Risk Management

Home | Integrated Reporting | Risk Management

Risk Management

Safeguarding the Dreams of Every Indian

For 25 years, our approach to risk management has gone beyond safeguarding the Company. It has protected the dreams and aspirations of millions of Indians who place their trust in us. By anticipating uncertainty and building robust safeguards, we ensure that our commitments remain uncompromised, regardless of the external environment

In a dynamic financial and regulatory landscape, our risk management framework empowers us to move forward with clarity and confidence. It enables us to support new opportunities while maintaining stability, helping us honour every promise and enable every policyholder’s dream to take flight, securely and sustainably.

Risk Management Framework

At SBI Life, Enterprise Risk Management (ERM) is embedded across all functions and decision-making processes. Our approach is designed to address current risk exposures while remaining agile for future shifts. Risk management is integral to planning at every level of the organisation.

Our ERM framework spans key risk categories, including strategic, business, insurance, investment, operational, technology, regulatory and legal risks, enabling a comprehensive and proactive risk posture.

SBI Life’s ERM system is compliant with the ISO 31000:2018 Risk Management standard, reflecting our alignment with global best practices. This certification covers all departments across the corporate office, central processing centre and regional/branch locations.

The Company is also certified under ISO 22301:2019 (Business Continuity Management Systems) and ISO 27001:2022 (Information Security Management Systems). Annual surveillance audits and periodic recertification audits by external auditors ensure that the Company’s risk management practices are reviewed at least once every year.

We follow a dual-layered approach to risk identification and management

Top-down

Risk Appetite Statements, Annual Risk Review and Risk Dashboards are developed at the corporate level and monitored by the Risk Management Committee of the Board (RMC-B), integrating risk into strategic decision-making.

Bottom-up

Risk assessment at functional levels includes Key Risk Indicators (KRIs), Risk and Control Self-Assessments (RCSA) and Incident Reporting, ensuring process-level visibility and control.

To ensure governance and oversight, we have established dedicated risk committees with clearly defined mandates

Risk Management Committee of the Board (RMC-B)

A Board-level committee guiding the Company’s risk management strategy, supported by the RMC of Executives and ALCO.

Asset Liability Management Committee (ALCO)

An executive-level committee ensuring that the Company’s investments align with its obligations to policyholders, aiming to maintain an optimal balance between risk and return

Information Security Risk Management Committee (ISRMC)

This committee reviews information security risks and shares updates with RMC-E, convened by the Chief Information Security Officer (CISO).

Risk Management Committee of the Executives (RMC-E)

An executive-level committee for risk identification and mitigation across all functions; reviews quarterly updates.

Risk Events Monitoring Committee (REMC)

Addresses reputational and major external risk events.

Data Governance Committee (DGC)

This committee ensures compliance with data protection laws and privacy regulations, convened by the Data Protection Officer (DPO)

Strengthening culture of risk management

We believe that effective risk management begins with a strong, organisation-wide culture of awareness and accountability. To embed this mindset, we conduct regular initiatives that promote risk consciousness across all levels of the Company.

Throughout the year, employees are engaged through classroom sessions, onboarding modules, awareness snippets and internal communications, ensuring that risk awareness becomes second nature in day-to-day operations. Risk awareness is also embedded into employee journeys through targeted communication, including bite-sized messages shared via internal emails and WhatsApp groups. These cover key topics such as incident reporting, Risk & Control Self-Assessment (RCSA), operational risk, fraud monitoring, business continuity, information security and data protection, ensuring awareness remains timely, relevant and aligned with business priorities.

To further reinforce this culture, we commemorate key observances that align with our risk and compliance priorities:

Data Privacy Day

Risk Awareness Day

Computer Security Month

Cyber Jaagrookta Diwas

Innovation and Data-Driven Risk Practice

We leverage technology to strengthen risk intelligence across the organisation. Our Operational Risk Management System (ORMS) supports key processes such as incident reporting, RCSA, business continuity assessments, business impact analysis and branch-level risk and information security assessments — all through a unified digital platform

We also use a predictive underwriting model that assigns risk scores to proposals based on customer profiles and historical data. This data-driven model helps underwriters identify high-risk cases, reduce anti-selection and make more informed, accurate decisions — enhancing overall risk control and underwriting efficiency.

