The Malta Financial Services Authority published the findings of an outcomes based review of risk management functions at insurance and reinsurance undertakings. While a self assessment covering about 30% of authorized undertakings indicated broad alignment with Solvency II and strong board oversight, onsite inspections at five firms identified weaknesses in the practical effectiveness of risk management systems and functions. Good practices included integrating the Own Risk and Solvency Assessment into strategic decisions, maintaining active risk registers and key risk indicators, embedding risk appetite in operations and overseeing outsourced functions effectively. Areas requiring improvement included formal risk identification and assessment, systematic recording and analysis of operational incidents and near misses, policies and workplans tailored to each undertaking, and regularly tested business continuity and succession arrangements. Undertakings must assess their frameworks against the findings, remediate gaps proportionately and ensure the risk management function has sufficient authority, independence, information and resources to challenge decisions and escalate concerns as an effective second line of defence.