Hiscox Regulatory News (HSX)

Strategic risk

The risks associated with strategic decisions and objectives taken or not taken by the Group, including uncertainties and opportunities in the internal and external environments.

What is the Risk?

Why do we have it?

How is it managed?

Strategy evolution and execution

The Group's continuing success depends on how well we understand our clients, markets and the various external factors affecting our business.

Having an ineffective strategy could have widespread repercussions on profitability, capital, market share, growth and reputation.

Setting the right course, particularly in a sector as hazardous as insurance, is essential for our

long-term success.

New risks could arise, which might transform the industry.

A key pillar of the Group's strategy is to balance the underwriting of high-margin, volatile, complex global risks by also selling stable, local specialist retail products.

The Group invests in growth areas that offer the potential of a good return on investment. To ensure individual and aggregate exposure remains within set parameters, the business plan is aligned to the Group risk appetite set by the Board.

The Group's emerging risk forum assesses risks and opportunities that could potentially affect the business, including geopolitical changes such as Brexit or US trading and taxation relationships. Stress testing and scenario analysis help identify unanticipated dependencies and correlations between risks, which could impact upon the Group's strategy.

Hiscox's ORSA process focuses on the changes, opportunities and threats that may affect the business in the future.

Insurance risk - underwriting

The risks related to our core business of providing insurance products and services to clients, and to the management of our net exposure to losses.

What is the risk?

Why do we have it?

How is it managed?

Pricing

Hiscox competes against major international insurance and reinsurance groups.

At times, competitors may choose to underwrite risk at prices below the break-even technical price. Prolonged periods in which premium levels are low or competition is intense are likely to have

a negative impact on the Group's financial performance.

Accepting risks below their technical price is detrimental to the industry. It can drive market rates down to a point where underwriting losses mount, insurers' capital is reduced and some businesses fail. Customers could receive poor service and the industry could suffer negative publicity.

Underwriting exposure management

Hiscox insures individual customers, businesses and other insurers for damage caused by a range of catastrophes, both natural (for example, hurricanes or earthquakes) and man-made (for example, terrorism), which can cause heavy underwriting losses that materially impact upon the Group's earnings and financial condition if the insured event materialises.

The Group buys reinsurance protection to manage catastrophe risk and reduce the volatility that major losses could have on our financial position. If the Group's reinsurance protection were proven to be inadequate

or inappropriate, it could significantly affect our financial condition.

Binding authorities

Hiscox generates considerable premium income through

third parties authorised to underwrite insurance policies on the Group's behalf.

Third parties may accept risk outside of agreed parameters or normal guidelines, exposing us to

financial and operational risks.

We operate in open, aggressively competitive markets in which barriers to entry for new players are relatively low. Competitors may choose to differentiate

themselves by undercutting their rivals. As a result, capacity levels in these markets rise and fall, causing prices to go up and down, creating volatile market cycles.

Underwriting large, volatile and complex risks can be potentially costly, but can also create strong returns over the medium to long term.

The scope and type of protection we buy may change from year to year depending on the extent and competitiveness of cover available in the market.

Binding or delegated authorities give the Group access to a greater volume of business and can contribute significantly to our profitability and market share.

We adapt our desire to write certain lines of business according to market conditions and the Group's overall risk appetite.

We reject business unlikely to generate underwriting profits and regularly monitor pricing levels, producing detailed monthly reports on how pricing and exposures are developing. This allows us to quickly identify and control any problems created by deteriorating market conditions. Hiscox frequently acts as the lead insurer in the co-insurance programmes needed to cover high-value assets, so we have some ability

to set market rates.

The Group rewards its staff for producing profit not revenue. This helps to maintain underwriting discipline in soft markets.

The Group underwrites catastrophe risk in a carefully managed, controlled manner. Our strategy of creating and maintaining a diversified portfolio, both by product and geography, helps limit our overall catastrophe exposure.

The Group's business plan is underpinned by a clearly-defined appetite for underwriting risk. We closely monitor our risk exposure to maximise the expected risk-return profile of our entire portfolio and offset any potential losses from more volatile accounts.

Underwriters are incentivised to make sound decisions that are aligned with the Group's strategic objectives and risk appetite and clear limits are placed on their underwriting authority. In response to legal developments, policy wordings are regularly reviewed to ensure that, as far as possible, exposure to those risks identified in the policy at the time of issue is maintained.

Our modeling resources are tailored to support insurance and reinsurance plans and ensure that exposure matches expectations. Risk aggregation and modeling resources are shared across the Group.

Stress and scenario testing is performed by the Group and by individual insurance carriers to assess our potential exposure to certain catastrophes.

We buy reinsurance to reduce our risk exposure and mitigate the impact of catastrophes based upon a clear outwards reinsurance strategy and centralised reinsurance programme that enables us to minimise gaps in coverage across the business and get the right deal by leveraging our size.

Decisions about the type and amount of reinsurance we buy are supervised by a dedicated reinsurance purchasing team using modeling techniques.

