The four functions Solvency II requires of every insurance undertaking: risk management, compliance, internal audit, and actuarial, each with direct access to the administrative body.
Pillar two does not impose an org chart, it imposes that four responsibilities be exercised, identified and attributable to a named person. The risk management function holds the identification and measurement framework and carries ORSA. The compliance function assesses non-compliance risk and warns about changes in the legal environment. The internal audit function evaluates the effectiveness of everything else, including the other three functions, which requires its independence: it may exercise no operational function, and it is the only one of the four under that absolute prohibition. The actuarial function coordinates the calculation of technical provisions, opines on the underwriting policy and on the adequacy of reinsurance arrangements. Two rules govern their exercise. Each has direct access to the administrative body, with no filter from executive management, because a warning routed through the hierarchy it implicates never arrives. And the proportionality principle allows them to be combined in small undertakings, except for internal audit.
Article 44 and following of Directive 2009/138/EC, applicable since January 1, 2016. In a midsize French insurer the four functions typically represent eight to fifteen people, and the holder of each is notified to the ACPR on appointment and on departure. That notification is what gives the function its practical protection: a holder dismissed after raising an alert leaves a trace with the supervisor.
quatre fonctions clés, key functions, fonction de gestion des risques, fonction de conformité, fonction d'audit interne