Operational risks

Operational risks refer to the risk of losses occurring because of the inadequacy or failure of internal processes or as a result of events triggered by employee-related, system-induced or external factors. In contrast to underwriting risks (e. g. the reserve risk), which we enter into in a deliberate and controlled manner in the context of our business activities, operational risks are an indivisible part of our business activities. The focus is therefore on risk minimisation. Unlike market, counterparty default and underwriting risks, operational risks are categorised as non-financial risks.

With the aid of the Self-Assessment for Operational Risks we determine the maturity level of our operational risk management system and define action fields for improvements. The assessment is carried out, for example, by assessing the maturity level of the risk management function or of the respective risk monitoring and reporting. The system enables us, among other things, to prioritise operational risks and is used to calculate the capital commitment in our internal capital model.

Within the overall framework of operational risks we consider, in particular, business process and data quality risks, compliance risks, outsourcing risks, fraud risks, personnel risks, information / IT security risks and business interruption risks.

Business process risks are associated with the risk of deficient or flawed internal processes, which can arise inter alia as a consequence of an inadequate process organisation. The criteria that we have defined for managing the risk result in a high process quality. Data quality is similarly a very critical success factor, especially in risk management, because – among other things – the validity of the results delivered by the internal model depends primarily on the data provided.

Compliance risks are associated with the risk of breaches of standards and requirements, non-compliance with which may entail lawsuits or official proceedings with not inconsiderable detrimental implications for the business activities of the Hannover Re Group. Regulatory compliance, compliance with the company’s Code of Conduct, data privacy and compliance with anti-trust and competition laws have been defined as issues of particular relevance. The compliance risk also extends to tax and legal risks. Among other things, we use sanctions screening software on parts of the Hannover Re Group’s portfolio to filter out individuals who are subject to sanctions on account of a criminal or terrorist background. Suitable steps are taken if such individuals are identified. Business partners are also screened in this way. Responsibilities within the compliance organisation are regulated and documented Group-wide and interfaces with risk management have been put in place. The set of tools is rounded off with regular compliance training programmes.

Outsourcing risks can result from the outsourcing of functions, services and / or organisational units to third parties outside Hannover Re. Mandatory rules have been put in place to limit this risk; among other things, they stipulate that a risk analysis is to be performed prior to a material outsourcing. In the context of this analysis a check is carried out to determine, inter alia, what specific risks exist and whether outsourcing can even occur in the first place. In addition, our external partners are subject to regular due diligence checks.

In selected market niches we transact primary insurance business that complements our reinsurance activities. In so doing, just as on the reinsurance side, we always work together with partners from the primary sector – such as insurance brokers and underwriting agencies. This gives rise to risks associated with such distribution channels, although these are minimised through the careful selection of agencies, mandatory underwriting guidelines and regular checks.

Fraud risks refer to the risk of intentional violations of laws or regulations committed by members of staff (internal fraud) and / or by externals (external fraud) for personal gain. This risk is reduced by the internal control system as well as by the audits conducted by Group Auditing on a Group-wide and line-independent basis.

The proper functioning and competitiveness of the Hannover Re Group can be attributed in large measure to the expertise and dedication of our staff. In order to minimise personnel risks, we pay special attention to the skills, experience and motivation of our employees and foster these qualities through outstanding personnel development and leadership activities. Regular employee surveys and the monitoring of turnover rates ensure that such risks are identified at an early stage and scope to take the necessary actions is created.

Information technology risks and information security risks arise, inter alia, out of the risk of the inadequate integrity, confidentiality or availability of systems and information. By way of example, losses and damage resulting from the unauthorised passing on of confidential information, the malicious overloading of important IT systems or from computer viruses are material to the Hannover Re Group. Given the broad spectrum of such risks, a diverse range of steering and monitoring measures and organisational standards, including for example the requirement to conclude confidentiality agreements with service providers, have been put in place. In addition, our employees are made more conscious of such security risks through practically oriented tools, including for example information campaigns and training activities.

When it comes to reducing business interruption risks, the paramount objective is the quickest possible return to normal operations after a crisis, for example through implementation of existing contingency plans. Guided by internationally accepted standards, we have defined the key framework conditions and – among other measures – we have assembled a crisis team to serve as a temporary steering body in the event of an emergency. The system is complemented by regular exercises and tests.