EY were first appointed as the external auditor for the 2019 accounting year. The respective responsibilities of the Directors and the Auditors in connection with the accounts are explained in the Governance section of the annual report under ‘Statement of Directors’ Responsibilities’ and the Independent Auditor’s Report.
The Board is responsible for the Group’s system of risk management and internal control and for reviewing its effectiveness. However, such a system can only provide reasonable, not absolute, assurance against material misstatement or loss. The system is designed to manage, rather than eliminate, the risk of failure to achieve business objectives within the risk appetite set by the Board. The Board confirms that it is comfortable with the effectiveness of the Group’s risk management and internal controls (including financial, operational and compliance controls), which have been in place throughout the year and continue to operate up to the date of approval of the annual report and accounts. The Board delegates oversight of these controls and their effectiveness to the Audit Committee and Risk Committee, as set out in their terms of reference. The Audit Committee has overseen work to enhance internal controls in relation to financial and non-financial information and reporting during the year. More information on work undertaken as well as the process to review internal financial controls is included in the Audit Committee report located in the Governance section of the annual report. The risk committee is responsible for oversight of the overall risk management system and of compliance and operational controls. More information on the process to review compliance and operational controls is included in the Risk Committee report.
The Risk Committee receives regular reports from the Risk Management and Second Line Assurance teams, which includes control validation activity carried out, and provides a review of the robustness of control systems. Reports throughout the year from both of these Committees to the Board help inform the view over the effectiveness of these systems and any enhancements or actions required. The Board, with the support of its Risk Committee, also performed an assessment of the principal and emerging risks facing the Group, in line with the risk management framework.
The Board agrees the overall risk appetite for the Group. Throughout the year, the Board has monitored performance against risk appetite in accordance with the risk management framework, which is itself reviewed and approved by the Board annually. Key components of the risk management framework include ongoing assessment and validation of controls, and taking steps to ensure that controls remain effective. Ongoing oversight of risk is undertaken via the Executive Risk and Regulatory Committee, which meets each month and considers key risk indicators and reviews of specific risk areas. The Board delegates oversight of risk management and compliance matters to the Risk Committee. There is ongoing reporting of risk matters to Risk Committee and Board, as appropriate, from the Chief Risk Officer and members of the Risk function. The Board also receives specific assessments of risk in the form of risk opinions to support key decision making. During the year, the Board received risk opinions in relation to the execution of key strategic projects related to the three platform strategy. This included reviewing all key risks including capital, insurance, liquidity and operational risks in relation to key steps in the projects. The Board also received a risk opinion in relation to the transition to Solvency Coverage Ratio for monitoring and reporting solvency.
Annually, the Board receives a risk opinion on the business plan for the forthcoming year. This year's risk assessment focused on whether the plan was logical, realistic and achievable as well as any risks to the plan and how they would be mitigated, which helped inform the Board's assessment and approval of next year’s business plan.
Further information is provided in the Risk management and compliance report located in the Strategic Report section of the annual report and the Risk Committee report.