Gap analysis template

Sheet1This template should be used in conjunction with Lloyd's "Guidance notes on gap analysis March 2009" and page references are included below. Additional notes on completion of the relevant columns are included at the foot of this document.(1) Do you understand the requirement sufficiently at this stage(2) What further work/help is required to reach an understanding(3) Do you currently meet this requirement(4) Where are you short on this requirement(5) Action required to address any shortfall/ gap(6) When do you envisage you will be able to meet this requirement(7) Who will be responsible for actions on this requirement(8) Estimated time required to address gap(9) Level of resource needed to address gap(10) Current status on requirement R / A /GGovernance SectionRedGeneral governance requirements (pages 5-6)AmberExistingGreenlGovernance standardslRisk management standards (risk governance) - structure for governance that supports risk management by providing clearly defined accountabilities, expectations and reporting requirements for all partieslOperational processes minimum standards:key business and operational processes must be properly documenteddirectors and staff should understand all the operational and business processes relevant to their rolelRisk management standards - effective risk policy, subject to regular reviewNEWlRegular internal review of the system of governancelWritten policies for:internal controlinternal auditoutsourcinglPolicies for risk management, internal control, internal audit and outsourcing reviewed at least annuallylProcesses for the identification and management of emerging risk issuesFit & Proper Requirements (page 7)ExistinglUnderwriting Byelaw, para 42A, (appointments to senior positions) - fit and proper requirements for directors/partners/active underwriters/run-off managerslLloyds process for notification and amendment of appointments to all senior positions, including active underwriters and run-off managerslGovernance standardsNewlN/A (no significant changes to Lloyds requirements and processes anticipated at this stage)Risk Management (pages 8-9)ExistinglRisk management standards - governance structure to support the management of risklRisk management standards:risk policy setting out risk management strategy, covering each risk categoryrisk management process - risk identification and assessment, monitoring and reportinglRisk management standards - process to identify all significant riskslRisk management standards (risk governance) - structure of the risk management functionlICA guidance minimum standard: Mapping to the risk registerlContingency plans operational processes minimum standards - appropriate business continuity plansNewlRisk management function will need to address the following tasks relating to the internal model:design and implementationtesting and validationdocumentationinforming the Board about the performance of the modelanalysis of the performance of the model and production of summary reportslContingency planning (considered in a wider sense than operational business continuity)ORSA (pages 10-11)ExistinglN/A (this is a new requirement under Solvency II consistent with the principles of the ICAS regime)NewlDemonstrate the link between risk and capital management:the assessment must be driven by risk appetiteconsideration should be given to all risks that the business faces, including those that fall outside the SCR calculation (this applies whether the standard formula or an internal model is used)the ORSA should form an integral part of the business strategy and be taken into account on an ongoing basis in strategic decisionslSet out the methods used to determine overall solvency needs, including:assessment at different confidence levels eg as required for SCR, economic capitallonger term considerations ie assessment beyond the 12 month time horizon used for regulatory capitallBe updated annually as a minimum:agents will also need to revisit the ORSA in line with their own needs/material changes in the businessfrequency of reassessment will be key in demonstrating useagents will be required to inform Lloyds of the results of any reassessment of the ORSAInternal control (page 12)ExistinglInternal controls as covered by existing franchise standards (including underwriting, claims, and risk management)lUnderwriting byelaw (paragraph 40) - compliance officer appointmentNewlCompliance function to advise on laws, regulations etc relating to Solvency IIlAssess the possible impact of changes in the legal environment on operations and the identification and assessment of compliance riskInternal Audit (page 13)ExistinglRisk management standards - assurance processeslRisk management standards - ensuring independence between risk management and assurance processesNewlInternal audit function, independent from the operational functions of the businesslWhere outsourced, internal audit must remain subject to effective internal oversightlInternal audit should provide assurance over compliance with all internal strategies, processes and reporting procedureslInternal audit will also need to assess whether the internal control system remains sufficient and appropriate for the businesslInternal audit findings:should be reported to the Audit Committee and/or Board on a timely basisAudit Committee and/or Board will be responsible for ensuring compliance with findingslInternal audit reporting linesActuarial function (page 14-15)ExistinglLloyds Valuation of Liabilities Rules (governing the production of Statements of Actuarial Opinion and technical provisions)lGN20 