Reinsurance Risk Management Strategy: What Boards Expect

Writing a Reinsurance Risk Management Strategy: What Boards and Regulators Expect

Last reviewed: November 2026

A reinsurance risk management strategy is the board-approved document that sets out why an insurer buys reinsurance, how much risk it keeps, which reinsurers it will accept and how the programme is controlled. It turns risk appetite into retention, limit and counterparty decisions that the reinsurance team can apply at every renewal.

Most insurers have a reinsurance policy of some kind. Far fewer have one that a supervisor could trace, line by line, from the board's risk appetite to the treaties actually bought.

This guide is for CROs, CFOs, heads of outwards reinsurance and board risk committee members. It covers what Solvency II, the PRA and the IAIS expect, what the document should contain, and how to test it against your own programme.

Key Takeaways

• A reinsurance risk management strategy sets objectives, appetite and limits; the reinsurance programme is the detailed implementation.
• Solvency II Article 44 and Delegated Regulation Article 260 require reinsurance to be covered in the written risk management policy.
• IAIS ICP 13 expects senior management to develop the strategy and the board to approve it and oversee its implementation.
• A strong strategy states measurable limits: net retention, single-reinsurer exposure, minimum security and liquidity tolerance.
• Supervisors test whether the strategy is applied in practice, for example when a reinsurer is downgraded mid-year.
• The strategy should feed the ORSA, and programme performance should feed back into the strategy every year.

What Is a Reinsurance Risk Management Strategy?

A reinsurance risk management strategy is the part of the insurer's risk and capital management framework that governs outwards reinsurance. It explains what reinsurance is meant to achieve and sets the boundaries within which the programme must sit.

The IAIS describes the split clearly. The strategy sets objectives, risk concentration levels and ceding limits, while the programme covers the detailed coverage, limits, deductibles, layers, signed lines and markets used.

Strategy, Policy and Programme

Firms use the terms differently, so it helps to fix them early:

• Strategy: why the insurer buys reinsurance, what it is trying to protect and the appetite boundaries.
• Policy: the written rules and procedures that apply the strategy, including approval authorities and security criteria.
• Programme: the treaties and facultative covers bought for a given period.

Under Solvency II, the "written policy" on reinsurance is a formal requirement. Many firms combine strategy and policy in one document, which is acceptable if both elements are clearly present.

What Do Regulators Require?

Regulators require the reinsurance strategy to be part of the risk management system, approved at board level and applied consistently. The detail differs by regime, but the core expectations are very similar.

Solvency II

Article 44 of the Solvency II Directive lists reinsurance and other risk-mitigation techniques as one of the areas the risk management system must cover. The written risk management policy must include a policy on that area.

Article 260 of Delegated Regulation 2015/35 adds detail. The policy must cover the actions taken to select suitable reinsurance, the assessment of which techniques suit the risks assumed and the firm's ability to manage them, and the firm's own assessment of their credit risk.

EIOPA's Opinion on the use of risk mitigation techniques reinforces this. Capital relief depends on effective risk transfer, and supervisors are asked to look closely at basis risk and at terms that could undermine the transfer.

United Kingdom

UK insurers apply the same requirements through the PRA Rulebook, Conditions Governing Business, which retains reinsurance and other risk-mitigation techniques as a required risk management area. The PRA has also published supervisory statements on reinsurance counterparty credit risk and on funded reinsurance.

Those statements make clear that concentrated counterparty exposure needs prudent mitigation, such as collateral or funds withheld. A UK strategy should show how those expectations are met.

International Standard: ICP 13

IAIS Insurance Core Principle 13 requires ceding insurers to have a reinsurance programme that is appropriate to their business and part of their overall risk and capital management strategies. It expects the strategy to articulate objectives, concentration levels and ceding limits, and the mechanisms to manage reinsurance risks.

ICP 13 also sets out credit risk tools: security criteria, single-reinsurer limits, spread of risk, downgrade clauses, collateral, active recovery monitoring and funds withheld. Many supervisors outside Europe, including in the Gulf, build their rules on these principles.

Supervisors Asking for the Document Itself

Some supervisors require the strategy to be submitted. When Saudi Arabia introduced its local reinsurance cession requirements, insurers were required to update their reinsurance strategies and submit them for regulatory no-objection.

Even where submission is not required, expect the document to be requested in on-site reviews. It should therefore read as a live control document, not a compliance artefact.

What Should the Strategy Document Contain?

A complete reinsurance strategy covers twelve elements. The table below lists each one and the question a supervisor will ask about it.

ICP 13 also expects controls over facultative purchases, with cover secured before the risk is accepted when it is needed to stay within net capacity. That belongs in the programme structure section.

How Does Risk Appetite Translate Into Limits?

Risk appetite becomes useful only when it is expressed as numbers the programme can be tested against. The worked compliance scenario below shows how a strategy behaves when the market moves.

Worked Compliance Scenario: A Downgrade and a Bigger Line

The illustration is simplified and uses EUR millions. A mid-sized non-life insurer has own funds of 400 and a modelled gross 1-in-200 catastrophe loss of 260.

Board-approved appetite in the strategy:

• Net loss from a 1-in-200 catastrophe event no more than 10% of own funds, which is 40
• Recoverables from any one reinsurer group in that event no more than 15% of own funds, which is 60
• Minimum reinsurer rating of A- or equivalent, unless the exposure is fully collateralised
• Net retention on any one risk no more than 1% of own funds, which is 4

Programme: cat XoL of 230 xs 40, so cover runs to 270, plus per risk XoL with a retention of 4. In the 1-in-200 event, the cat programme recovers 260 − 40 = 220.

