49. Risk management and control

The pages which follow describe the Group’s approach to risk management. The first section deals with the overall approach, applicable to all risks. It is followed by a detailed review of risks within the Group’s key businesses.

Risk management objectives

The Group has defined its appetite for risk in relation to its balanced scorecard for capital management. Its primary objective in undertaking risk management activity is to manage risk exposures in line with risk appetite, minimising its exposure to unexpected financial loss and limiting the potential for deviation from anticipated outcomes.

Risk management approach

A significant part of the Group’s business involves the acceptance and management of risk. The Group is exposed to insurance, market, credit, liquidity and operational risks and operates a formal risk management framework to ensure that all significant risks are identified and managed. The risk factors mentioned below should not be regarded as a complete and comprehensive statement of all potential risks and uncertainties.

Insurance risk: the risk arising from higher claims being experienced than anticipated.

Market risk: the risk arising from fluctuations in interest rates, exchange rates, share prices and other relevant market prices.

Credit risk: the risk of loss if another party fails to perform its financial obligations to the Group.

Liquidity risk: the risk that the Group, though solvent, does not have sufficient financial resources available to enable it to meet its obligations as they fall due, or can only secure them at excessive cost.

Operational risk: the risk arising from inadequate or failed internal processes, people and systems, or from external events.

Risk framework

Overall responsibility for the management of the Group’s exposure to risk is vested in the Group Board. To support it in this role, a risk framework is in place comprising a structure of formal committees, risk assessment and reporting processes and risk review functions. The framework provides assurance that risks are being appropriately identified and managed and that an independent assessment of risks is being performed.

Oversight of the risk management framework is performed on behalf of the Group Board by its sub-committee, the Group Risk and Compliance Committee (GRCC). The GRCC is supported in this role by the following sub-committees:

Group Capital Committee: The Committee assesses the capital requirements (including the risk based capital requirements) of the Group; monitors the sources of capital available to meet these requirements; oversees the allocation of capital to firms; and monitors at a Group level a number of performance and capital measures.

Counterparty Credit Committee: The Committee has oversight of counterparty credit risk across the Group, sets the limits for the Group’s exposure to any single counterparty failure and manages exposures within these limits.

Group Investment and Market Risk Committee: The Committee determines the Group’s overall framework for the management of market and liquidity risks and maintains oversight of exposures to ensure that they remain within acceptable tolerances.

Group Insurance Risk Committee: The Committee determines the Group’s overall framework for the management of insurance risk and maintains oversight of exposures to ensure that they remain within acceptable tolerances.

For both the Group Investment and Market Risk Committee and the Group Insurance Risk Committee, detailed monitoring of actual risk positions to tolerances is performed by business operating units, reporting to the committees and supported, where relevant, by risk review functions.

Group Operational Risk Assessment Committee: The Committee maintains oversight of the overall framework for the management of operational risk and determines the policy for the management of specific aspects of the Group’s operational risk, particularly those issues which are common across the Group.

In addition, Risk and Compliance Committees (RCCs) are in place for each of the Group’s main operational businesses. These committees are predominantly responsible for reviewing the management of operational risks and compliance with regulation.

Methods used to monitor and assess risk exposures

A continuous Groupwide process is in place formally identifying, evaluating and managing significant risks to the achievement of the Group’s objectives. A standard approach is used to assess the risks. Senior management and the risk review functions review the output of the assessments. A Groupwide risk assessment process is used to determine the key risks within the Group reported to the GRCC.

Group and business operating unit risk review functions provide oversight of the risk management processes within the Group. A central risk function is responsible for setting the risk management framework and standards. Risk review functions in each of the business operating units manage the framework in line with these standards. Their responsibilities include the evaluation of changes in the business operating environment and business processes, the assessment of the impact of these changes on risks to the business and the monitoring of the mitigating actions. The risk review functions also ensure that the operational business management and RCCs are provided with relevant risk reports and that there is appropriate information to assess risk issues.