Actuarial reporting under the Lloyds Valuation of Liabilities rulesNewlEach syndicate will need to ensure they have an actuarial functionlContribute to implementation of risk management systemlHave relevant experience and expertiselExpress an opinion on the overall underwriting policylExpress an opinion on the adequacy of reinsurance arrangementsOutsourcing (page 16)ExistinglOperational processes minimum standards - outsourced activities should be properly monitored and controlledNewlWhere functions are outsourced, agents will remain fully responsible for discharging all of their duties under the draft DirectiveTechnical SectionSupervisory Reporting & Public Disclosure (pages 17-18)ExistinglRequirement to submit information to Lloyds for annual regulatory return to the FSAlProvide syndicate annual reports to Lloyds and the FSAlReport financial and solvency position to Lloyds on a quarterly basisNewlFinal requirements will not be clarified until Level 2 but it is envisaged that a new set of regulatory reporting forms will be developedValuation of Liabilities (page 19-20)ExistinglLloyds Valuation of Liabilities RuleslGN20 Actuarial reporting under the Lloyds Valuation of Liabilities rulesNewlCalculate technical provisions as specified under QIS4:definition of best estimatecashflowsrisk marginpremium provisionsOwn Funds (page 21)ExistinglSyndicate assets comply with GENPRUNewlN/A (Lloyds do not anticipate applying any additional requirements for assets held at syndicate level over and above the draft Directive requirements)Use and approval of internal modelsUse Test (pages 23-24)ExistinglRisk Management standards, capital allocation:the capital assessment should be driven by the key business riskssound and appropriate capital assessment methodologyorganisation understands key drivers of its capital requirementslLloyds ICA Guidance and Minimum Standards:the need to demonstrate clearly the link between the risk framework and the ICA calculationconsistency with the syndicate business plan (SBF)embedding the ICAthe need to reflect the agents position against the franchise standards in the ICAthe importance of the involvement of senior management and the Board in deriving and challenging the capital assessmentthe requirement for an amended ICA where the risk profile of the syndicate has changed materially or a new SBF is submitted during the yearNewlDemonstrate use of the model in the businesslProcess for review of the internal modellBoard and senior management understanding and constructive challengelConsider the impact on the SCR where the model is re-run to reflect changes in the businesslChanges to the risk management framework, including the modelling process:formal approval by Board/senior managementappropriate adjustments to be made when the risk profile changeslClear link and consistency between the capital element of the internal model and other elementsStatistical quality standards (pages 25-26)ExistinglExtent of reliance on syndicate datalReference should be made to market data but needs to be adjusted to reflect syndicate characteristicslData should not be excessively smoothed as this is likely to understate volatilitiesNewlExpect the person responsible for any analysis supported by data to sign off that data meets criterion allowing for proportionalityCalibration Standards (pages 27-28)ExistinglModel should be calibrated using a VaR measure with a 99.5% confidence level, over a one year periodlNon modelled risks should be calibrated to the 99.5% confidence level and a suitable aggregation method should be usedlThe model must be able to calculate a separate ICA for each syndicate covering all years of account of the syndicate combinedlThe model should allow output into constituent risk groups and be capable of showing the result by risk group both pre and post diversificationlThe drivers of risk in each risk group should be identified and describedlThe model should allow sensitivity testing of the main parameters as requestedlPrescribed sensitivity tests are required as part of ICA pro-formaNewlModel should be flexible enough to allow for outputs other than the 1:200 level resultlOutput must address Solvency II risk categorisations for comparison with standard formula SCRProfit & loss attribution (page 29)ExistinglProvide analysis of model output against actual loss experiencelReview validity of past data over time as trends emerge and experience changesNewlExplicit back testing of the model is requiredlComparison of model output to emerging experience on a timely basis (expected to be at a class of business level)lAnalysis of emerging experience versus model expectations may need to be regularly reported to LloydsValidation Standards (pages 30-31)ExistinglStress tests are needed to validate the model output for reasonableness and to help with calibrating assumptionslStress and scenario tests must be relevant to their business and sufficiently extreme to represent the 1:200 levellSufficient data over and above a syndicates own data should be considered and additional stress tests performed on uncertain assumptionslAll models must be subject to sensitivity analysislManagement and Board understanding of sensitivity testinglValidate ICA against ECR and explain differencesNewlOutput of internal model will have to be compared against standard formula SCR for at least first two years of internal model uselValidation function should be independent of the person parameterising the model to allow objective and robust challengelBoard should have overall responsibility for validation - management information on validation should be presented