
Ecclesiastical Insurance Office public limited company
Strategic Report
• Robust management of claims including
investigation and justification
• Reserving Team training and understanding of
the risk to ensure recommendation of
appropriate reserves
Catastrophe risk
• Modelling and exposure monitoring is
There have not been material changes to this risk
The risk of large scale extreme events
undertaken to understand the risk profile and
during the year.
giving rise to significant insured losses.
inform the purchase of reinsurance
Through our General Insurance
• Local risk appetite limits have been established
business we are exposed to significant
to manage concentrations of risk and these are
natural catastrophes in the territories in
monitored by SBUs
which we do business.
• There is a comprehensive reinsurance
programme in place to protect against extreme
events. All placements are reviewed and
approved by the Group Reinsurance Board
• Processes in place to provide oversight and
sign off of reinsurance modelling and exposure
management across the company
• The Risk Appetite specifies the reinsurance
purchase levels and retention levels for such
events
Reinsurance risk
• We take a long-term view of reinsurance
The level of this risk has remained broadly similar
The risk of failing to access and manage
relationships to deliver sustainable capacity
since last year. We continue to take a long-term
reinsurance capacity at a reasonable
• A well-diversified panel of reinsurers is
approach to our reinsurance relationships.
price. Reinsurance is a central
maintained for each element of the programme
component of our business model,
• A General Insurance Reinsurance Executive
enabling us to insure a portfolio of large
Meeting approves all strategic general
risks in proportion to our capital base.
reinsurance decisions
Operational risk
The risk of loss arising from inadequate or failed internal processes, people and systems, or from external events
Risk detail Key mitigants Change from last year
Cyber risk
• A number of security measures are deployed to
Cyber risk remains a constantly evolving threat, with
The risk of criminal or unauthorised use
ensure protected system access
malicious threat actors continuing to seek to exploit
of electronic information, either
• Security reviews and assessments are
businesses. Ongoing investment in technology and
belonging to the Company or its
performed on an ongoing basis
employee awareness and vigilance is therefore
stakeholders for example customers,
• There is ongoing maintenance and monitoring
highly important at this time, which is continuing to
employees etc. Cyber security threats
of our systems and infrastructure in order to
be proactively managed.
from malicious parties continue to
prevent and detect cyber security attacks
increase in both number and
• There is an ongoing information security
sophistication across all industries and
training and awareness programme
remains the Company’s highest rated
risk.
Data governance (inc. management and
• A Group Data Committee is in place
Enhancements continue to be made to the
protection)
• Group data governance and Group data
governance, management, use and control of data, in
The risk that the confidentiality,
management and information security policies
order to meet the evolving requirements, and
integrity and/or availability of data held
are in place
remains a key focus.
across the Group is compromised, or
• Data is managed by Data Owners and
data is misused. The Group holds
Stewards, and supported by Data teams for
significant amounts of customer and
technical support and oversight
financial data and there could be
significant implications, including if this
is compromised or is found to be
inaccurate.
Critical Supplier risk
• Pre-defined contingency/exit plans in place
The risk remains unchanged, with action underway
Poor customer service or disruption to
with business-critical services
to continue to enhance oversight of the high risk
the business caused by supplier failure
• Regular credit checking and financial
suppliers.
(including data or regulatory breach) or
monitoring of suppliers' financial status
inadequate contractual arrangements,
• Ongoing and specialist due diligence and
due diligence, and ongoing supplier
ongoing monitoring, including cyber security and
management.