MFSA Review of Risk Management Functions:

Strengthening risk identification and assessment

One of the main areas requiring improvement relates to how undertakings identify, assess and document their risks.

The MFSA identified instances where risk identification relied heavily on informal discussions or desk-based exercises, without sufficiently structured and documented methodologies.

The Authority also highlighted weaknesses in the assessment of inherent and residual risks, together with instances where risk ownership was not clearly assigned to individual stakeholders.

An effective risk management framework should establish consistent processes for identifying material risks, evaluating their potential impact and likelihood, assessing the effectiveness of mitigating controls and assigning clear accountability.

Risk Registers should therefore be treated as dynamic management tools that reflect changes in the business environment, rather than documents updated primarily for compliance purposes.


 

Making risk appetite meaningful in practice

Another important theme emerging from the MFSA's review is the integration of risk appetite into everyday business decisions.

The Authority identified good practices among undertakings that established measurable risk appetite limits, meaningful Key Risk Indicators (KRIs) and clearly defined escalation procedures.

In these cases, risk appetite was not limited to a Board-approved framework. It was actively used to monitor emerging exposures, challenge business decisions and trigger management actions when risks approached or exceeded established thresholds.

For insurance undertakings, this highlights the importance of aligning the Risk Appetite Framework with the Risk Register, risk monitoring activities and management reporting.

Effective integration enables Boards and Senior Management to understand whether the undertaking is operating within its approved risk appetite and respond appropriately when risk exposures change.


 

Improving operational risk incident management

The MFSA also identified weaknesses in operational risk incident management, particularly concerning the identification, recording, investigation and escalation of incidents.

In certain cases, incident reporting processes did not consistently capture operational events or near misses. Other weaknesses included inconsistent reporting thresholds, insufficient root cause analysis and inadequate monitoring of corrective actions.

These gaps can limit an undertaking's ability to identify recurring control weaknesses and emerging operational risks.

A robust incident management framework should therefore ensure that incidents and near misses are systematically recorded, analysed and reported, with clearly defined responsibilities and timely remediation.

Importantly, information obtained through incident management should also feed into broader risk assessments, scenario analysis and the Own Risk and Solvency Assessment (ORSA), supporting a more forward-looking approach to risk management.


 

Risk Management Policies should reflect business realities

Although the MFSA acknowledged that undertakings generally maintained Board-approved Risk Management Policies, its review highlighted that several policies remained overly generic.

In some instances, policies lacked sufficient detail regarding risk management methodologies, links to capital requirements and risk tolerances, or the arrangements for conducting stress testing.

The Authority also observed cases where annual policy reviews resulted in limited substantive changes, despite evolving business activities and risk exposures.

This highlights the importance of ensuring that risk management policies are tailored to the undertaking's business model, operational complexity and risk profile.

Periodic reviews should go beyond administrative updates and consider whether existing methodologies, controls and governance arrangements remain appropriate and effective.


 

Ensuring continuity and effective oversight

The review also addressed the importance of adequate resources, structured risk management workplans, business continuity and succession planning.

The MFSA identified opportunities to strengthen workplans by incorporating clearly defined activities, timelines and responsibilities, while allowing sufficient flexibility to respond to emerging risks.

Weaknesses were also identified in business continuity arrangements, including limited involvement of the RMF in Business Continuity Planning and insufficient testing.

Similarly, succession planning arrangements did not always adequately address continuity in key positions.

For undertakings that outsource their RMF, the MFSA emphasised the importance of maintaining effective oversight, sufficient internal expertise and ongoing engagement with service providers.

These observations reinforce the need for the RMF to operate continuously and effectively, irrespective of organisational changes or outsourcing arrangements.


 

What should insurance undertakings consider next?

The MFSA expects insurance and reinsurance undertakings to assess their existing Risk Management Systems against the observations and good practices highlighted in the Dear CEO Letter.

Key areas for consideration include:

• The adequacy of risk identification and assessment methodologies.
• The integration of risk appetite, KRIs and Risk Registers.
• The effectiveness of operational risk incident reporting and monitoring.
• The relevance and completeness of Risk Management Policies.
• The adequacy of RMF resources, workplans and governance arrangements.
• The effectiveness of business continuity, succession planning and oversight arrangements.

The broader message is clear: maintaining regulatory compliance is important, but the effectiveness of risk management ultimately depends on how well it is embedded within the organisation's governance and decision-making processes.

For Malta's insurance sector, the findings provide an opportunity to strengthen existing arrangements, improve risk oversight and build greater organisational resilience.


 

How can BDO Malta help?

BDO Malta can support insurance and reinsurance undertakings in assessing and strengthening their Risk Management Functions and broader risk management frameworks in line with Solvency II requirements and MFSA supervisory expectations.

By identifying gaps and areas for improvement, BDO Malta can help undertakings enhance their risk governance, risk assessment methodologies and monitoring arrangements, supporting more effective risk management, regulatory compliance and organisational resilience.

To discuss how your organisation can strengthen its Risk Management Function and risk management arrangements, get in touch with our team.