Management of risks

The Group seeks to manage its exposures to risk through control techniques which ensure that the residual risk exposures are within acceptable tolerances agreed by the Board. The key control techniques for the major categories of risk exposure are summarised in the following sections.

The fair value of collateral held against loans that are past due or impaired at 31 December 2007 was £nil (2006: £1m).

Liquidity risk

Liquidity risk is the risk that the Group, though solvent, either does not have sufficient financial resources available to enable it to meet its obligations as they fall due or can secure them only at excessive cost. The Group’s treasury function is responsible for managing the Group’s banking relationships, capital raising activities, overall cash and liquidity position and the payment of dividends. The Group seeks to manage funds and liquidity requirements on a pooled basis and to ensure the Group maintains sufficient liquid assets and standby facilities to meet a prudent estimate of its net cash outflows. In addition, it ensures that, even under adverse conditions, the Group has access to the funds necessary to cover surrenders, withdrawals and maturing liabilities. In practice, most of the Group’s invested assets are marketable securities. This, combined with the fact that a large proportion of the liabilities contain discretionary surrender values or surrender charges, reduces the liquidity risk. The Group has in place a £1bn, five year syndicated borrowing facility which provides flexibility in the management of the Group’s liquidity.

Operational risk

Operational risk is the potential for loss resulting from inadequate or failed internal processes, people and systems, or from external events. There are a number of headings under which operational risk and its management across the Group can be considered. Identified control issues are escalated to business unit RCCs.

Internal process failure

The Group is exposed to the risk of loss from failure of the internal processes with which it transacts its business. Each subsidiary is responsible for ensuring the adequacy of the controls over its processes and regular reviews are undertaken of their appropriateness and effectiveness. All business managers are required to confirm regularly the adequacy of controls from these reviews to business unit RCCs, the GRCC and the Group Audit Committee. Significant control issues which business areas identify are escalated to business unit RCCs, which oversee their resolution.

People

The Group is potentially exposed to the risk of loss from inappropriate actions by its staff. The risk is actively managed by business management and human resource (HR) functions. Recruitment is managed centrally by HR functions, and all new recruits undergo a formal induction programme. All employees have job descriptions setting out their accountabilities and reporting lines, and are appraised annually in accordance with agreed performance management frameworks. Employees in regulated subsidiaries are provided with appropriate training to enable them to meet the relevant regulatory requirements. Risks relating to health and safety and other legislation are managed through the provision of relevant training to all staff.

Outsourcing

The Group is potentially exposed to the actions or failure of suppliers contracted to provide services on an outsourced basis. The required minimum standards of control for outsourced arrangements are set out in the Group’s outsourcing and key supplier policy. Compliance with this policy is monitored by business management and adherence is reported through the regular controls confirmation process undertaken across the Group.

Legal

Legal risk is the risk of loss from unclear or deficient product documentation; inadequate documentation in support of material contracts such as reassurance treaties; the incorrect interpretation of changes in legislation; employment related disputes and claims; and commercial disputes with suppliers. The risks are actively managed through the Group Legal Risk framework, which defines minimum standards of control to be applied to minimise the risk of loss.

Compliance

Compliance risk within the Group relates to the risk of non-adherence to legislative requirements, regulations and internal policies and procedures. Responsibility for ensuring adherence to relevant legal and regulatory requirements is vested in individual business managers. They are supported, where appropriate, by business standards functions which assess and confirm that business processes conform to these requirements. A Group compliance function has oversight of the Group’s compliance with regulatory requirements and standards, providing policy advice and guidance and oversight of compliance arrangements and responsibilities.

Event

Event risk relates to the potential for loss arising from external significant events such as terrorism, financial crisis, major changes in fiscal systems or disaster. Typically, such events have a low likelihood of occurrence, a material impact and can be difficult to prevent. The Group’s risk mitigation focuses on minimising the business disruption and potential financial loss which may ensue from such an event. This includes maintaining a framework for the management of major incidents, the maintenance and regular testing of detailed business, technical and location recovery plans and the provision of insurance cover for the loss of buildings, contents and information technology (IT) systems and for the increased cost of working in the event of business disruption.

