Sun Life 2012 Annual Report Download - page 69

• Board approved maximum retention limits (amounts issued in excess of these limits are reinsured).
• Various limits, restrictions and fee structures are introduced into plan designs in order to establish more homogeneous policy risk
profile and limit potential for anti-selection.
• Enterprise underwriting and risk selection standards with oversight by corporate underwriting and claims risk management function.
• Diversification and risk pooling is managed by aggregation of broad exposures across product lines, geography, distribution
channels etc.
• Company specific and industry level experience studies and Source of Earnings analysis are monitored and factored into ongoing
valuation, renewal and new business pricing processes.
• Stress-testing techniques, such as DCAT, are used to measure the effects of large and sustained adverse movements in insurance
risk factors.
• Reinsurance ceded policy establishes acceptance criteria and protocols to monitor the level of reinsurance ceded to any single
reinsurer or group of reinsurers. Our reinsurance counterparty risk profile is monitored closely, including through annual reporting to
the Risk Review Committee of the Board.
We use reinsurance to limit losses, minimize exposure to significant risks and to provide additional capacity for growth. Our
Underwriting and Claims Liability Management Policy sets maximum global retention limits and related management standards and
practices which are applied to reduce our exposure to large claims. Amounts in excess of the Board approved maximum retention limits
are reinsured. Our maximum global retention limits are unchanged from 2011. On a single life or joint-first-to-die basis our retention
limit is $25 million in Canada and is US$25 million outside of Canada. For survivorship life insurance, our maximum global retention
limit is $30 million in Canada and is US$30 million outside of Canada. In certain markets and jurisdictions retention levels below the
maximum are applied. Reinsurance is utilized for numerous products in most business segments, and placement is done on an
automatic basis for defined insurance portfolios and on a facultative basis for individual risks with certain characteristics. Reinsurance
is used to provide catastrophic mortality and morbidity coverage for the Canadian GB business.
Our reinsurance coverage is well-diversified and controls are in place to manage exposure to reinsurance counterparties. Reinsurance
exposures are monitored to ensure that no single reinsurer represents an undue level of credit risk. While reinsurance arrangements
provide for the recovery of claims arising from the liabilities ceded, we retain primary responsibility to the policyholders.
Operational Risk
Risk Description
Operational risk is the uncertainty arising from larger than expected losses or damage to finances or reputation resulting from
inadequate or failed internal processes, controls, people, systems, or from external events. Operational risk is naturally present in all of
our business activities and encompasses a broad range of risks, including those pertaining to legal and regulatory compliance,
business interruption, model risk, information system security and privacy, outsourcing, theft and fraud, environmental risk, human
resource management, liquidity risk, processing errors, complex modelling and damage to physical assets. Operational risk
management is embedded in the practices utilized to manage other risks and, therefore, if not managed effectively, operational risk can
impact our ability to manage other key risks such as credit risk, market, liquidity and insurance risk.
Operational Risk Management Governance and Control
Our governance practices, corporate values, Code of Conduct and enterprise-wide approach to managing risk set the foundation for
mitigation of operational risks. Our Code of Conduct sets the tone for a strong ethical culture, and we regularly review and update the
Code of Conduct to ensure that it continues to meet the expectations of regulators and other stakeholders. All our employees must
reconfirm annually their understanding of and commitment to comply with the Code of Conduct.
We enhance this foundation by establishing appropriate internal controls and systems, compensation programs, and by seeking to hire
and retain trained and competent people throughout the organization. We align compensation programs with business strategy, long-
term shareholder value and good governance practices, and we benchmark them against peer companies. We perform ongoing
monitoring and reporting of all significant operational risks, including regular briefings to senior management and Board Committees. In
addition, operational risk taxonomy has been developed for establishing consistency in our operational risk practices.
Through our corporate insurance program, we transfer a portion of our operational risk exposure by purchasing enterprise and local
insurance coverage that provides some protection against unexpected material losses resulting from events such as criminal activity,
property loss or damage and liability exposures, or that satisfies legal requirements and contractual obligations.
The following is a description of enterprise risk management programs for key operational risks that could materially impact our ability
to do business or our reputation.
Legal and Regulatory Risk
As a result of our global activities, we are subject to extensive regulatory oversight by insurance and financial services regulators in the
jurisdictions in which we conduct business. Failure to comply with applicable laws or to conduct our business consistent with changing
regulatory or public expectations could adversely impact our reputation and may lead to regulatory proceedings, penalties, litigation or
an inability to carry out our business strategy.
Our Chief Compliance Officer oversees our comprehensive enterprise-wide compliance framework, which is consistent with regulatory
guidance from OSFI and other regulators. This framework promotes proactive, risk-based management of compliance and regulatory
risk, and includes: enterprise and business segment policies, standards and operating guidelines, programs to promote awareness of
laws and regulations that impact us, ongoing monitoring of emerging legal issues and regulatory changes, and training programs.
There are also new employee orientation programs that include anti-money laundering and anti-terrorist financing, privacy and
information security risk management. To ensure effective oversight and implementation, the framework is supported by an enterprise
network of compliance officers and the general counsel in each business segment. The Chief Compliance Officer reports regularly to
the Board of Directors on the state of enterprise compliance, key compliance risks, emerging regulatory trends, escalation of key issues
and key compliance indicators.
Management’s Discussion and Analysis Sun Life Financial Inc. Annual Report 2012 67