Skip Ribbon Commands
Skip to main content

Letter to industry: Catastrophe Risk Governance

To:  Chairmen and Chief Executive Officers of general insurers and Level 2 insurance groups

Catastrophe Risk Governance and Management


The significant natural peril events in Australia and New Zealand during 2010/2011 highlighted the importance of strong governance and risk management by insurers when deciding their catastrophe risk appetite and catastrophe reinsurance arrangements.

As a result, during 2012/13 APRA undertook a thematic review of the catastrophe modelling governance and risk management policies and practices applied by a sample of property insurers. We found that insurers could improve their catastrophe risk governance and management in a number of ways.

Review Results

The Attachment to this letter sets out our conclusions from the review and highlights matters which we consider warrant attention by insurers1.  We suggest that each insurer exposed to catastrophe risks review the questions in the Attachment and consider whether improvements could be made to current policies and practices. We note in particular that the board should review section A: ‘Board governance and risk appetite’. Other sections may be more appropriately addressed by senior management with subsequent reporting to the board.

More generally, boards and senior management of insurers should satisfy themselves that the policies and practices they follow for catastrophe risk management are sound and lead to appropriately prudent outcomes. Each insurer should ensure that it:

  • clearly sets and articulates its appetite for catastrophe risk;
  • understands the strengths, weaknesses and inherent assumptions of any models it uses;
  • understands the degree of uncertainty in the results produced by the catastrophe models;
  • complements model outputs with further work, including scenario testing and other analysis;
  • makes decisions in relation to catastrophe reinsurance arrangements in light of the above; and
  • satisfies itself that the residual catastrophe risk is truly within its appetite.

Next steps

APRA is not seeking a formal response to this letter. However, we are intent on seeing industry practice improve in the areas identified in this letter. As part of APRA’s ongoing supervision process, we will be considering the issues raised and may discuss these with senior management and/or the board.

For insurers that were involved in the 2012/13 reviews, your APRA Responsible Supervisor has either provided or will give specific feedback where appropriate.

Yours sincerely


Attachment – Matters for consideration on catastrophe risk governance and management


  1. Prudential Standard GPS 116 Capital Adequacy: Insurance Concentration Risk Charge (GPS 116) sets out APRA’s minimum requirements in relation to catastrophe modelling (refer to paragraph 55). The associated Prudential Practice Guide GPG 116 Insurance Concentration Risk (GPG 116) sets out APRA’s expectations and good practice in relation to catastrophe risk management, including catastrophe modelling.
  2. The topic of catastrophe modelling is, by its nature, much more relevant to property/natural peril exposures then other exposures. Nonetheless, non-property insurers should consider the material outlined in this Attachment in relation to board governance, risk appetite, scenario analysis and reinsurance purchase. Non-property insurers should also refer to GPG 116. These insurers may also find the Actuaries Institute’s Information Note: Insurance Concentration Risk Charge - Other Accumulations Vertical Requirement  useful.

A. Board governance and risk appetite

The ultimate responsibility for ensuring prudent and effective management of insurance concentration risk rests with the board of the insurer. APRA expects the board to oversee the insurer’s gross exposure to insurance concentration risk, the effectiveness of the proposed reinsurance arrangements in protecting the insurer against insurance concentrations, and the residual risk retained by the insurer.

APRA expects the insurer to articulate and document its appetite for catastrophe risk. The appetite would be based on a range of considerations, including the insurer’s Internal Capital Adequacy Assessment Process (ICAAP) (e.g. its target capital and access to additional capital), the cost and availability of reinsurance, the insurer’s strategy and the board’s general view of an acceptable return period.   The return period3 should not automatically be set at the minimum set out in GPS 116, as this is only the minimum for regulatory purposes and does not consider the insurer’s own circumstances. APRA also expects to see a clear link between, and regular review of, the catastrophe risk appetite and the insurer’s Reinsurance Management Strategy. Finally, the board should consider the residual catastrophe risk and satisfy itself that it is truly within the appetite of the insurer.

The review highlighted that board engagement in the catastrophe modelling and risk management process was mixed: for some insurers it was sound, whilst other insurers have recognised the need for improvement. However, APRA identified that insurers could benefit from formalising their governance frameworks for assessing their catastrophe reinsurance needs. This is discussed further in section E: ‘Reinsurance purchase’.

Better practice in this area involves regular board reporting and education sessions as part of an ongoing discussion between the board, senior management and specialists. This should also involve a healthy level of board scepticism and challenge of all components of catastrophe risk management, including model outputs, other analysis and conclusions on residual risk.

For consideration:

  • Has the board set an appetite for catastrophe risks? How is this linked to the overall risk appetite of the insurer? How is it translated for operational purposes?
  • Does the catastrophe risk appetite address matters other than minimum regulatory capital requirements? Does the catastrophe risk appetite address multiple events in one year?
  • What is the link between the catastrophe risk appetite and reinsurance strategy? Are they consistent?
  • Is there adequate, ongoing discussion at board level in relation to catastrophe risk management?

