11 June 2013

ECIIA: The role of Internal Audit under Solvency II

This document represents the common thinking and position achieved by the working group on this topic and aims at promoting a homogenous approach by its practitioners as well as boosting the cooperation with the European Insurance Authorities. This cooperation is considered vital by the ECIIA to ensure an effective and efficient implementation of the third and fourth level of the Lamfalussy process, consistent with the high level of internal control knowledge and expertise already achieved by Internal Audit.

The document discusses to what extent the internal audit function is already in line with the new requirements of Solvency II, taking into account existing standards for the profession. For this purpose, the starting point for the analysis will be a review of both the Definition of Internal Audit and the IIA Standards, compared to the requirements of the Solvency II Directive. The second part of the document provides clarification of the impact the new processes required by the Solvency II Directive will have on the audit universe including a description of new activities that may be required.

The ECIIA welcomes the fact that with the Solvency II framework the important role of Internal Audit in the system of governance has been acknowledged by the EU for the insurance industry. In particular, the high level of independence of Internal Audit, clearly distinguishing it from the other governance functions, has been emphasised by Solvency II. A high level of independence is a key factor if Internal Audit is to perform its primary role as the assurance function for the Board of an insurance undertaking. The definition of the position, role and tasks of Internal Audit in the Solvency II directive is fully in line with the existing IIA

Standards and the generally accepted good practice of the profession. Thus Solvency II does not in principle lead to any real change in the role of Internal Audit.

However, the ECIIA acknowledges that - depending on the already existing regulatory framework in the different countries of the EU - in some countries there may still be a long way to go before all internal audit functions in insurance undertakings are fully compliant with the already existing IIA standards and principles.

This applies both in respect of the position of Internal Audit, as the independent assurance function in an insurance undertaking, as well as to the specific requirements for Internal Audit according to Solvency II.

The ECIIA wishes to support EIOPA by promoting the further development of the internal audit function and by finding practical solutions for the implementation of the Solvency II requirements.

In a Solvency II scenario, the ECIIA expects Internal Audit to:

• regularly review the adequacy and effectiveness of the main governance process installed by other governance functions;
• ensure a fair exchange of information with other governance functions;
• discuss with other governance functions risk categorisation, opinion parameters, reporting tools, materiality metrics etc. and thus enable all governance functions to speak to the Board (including the Audit Committee) using the same language;
• use the output from other governance functions to build independent risk oriented audit plans. Internal Audit should proactively work to enhance effective collaboration, clear responsibilities and peer acceptance with other governance functions in addition to seeking Board approval of the above-mentioned topics.

In conclusion, the ECIIA is of the opinion that the requirements set out in Solvency II as to the work, structure and organisation of an Internal Audit department are not new as they follow the guidelines already defined by the IIA for the profession. However, Solvency II presents a challenge for the profession as there may still be a long way to go for many insurance undertakings to fully comply with the new regulation and the existing IIA Standards. This applies in particular in the area of the independence of Internal Audit.

This is crucial, if Internal Audit wants to act as the objective assurance function for the Board. Another challenge is the extension of the audit universe by Solvency II, which requires an internal audit function to possess additional skills. Internal Audit will need to ensure an adequate professional knowledge through and investment in human capital as well as insourcing expertise as appropriate. Last but not least the creation of a new governance system by Solvency II means a challenge not only for Internal Audit but for an insurance undertaking taken as a whole, if the governance system is to work effectively.

Press release

Publication

© ECIIA