2017 Annual Report

Why do we have it?

How is it managed?

Setting the right course, particularly in a sector as hazardous as insurance, is essential for our

long-term success.

New risks could arise, which might transform the industry.

A key pillar of the Group's strategy is to balance the underwriting of high-margin, volatile, complex global risks by also selling stable, local specialist retail products.

The Group invests in growth areas that offer the potential of a good return on investment. To ensure individual and aggregate exposure remains within set parameters, the business plan is aligned to the Group risk appetite set by the Board.

The Group's emerging risk forum assesses risks and opportunities that could potentially affect the business, including geopolitical changes such as Brexit or US trading and taxation relationships. Stress testing and scenario analysis help identify unanticipated dependencies and correlations between risks, which could impact upon the Group's strategy.

Hiscox's ORSA process focuses on the changes, opportunities and threats that may affect the business in the future.

Why do we have it?

How is it managed?

We operate in open, aggressively competitive markets in which barriers to entry for new players are relatively low. Competitors may choose to differentiate

themselves by undercutting their rivals. As a result, capacity levels in these markets rise and fall, causing prices to go up and down, creating volatile market cycles.

Underwriting large, volatile and complex risks can be potentially costly, but can also create strong returns over the medium to long term.

The scope and type of protection we buy may change from year to year depending on the extent and competitiveness of cover available in the market.

Binding or delegated authorities give the Group access to a greater volume of business and can contribute significantly to our profitability and market share.

We adapt our desire to write certain lines of business according to market conditions and the Group's overall risk appetite.

We reject business unlikely to generate underwriting profits and regularly monitor pricing levels, producing detailed monthly reports on how pricing and exposures are developing. This allows us to quickly identify and control any problems created by deteriorating market conditions. Hiscox frequently acts as the lead insurer in the co-insurance programmes needed to cover high-value assets, so we have some ability

to set market rates.

The Group rewards its staff for producing profit not revenue. This helps to maintain underwriting discipline in soft markets.

The Group underwrites catastrophe risk in a carefully managed, controlled manner. Our strategy of creating and maintaining a diversified portfolio, both by product and geography, helps limit our overall catastrophe exposure.

The Group's business plan is underpinned by a clearly-defined appetite for underwriting risk. We closely monitor our risk exposure to maximise the expected risk-return profile of our entire portfolio and offset any potential losses from more volatile accounts.

Underwriters are incentivised to make sound decisions that are aligned with the Group's strategic objectives and risk appetite and clear limits are placed on their underwriting authority. In response to legal developments, policy wordings are regularly reviewed to ensure that, as far as possible, exposure to those risks identified in the policy at the time of issue is maintained.

Our modeling resources are tailored to support insurance and reinsurance plans and ensure that exposure matches expectations. Risk aggregation and modeling resources are shared across the Group.

Stress and scenario testing is performed by the Group and by individual insurance carriers to assess our potential exposure to certain catastrophes.

We buy reinsurance to reduce our risk exposure and mitigate the impact of catastrophes based upon a clear outwards reinsurance strategy and centralised reinsurance programme that enables us to minimise gaps in coverage across the business and get the right deal by leveraging our size.

Decisions about the type and amount of reinsurance we buy are supervised by a dedicated reinsurance purchasing team using modeling techniques.

Authorities granted by Hiscox are closely controlled through strict underwriting guidelines, contractual restrictions and obligations. A Group-wide delegated authority policy sets out clear standards and principles for managing the delegation of authority to external third parties. We vet all third parties prior to appointment and monitor and audit them regularly to ensure they meet our standards.

Why do we have it?

How is it managed?

When underwriting risks, we estimate both the likelihood of them occurring and their cost. Our actual claims experience could exceed our expectations, requiring us to increase our levels of reserves held.

The provisions we make to pay claims reflect our own experience and the industry's view of similar business. They are also influenced by loss payments, pending levels of unpaid claims, historic trends in reserving patterns and potential changes in rates arising from market or economic conditions. Provisions

are set above the actuarial mid-point to reduce the risk that actual claims may exceed the amount we have set aside.

Our provision estimates are subject to rigorous review by all areas of the business, as well as by independent actuaries on the managed Syndicates. The relevant boards approve the amount of the final provision, on the recommendation of dedicated reserving committees.

Details of the actuarial and statistical methods and assumptions used to calculate reserves are set out in note 25 to the consolidated financial statements.

Why do we have it

How is it managed?

The investment of Hiscox's assets generates an investment return. Our investment portfolio is exposed to a number of risks related to changes in interest rates, credit spreads and equity prices, among others.

If a catastrophe occurs, the Group may be faced with large, unplanned cash demands.

This could be exacerbated by having to fund a large number of claims pending recovery from our reinsurers.

Although our investment policies stress the conservation of principal and liquidity,

our investments are subject to market-wide risks

and fluctuations.

Our objective is to maximise investment returns in the prevailing financial, economic and market conditions, without creating undue risk to the Group's capacity to underwrite. Funds held for reserves are invested primarily in high-quality bonds and cash. To reduce foreign exchange risk, these are usually maintained in the currency of the original premiums for which they were set aside. As many of our insurance and reinsurance liabilities have short timespans, we do not aim to match exactly the duration of our assets and liabilities.

