Hiscox Regulatory News (HSX)

What is the risk?

Why do we have it?

How is it managed?

Strategic risk

Insurance cycle

Hiscox competes against major international insurance and reinsurance groups. At times, some of these groups may choose to underwrite risks at prices that fall below the breakeven technical price. Prolonged periods when premium levels are low or when competition is intense are likely to have a negative impact on the Group's financial performance.

We operate in open, aggressively competitive markets in which barriers to entry for new players are low and where competitors may choose to differentiate themselves by undercutting their rivals. As a result, capacity levels in these markets will rise and fall, causing prices to go up and down, creating volatile market cycles.

Pricing discipline: we are firmly resolved to reject business that is unlikely to generate underwriting profits. Accepting risks below their technical price is detrimental to the industry as it can drive market rates down to a point where underwriting losses mount, insurers' capital is destroyed causing some businesses to fail, customers to receive poor service and the industry to suffer negative publicity.

Remuneration: Hiscox incentivises underwriters on return on equity, rewarding staff for profit not revenue.

Risk appetite: our appetite for certain lines of business changes according to market conditions and the risk appetite of the Group.

Monitoring: we regularly monitor pricing levels, producing detailed monthly reports grouping current prices with exposure and trends over the past 12 months. This ensures that we quickly identify and control any problems created by adverse changes in market conditions.

Lead insurer: we frequently act as the lead insurer in the coinsurance programmes required to cover significant high-value assets, so we have some ability to set market rates rather than follow them.

Hiscox credit rating

The external ratings assigned to the Group and its subsidiaries are essential to our profitability, particularly for our reinsurance business, and to manage our financing costs and access to capital.

A reduction in these external ratings may impact the Group's ability to generate business and/or access finance.

The business in which we operate is determined largely by financial strength ratings issued by the major credit rating agencies.

Careful management: we have identified the key aspects of our business that are critical to maintaining our ratings. These are closely managed to minimise the risk of an event, or change in strategy, that might jeopardise our ratings.

Communication: regular and open communication with the major credit rating agencies helps to ensure we continue to meet their expectations.

Emerging risks

We are exposed to new and emerging risks, primarily through legal or political decisions. For example, a change in US legislation may result in exposures being included within our coverage that had not been intended by our underwriters, or may require us to cease business in certain US states.

Our business is taking risk, which by its nature is inherently uncertain.

Risk assessment: identifying, planning for and controlling emerging risks is an important part of our risk management activity across all aspects of our business, including underwriting, operations and strategy. We make a significant effort to identify material emerging threats to the Group. It is a core responsibility of each of our risk committees and we believe we take all reasonable steps to minimise the likelihood and impact of emerging risks and to prepare for them in case they occur.

What is the risk?

Why do we have it?

How is it managed?

Insurance risk - underwriting

Catastrophic and systemic insurance losses We insure individual customers, businesses and other insurers for damage caused by a range of catastrophes, both natural

(e.g. hurricanes, earthquakes) and man-made (such as terrorism), which can cause heavy underwriting losses that could have a material impact on the Group's earnings.

Though volatile and potentially costly, this business is compelling for us, as it is capable of

earning good margins over the medium to long term.

Diversified portfolio: Hiscox has a well-diversified portfolio by product and geography to help balance any catastrophe exposure.

Risk appetite: we clearly define our risk appetite for underwriting risk, which dictates our business plan. To ensure that we do not exceed our risk appetite, we monitor our exposures closely and take mitigating actions to maintain the business plan. This enables us to maximise the expected risk return profile on the whole portfolio and offset the potential losses on more volatile accounts.

Underwriting discipline: underwriters are incentivised to make sound decisions that are aligned with the Group's overall strategic objectives and risk appetite. Clear limits are placed on their underwriting authority. Policy wordings are regularly reviewed in the light of legal developments to ensure the Group's exposure is restricted, as far as possible, to those risks identified in the policy at the time of issue.

Modeling: we have tailored our modeling resources to assist insurance and reinsurance plans and ensure that the exposure we write matches expectations. The risk aggregation and modeling resources are shared across the Group to ensure everyone uses the same modeling tools.

Stress and scenario testing: we run stress and scenario tests for a range of specific events for each of our business units as well as the Group as a whole, so we can estimate our potential losses from a major catastrophe.

Reinsurance: we buy reinsurance for our business carriers

and the Group as a whole, to mitigate the effect of catastrophes and unexpected concentrations in risk. The scope and type of protection we buy may change from year to year depending on the extent and competitiveness of cover available in the market. The Group is exposed to the risk that the reinsurance protection it has bought is inadequate or inappropriate, but this is monitored and managed using modeling techniques, supervised by a dedicated reinsurance purchase group.

