Prudential Regulation Authority Rulebook

3.1

This Chapter only applies to a large non-directive insurer and a Swiss general insurer.

3.2

(1) A firm must have in place an effective system of governance which provides for sound and prudent management of its business.

(2) The system of governance must include at least:

(a) an adequate transparent organisational structure with a clear allocation and appropriate segregation of responsibilities; and

(b) an effective system for ensuring the transmission of information.

(3) The system of governance must include compliance with the requirements laid down in:

(a) 3.5

(b) 4 to 10 (as applicable);

(c) Large Non-Solvency II Firms – Fitness and Propriety 2.1 to 2.3, 4.1, 4.3 and 4.4; and

(d) Large Non-Solvency II Firms – Allocation of Responsibilities 4.

(4) The system of governance must be subject to regular internal review.

3.3

A firm’s system of governance must be proportionate to the nature, scale and complexity of its operations.

3.4

A firm must:

(1) have written policies in relation to at least risk management, internal control, internal audit and, where relevant, outsourcing;

(2) make those policies subject to prior approval of its governing body;

(3) ensure those policies are implemented;

(4) review those policies at least annually; and

(5) adapt those policies in view of any significant change in the system or area concerned.

3.5

The written policy on risk management referred to in 3.4(1) must comprise at least the specific policies required by 7.2.

3.6

A firm must take reasonable steps to ensure continuity and regularity in the performance of its activities, including the development of contingency plans, to which end, the firm must employ appropriate and proportionate systems, resources and procedures.

3.7

A firm (other than a Swiss general insurer) must engage a broad set of qualities and competences when recruiting members to the governing body.

3.8

A firm must put in place a policy promoting diversity on the governing body.

3.9

A firm that maintains a website must explain on the website how it complies with the requirements of 3.7 and 3.8.