The tools which help to identify, analyse and evaluate risks across the Company are as shared below:

a)Annual Risk Assessment

Identifies, prioritises and monitors SBI Life’s key risks. It complements other risk evaluations and enables timely, appropriate responses. Identified risks are regularly reviewed throughout the year.

b)Key Risk Indicators (KRIs)

Key Risk Indicators (KRIs) are defined and monitored for critical risks impacting strategy. They help management track risks nearing unacceptable levels and identify top risks for the Company.

c)Risk & Control Self-Assessment

Risk & Control Self-Assessment (RCSA) identifies process risks and reviews control design and effectiveness. It reflects the quality of internal controls and risk mitigation. Risk assessments analyse risks by evaluating consequence and likelihood within control contexts. These factors combine to estimate overall risk levels.

d)Incident Reporting Process

The Incident Reporting Process ensures systematic reporting of incidents across all departments. It supports self-improvement process and is a tool for operational loss data collection. Function heads, Risk Officers and employees are responsible for reporting incidents in their areas.

e)Business Continuity Management (BCM) and Disaster Recovery Planning (DRP)

The Company has a robust Business Continuity and Disaster Recovery Plan, outlining roles and responsibilities. BCP and DRP are tested annually, with results reviewed by the RMC-E and RMC Board.

f)Fraud Monitoring

The Company follows a Fraud Prevention Policy as per IRDAI guidelines, with a holistic approach to identify, measure, control and monitor fraud risk.

g)Information Security

The Company complies with regulatory information security requirements and has a designated Chief Information Security Officer (CISO) to monitor security risks.

h)Data Protection

A Data Protection Officer (DPO) is appointed to oversee data governance, privacy, classification and protection. The DPO ensures compliance with data privacy regulations and acts as the contact for the Data Protection Authority.

i)Risk Control Unit (RCU)

The Risk Control Unit (RCU) implements enterprise-wide risk management at regional and branch levels. Regional Risk Managers handle risk assessment, monitoring and training activities.

j)Monitoring & Reporting

Risk reporting is an essential component of the risk management process of identification, assessment and monitoring risks. Risk update is shared with RMC-E and RMC-B every quarter.

Information Security

Ensuring the security of information assets is a core priority at SBI Life. Our practices are guided by a comprehensive Information and Cyber Security Policy and are ISO 27001:2022 certified, reflecting alignment with global standards.

A dedicated Information Security Team (IST), led by the Chief Information Security Officer (CISO), drives the Company’s security strategy. The Information Security Risk Management Committee (ISRMC) convened by the CISO, regularly monitors all security initiatives and reports updates to the Risk Management Committee of the Board, ensuring ongoing oversight, accountability and alignment with enterprise risk objectives.

Mitigating Principal Risks in our Operating Environment

Distribution Risk

Risks

This refers to the risk arising from an overdependence on a single distribution channel, which may expose the business to potential disruption — especially in the face of regulatory changes or market shifts. An imbalanced channel mix can also indicate challenges in expanding or strengthening alternate distribution avenues.

Stakeholders Impacted

Material topic

M1 -Customer service and satisfaction

M3 -Purposeful products and services driving financial inclusion

M5 -Risk management and business continuity

Impact on capitals

Mitigation

To address this risk, the Company continues to take a multi-pronged approach:

Focused recruitment, training and retention of high-performing agents and Life Mitras (LMs)
Reactivation initiatives to engage and energise inactive agents
Strengthened training and development programmes across all distribution channels
Continued enhancement of digital platforms to boost e-commerce and online sales
Expansion of partnerships with licensed entities to diversify distribution reach

Financial Capital

Service Capital

Intellectual Capital

Human Capital

Social & Relationship Capital

Natural Capital

Product Risk