Fraud

The Group is exposed to the risk of internal fraud, claim related fraud, and external action by third parties. The risk of internal fraud is managed through a number of processes including the screening of staff at recruitment, segregation of duties and whistle-blowing policies. The activities of internal audit also act to counter the risk. Claims-related fraud is managed by ensuring business processes are designed to validate fully claims and ensure that only bona fide claims are settled. Anti-fraud techniques are regularly updated to mitigate risks and emerging threats.

Technology

The Group places a high degree of reliance on IT in its business activities. The failure of IT systems could potentially expose the Group to significant business disruption and loss. To mitigate this risk, standards and methodologies for developing, testing and operating IT systems are maintained. There is a centralised management for development activity and production systems to ensure consistency and adherence to standards. Disaster recovery facilities enable IT operations to be conducted at remote locations in the event of the loss of computer facilities at a principal office site. All records are remotely backed up and computer suites are equipped with alternative power sources.

Concentration of risk

As part of the ongoing risk assessment processes the Group considers the concentration of risk. The Group seeks to manage concentrations by setting limits around the maximum exposure to loss that it can tolerate from a series of related events. Limits set include maximum exposures to single lives, geographic locations, financial instruments and reinsurance balances.

UK life and pensions

UK life and pensions products are structured as either participating or non-participating. The level of shareholders’ interest in the value of policies and their share of the related profit or loss varies depending upon the contract structure.

Non-participating contracts

Non-participating business is written mainly in the non profit part of the Society LTF. Profits accrue solely to shareholders. In addition, there is some non-participating business in the with-profits part of the Society LTF where the profits are shared, between participating policyholders and shareholders.

Protection business (individual and group)

The Group offers protection products which provide mortality or morbidity benefits and may include health, disability, critical illness and accident benefits. These additional benefits are commonly provided as supplements to main life policies but can also be sold separately. The benefit amounts would usually be specified in the policy terms. Some sickness benefits cover the policyholder’s mortgage repayments and are linked to the prevailing mortgage interest rates. In addition to these benefits, some contracts may guarantee premium rates, provide guaranteed insurability benefits and offer policyholders conversion options.

Life savings business

A range of contracts are offered in a variety of different forms to meet customers’ long term savings objectives. Policyholders may choose to include a number of protection benefits within their savings contracts. Typically, any guarantees under the contract would only apply on maturity or earlier death. On certain older contracts there may be provisions guaranteeing surrender benefits. Savings contracts may or may not guarantee policyholders an investment return. Where the return is guaranteed, the Group may be exposed to interest rate risk with respect to the backing assets.

Pensions (individual and corporate)

These are long term savings contracts through which policyholders accumulate pension benefits. Some older contracts contain a basic guaranteed benefit expressed as an amount of pension payable or a guaranteed annuity option, which exposes the Group to interest rate and longevity risk. These guarantees become more costly during periods when interest rates are low or when annuitant mortality improves faster than expected. The ultimate cost will also depend on the take-up rate of any option and the final form of annuity selected by the policyholder.

Other options provided by these contracts include an open market option on maturity, early retirement and late retirement. The Group would generally have discretion over the terms on which these options are offered.

Annuities

Deferred and immediate annuity contracts are offered. Immediate annuities provide a regular income stream to the policyholder, purchased with a lump sum investment, where the income stream starts immediately after the purchase. The income stream from a deferred annuity is delayed until a specified future date. Bulk annuities are also offered, where the Group manages the assets and accepts the liabilities of a company pension scheme or a life fund.

Non-participating deferred annuities written by the Group do not contain guaranteed cash options.

Annuity products provide guaranteed income for a specified time, usually the life of the policyholder, in exchange for a lump sum capital payment. No surrender value is available under any of these products. The primary risks to the Group from annuity products are therefore mortality improvements and investment performance.