B. Senior management and specialist committees

In the review, APRA observed that the use of committees of senior management and experienced internal modelling and other specialists (such as brokers, model suppliers, reinsurers and natural peril experts) worked well. This provided a forum for challenge when making key decisions in the modelling process. APRA notes that brokers can provide value in the analysis of catastrophe risks. However, APRA observed in some cases there was an over-reliance on brokers, with no exploration of shortcomings or weaknesses of the outputs provided or exploration of other models and techniques.

APRA expects to see clear leadership from the Chief Executive Officer and the senior management team (including the Chief Risk Officer, Chief Reinsurance Officer and Appointed Actuary where relevant) on catastrophe risk management. APRA expects that these executives will call on the specialists mentioned above to provide support in relation to catastrophe risk management. Senior management and relevant experts should produce analysis and recommendations to assist the board in understanding concentration risk, including setting its catastrophe risk appetite. The analysis would often include the use of catastrophe models, scenario analysis, stress testing, advice and analysis provided by reinsurance brokers or reinsurers and region−specific information.

For consideration:

  • What analysis is provided to the board from senior management? Does the board or senior management receive any analysis based on the science of natural perils?
  • What reporting is there by senior management to the board on catastrophe modelling risk both in absolute terms and in the context of risk appetite?
  • How are the analysis, documentation and recommendations challenged prior to, and at, board level?

C. Use of catastrophe model

i) Governance

As noted in GPS 116, it is common practice for insurers to use computer modelling, developed either in-house or by external providers, to estimate likely losses under different catastrophe scenarios. These models, however, are clearly only a representation of the real world. They will contain explicit assumptions, limitations and unknown shortcomings. APRA expects the board and senior management to have a sound understanding of the insurer’s approach to the use of models to manage catastrophe risks. It is essential that insurers undertake appropriate due diligence in relation to the use of catastrophe models. As part of that process, insurers should consider the minimum requirements in GPS 116 (paragraph 55) and the guidance provided in GPG 116 (paragraphs 88 to 108).

Some of the insurers in the review relied exclusively on their broker to perform the due diligence on the catastrophe model(s) used. Other insurers had insufficient control of the choice of model(s) used, as well as a lack of appreciation of the reasons for selecting a particular model over another and the comparative strengths and weaknesses of each model.

For consideration:

  • What modelling techniques and model(s) are used by the insurer? Do senior management and the board understand the reasoning behind the use of these techniques and model(s)?
  • What analysis has been undertaken, documented and presented to senior management and the board with respect to the model(s)? Does the analysis address assumptions, limitations, strengths and weaknesses? 
  • Does the board have a sound appreciation of the uncertainty in the model outputs? On what has it based its understanding? Does the analysis provide detail on the range of possible outcomes given changes in assumptions? Has the uncertainty been explicitly considered in the context of the catastrophe risk appetite?
  • Who is involved in the model(s) vetting process and what reliance is placed on their work?
  • How have senior management and the board satisfied themselves that the models used meet the minimum criteria in GPS 116 with respect to model(s) research and testing, data quality and understanding of the model(s)?

ii) Resourcing

APRA found that the ability of insurers to directly engage in the modelling process and challenge model outputs was heavily influenced by the level of internal modelling expertise they employ. Among most of the insurers in the review, internal resourcing was found to be adequate or was being strengthened. Some foreign insurers placed reliance on the modelling expertise that is based offshore, whilst other foreign insurers did have a dedicated team in Australia and staff employed by their group parent with Australian working experience.
APRA does not necessarily expect all the resources used by insurers to be internal. However, the ultimate responsibility for the modelling process and outputs remains with the insurer if the insurer engages experts (including for example brokers and natural peril experts) to assist in the understanding, testing and use of models.

For consideration:

  • What level of resourcing is currently employed for catastrophe modelling? Is it sufficient for the insurer to be able to understand and engage with the modelling process?
  • What reliance is placed on experts that are external to the local insurer? How are these relationships documented and managed?
  • If the catastrophe modelling function (or elements of it) is offshored, has there been appropriate due diligence performed with adequate senior management and board oversight?
  • Has the insurer considered whether any of these relationships are material and, if applicable, meet the relevant requirements of Prudential Standard CPS 231 Outsourcing?

iii) Data collection and quality

Exposure data provided by an insurer is a key input in the modelling process. Insurers should understand that improving the quality of data provided can reduce the uncertainty of model outputs. Insurers are required under GPS 116 to ensure that the data used to estimate their losses is sufficiently consistent, accurate and complete, and that there is appropriate documentation of any estimates of data used. APRA expects the data to be compared across time and tested for consistency with changes in outputs from the model. GPG 116 notes that it is good practice for insurers to have clearly defined responsibilities, appropriate controls and documentation surrounding data extraction, cleansing and mapping from the insurer’s system to the model(s). APRA also expects insurers to understand the limitations in data used and the level of possible errors in the data. 