Authorities granted by Hiscox are closely controlled through strict underwriting guidelines, contractual restrictions and obligations. A Group-wide delegated authority policy sets out clear standards and principles for managing the delegation of authority to external third parties. We vet all third parties prior to appointment and monitor and audit them regularly to ensure they meet our standards.

Insurance risk - reserve

The risks of managing the adequacy and volatility of claim provision reserves set aside to pay for existing and future claims.

What is the risk?

Why do we have it?

How is it managed?

Reserve risk

The Group makes financial provisions for unpaid claims, defence costs and related expenses to cover liabilities both from reported claims and from 'incurred but not reported' (IBNR) claims.

If insufficient reserves were put aside to cover our exposures, this could affect the Group's future earnings and capital

When underwriting risks, we estimate both the likelihood of them occurring and their cost. Our actual claims experience could exceed our expectations, requiring us to increase our levels of reserves held.

The provisions we make to pay claims reflect our own experience and the industry's view of similar business. They are also influenced by loss payments, pending levels of unpaid claims, historic trends in reserving patterns and potential changes in rates arising from market or economic conditions. Provisions

are set above the actuarial mid-point to reduce the risk that actual claims may exceed the amount we have set aside.

Our provision estimates are subject to rigorous review by all areas of the business, as well as by independent actuaries on the managed Syndicates. The relevant boards approve the amount of the final provision, on the recommendation of dedicated reserving committees.

Details of the actuarial and statistical methods and assumptions used to calculate reserves are set out in note 25 to the consolidated financial statements.

Market risk - investment

The risk of financial loss or adverse movements in the value of Hiscox's assets resulting from adverse movements in market prices and our exposure from trading and/or the risk of exposure to inappropriate assets/asset classes.

What is the risk?

Why do we have it

How is it managed?

Asset value

Money received from our clients in premiums and the capital on our balance sheet is invested until it is needed to pay claims. These funds are inevitably exposed to investment risk.

Investment risk also encompasses the risk of default of investment counterparties, who are primarily the issuers of

bonds in which we invest.

Liquidity

A failure of our liquidity strategy could leave us unable to meet cash requirements to pay liabilities to customers or other creditors when they fall due.

We might also incur high costs in selling assets or raising money quickly in order to meet our obligations.

Such a failure could have a material adverse effect on the Group's financial condition and cash flows

The investment of Hiscox's assets generates an investment return. Our investment portfolio is exposed to a number of risks related to changes in interest rates, credit spreads and equity prices, among others.

If a catastrophe occurs, the Group may be faced with large, unplanned cash demands.

This could be exacerbated by having to fund a large number of claims pending recovery from our reinsurers.

Although our investment policies stress the conservation of principal and liquidity,

our investments are subject to market-wide risks

and fluctuations.

Our objective is to maximise investment returns in the prevailing financial, economic and market conditions, without creating undue risk to the Group's capacity to underwrite. Funds held for reserves are invested primarily in high-quality bonds and cash. To reduce foreign exchange risk, these are usually maintained in the currency of the original premiums for which they were set aside. As many of our insurance and reinsurance liabilities have short timespans, we do not aim to match exactly the duration of our assets and liabilities.

The Group's fixed-income fund managers operate within clear guidelines as to the type and nature of bonds in which they can invest. These prioritise the need to pay claims while providing sufficient flexibility to enhance returns.

A proportion of funds is allocated to riskier assets, principally equities. By taking a long-term view on these assets, we seek to achieve the best possible risk-adjusted returns. Within our risk assets, we make an allocation to less volatile, absolute return strategies, which balance our desire to maximise returns with the need to ensure capital is available to support our underwriting throughout any downturn in financial markets.

The Group's investment policy recognises the demands created by our underwriting strategy, so that some investments may need to be sold before maturity or at short notice.

A high proportion of our investments are in liquid assets, which reduces the risk of losses being incurred if a quick sale is needed. Funds held for reserves are invested primarily in high-quality, short duration bonds and cash so the Group can meet its aim of paying valid claims quickly.

The Group's cash requirements can normally be met through regular income streams: premiums, investment income, existing cash balances or by realising investments that have reached maturity. Our primary source of inflows is insurance premiums, while our outflows are largely expenses and payments to policyholders through claims. We forecast our cash flow for

the week, month, quarter, or up to three years ahead, depending on the source.

To identify potential issues, we run stress tests to estimate the impact of a major catastrophe on our cash position. We also consider the impact on our liquidity of other adverse events occurring, such as an economic downturn and declining investment returns.

The Group maintains extensive borrowing facilities with a range of major international banks. This minimises the risk of one or more institutions being unable to honour commitments to us.

Credit risk

The risk of loss or adverse financial impact due to counterparty default or failure to meet obligations with agreed terms.

What is the risk?

Why do we have it?

How is it managed?

Credit risk - reinsurance

The Group buys reinsurance to protect us, but if our reinsurers were unable to meet their obligations to us it could put

a strain on our earnings and capital, and harm our financial condition and cash flows.