There is a block of immediate and deferred annuities within the UK non profit business with benefits linked to changes in the RPI, but with contractual maximum or minimum increases. In particular, most of these annuities have a provision that the annuity will not reduce if RPI falls. The total of such annuities in payment at 31 December 2007 was £162m (2006: £136m). Thus, 1% negative inflation, which was reversed in the following year would result in a guarantee cost of approximately £2m (2006: £1m). Negative inflation sustained over a longer period would give rise to significantly greater guarantee costs. Some of these guarantee costs have been partially matched through the purchase of negative inflation hedges and limited price indexation bonds.

Key risk factors

(a) Insurance risk
(i) Mortality risk
For contracts providing death benefits, higher mortality rates would lead to an increase in claims costs. For annuity contracts, the Group is exposed to the risk that mortality experience is lower than assumed. Lower than expected mortality would require payments to be made for longer and increase the cost of benefits provided. The Group regularly reviews its mortality experience and industry projections of longevity and adjusts the valuation and pricing assumptions accordingly.

The Group is exposed to mortality risk on protection and annuity business. For protection products, the Group has entered into reinsurance arrangements to mitigate this risk and provide financing. Annuity contracts are not generally reinsured externally.

(ii) Persistency
In the early years of a policy, lapses and surrenders are likely to result in a loss to the Group, as the acquisition costs associated with the contract would not have been recovered from product margins. Some contracts include surrender penalties to mitigate this risk.

In later periods, once the acquisition costs have been recouped, the effect of lapses and surrenders depends upon the relationship between the exit benefit, if any, and the liability for that contract. Exit benefits are not generally guaranteed and the Group has some discretion in determining the amount of the payment. As a result, the effect on profit at later duration is expected to be broadly neutral.

Following the adoption of PS06/14 in 2006 the persistency assumption for non-participating protection business allows for the expected pattern of persistency, adjusted to incorporate a margin for adverse deviation. Previously, the liabilities were established so that they were sufficient to cover the more onerous of the two scenarios, in which the policies either remain in force until maturity, or discontinue at the valuation date.

There is no persistency risk exposure for annuities in payment. These contracts do not provide a lapse or surrender option.

(iii) Morbidity rates
The cost of health related claims depends on both the incidence of policyholders becoming ill and the duration over which they remain ill. Higher than expected incidence and duration would increase costs over the level currently assumed in the calculation of liabilities.

(iv) Expense variances
Higher expenses and/or expense inflation will tend to increase the amount of the reserves required. The Group is exposed to the risk that its liabilities are not sufficient to cover future expenses.

(v) Geographic concentrations of risk
Insurance risk may be concentrated in geographic regions, altering the risk profile of the Group. The most significant exposure of this type arises for the group protection business, where a single event could result in a large number of related claims. To reduce the overall exposure, current contracts include an ‘event limit’ which caps the total liability. Additionally, excess of loss reinsurance arrangements further mitigate the exposure.

(vi) Epidemics
The spread of an epidemic could cause large aggregate claims across the Group’s portfolio. Quota share reinsurance contracts are used to manage this risk.

(vii) Accumulation of risks
There is limited potential for single incidents to give rise to a large number of claims across the different contract types written by the Group. In particular, there is little significant overlap between the long term and short term insurance business written by the Group. However, there are potentially material correlations of insurance risk with other types of risk exposure. These correlations are difficult to estimate though they would tend to be more acute as the underlying risk scenarios became more extreme. An example of the accumulation of risk is the correlation between reinsurer credit risk with mortality and morbidity exposures.

(b) Market risk
Investment of the assets backing the Group liabilities reflects the nature of the liabilities being supported. For non-participating business, the objective is to maximise profits, while ensuring stability, by closely matching the cash flows of assets and liabilties. To achieve this matching, the strategy is to invest in fixed income securities of appropriate maturity dates.