APRA found the quality of data used in the modelling process and the management of this data needed improvement by many insurers. Some insurers have initiated projects or system changes to address these issues. The documentation of assumptions, data collection and data quality processes was considered inadequate for the majority of insurers reviewed.

For consideration:

  • How is exposure data collected, managed, monitored and documented?
  • Is senior management satisfied with the quality of data? What steps are being taken to address any shortcomings or weaknesses?
  • Is the documentation of assumptions, data collection and data quality processes of a satisfactory standard?

iv) Control of model assumptions and parameters

Any model(s) used will likely have assumptions and estimates that need to be made, as well as parameters that need to be set. APRA expects insurers to be engaged in this process and understand the impact of these assumptions, estimates and parameters on model outputs. It is good practice for insurers to clearly define and document any assumptions and estimates made and parameters used. In addition, the modelling assumptions and estimates applied should be monitored against changes in exposure data and reviewed on a regular basis.

APRA’s review found that better practice involved insurers taking control of the assumptions and parameters used in the catastrophe modelling process, with appropriate challenge of these from business units and governance committees. Some foreign insurers have been using modelling assumptions developed by their offshore parent/head office which may not be appropriate for Australian perils. They have recognised this as a weakness and are developing a process for the use of local inputs for their modelling process.

For consideration:

  • What involvement does the insurer have in setting of the model(s) assumptions, estimates and parameters?
  • How does senior management test these and understand the impact they have on model outputs?

v) Model outputs

As mentioned above, catastrophe models are only a representation of the real world and will carry significant uncertainty of outcome. It is good practice for model outputs to be accompanied by allowances for that uncertainty. For example, model outputs should show ranges or bounds of uncertainty on modelled losses for a given return period. 

Insurers should test the model outputs against recent catastrophe events to check the reasonableness of model outputs. Insurers should engage with brokers and model suppliers and seek to understand the impact of different assumptions and parameters on model outputs.

APRA expects explicit recognition of the limitations of catastrophe risk models and further work to complement the outputs of models, discussed further in section

D: ‘Scenario testing and other analysis’.

The use of catastrophe model outputs should extend further than determining regulatory capital needs. Modelling of multiple events, different levels of key assumptions and the size of events considered could be used in scenarios in the ICAAP so that the board might assess its risk appetite independently of the regulatory capital framework. Insurers should also consider the shape of the modelled loss curve above the regulatory minimum and may also consider the use of other risk measures in their analysis.

For consideration:

  • What testing is undertaken on model outputs and how is uncertainty in those outputs understood? Are ranges or bounds of uncertainty produced and is testing against historical losses undertaken?
  • How are model outputs used by senior management as an input into regulatory capital management? How are the outputs used in wider decision-making? What reliance is placed on the model outputs? How is uncertainty in the model outputs factored in?
  • What education has the board undertaken so that it can understand the model outputs and the implications for strategy and risk appetite?

vi) Non-modelled perils and elements

GPS 116 requires an insurer to consider and make allowance for non-modelled perils in the calculation of the Insurance Concentration Risk Charge. In addition, insurers are required to demonstrate an understanding of the model(s) used and the perils and elements not included in that model. This includes perils or regions where exposures are not reliably modelled, non-modelled sources of loss (such as post-event amplification) and non-modelled exposures or lines of business (such as the impact of an earthquake on workers’ compensation claims).

APRA found that many insurers attempted to manage the impact of non-modelled risks and potential ‘model miss’ by using outputs from models at a higher return period than the APRA minimum in order to generate an allowance or buffer. An example of better practice in this area involves best endeavours to quantify these non-modelled elements and communicate any adjustments applied to the model outputs to the board. Regularly reviewing the treatment of non-modelled sources of loss and post event analysis of actual claims experience are also sound practices.

For consideration:

How does the insurer factor into its analysis non-modelled perils and elements? What adjustments are made to model outputs or recommendations as a result of these non-modelled perils and elements?

D. Scenario testing and other analysis

It is imprudent for boards and senior management to use model outputs as the sole source of estimates of catastrophe risk. APRA expects explicit recognition of the limitations of catastrophe risk models and further work to complement the outputs of models. These outputs are simply a starting point for understanding catastrophe risk, and reinsurance and capital management needs. APRA expects to see clear evidence of stress testing and scenario analysis being used to challenge and complement the modelling work. Sources of information and analysis in the management of catastrophe risk include:

  • detailed analysis of the model outputs as discussed above;
  • advice and any analysis provided by reinsurance brokers and reinsurers;
  • consideration of region-specific information (such as meteorological records or relevant scientific studies) that provide a greater understanding of a region and the perils the insurer is exposed to in that region;
  • stress testing of catastrophe exposures and comparison of this to model outputs and other estimates used by the insurer; and
  • scenario analysis including discussions on the likelihood or various types of events occurring in a particular region.

