SS11/16 – Solvency II: External audit of, and responsibilities of the governing body in relation to, the public disclosure requirement

1.1

This Prudential Regulation Authority (PRA) supervisory statement is relevant to firms in scope of Solvency II, including the Society of Lloyd's (collectively 'insurers' or ‘firms’ throughout the SS), and the auditors of those firms.¹ It reminds the governing body of its responsibilities in respect of the ongoing appropriateness of the information disclosed, and that it must approve the Solvency and Financial Condition Report (SFCR). It also sets out the level of assurance expected with respect to the external audit requirement on the SFCR and the audit guidance that the PRA expects auditors to follow in auditing a firm’s SFCR. It should be read alongside the External Auditors Part of the PRA Rulebook. The parts of this supervisory statement that relate to the external audit of the SFCR are not applicable to 'small insurers for external audit purposes' and 'small groups for external audit purposes', as set out in External Audit 1.1.

1.2

By clearly and consistently explaining its expectations of insurers and audit firms in relation to the particular areas addressed, the PRA seeks to advance its statutory objectives of ensuring the safety and soundness of the firms it regulates, and contributing to securing an appropriate degree of protection for policyholders.² The PRA is legally required, so far as is reasonably possible, to facilitate effective competition in the markets for services provided by PRA authorised persons in carrying on regulated activities. The PRA has considered matters to which it is required to have regard, and it considers that this supervisory statement is compatible with the Regulatory Principles and relevant provisions of the Legislative and Regulatory Reform Act 2006. This supervisory statement is not expected to have any direct or indirect discriminatory impact under existing UK law.

2.1

The Reporting Part of the PRA Rulebook requires that an insurer must have in place a written policy ensuring the ongoing appropriateness of any information disclosed and that the insurer must ensure that its SFCR is subject to approval by its governing body.³ Therefore the PRA expects the governing body to take responsibility for ensuring that the SFCR has been properly prepared in all material respects in accordance with the PRA rules and Solvency II Regulations.

2.2

As well as having a written policy in place to ensure the ongoing appropriateness of any information disclosed, the PRA expects that the governing body should be satisfied that:

1. (a) throughout the financial year in question, the insurer has complied in all material respects with the requirements of the PRA rules and Solvency II Regulations as applicable to the insurer; and
2. (b) it is reasonable to believe that, at the date of the publication of the SFCR, the insurer has continued so to comply, and will continue so to comply in future.

2.3

The PRA expects the governing body to acknowledge and evidence in writing its responsibility for the SFCR and make this available to potential readers of the SFCR by signing the SFCR and attaching the written acknowledgment to the SFCR.

3.1

External audit of the SFCR refers to an independent auditor gathering sufficient appropriate evidence to provide an overall reasonable assurance opinion that the public disclosure in scope complies in all material respects with PRA rules and Solvency II Regulations. Reasonable assurance is a high level of assurance described in relevant auditing standards.⁴ It is achieved when the auditor has obtained sufficient appropriate audit evidence to reduce audit risk (that is the risk that the auditor expresses an inappropriate opinion when the SFCR is materially misstated) to an acceptably low level. External Audit 2.2 describes the relevant elements of the public disclosure in scope in the ‘Valuation for solvency purposes’ and ‘Capital management’ sections of the SFCR subject to the two exemptions. First, the Solvency Capital Requirement (SCR) and information that derives from it, is exempt if calculated using an approved full or partial internal model (External Audit 2.2(3) and 2.2(4)). Secondly, where Solvency II requires information in the SFCR to be produced using sectoral rules (External Audit 4.2 explained in paragraph 3.3 below).

3.2

PRA rules apply whenever a SFCR is disclosed, whether at the solo or, where relevant, at the group and sub group level. Information in relation to undertakings included in the SFCR (including undertakings established in the UK and those established in a third country) will therefore be within scope for external audit (except where the information in the group SFCR has been compiled in accordance with sectoral rules).