Interest rate risk is reduced by managing the duration and maturity structure of each investment portfolio in relation to the estimated duration of the liabilities it supports. A number of derivatives are held to enable the closer matching of assets and liabilities and to mitigate further exposure to interest rate movements, in particular, to limit the exposure to any options and guarantees in contracts.

In addition, the exposure to these risks is allowed for in the actuarial valuation of liabilities under these contracts.

Participating contracts

Participating contracts are supported by the with-profits part of the Society LTF. They offer policyholders the possibility of the payment of benefits in addition to those guaranteed by the contract. The amount and timing of the additional benefits (usually called bonuses) are contractually at the discretion of the Group.

Policyholders and shareholders share in the risks and returns of the with-profits part of the Society LTF. The return to shareholders on virtually all participating products is in the form of a transfer to shareholders’ equity, which is analogous to a dividend from the Society LTF and is dependent upon the bonuses credited or declared on policies in that year. The bonuses are broadly based on historic and current rates of return on equity, property and fixed income securities, as well as expectations of future investment returns.

Discretionary increases to benefits on participating contracts are allowed in one or both of regular and final bonus form. These bonuses are determined in accordance with the principles outlined in the Group’s PPFM for the management of the with-profits part of the Society LTF. The principles include:

International life and pensions

Legal & General America (LGA)

The principal products written by LGA are individual term assurance, universal life insurance and smaller blocks of deferred and immediate annuities.

The individual term assurances provide death benefits over the medium to long term. The contracts have level premiums for an initial period with premiums increasing annually thereafter. During the initial period, there is generally an option to convert the contract to a universal life contract. After the initial period, the premium rates are not guaranteed, but cannot exceed the age related guaranteed premium.

Reinsurance is used to reduce the insurance risk on this portfolio and manage liquidity risks, through the reinsurance commission received under quota share arrangements. Reinsurance and securitisation are used to provide regulatory solvency relief (including relief from regulation Triple X). These practices lead to the establishment of reinsurance assets on the Group’s balance sheet.

The universal life insurance and deferred annuities provide a savings element. In addition to the savings component, the universal life contract provides substantial death benefits over the medium to long term. The savings element has a guaranteed minimum growth rate. LGA has exposure to loss in the event that interest rates decrease and it is unable to earn enough on the underlying assets to cover the guaranteed rate. LGA is also exposed to loss should interest rates increase, as the underlying market value of assets will generally fall without a change in the surrender value. The reserves for universal life and deferred annuities totalled $758m and $248m respectively at 31 December 2007 (2006: $766m and $272m respectively). The guaranteed interest rates associated with those reserves ranged from 0.0% to 6.0%, with the majority of the policies having a 4.0% guaranteed rate (the same rates applied in 2006).

The deferred annuity contracts also contain a provision that, at maturity, a policyholder may move the account value into an immediate annuity, at rates which are either those currently in effect, or rates guaranteed in the contract. The other annuity contracts have similar risks to those in the UK.

Legal & General Netherlands (LGN)

LGN principally writes non-participating individual unit linked savings, protection and annuity business. The unit linked savings business generally includes an element of exposure to mortality risk. The individual term assurances provide death benefits over the medium to long term. Reinsurance is used to reduce the share of insurance risk.

The annuity contracts have similar risks to those in the UK; however, the majority of annuity business has a term of three years or less.

Legal & General France (LGF)

LGF writes a range of long term insurance and investment business through its subsidiaries. The principal products written are life assurance and pensions savings, group protection, annuities and open ended investment vehicles.

The group protection business consists of group term assurance, renewable on an annual basis, sickness and disability, and medical expenses assurance. The group sickness and disability and medical expenses policies integrate with social security benefits providing a level of top-up to those benefits. Reinsurance is used to manage exposure to large individual and group claims.

The annuity contracts have similar risks to those in the UK.

Sensitivity analysis

Table 7 below shows the effect of alternative assumptions on the long term embedded value, prepared in accordance with the guidance issued by the CFO Forum in October 2005. These sensitivities correspond to those contained within the Supplementary Financial Statements of the Annual Report and Accounts.