APRA found in its review that stress testing and scenario analysis could be used more effectively as tools to challenge the catastrophe model outputs used in key decisions. In the review, the standard of scenario testing varied considerably across the sample of insurers. In some cases APRA had concerns that analysis was not undertaken of catastrophe model outputs and that stress-testing of catastrophe exposures was not undertaken.

Better practice involves using Australia-specific scenarios, scenario testing to check the upper limits of catastrophe programs and the use of reverse stress tests, with results being presented to the board. Another example of good practice involves workshops run by management with external support to help with this work.

For consideration:

  • What scenario testing and other analysis is undertaken by the insurer? How is this undertaken? How is this compared and contrasted to catastrophe model outputs?
  • What testing and analysis is presented to the board? How is this questioned and challenged by the board?

E. Reinsurance purchase

APRA expects reinsurance arrangements to be prudently and soundly managed. There must be a link between the reinsurance management framework and strategy, the risk management framework and the capital management framework. The ICAAP should specifically address catastrophe risk, including the possibility of multiple events and their financial impact.

The purchase of reinsurance should be made after consideration of the above factors, as well as the matters mentioned in the earlier sections of this Attachment. The reinsurance arrangements should not just be set with reference to the minimum regulatory requirements. The return period chosen for reinsurance protection should be a reflection of the appetite for catastrophe risk. The reinsurance levels that are set must make allowance for both the deficiencies in the model(s) and the uncertainty in the outcomes from those models.
APRA expects an insurer to clearly document the rationale for its reinsurance arrangements and the residual risk to the insurer after the reinsurance purchase. The insurer should regularly review its insurance concentration risk exposure, including the ongoing suitability and adequacy of its reinsurance arrangements, against its risk appetite.

As mentioned above, APRA has also found that insurers could benefit from formalising their governance frameworks for assessing their catastrophe reinsurance needs. These frameworks should include the board’s consideration of model uncertainty, key responsibilities and whether the modelling return period reflects the risk appetite. Weaker practices included placing reliance on the overseas parents or reinsurance brokers to make recommendations and/or decisions in relation to reinsurance purchase.

For consideration:

  • What information is presented to the board with respect to the insurer’s proposed reinsurance arrangements? Does it include consideration of risk appetite and the matters mentioned in earlier sections of this Attachment?
  • How is the reinsurance purchasing decision made? What reliance is placed on other parties?
  • What regular review is undertaken of the reinsurance arrangements in place and the ongoing suitability of the arrangements?

F. Actuarial and audit reviews

Under Prudential Standard GPS 320 Actuarial and Related Matters, the Appointed Actuary is required in the Financial Condition Report (FCR) to include ‘an assessment of the suitability and adequacy of reinsurance arrangements, including the documentation of reinsurance arrangements and the existence and impact of any limited risk transfer arrangements, and whether the reinsurance arrangements are sufficient to cover the Probable Maximum Loss defined in GPS 116’.

APRA recently reviewed a small sample of FCRs with respect to this requirement. The quality and detail varied across the sample, however overall APRA found the content to be satisfactory. Better practice in the FCRs reviewed included:

  • separate discussion of the Probable Maximum Loss (PML) and the reinsurance arrangements, including discussion of the uncertainty in the PML;
  • discussion on risks and limitations regarding catastrophe modelling, as well as commentary on ranges of model outcomes based on different input assumptions and reasonableness checks against historical events;
  • clear statement of reinsurance arrangements, including retention, upper limit, defined coverage, reinsurers involved, reinstatements and downgrade clauses;
  • discussion of the process for selecting structure and resulting catastrophe cover; and
  • providing an actuarial opinion as well as stating facts on the suitability and adequacy of the reinsurance arrangements and identifying gaps in process or areas for improvement.

APRA expects catastrophe risk would also be captured in broader risk management reviews by Internal Audit. In addition, External Audit should review and report on the processes with respect to catastrophe risk management (data quality process, use of model(s), stress testing and scenario analysis, advice from experts).

For consideration:

  • What discussions are held with the Appointed Actuary and auditors with respect to catastrophe risk (including modelling) and reinsurance arrangements?
  • How are the FCR, Appointed Actuary and audit reviews used in the board’s decision-making processes?


1 For the purposes of this letter, any reference to insurers should also be read to refer to insurance groups.

2 This information note can be found at: 

3 Return period is an estimate of the likelihood of an event. It is the inverse of the probability of adequacy. For example, a probability of adequacy of 99.5 per cent is consistent with a 1 in 200 year return period.