The Group's fixed-income fund managers operate within clear guidelines as to the type and nature of bonds in which they can invest. These prioritise the need to pay claims while providing sufficient flexibility to enhance returns.

A proportion of funds is allocated to riskier assets, principally equities. By taking a long-term view on these assets, we seek to achieve the best possible risk-adjusted returns. Within our risk assets, we make an allocation to less volatile, absolute return strategies, which balance our desire to maximise returns with the need to ensure capital is available to support our underwriting throughout any downturn in financial markets.

The Group's investment policy recognises the demands created by our underwriting strategy, so that some investments may need to be sold before maturity or at short notice.

A high proportion of our investments are in liquid assets, which reduces the risk of losses being incurred if a quick sale is needed. Funds held for reserves are invested primarily in high-quality, short duration bonds and cash so the Group can meet its aim of paying valid claims quickly.

The Group's cash requirements can normally be met through regular income streams: premiums, investment income, existing cash balances or by realising investments that have reached maturity. Our primary source of inflows is insurance premiums, while our outflows are largely expenses and payments to policyholders through claims. We forecast our cash flow for

the week, month, quarter, or up to three years ahead, depending on the source.

To identify potential issues, we run stress tests to estimate the impact of a major catastrophe on our cash position. We also consider the impact on our liquidity of other adverse events occurring, such as an economic downturn and declining investment returns.

The Group maintains extensive borrowing facilities with a range of major international banks. This minimises the risk of one or more institutions being unable to honour commitments to us.

Why do we have it?

How is it managed?

We cover clients against a range of catastrophes and protect ourselves through reinsurance. We face credit risk when we seek to recover sums from our reinsurers.

The vast majority of our business is written through brokers. We face credit risk when money is transferred to and from brokers for premiums or claims.

We buy reinsurance only from companies we believe to be strong. A dedicated Group Credit Committee must approve the use of every reinsurer, based on an assessment of their financial strength, trading record, payment history, outlook, organisational structure and external credit ratings.

Our credit exposures to these companies are closely monitored, as are the companies themselves, so we can quickly identify any potential problems. We consider public information, our experience of the companies, their behaviour in the marketplace and consultants' and rating agencies' analysis.

We monitor our exposure to brokers on an on-going basis and have a continuing dialogue with our core brokers to quickly identify and resolve any credit issues that arise. Such monitoring takes into account a number of factors, which can include credit rating, financial position, financial performance, payment history and market factors.

In the case of some large losses, we pay policyholders directly to reduce broker credit risk on material transactions.

Why do we have it?

How is it managed?

Our business is based on trust from customers and partners, and that trust depends on our ability to keep their information secure.

We operate in a world in which the volume of sensitive data and the number of connected devices and applications have increased exponentially, while cyber attacks are increasingly frequent and sophisticated.

Our business depends on the integrity and timeliness of the information and data we maintain, own and use.

Our information technology and systems are critical to conducting business and providing continuity of service to our clients, including supporting underwriting and claims processes.

We operate in an ever- changing environment, with technological advancements, customer behaviour and external expectations evolving rapidly in recent years.

To remain relevant we must continue to evolve how we conduct our business.

Information security risk is managed as a business risk, not an IT responsibility. We employ an information security policy and a cyber security risk strategy.

The Group employs information security resources, which provide advice on information security design and standards. We also have an information security group, including experts from around the business who assess and manage these threats in line with risk appetite. Our cyber strategy combines industry standard perimeter security with protection for specific, highly confidential information.

The Group constantly deploys and evolves systems, policies and procedures to mitigate internal and external threats to our IT infrastructure. We conduct Group-wide mandatory training on information and cyber security, which is also mandatory for all third parties and contractors.

Our stress testing and scenario analysis considers the impact and likelihood of information security exposures and assesses management actions, including response plans.

We have dedicated IT resources that support the Group's technology needs and oversee critical systems and applications.

Our stress testing and scenario analysis considers the impact and likelihood of an IT or systems failure and assesses how management actions could be taken to mitigate the risk.

A formal disaster recovery plan is in place to deal with workspace recovery and the retrieval of communications, IT systems and data should a major incident occur. These procedures would enable us to quickly move the affected

operations to alternative facilities. The plan is tested regularly and includes simulation tests.

All major programmes have dedicated project governance structures to oversee the delivery of the programme, including risk management aspects. Programme sponsors also provide updates to the Board and Risk Committee as appropriate

The newly-formed Programme Assurance Office provides oversight across all major programmes. It provides senior management with an independent view of the progress, risks and issues within the programmes as well as the linkages between them.

Specialist resource is used to augment project resources, either in a contractor or advisory capacity, as needed.

Why do we have it?

How is it managed?

Insurance is a highly regulated industry. There may be

times when the regulatory landscape undergoes a significant shift that directly impacts our business.

The Group understands that sound, prudent regulation is key to the stability and sustainability of the insurance and wider financial markets. We continuously monitor new regulation and review

our internal processes to facilitate compliance. Our approach is to combine local expertise with a globally consistent framework to manage regulatory change and provide effective compliance with the varied and evolving requirements.