Credit risk - brokers

If a broker fails to pass premiums to us or fails to pass the claims payment

on to a policyholder, this can result in us losing money.

We cover clients against a range of catastrophes and protect ourselves through reinsurance. We face credit risk when we seek to recover sums from our reinsurers.

The vast majority of our business is written through brokers. We face credit risk when money is transferred to and from brokers for premiums or claims.

We buy reinsurance only from companies we believe to be strong. A dedicated Group Credit Committee must approve the use of every reinsurer, based on an assessment of their financial strength, trading record, payment history, outlook, organisational structure and external credit ratings.

Our credit exposures to these companies are closely monitored, as are the companies themselves, so we can quickly identify any potential problems. We consider public information, our experience of the companies, their behaviour in the marketplace and consultants' and rating agencies' analysis.

We monitor our exposure to brokers on an on-going basis and have a continuing dialogue with our core brokers to quickly identify and resolve any credit issues that arise. Such monitoring takes into account a number of factors, which can include credit rating, financial position, financial performance, payment history and market factors.

In the case of some large losses, we pay policyholders directly to reduce broker credit risk on material transactions.

Operational risk

The risks of direct or indirect losses involving people, processes, systems and external events, resulting from the running of the business.

What is the risk?

Why do we have it?

How is it managed?

Information security (including cyber security)

A failure to properly protect information could compromise the confidentiality, availability or integrity of our data.

Cyber security risk is the threat to the Group from globally connected networks such as the internet. It differs from the exposure posed

by underwriting cyber risks, which is considered an insurance risk.

As well as causing financial losses, information security risk can have legal, regulatory and reputational consequences.

Information technology and systems failure

A major IT systems, or service failure would have a significant impact on our business.

Project risk and change management

The risks that projects and/ or change initiatives are not delivered to plan, budget or specification, or that the risks inherent in projects are not appropriately managed.

Where this occurs, there may be not only direct financial losses but also indirect losses through distraction risks

and inefficiencies

Our business is based on trust from customers and partners, and that trust depends on our ability to keep their information secure.

We operate in a world in which the volume of sensitive data and the number of connected devices and applications have increased exponentially, while cyber attacks are increasingly frequent and sophisticated.

Our business depends on the integrity and timeliness of the information and data we maintain, own and use.

Our information technology and systems are critical to conducting business and providing continuity of service to our clients, including supporting underwriting and claims processes.

We operate in an ever- changing environment, with technological advancements, customer behaviour and external expectations evolving rapidly in recent years.

To remain relevant we must continue to evolve how we conduct our business.

Information security risk is managed as a business risk, not an IT responsibility. We employ an information security policy and a cyber security risk strategy.

The Group employs information security resources, which provide advice on information security design and standards. We also have an information security group, including experts from around the business who assess and manage these threats in line with risk appetite. Our cyber strategy combines industry standard perimeter security with protection for specific, highly confidential information.

The Group constantly deploys and evolves systems, policies and procedures to mitigate internal and external threats to our IT infrastructure. We conduct Group-wide mandatory training on information and cyber security, which is also mandatory for all third parties and contractors.

Our stress testing and scenario analysis considers the impact and likelihood of information security exposures and assesses management actions, including response plans.

We have dedicated IT resources that support the Group's technology needs and oversee critical systems and applications.

Our stress testing and scenario analysis considers the impact and likelihood of an IT or systems failure and assesses how management actions could be taken to mitigate the risk.

A formal disaster recovery plan is in place to deal with workspace recovery and the retrieval of communications, IT systems and data should a major incident occur. These procedures would enable us to quickly move the affected

operations to alternative facilities. The plan is tested regularly and includes simulation tests.

All major programmes have dedicated project governance structures to oversee the delivery of the programme, including risk management aspects. Programme sponsors also provide updates to the Board and Risk Committee as appropriate

The newly-formed Programme Assurance Office provides oversight across all major programmes. It provides senior management with an independent view of the progress, risks and issues within the programmes as well as the linkages between them.

Specialist resource is used to augment project resources, either in a contractor or advisory capacity, as needed.

Regulatory and legal risk

The risk of financial loss, regulatory censure, reputational damage and/or other adverse impact as a result of non-compliance with all relevant regulations and/or legislation in all relevant jurisdictions.

What is the risk?

Why do we have it?

How is it managed?

Regulatory change

The insurance industry is exposed to continuous regulatory change, which may affect the level of capital we are required to hold or require changes to how we are set up operationally from time to time.

Insurance is a highly regulated industry. There may be

times when the regulatory landscape undergoes a significant shift that directly impacts our business.

The Group understands that sound, prudent regulation is key to the stability and sustainability of the insurance and wider financial markets. We continuously monitor new regulation and review

our internal processes to facilitate compliance. Our approach is to combine local expertise with a globally consistent framework to manage regulatory change and provide effective compliance with the varied and evolving requirements.