3.3

Where information for the group SFCR is compiled in accordance with sectoral rules (as required under Solvency II), the group auditor should undertake an assessment of whether that information has been properly extracted in accordance with the relevant sectoral rules, from information provided to the insurer by other undertakings of the insurance group and from the insurer’s own records. An external audit of sectoral information is not required.

3.4

The auditor is not expected to express an opinion on the validity of an approval, waiver or other supervisory determination. Instead approvals, waivers and supervisory determinations provided by the competent authority should be considered as part of the framework against which the audit opinion is being given. For the purposes of transitional measures on technical provisions, Pillar 1 and 2 assets, liabilities and capital calculated in accordance with the previous regime, should be treated as part of the framework against which the audit opinion is being given.

3.5

External Audit 4.1(3) requires that the auditor read and consider all information disclosed by the firm in its SFCR that is not subject to the reasonable assurance opinion as a relevant element of the SFCR (other information) to identify material inconsistencies with the relevant elements of the SFCR and any knowledge obtained during the course of the audit of the SFCR engagement, and (where applicable) audit of the financial statements. When complying with this rule, the PRA expects the auditor to follow ‘International Standard on Auditing (UK) 720 (Revised November 2019) The Auditors Responsibilities Relating to Other Information’.⁵

4.1

The PRA notes that standards and guidance for auditors are issued by the Financial Reporting Council (FRC) which apply to non-statutory audit engagements of the type required by the PRA’s rules. The PRA would normally expect auditors to comply with relevant standards in such engagements. The PRA therefore regards compliance with International Standards on Auditing (UK) (ISAs (UK)) as the primary means by which auditors will be able to demonstrate that they have complied with the External Audit Part of the PRA Rulebook.

4.2

Auditing standards and guidance will be updated by the FRC from time to time. The PRA may update this supervisory statement accordingly as appropriate.

4.2A

The scale of the matching adjustment (ie the extent to which the MA impacts on technical provisions) is within scope of audit where the PRA’s external audit rules apply.⁶ This reflects the fact that the impact of the MA falls within the ‘relevant elements’ that external auditors of the SFCR are required to form a view on.⁷

4.2B

However, the interaction of the SFCR external audit rules and those relating to firms’ use of the matching adjustment (MA) may be complex. This reflects the nature of the MA, the role of the PRA in supervising its use, and the interaction of these with audit requirements.

4.2C

In the context of the External Audit Part, the main requirements relating to the MA can usefully be separated between the related but distinct:

• conditions of eligibility (as specified by regulation 4 of The Insurance and Reinsurance Undertakings (Prudential Requirements) Regulations 2023 (the entire regulations referred to henceforth as the ‘IRPR regulations’) and Chapter 2 of the Matching Adjustment Part of the PRA Rulebook);
• the calculation of the MA (specified by regulations 5 and 6 of the IRPR regulations, Chapters 4, 6 and 8 of the Matching Adjustment Part as well as supporting technical information published by the PRA); and
• the way that the MA is applied (specified by Matching Adjustment 2.1, 3.2 and Chapter 13 of the Matching Adjustment Part).⁸

4.2D

The PRA takes into account the firm’s description of its process to calculate the MA during the MA application process. It does not approve the firm’s calculation methodology as part of that process. The PRA supervises firms’ use of the MA and the scale of MA benefit claimed on an ongoing basis, in a way that is consistent with the PRA’s published approach to insurance supervision. As part of supervisory work, the PRA may decide to review a firm’s MA calculation in order to ensure that this is done to an appropriate standard and complies with relevant requirements. The PRA may apply closer scrutiny and, where appropriate, would consider use of its relevant supervisory powers under s55M FSMA where it has concerns about the compliance of a firm’s MA calculation with the legislative requirements (eg regulations 5 and 6 of the IRPR regulations and Chapters 4, 6 and 8 of the Matching Adjustment Part).⁹

4.2E

In forming the opinion required by Rules 2.1 and 4.1 of the External Audit Part of the PRA Rulebook, auditors are not required to assess whether a firm meets the eligibility conditions for use of the MA. As noted in paragraph 3.4, auditors are not expected to express an opinion on the validity of an approval, waiver or other supervisory determination.