Binding authorities Hiscox generates considerable premium income through agents

to whom binding authority is given to underwrite insurance policies on

our behalf. Agents may underwrite business outside of our normal guidelines.

Binding authorities give the Group access to a greater volume of business.

Vetting and auditing: all binding authorities we grant are closely controlled through tight underwriting guidelines. We vet all our agents prior to appointment and monitor and audit them regularly. Agents are frequently audited to ensure they meet our standards.

What is the risk?

Why do we have it?

How is it managed?

Insurance risk - reserving

We make financial provisions for unpaid claims, defence costs and related expenses to cover our ultimate liability both from reported claims and from 'incurred but not reported' (IBNR) claims.

There is the possibility that we do not make sufficient provision for our exposures, which could affect the Group's earnings, capital and possibly even its survival.

As an insurance company we are required to hold claims reserves.

Historical data and actuarial analysis: the provisions we make to pay claims reflect our own experience and the industry's view of similar business; historical trends in reserving patterns, loss payments and pending levels of unpaid claims and awards as well as any potential changes in historic rates arising from market or economic conditions. Details of the actuarial and statistical methods and assumptions used to calculate reserves are set out in note 26 to the consolidated financial statements. The provisions we make are set above the actuarial mid-point to reduce the risk that actual claims exceed the amount that has been set aside.

Senior management and Board approval: our provision estimates are subject to rigorous review by senior management from all areas of the business including independent actuaries. The final provision is approved by the relevant boards on the recommendation of dedicated reserving committees.

Market risk - investment risk

Asset value

The premiums and technical funds we hold for the payment of future claims are inevitably exposed to investment risk.

We invest the cash we receive from our clients and the capital on our balance sheet until it might be needed to be paid as claims.

Conservative policy: our overriding concern is to not lose money or to put at risk the Group's capacity to underwrite. Our policy is designed to maximise returns within an overall risk appetite.

Technical funds: those funds held for reserves are invested primarily in high-quality bonds and cash. The high quality and short duration of these funds allows the Group to meet its aim of paying valid claims quickly.

Currency matching: these funds, as far as possible, are maintained in the currency of the original premiums for which they are set aside to reduce foreign exchange risk.

Duration: as many of our insurance and reinsurance liabilities have short time spans, we do not aim to match exactly the duration of our assets and liabilities.

Benchmarks: our fixed income fund managers are set benchmarks that approximate the payment profile of our claims while still providing them with some flexibility to enhance returns.

Equities: a proportion of the Group's assets is allocated to riskier assets, principally equities. For these assets we take a long-term view so we can achieve the best risk-adjusted returns. The proportion of funds we invest in risk assets will depend on the outlook for investment and underwriting markets. We make an allocation to less volatile, absolute return strategies within our risk assets, so as to balance our desire to maximise returns with the need to ensure capital is available to support our underwriting throughout any downturn in financial markets.

Guidelines: investment risk also encompasses the risk of default of counterparties, which is primarily with issuers of bonds in which we invest. Our third-party investment managers are issued guidelines as to the type and nature of bonds in which to invest.

What is the risk?

Why do we have it?

How is it managed?

Market risk -

investment risk continued

Liquidity

We are unable to meet our liabilities to customers or other creditors when they fall due. Also the risk that we incur excessive costs by selling assets or raising finance quickly to meet our obligations.

We provide cover against a range of catastrophes, so if one occurs we may be faced with large, unplanned cash demands. This situation could be exacerbated if we have

to fund a large portion of claims pending recovery from our reinsurers.

Risk management: we believe the likelihood that we may

be unable to meet our liabilities, or that we incur excessive

costs in doing so, is extremely remote, because of our risk

management measures.

Forecasting: most of our cash inflows and outflows are routine and can be forecast well in advance. Our primary source of inflows is insurance premiums while our outflows are largely expenses and payments to policyholders through claims. We forecast our cash flow for the week, month, quarter or up to two years ahead, depending on the source.

Cash: available cash is invested according to the Group's investment policy and our cash requirements can normally be met through our regular income streams: premiums, investment income, existing cash balances or by realising investments that have reached maturity.

Stress tests: we run tests to estimate the impact of a major

catastrophe on our cash position in order to identify potential issues. We also run scenario analysis that considers the impact on our liquidity should a number of adverse events occur simultaneously, such as an economic downturn and declining investment returns combined with unusually high insurance losses.

