Hong Kong Insurance Authority changes guidance on governance – what you and your board need to know

Changes effective January 1, 2017

Change

Action item

Spread and level of expertise in Board
It is advisable for the Board to have an adequate spread and level of expertise in key areas of insurer’s business, such as underwriting, claims, actuarial, finance, and investment (paragraph 4.2.2).

Consideration to be given to the composition of your board of directors and whether your existing board has an adequate spread and level of expertise in the areas most relevant to your business.

Chairman/chief executive
The role of Chairman and chief executive should not be performed by the same person (paragraph 4.4.1).

If your board is currently chaired by your chief executive, a new Chairman will need to be appointed.

Fair treatment of policy holders
When setting business objectives and strategies, the board should consider the fair treatment of policy holders as well as the long term financial soundness of the insurer and the legitimate interests of its stakeholders (paragraph 5.1.1(a)).

Boards need to keep policyholders front of mind when setting business objectives and strategies. GN10 indicates that the Hong Kong regulator’s intention is that policy holder interests should be considered a board issue as well as a regulatory issue.

Review of committees
The Board should review its committees, at least annually, to ascertain whether the members of the committees collectively and individually remain effective in discharging their responsibilities (paragraph 6.7.1).

Schedule at least an annual review of any committees to assess and consider the effectiveness of the committee and its members.

Chair of the audit committee
An independent non-executive director (INED) should chair your audit committee (paragraph 8.4.2).

Consider appointing an INED as chair of the audit committee, if an INED does not currently hold that role.

Cyber security
Insurers are encouraged to have policies and procedures in place to identify, prevent, detect and mitigate cyber security threats (paragraph 7.17.1).

To the extent not already in place, consider adopting a cyber security policy commensurate with the scale and complexity of your business.

Business continuity planning
It is suggested that insurers should have a business continuity policy and a business continuity plan for both going-concern and gone-concern situations. The policy and plan should identify viable measures and actions the insurer can take to restore its business activities under different stressed conditions or by way of precautionary measure (paragraph 7.18.1).

Consider adopting a business continuity policy and a business continuity plan.

Changes effective January 1, 2018

Change

Action item

Standalone risk committee*
Insurers will need to have separate audit and risk committees (paragraph 8.2).

If you currently have a combined audit and risk committee you will need to consider when you split them into separate  committees and which personnel will sit on each. If you currently have only an audit committee you will need to establish a risk committee. Terms of reference for the risk committee will need to be prepared.

INEDs*
From January 1, 2018, the number of independent directors sitting on your board will need to increase from 1/5th to 1/3rd (paragraph 4.2.3).

Across the market this will result in much greater demand for INED services. Consider approaching any additional INED(s) in advance.

Remuneration
Insurers will need to have a written remuneration policy which “should not induce inappropriate or excessive risk taking” (paragraph 9.1).

The remuneration policy should motivate directors and employees to pursue the long-term growth and success of the insurer and demonstrate a clear relationship between performance and remuneration (paragraph 9.2.3).

If you do not currently have a remuneration policy, you will need to adopt one. If you already have a remuneration policy, it will need to be reviewed for compliance with the revised guidance note.

Changes effective when section 13AE of the ICO commences

Change

Action item

Fit and proper persons in “control functions” Whilst GN10 envisages delegation, insurers will need to satisfy themselves, and the IA, that any persons solely or jointly responsible for the performance of a “control function” are fit and proper. For these purposes “control functions” include actuarial, financial control, internal audit, compliance, risk management and intermediary management functions (paragraph 4.6).

The IA’s prior consent will need to be obtained before a senior executive who will carry out a control function is appointed, so additional time will need to be factored in when an appointment is proposed.