Enterprise risk ORSA and risk appetite practice library32
DesignSTR-01
Enterprise AI risk policy and appetite
Define approved uses, exclusions, risk tolerance, governance, reporting, and escalation for AI across the enterprise.
PilotSTR-02
AI risk taxonomy and ownership
Use one taxonomy for strategic, insurance, operational, model, data, cyber, legal, conduct, liquidity, capital, and third party AI risks.
OperateSTR-03
Risk decision authority map
Assign proposal, assessment, challenge, acceptance, escalation, pause, remediation, and retirement authority.
ImproveSTR-04
AI portfolio risk and value priorities
Prioritize the AI portfolio using expected value, residual risk, concentration, control readiness, capital effects, and dependencies.
DesignRID-01
Use case inherent risk assessment
Assess intended use, affected parties, decision influence, exposure, likelihood, consequence, reversibility, uncertainty, and existing controls.
PilotRID-02
Consumer operational and financial impact
Evaluate policyholder, claimant, producer, employee, operational, financial, legal, regulatory, and reputational consequences.
OperateRID-03
Dependency concentration and systemic risk
Identify shared models, data, vendors, cloud services, processes, and agents that can create correlated or systemic loss.
ImproveRID-04
Residual risk and acceptance decision
Document residual risk, control evidence, accountable acceptance, conditions, review date, and decision.
DesignAPP-01
Appetite statement and measurable limits
Translate risk appetite into approved activities, prohibited outcomes, tolerances, limits, and accountable owners.
PilotAPP-02
Early warning indicators and thresholds
Define quantitative and qualitative indicators with data sources, trigger levels, frequency, interpretation, and action.
OperateAPP-03
Breach escalation and management action
Route breaches to named owners and governing bodies with containment, analysis, decision, communication, and evidence.
ImproveAPP-04
Exception acceptance and expiry
Require a business reason, compensating controls, accountable acceptance, expiry date, monitoring, and renewal or closure.
DesignORS-01
ORSA materiality and AI risk inclusion
Determine whether AI risks are material to the insurer or group and how they enter the ORSA and ERM process.
PilotORS-02
Stress scenario design and assumptions
Design severe but plausible scenarios covering model, data, cyber, vendor, legal, conduct, operational, and market conditions.
OperateORS-03
Capital liquidity and solvency effects
Estimate losses, earnings, liquidity, capital, solvency, policyholder effects, timing, uncertainty, and aggregation under stress.
ImproveORS-04
Management action and reverse stress
Test credible management actions, limitations, execution timing, recovery, and scenarios that could breach solvency objectives.
DesignEMR-01
AI technology and threat horizon scanning
Monitor AI capabilities, attack methods, failures, dependency shifts, social impacts, and uncertainty that can change exposure.
PilotEMR-02
Regulatory legal and market developments
Track insurance regulation, litigation, standards, market practices, and stakeholder expectations by jurisdiction.
OperateEMR-03
Vendor ecosystem and concentration signals
Watch vendor, foundation model, cloud, data, talent, and infrastructure concentration and substitution options.
ImproveEMR-04
Emerging risk assessment and response
Assess emerging risks, assign owners, select a response, set indicators, and connect material findings to scenarios and appetite.
DesignOPS-01
AI process risk and control assessment
Map AI-enabled processes, failure modes, controls, owners, evidence, residual risk, and accepted gaps.
PilotOPS-02
Critical service dependency mapping
Identify critical services and the data, model, agent, vendor, cloud, people, and manual dependencies supporting them.
OperateOPS-03
Incident loss and near miss capture
Capture AI incidents, losses, near misses, complaints, overrides, control failures, recoveries, and lessons using consistent categories.
ImproveOPS-04
Resilience continuity and recovery testing
Test continuity, safe degradation, fallback, recovery time, data restoration, communications, and vendor response.
DesignMTP-01
Model data prompt retrieval and agent risk
Assess model behavior, data lineage, prompts, retrieval, tools, permissions, actions, human interaction, and downstream effects.
PilotMTP-02
Validation monitoring and material change
Validate performance and controls before use and after material changes, then monitor drift, incidents, and limits.
OperateMTP-03
Third party risk and exit readiness
Assess providers, concentration, contracts, audit access, continuity, substitution, data return, termination, and exit testing.
ImproveMTP-04
Aggregation correlation and risk transfer
Aggregate exposures across use cases and dependencies, assess correlation, and evaluate mitigation, diversification, and risk transfer.
DesignRPT-01
Management and board risk reporting
Report portfolio exposure, risk appetite use, breaches, scenarios, events, controls, remediation, concentration, and decisions.
PilotRPT-02
Independent challenge and assurance
Provide independent challenge of assumptions, models, scenarios, control evidence, residual risk, and management action.
OperateRPT-03
Risk event lessons and remediation
Link events and assurance findings to root causes, accountable actions, due dates, validation, closure, and framework changes.
ImproveRPT-04
Framework review and continuous improvement
Review taxonomy, appetite, scenarios, methods, thresholds, governance, reporting, and evidence as AI and the business change.