Sun Life 2010 Annual Report Download - page 69

Insurance Risk
Risk Description
Insurance risk is the uncertainty of product performance due to differences between the actual experience and expected assumptions
affecting amounts of claims, benefits payments, expenses and the cost of embedded options and guarantees related to insurance
risks. This risk class includes risk factors relating to product development and pricing, mortality, morbidity, longevity, policyholder
behaviour and reinsurance.
Insurance Risk Management Governance and Control
Insurance risk is managed through a number of enterprise-wide controls addressing a wide range of insurance risk factors, as follows:
• Enterprise-wide insurance underwriting and claims, product development and pricing, and reinsurance risk management policies
• Product development and pricing policies require detailed risk assessment and provision for material insurance risks
• Reserve provisions are established in accordance with standards set forth by the Canadian Institute of Actuaries
• Target capital levels established that exceed regulatory minimums
• Board-approved maximum retention limits (amounts issued in excess of these limits are reinsured)
• Various limits, restrictions and fee structures may be introduced into plan designs in order to establish more homogeneous policy
risk profile and limit potential for anti-selection
• Enterprise underwriting and risk selection standards with oversight by corporate underwriting and claims risk management function
• Diversification and risk pooling is managed by aggregation of broad exposures across product lines, geography, distribution
channels, etc.
• Experience studies (both Company specific and industry level) and Source of Earnings analysis are periodically monitored and
factored into ongoing valuation, renewal and new business pricing processes
• Stress-testing techniques, such as Dynamic Capital Adequacy Testing, are used to measure the effects of large and sustained
adverse movements in insurance risk factors
• We have established a reinsurance ceded policy to set acceptance criteria and protocols to monitor the level of reinsurance ceded
to any single reinsurer or group of reinsurers. Our reinsurance counterparty risk profile is monitored closely, including through
regular reporting to the Risk Review Committee of the Board of Directors
As part of our governance and control procedures, we review our global retention limits from time to time. Effective January 1, 2011, we
increased our global mortality retention limit for individual life insurance from US$15 million to US$ 25 million, for business sold in
Canada the new limit is $25 million. The limit for survivorship life insurance has increased from US$20 million to US$30 million, for
business sold in Canada the new limit is $30 million. The changes in limits are not expected to have a material impact on our risk
exposure.
Operational Risk
Risk Description
Operational risk is the uncertainty arising from larger than expected losses or damage to finances or reputation resulting from
inadequate or failed internal processes, controls, people, systems, or from external events. This risk class encompasses a wide range
of risks, including those pertaining to legal and regulatory, business continuity, model risk, information system security and privacy,
outsourcing, fraud, environmental risk, human resource management and liquidity risk. Operational risk is also embedded in the
practices utilized to manage other risks therefore, if not managed effectively, it can impact our ability to manage other key risks such as
credit risk, market and insurance risk.
Operational Risk Management Governance and Control
Our governance practices, corporate values and Code of Conduct set the foundation for mitigation of operational risks. We perform
ongoing monitoring and reporting of all significant operational risks, including regular briefings to senior management and Board
Committees. We have established enterprise-wide policies and controls for all significant operational risks, including:
• Compliance: An enterprise-wide compliance framework has been established consisting of policies and operating guidelines and
is supported by a network of compliance officers. Enterprise oversight is provided by the Chief Compliance Officer.
• Privacy: Privacy policies, privacy officers and processes have been established to provide guidance on handling private and
confidential information and for reporting privacy issues to appropriate management for response and resolution. Enterprise
oversight is provided by the Chief Privacy Officer.
• Financial Models: An enterprise-wide Management of Financial Models Policy and Business Segment Operating Guidelines have
been established. These policies include a requirement that each business segment maintain an inventory of significant models and
sets out expectations for associated documentation, review and testing. Risk assessments are conducted on significant models,
and plans are developed to address identified sources of risk.
• Business Interruption: An enterprise-wide Business Continuity Policy has been established. Business continuity, crisis
management and disaster recovery programs have been designed and implemented to ensure to the extent practically possible that
key business functions can continue and normal operations can resume effectively and efficiently in the event of a major disruption.
These programs are periodically tested, and each business unit maintains its own business continuity plans under the oversight of
the global business continuity program.
• Information Security: An enterprise-wide security program has been established, consisting of policies, standards and processes.
The program is aligned to appropriate industry standards and is compliant with applicable laws and regulations. Enterprise oversight
is provided through the Chief Information Officer.
• Outsourcing: An enterprise-wide Outsourcing Policy and operating guidelines have been established to manage the risks
associated with the outsourcing of business activities, functions or processes to a third-party provider.
Management’s Discussion And Analysis Sun Life Financial Inc. Annual Report 2010 65