The insurers risk escalation process should allow for reporting on
risk issues within established reporting cycles and outside of them
for matters of particular urgency.
The Board should have appropriate ways to carry out its
responsibilities for risk oversight. This includes having a policy on
the content, form and frequency of reporting that it expects on risk
from Senior Management and each of the control functions. Any
proposed activity that would go beyond the Board-approved risk
appetite should be subject to appropriate review and require Board
approval.
Both the Board and Senior Management should be attentive to the
potential need to modify the risk management system in light of new
internal or external circumstances.