Without the strategy, both renewal changes look attractive. The larger line simplifies placement, and the downgraded reinsurer may be cheap to keep.

With measurable limits, the reinsurance team knows what to do without escalating every decision. The board sees exceptions, not routine choices.

The lesson for boards and CROs: an appetite statement that cannot be calculated from the programme is not an appetite statement. Every limit in the strategy should map to a number the reinsurance team can produce on the day of the decision.

Who Approves What: Board, Management or Reinsurance Team?

Clear allocation of decisions keeps the board focused on strategy and stops routine placement choices from reaching it. The table below shows a typical split consistent with ICP 13.

The IAIS notes that senior management develops the strategy and the programme, and the board approves the strategy and oversees implementation. That division is the default supervisors will expect to see.

Which Mistakes Make a Strategy Fail Supervisory Review?

Seven mistakes account for most supervisory findings on reinsurance strategy. All of them come from a gap between the document and how the programme is actually run.

How Should You Write and Implement the Strategy?

Write the strategy from the risk appetite downwards, then build the data that proves it is being followed. The steps below keep the document practical.

Implementation Steps

1. Start from appetite. Take the board's capital, earnings and liquidity tolerances and express each one as a reinsurance limit.
2. Map the current programme. Calculate where every treaty sits against each limit today.
3. Set security and concentration rules. Include ratings, unrated reinsurers, collateral, affiliates and downgrade actions.
4. Define risk transfer and basis risk tests. Specify which features trigger a formal assessment.
5. Plan liquidity. Estimate the cash gap between claims and recoveries in a severe event, and state how it is funded.
6. Allocate decisions. Record who approves the strategy, the programme, panel choices and exceptions.
7. Set KPIs and review triggers. Agree what is reported to the risk committee each quarter and what forces an off-cycle review.

What Data Does the Strategy Depend On?

The data behind these items is often spread across broking slips, spreadsheets and finance systems. Our article on why CFOs and CROs need one view of reinsurance buying looks at that problem in depth.

How Does the Strategy Link to Capital, ORSA and Accounting?

The strategy determines how reinsurance changes the insurer's capital, its own risk assessment and its financial statements. Each link should be explicit.

Solvency Capital

Under Solvency II, reinsurance reduces underwriting risk charges where risk is effectively transferred. It also creates counterparty default risk on recoverables, so the strategy's security and concentration limits directly affect the capital charge.

ORSA

ICP 13 expects reinsurance credit risk to be reflected in capital assessment and the ORSA. The ORSA should test the programme under stress, including multiple events, reinsurer default and failure to renew key cover.

Many firms still run those tests on simplified recoverable data. We explain how to close that gap in the reinsurer data gap in ORSA.

Accounting

Under IFRS 17, reinsurance contracts held are measured separately from the underlying contracts. The strategy should be consistent with how finance groups and measures those contracts, so that the economics the board approved match what is reported.

What Market Conditions Should the Strategy Anticipate?

A strategy written in one market phase has to survive the next. The reset of 2023 showed that retentions, terms and capacity can all change sharply in a single renewal.

Since then, capacity has returned to many lines and pricing has eased in parts of the property market. Softer conditions make it tempting to relax security criteria, accept larger single lines or buy features that dilute risk transfer.

The strategy should state in advance which of those trade-offs the board will accept. Supervisors are also paying closer attention to funded reinsurance, termination clauses and offshore concentrations, so those areas deserve explicit rules.

Checklist for Boards and CROs

Use this checklist when you write, review or challenge a reinsurance risk management strategy.

• Every appetite limit is expressed as a number that can be calculated from the programme
• Gross and net bases are consistent between appetite, models and treaty retentions
• Security criteria include unrated reinsurers, collateral and a mid-year downgrade rule
• Concentration limits cover reinsurer groups, including affiliates
• Contracts with caps, corridors, termination rights or non-indemnity triggers get a documented risk transfer assessment
• The liquidity gap between claims and recoveries is estimated and funded
• Board, management and reinsurance team decision rights are recorded
• The strategy is reviewed at least annually and after any material change

For the controls behind these items, a centralised reinsurance treaty management platform keeps terms, shares and settlement rules in one place. That lets the risk function test the strategy against the live programme instead of last year's spreadsheet.

Key Terms

Reinsurance risk management strategy: The board-approved statement of why and how an insurer uses reinsurance, including appetite, retention, security and concentration limits.

Reinsurance programme: The specific treaties and facultative covers bought to implement the strategy for a period, including layers, limits and signed lines.

Risk appetite: The level and type of risk an insurer is willing to accept in pursuit of its objectives, expressed on both a gross and a net basis.

Security criteria: The minimum financial strength, rating or collateral standards a reinsurer must meet to join the panel.

Concentration limit: The maximum exposure the insurer will accept to one reinsurer or group of related reinsurers.

Downgrade clause: A treaty term that gives the cedent rights, such as collateral or termination, if a reinsurer's rating falls below a threshold.

Effective risk transfer: The extent to which a contract genuinely moves insurance risk to the reinsurer. Capital relief depends on it.

Basis risk: The risk that the exposure covered by a risk-mitigation technique does not match the insurer's actual risk exposure.

ORSA: The own risk and solvency assessment, in which the insurer assesses its risks, its capital needs and the effect of its reinsurance.

Sources

• Solvency II Directive, Article 44 Risk management (EIOPA Single Rulebook)
• Delegated Regulation (EU) 2015/35, Article 260 Risk management areas (EIOPA Single Rulebook)
• EIOPA Opinion on the use of risk mitigation techniques by insurance undertakings
• PRA Rulebook: Conditions Governing Business
• IAIS Insurance Core Principles and ComFrame, December 2024 (ICP 13)