C _ Group Management Report Allianz has developed a consistent operational risk management Business risks include cost risks and policyholder behavior risks. They framework, which is applied across the Group based on are mostly driven by the Life/Health business and to a lesser extent by proportionality and focuses on the early recognition and proactive the Property-Casualty business. Cost risks are associated with the risk management of material operational risks. The framework defines that expenses incurred in administering policies are higher than roles and responsibilities as well as management processes and expected or that new business volume decreases to a level that does methods: Local risk managers at Allianz SE and at the other operating not allow Allianz to absorb its fixed costs. Business risk is measured entities of the Allianz Group, in their capacity as Second Line of relative to baseline plans. Defense, identify and evaluate relevant operational risks and control For the Life/Health business, policyholder behavior risks are risks deficiencies via a dialogue with the First Line of Defense, report related to unpredictable, adverse behavior of policyholders in operational risk events in a central database, and ensure that the exercising their contractual options, such as, for instance, early framework is implemented in their respective operating entity. termination of contracts, surrenders, partial withdrawals, renewals, This framework triggers specific mitigating control programs. For and annuity take-up options. example, compliance risks are addressed with written policies and Assumptions on policyholder behavior are set in line with dedicated compliance programs monitored by compliance functions accepted actuarial methods and based on own historical data, where across the Allianz Group. The risk of financial misstatement is available. If there is no historical data, assumptions are based on mitigated by a system of internal controls covering financial reporting. industry data or expert judgment. These are used as a basis to Outsourcing risks are covered by our Outsourcing Policy, Service Level determine the economic impact of policyholder behavior under Agreements, and Business Continuity and Crisis Management different scenarios within our internal model. programs to protect critical business functions from these events. Cyber risks are mitigated through investments in cybersecurity, cyber insurance that Allianz buys from third-party insurers, and a variety of Operational risks refer to losses resulting from inadequate or failed ongoing control activities. internal processes, human errors, system failures, and external events, and can stem from a wide variety of sources, including the following: − “Clients, Products and Business Practices”: potential losses due to There are risks which, due to their nature, cannot be adequately a failure to meet the professional obligations or from the design of addressed or mitigated by setting aside dedicated capital. These risks products. Examples include misselling, non-compliance with are therefore not considered in the internal model. For the internal or external requirements related to products, anti-trust identification, analysis, assessment, monitoring, and management of behavior, data protection, sanctions and embargoes, etc. These these risks we also use a systematic approach, with risk assessment losses tend to be less frequent but, when they occur, can have high generally based on qualitative criteria or scenario analyses. The most financial impact. important of these other risks are strategic, liquidity, and reputational − “Execution, Delivery, and Process Management”: potential losses risk. arising from transaction or process management failures. Examples include interest and penalties from non-payment or Strategic risk underpayment of taxes or losses associated with broker and agent Strategic risk is the risk of a decrease in the company’s value that will distribution processes. These losses tend to be of a relatively higher arise from adverse management decisions on business strategies and frequency but with little financial impact (although single large- their implementation. loss events can occur). Strategic risks are identified and evaluated as part of the Group’s − Other operational risks including, for example, internal or external Top Risk Assessment process, and discussed in various Board of fraud, financial misstatement risk, a cybersecurity incident causing Management-level committees (for example, GFRC). We also monitor business disruption or fines, a potential failure at our outsourcing market and competitive conditions, capital market requirements, partners causing a disruption to our working environment, etc. regulatory conditions, etc., to decide if strategic adjustments are necessary. The Group’s operational risk capital is dominated (by more than 80 %) The most important strategic risks are directly addressed through by the risk of potential losses within the categories “Clients, Products, Allianz’s Renewal Agenda, which focuses on five themes: True and Business Practices” and “Execution, Delivery, and Process Customer Centricity, Digital by Default, Technical Excellence, Growth Management”. With regard to the largest category “Clients, Products, Engines, and Inclusive Meritocracy. Progress on mitigating strategic and Business Practices”, key external drivers are changes in laws and risks and meeting the Renewal Agenda objectives is monitored and regulations. Internal drivers reflect potential failures of internal evaluated in the course of the Strategic and Planning Dialogues processes. These drivers are considered in the local scenario analyses. between the Allianz Group and the related undertakings. Operational risk capital is calculated using a scenario-based approach based on expert judgment as well as internal and external operational loss data. The estimates for frequency and severity of potential loss events for each material operational risk category are assessed and used as a basis for our internal model calibration. Annual Report 2021 − Allianz Group 103