Central Bank's Expectations on Outsourcing

Background  

The Central Bank of Ireland (the Central Bank) shared their main observations following a 2022 thematic review of the governance and oversight controls in use by (re)insurers when delegating to underwriting MGAs. The six firms inspected have received individual feedback; however, as many (re)insurance undertakings delegate underwriting and pricing duties to MGA partners in Ireland the Central Bank published a summary of the common themes and key issues found during the review.

These findings are relevant to any firm that utilises MGAs as part of their business model, and more broadly to all outsourcing arrangements.

Findings

The Central Bank found during the inspections that the level of oversight and monitoring when outsourcing and delegating critical activities to MGAs were both below the required standard and need to be enhanced. Despite the significant level of operational risk introduced to a firm when delegating activities to a third party, the specific risks emanating as a result of using an MGA were not adequately assessed by firms, or independently tested. Furthermore, the procedures relating to the monitoring of MGAs were either non-existent, incomplete, or lacking adequate detail.

Deficiencies in relation to operational systems and processes, pricing assumptions and data quality, bordereaux management and reporting have been highlighted by the Central Bank as the root cause of many past failings of this operating model.

The Central Bank observed evidence during the inspection that the governance over underwriting MGAs takes place at other forums and not typically at a Board level. Additionally, the majority of the key oversight activities of the MGAs are completed by the Operations or Delegated Authority Underwriting teams, which are often part of the wider group of the (re)insurance companies located outside Ireland.

The Central Bank reiterates its expectations on governance and management of outsourcing to MGAs, and reminds firms of their obligations under Solvency II. The Central Bank expects Boards and Senior Management to have reviewed the ample guidance available in relation to regulatory expectations and good practice when outsourcing, and ensure that they identify, mitigate and monitor the specific risks arising from these outsourcing arrangements.

Summary of Key Issues  

In particular, the Central Bank note that insurance and reinsurance undertakings using the MGA model should:

1. Enhance documentation regarding outsourcing; ensure they clearly define “critical” for Critical or Important Functions or Activities reporting purposes; include sufficient detail and linkage to other company procedures; and review on a consistent regular review cycle.
2. Include a clear reference to the risk of using an underwriting MGA partner in the key risk management documents. More specifically, including a direct reference to underwriting MGAs within the Risk Appetite Statement and Own Risk and Solvency Assessment.
3. Ensure that Risk and Compliance functions perform independent assurance testing of the controls in relation to the oversight and management of MGAs on a continuous basis as opposed to just the initial due diligence phase and high level monitoring carried out thereafter.
4. Maintain policies and procedures which are adequately documented to reflect the initial and ongoing due diligence of MGAs. More specifically, procedures should detail the roles and responsibilities of those involved in the process,in addition to the suitability and capability criteria used as part of the MGA selection and approval process, and should describe how the assessment of reputation and culture is completed.
5. Ensure that monitoring procedures sufficiently capture how current MGA arrangements are controlled on a continuous basis, versus the on boarding or renewal stage of an MGA arrangement only.In addition, ensure the Delegated Underwriting Authority Framework provides clarity and adequate detail on governance, oversight and monitoring; and comprehensively details the bordereau process, along with the roles and responsibilities of the areas involved and data controls in place.

What Next?

While the Central Bank does not prescribe next steps in relation to this it notes its expectation that (re)insurance undertakings ensure this guidance is fully applied to all outsourced activities, and in particular to all underwriting MGA arrangements. Accordingly, a practical next step would be for firms to assess its compliance via an internal audit or third party review and immediately remediate any areas where non-compliance is found.

How can we help?

Grant Thornton Ireland are well positioned to assist your firm with such a review and any Outsourcing and Solvency II related queries. With an experienced Insurance Regulatory team, including ex-CBI insurance regulators, we understand the practical operational aspects and can assist firms in the interpretation of regulatory requirements, guidance and feedback.