Munich Re Group Annual Report 2006 (PDF, 1.8

Munich Re Group Annual Report 2006 Management report_Risk report
We minimise such risks through systematic application
of specific risk management measures. It is our declared
corporate aim, which we consistently pursue, to sensitise
employees to possible risks and to establish an appropriate
risk culture. This includes the willingness to learn from
mistakes and to recognise and grasp these as opportunities
for change and improvement.
To prevent infringements of insider law, Munich Re has
appointed a Compliance Officer, who ensures that inside
information is handled in conformity with the law. In addition,
a Disclosure Committee has been established to
ensure that disclosure requirements regarding pricesensitive
information are complied with.
Compliance with antitrust regulations is a basic principle
of Munich Re’s business policy. To prevent violations,
staff are informed about antitrust regulations and
are expected to comply with them. Line managers have
been entrusted with delegated responsibilities to ensure
compliance in this regard.
We attach particular importance to precautionary
measures that ensure continuity of our operations in an
emergency or crisis situation. Business processes critical
to value creation can be maintained or resumed as quickly
as possible in such cases. Responsibility for establishing
and monitoring this business continuity process in the
Munich Re Group has been entrusted to a separate unit,
which is guided by internationally recognised business
continuity management standards (e.g. PAS 56).
Risks in the area of information technology and project
risks
Munich Re’s global business and Group-wide risk management
require an organisational and technical networking
of our business units and systems. We are dependent on
electronic communications technology, the complexity of
which is continually increasing. The significance of the
stored and transmitted information is growing as well. As
a result, we are also increasingly exposed not only to IT
security risks (such as breakdowns and outages, disruptions
due to viruses, attacks by hackers and theft of data)
but also to the risk of theft of information through the
deception of staff (”social engineering”).
These risks are identified and limited by decentralised
security organisations that liaise closely. Their procedures
are constantly being improved and adjusted to take into
account the latest knowledge and state-of-the-art techniques.
Our security regulations embrace not only the
technical design of hardware and software systems but
also functional security structures and organisational
measures, including training staff in the proper handling
of systems and data.
Various major projects are currently being realised in
our primary insurance and reinsurance business that,
among other things, are integrating information architecture
in the back-office area to an ever greater extent. Considerable
project risks are related to size and complexity
of such projects. Proceeding from project management,
Munich Re’s project landscape will be made more transparent
and the interfaces of individual projects enhanced
by means of multi-project management designed to assess
and control interdependencies better. In addition, the
dependencies and priorities within the systems architecture
are analysed and addressed by specially appointed
committees.
The conclusion of our internal IT project Gloria in 2006
marked an important milestone in the unification – on the
basis of an SAP standard product – of the entire reinsurance
group’s IT and process landscape (more information
on this may be found on page 109). This system, which has
now gone live at Munich Re Munich, will successively be
extended to the rest of the reinsurance companies in the
Group, whilst additional systems that build on it are being
designed and implemented.
ERGO is also implementing important major projects,
such as the ongoing convergence of its systems and
processes in the health segment.
Risks involving human resources
The companies in the Munich Re Group have binding rules
setting out minimum standards of corporate integrity for
conduct within the companies themselves, their business
transactions and other relationships with external parties.
These standards, which are included in a detailed code of
conduct, are tailored to the special features of each company
and serve to prevent conflicts of interest for staff,
thus ensuring that we use only fair and legal means of
competition. The clear separation of management and
control functions limits the risk of internal and external
regulations being breached. We ensure that the German
General Equal Treatment Act and similar anti-discrimin-
135