The Board of Directors is responsible for oversight of risk management and internal control systems and policies. The Board of Directors has established Board of Directors level risk committees at group and subsidiary levels, whose members are largely independent of management. These committees meet quarterly to oversee and challenge the development and effectiveness of risk management frameworks and priorities and to review risk reporting.

The Group Risk Management function, under the direction of the Group Chief Risk Officer, promotes sound and effective risk management across the Company by (i) ensuring the effective processes are in place to identify, assess, monitor, manage and report the risks to which the Company is or might be exposed, (ii) facilitating the setting of risk tolerances, limits and appetite by the Board and (iii) providing comprehensive and timely information on material risks which enables the Board and the Risk Committee to understand the overall risk profile of the Company. The Group Chief Risk Officer liaises with Risk Officers at subsidiary levels to develop consistency of approach with respect to risk identifying, assessing, monitoring, managing and reporting tailored to the operations of the subsidiaries.

All Risk Officers at group and subsidiary levels report directly to their relevant risk committees. In addition, there are management level risk and underwriting committees at group and subsidiary levels with escalation processes to Board of Directors level committees.