Credit: we maintain extensive borrowing facilities. These arrangements have been made with a range of major international banks to minimise the risk of one or more of the institutions being unable to honour their commitments to us.

Liquid assets: our investment policy recognises the demands created by our underwriting strategy, so that some investments may need to be realised before maturity or at short notice. Hence a high proportion of our investments are in liquid assets, which reduces our risk of making losses because we may have to sell assets quickly.

Market risk - FX risk

Foreign exchange risk

Our reporting currency is Sterling, but a significant proportion of our underwriting activity is located in the US and Europe. In addition the capital bases of our insurance companies in Bermuda, Guernsey and US are in US Dollars. Therefore, movements in foreign exchange rates may have a material adverse effect on our financial performance and position.

We are an international insurance and reinsurance group that operates in numerous markets around the world.

Currency matching: as the US Dollar is the Group's largest underwriting currency, our policy is to match our US Dollar insurance liabilities with investments held in that currency to minimise any losses from currency fluctuations. We will hold a percentage of our capital in the matching currency of that part of our underlying business, where it is deemed appropriate.

Currency hedging: we closely monitor our net currency positions and will enter into currency hedges if we anticipate adverse movements in exchange rates. Further details of the Group's investment profile and its management of currency risks are provided in notes 3 and 19 to the consolidated financial statements.

What is the risk?

Why do we have it?

How is it managed?

Credit risk - reinsurance

We buy reinsurance to protect us from large single claims as well as the aggregate effect of many claims resulting from catastrophes. The risk is that our reinsurers are unable to meet their obligations to us, which would put a strain on our earnings and capital.

We cover clients against a range of catastrophes and protect ourselves through reinsurance. We face credit risk where we seek to recover sums from other reinsurers.

Careful selection: we buy reinsurance only from companies that we believe to be strong. Every reinsurer we use must be approved by a dedicated Group Credit Committee, based on an assessment of financial strength, trading record, payment history, outlook, organisational structure, plus its external credit ratings.

Monitoring: our credit exposures to these companies are closely monitored. The companies are continuously monitored so that we are able to identify any potential problems. The committee considers public information, experience of the companies concerned, their behaviour in the marketplace and analysis from consultants and from rating agencies.

Guidelines: we set guidelines for exposure to each of our approved reinsurers.

Credit risk - brokers

Broker credit risk is the risk of loss due to exposure to intermediary brokers, i.e. the policyholder pays the broker but the broker fails to pass the premium to us, or we pay a claim to the broker but the broker fails to pass the payment to the policyholder.

The vast majority of our business is written through brokers (i.e. premiums and claims, paid and received), though there are direct books of business in the UK, US, Europe and Asia. We face credit risk where we transfer money to, and receive money from brokers.

Careful selection: we follow the same careful selection, monitoring and guidelines process for broker credit risk as reinsurance credit risk.

Payments: for large losses, we pay the policyholders directly to remove broker credit risk on these material transactions.

Operational risk

Regulatory change The insurance industry is undergoing a period of unprecedented regulatory change, which may impact the capital we are required to hold.

Cyber security

Cyber security risk specifically relates to threats from globally connected networks such as the internet. It differs from

the exposure posed by underwriting cyber risks, which is considered an insurance risk and can result in derivative impacts including loss of profit and legal, regulatory and reputational consequences.

Insurance is a regulated industry. While regulations typically evolve on an ongoing basis, there may be times where the regulatory landscape undergoes a significant shift.

We operate in a world where the volume of sensitive data and the number of connected devices and applications have increased exponentially. In parallel, the threat environment is constantly evolving as cyber attacks become increasingly frequent and sophisticated.

Cyber risk is an integral part of what we do. As such, it is managed as a business risk, not an IT responsibility.

Monitoring: we constantly monitor new regulation and review our internal arrangements operating under the guidance of the Group CFO.

Strategy: our cyber security risk strategy combines industry

standard perimeter security with data-centric protection for

specific highly confidential information.

Risk management: we have dedicated IT security resources which provide advice on security design and standards, establishing appropriate system protection, embedding of security within IT practices and management of incidents.

Controls: we constantly deploy and evolve systems, policies and procedures to mitigate internal and external threats to the IT infrastructure.

Stress testing and scenario analysis: our stress testing and scenario analysis considers the impact and likelihood of information security exposures, including cyber security risks, to assess the effect on the business and discuss management actions.

Disaster recovery planning: a formal disaster recovery plan is in place to deal with workspace recovery and the retrieval of communications, IT systems and data should a major problem occur. These procedures would enable us to move the affected operations to alternative facilities quickly. The plan is tested regularly and includes simulation tests.