to the board and challenged by itlValidation of the model should be carried out at least annually (appropriate frequency should be assessed by materiality)lGoodness of fit of probability distributions should be tested where statistical techniques are used, including both the choice of distribution and the parameterslActual vs expected analysis should be part of the validation process (expected to be at a class of business level)lValidation should consider not only emerging claims experience but all new data including:non-claims experience that could affect the profit and capital positionnew external quantitative informationqualitative information, both internal and externallValidation should check that all risks in the risk register are modelled and if not modelled there should be written justificationlAssessment of accuracy, completeness and appropriateness of data should form part of the validation process. Data quality and model sensitivity should drive design of calibrationlDocumentation should be adequate enough to allow independent verification of the validation processDocumentation Standards (pages 32-33)ExistinglExplain the approach to deriving the ICA and how it links together the business plan, key risks inherent in the business, related risk management processes and practices and the capital required by the riskslWhy the methodology chosen is appropriate to the syndicates business, taking account of its risk profile, risk appetite, track record with respect to risk experience and exposure and the key principles upon which the ICA is basedlThe approach adopted towards the quantification of risk and the rationale for this approachlThe stress and scenario tests used and why they are appropriate for the businesslThe sensitivity of key assumptionslThe overall ICA figure split by major risk category, before and after diversificationlThe allocation of capital across risk groups and the rationale and method used to derive the figures for eachlAll Lloyds minimum ICA standards must be addressedNewlCover the operational details of the internal model as well as the designlAddress articles 118-122 and 124lBe detailed and complete enough to allow a skilled and knowledgeable professional to replicate the modellDetail the theory underlying the internal model and be relevant to complexity of modellHighlight any areas where model is deemed not to perform effectively (model weaknesses) and detail how these are addressedlOutline the policy for changing the modellAll changes should be documented on an ongoing basis (model to be revisited regularly and updated as necessary in line with risk profile of business)External models and data (page 34)ExistinglSet out how Board/senior management are engaged in process particularly where outsourcing/consultants usedlUse of external cat models/ESG ICA must allow for possibility of model error or risks not captured in external modelslExternal loss databases, such as ORIC (operational risk consortium) for operational risk, to supplement own data when assessing 1:200 lossesNewlAny reliance on external supplier to be documented together with role of product(s) and extent to which they are usedlAble to demonstrate thorough understanding of use and limitations of any vendor software/products usedlDocument process undertaken to ensure external data/model chosen is appropriate to risk profile and should include sufficient sensitivity and scenario testing to validate uselClear strategy for regular review of any external models/data sources usedNotes1Agents should detail whether they currently feel they have a sufficient understanding of the requirement and what it is trying to achieve, bearing in mind that further guidance and detail will be provided going forward as the Level 2 implementing measures are developed. Agents should also consider the extent to which the understanding of the requirement is shared across the organisation.2Details should be provided as to what additional work the agent feels needs to be completed by them in order for the appropriate people at the agency to reach an adequate level of understanding of the requirement. Agents should also include here anything that Lloyds could do or provide to assist in reaching this understanding.3Agents should state whether they currently meet both the new and existing requirements.4Where the agent has identified a shortfall in meeting any of the expected requirements, they should provide detail as to where the gap arises.5For each identified gap, detail should be provided as to what actions are planned in order for the agent to address this gap and meet the requirement as it is currently envisaged.6For those requirements not currently met, agents should state the approximate date by which they expect to become compliant (in particular whether they expect to have addressed any gaps in time for the dry running process).7Agents should state the name and job title of those individuals responsible for completing each specific action identified.8An indication of the time required to address this gap (e.g. in person months) should be provided.9Agents should estimate here the amount and level of resource necessary to become compliant with the requirements where these are not currently met. In particular, agents should highlight areas where they expect that additional resource will be required and what form this additional resource will take.10Agents should select a status of red, amber or green to reflect the size and nature of the gap identified, and the level of risk associated with not complying with the requirement by the time of Solvency II implementation.