companies gain insight into the actual level of their exposure to such risks and take the necessary measures to mitigate them. According to the qualitative assessment, the exposure of the Sava Insurance Group and Sava Re to operational risk is medium.
The key operational risks of the Sava Insurance Group in 2023, ranked according to their rating in the risk register (from highest to lowest) are set out below. Risks that increased in 2023 are marked as such:
•the risk of personal data breaches by the EU-based companies (increased due to the implementation of the new Data Protection Act (ZVOP-2)),
•the risk of intentional or unintentional leakage of confidential information,
•the risk of data loss due to a compromised or non-functioning IT system (slightly increased),
•the risk of cyberattack,
•the risks associated with subsidiaries reporting to the parent,
•the risk of inadequate provision of external IT services (in-house or commercial cloud services),
•the risk of errors in the consolidated calculations for the Group (increased due to the implementation of the new accounting standard IFRS 17).
The key operational risks of the Company in 2023, ranked according to their rating in the risk register (from highest to lowest), are set out below. Risks that increased in 2023 are marked as such:
•the risk of personal data breaches (increased due to the implementation of the new Data Protection Act (ZVOP-2)),
•the risk of intentional or unintentional leakage of confidential information,
•the risk of cyberattack,
•the risk of inadequate IT support for reinsurance,
•the risk of inadequate provision of external IT services (in-house or commercial cloud services),
•the risk of data loss due to a compromised or non-functioning IT system (slightly increased),
•the risk related to the sanctions clause,
•the risk of incorrect calculation input data, miscalculations or errors in Sava Re’s internal or external reports (related to Solvency II) (increased due to the transition to the new accounting standard IFRS 17),
•risk of misstatements in reports to the management or supervisory boards (increased due to the implementation of the new accounting standard IFRS 17).
To manage operational risks effectively, the Group companies have processes in place to identify, measure, monitor, manage and report on such risks. Operational risk management processes have also been set up at the Group level and are defined in the operational risk management policy.
The main measures of operational risk management at the individual company and Group levels include:
•maintaining an effective business processes management system and a system of internal controls,
•maintaining records of and monitoring incidents,
•awareness-raising and training of all employees on their role in the implementation of the internal control system and management of operational risks,
•implementing appropriate policies as regards information security,
•having in place a business continuity plan for all critical processes (to minimise the risk of unpreparedness for incidents and external events and any resulting business interruption),
•monitoring operational risk indicators at Group level for all Group companies (indicators are defined in the risk strategy and are also used to indirectly measure reputational risk),