7.1 Introduction

The objective of risk management is to:

• enhance the PZU Group’s value through active and deliberate management of the extent of risk taken;
• prevent the acceptance of risk at a level that could pose a threat to the PZU Group’s financial stability.

Risk management in the PZU Group is based on risk analysis in all processes and units. Risk management is an integral part of the management system.

The main elements of risk management are consistent for all PZU Group companies and implemented to ensure the execution of strategic plans of the individual companies as well as business objectives of the entire PZU Group. They include the following:

• systems of limits and limitations on the acceptable level of risk, including the level of risk appetite;
• processes involving the identification, measurement and assessment, monitoring and controlling, reporting and management measures pertaining to various risks;
• risk management organizational structure in which the management boards and supervisory boards of the companies and dedicated committees play a crucial role.

The risk management system in the PZU Group is based on the following:

• organizational structure – comprising a split of duties and tasks performed in the risk management process by statutory bodies, committees and individual organizational units and cells;
• risk management process, including risk identification, measurement and assessment, monitoring and control methods, risk reporting and undertaking management actions.

Risk management strategy at the PZU Group and in individual PZU Group companies defines the risk management framework by setting limits for risk parameters (defining risk appetite and describing the risk profile), identifying the roles and responsibilities of participants in the risk management process and the course of the process. It is also used to improve business planning and maintaining risk at an acceptable level.

The objective of the strategy and related management policies for individual risk categories is to:

• introduce unified definitions related to risk management;
• introduce the rules governing the identification, measurement and assessment, monitoring and controlling, reporting of risk and decision-making about risk levels;
• set the risk appetite and the risk profile.

The integrated risk management system of the PZU Group ensures compliance with the requirements of the Insurance and Reinsurance Activity Act of 11 September 2015 and covers mainly the PZU Group’s insurance undertakings. Entities from other financial market sectors are obligated to apply the standards applicable to a given sector. The accepted internal regulations set out:

• processes, methods and procedures facilitating risk measurement and management;
• split of duties in the risk management process;
• scope and conditions and the frequency of risk management reporting.

PZU exercises supervision over the PZU Group’s risk management system on the basis of cooperation agreements signed with other PZU Group entities. PZU uses the information received to manage the PZU Group’s risk at an aggregate level. The cooperation agreements and the scope of information to be provided take into consideration the specific legal nature of each entity concerned, including limitations arising from banking secrecy rules.

In order to ensure effectiveness of risk management at the PZU Group level, the risk management rules applicable to subsidiaries have been adopted; they include PZU’s recommendation regarding the organization of the risk management system (in both insurance and banking sectors).

The management boards of PZU Group entities are responsible for fulfilling their own duties in accordance with the generally applicable provisions of national, European and international law. In particular, they are responsible for the implementation of an adequate and effective risk management system.

Supervision over the risk management systems in each regulated entity is exercised by the supervisory boards to which PZU appoints its representatives.