4.2F

However, to provide the audit opinion required in relation to the SFCR, to the extent it is material to their opinion, auditors are expected to consider the scale of the MA claimed by the firm. This reflects the fact that the impact of the MA on technical provisions falls within the relevant elements that are within the required scope of audit as set out by Rule 2.2 in the External Audit Part of the PRA Rulebook. The MA calculation depends in part on the application of the MA calculation requirements (set out including in regulations 5 and 6 of the IRPR regulations and Chapters 4, 6 and 8 of the Matching Adjustment Part). However, the scale of the MA could also be affected if the assets and liabilities used to calculate the MA were not within scope of an MA permission.

4.2FA

Any additions made to the fundamental spread to ensure that it covers all risks retained, other than those arising from the uncertainty regarding the timing and amount of cash flows from assets with highly predictable cash flows, remain at the discretion of firms, and hence the PRA does not expect these to be covered by an external audit. The PRA also considers that neither the attestation report nor the underlying evidence are within the scope of an external audit, as the attestation is directed to the PRA.

4.2G

The PRA is not prescriptive about the audit work necessary to support the auditor's opinion on the SFCR, or the approach that it should take in forming its view. The PRA notes that the audit approach taken is likely to vary based on circumstances, materiality, risk and other factors.

4.2H

The MA calculation does not form part of the eligibility conditions under which the PRA would be obliged (if the conditions were met) to grant permission in accordance with regulation 4(2) of the IRPR regulations. As the calculation methodology is not part of the eligibility conditions, the PRA’s permission does not cover the firm’s calculation of the MA.¹⁰ Therefore, auditors should not treat these factors as being part of the framework that they audit against. Instead, auditors are expected to form their own view on the calculation of the MA, as part of their work to give an opinion as to whether the relevant elements of the SFCR are prepared in all material respects in accordance with the IRPR regulations and PRA rules on which it is based.¹¹

4.2I

Where the PRA has carried out work to review the MA calculation (including the methodologies, processes, or judgements that contribute to the MA), an auditor of the SFCR would still be expected to incorporate its own views on this calculation into its audit opinion. Similarly, the PRA does not expect auditors to assume that an absence of PRA challenge (eg in relation to the MA calculated) overrides a need for auditors to form their own views in the SFCR audit opinion.

4.2J

If through the course of their work, an auditor becomes aware that the firm may not be compliant with MA requirements (whether or not those requirements are within the scope of the auditor’s opinion on the relevant elements of the SFCR), then the PRA would expect the auditor to inform the firm in the first instance.¹² Auditors may also choose to remind the firm of the requirement in Matching Adjustment 13.4 to inform the PRA if it is not able to comply with the conditions specified and to take the necessary measures to restore compliance as soon as possible.

4.2K

If a firm materially changes its approach to calculating the MA, then the PRA would usually expect this to be discussed by the firm with the supervisory team.¹³ However, consistent with Legacy SS7/13, if the auditor is aware that the PRA has not been informed of such a change then the auditor would be expected to pass this information on to the PRA.¹⁴

4.2L

The expectations for auditor communication in paragraphs 4.2J and 4.2K above relate to information that auditors become aware of in the course of their work and are not intended to require additional audit procedures. These expectations are subject to other communication requirements that may be relevant, including the auditor’s statutory duty to report and do not override or alter existing expectations or communications requirements. These paragraphs should therefore be read in conjunction with existing communication requirements and the expectations set out in Legacy SS7/13.¹⁵

4.3

ISAs (UK) specify that the auditor shall determine whether, to obtain sufficient appropriate audit evidence, he or she should use the work of an auditor’s expert, and should evaluate the expert’s competence, capabilities and objectivity. As a minimum, for firms that write life insurance business, the PRA expects that auditors, in undertaking the external audit, will obtain and pay due regard to the work of a suitably qualified actuary who is independent of the firm.

The table below lists the elements of the SFCR and highlights which are considered to be part of the ‘relevant elements of the SFCR’ and which should be treated as ‘other information’ in accordance with ISA (UK) 720 (Revised June 2016).