt review of coverage, pricing assumptions, distribution, systems, and solvency scenarios. Those checks can reveal gaps before launch.
Useful insurance topics for a presentation include underwriting concentration, reinsurance, claims continuity, AI governance, and ORSA. These topics connect strategy with everyday choices across product development, underwriting, investment management, claims, and distribution.
We should also ask whether control owners can show evidence that their actions work. A written plan alone cannot show how teams respond during a disruption.
Use a scenario to test ownership and actions, not to claim that one control eliminates the risk.
What Should an ERM Maturity Review Test?
A mature ERM program is demonstrated by decisions and evidence, not by the length of its policy documents. Evidence of use shows whether people follow the process.
Review accountability, links to objectives, control evidence, reporting, and changes made after lessons emerge. A documented policy is not proof that the process works.
The IIA Three Lines Model distinguishes governing body oversight, management roles, and independent internal audit. COSO ERM and ISO 31000 also offer established reference frameworks for reviewing risk practices.
Management keeps ownership of risks and controls. Internal audit can provide independent assurance about whether governance and controls operate as intended.
- Governance: Are decision rights and oversight clear?
- Strategy alignment: Do material risks connect to objectives?
- Risk ownership: Can leaders identify who acts?
- Control operation: Do records show controls in use?
- Response to findings: Do lessons lead to changes?
Track each review finding to an accountable owner and a completed corrective action.
Look for evidence in decision records, control tests, and follow-up actions. Track each review finding to an accountable owner and a completed corrective action.
Conclusion
Strong ERM helps an insurer understand what it is taking on and act before connected risks undermine its objectives. Enterprise risk management should support informed risk-taking in service of strategy.
We can start with one material business decision and trace its risks, limits, owner, controls, and reporting. That test shows whether our information reaches the people who need to act.
Choose one upcoming decision, document its risk owner and tolerance, and review whether the controls deliver the information leadership needs.