The social security institution sets out appropriate processes and structures to identify risk.

The social security institution regularly assesses the level of protection offered by the scheme through the actuary's analysis of the replacement rate and other relevant adequacy measures. When assessing benefit adequacy of a pension scheme, the social security institution considers retirement income from other sources, such as any universal non-contributory pension, mandatory or voluntary occupational or individual pension plans, and/or legislated end-of-service payments.

Key capacities – some internal to the institution, some external – enable social security institutions to work towards the extension of coverage. In most cases, the extension of coverage is a horizontal endeavour requiring the collaboration of a variety of institutional players.

The specific guidelines in this section are:

The institution collaborates with external organizations on operational processes to collect contributions and enforce compliance among difficult-to-cover groups.

The institution remains in touch with its internal and external stakeholders in order to listen before speak.

Advances in information and communication technology (ICT) are explored for cost efficiency and to facilitate interactions with the institution.

• Relevant legislation and regulations are taken into account when developing the services under all guidelines. This includes, especially:
• Regulations on administrative procedures, especially concerning contribution collection and compliance;
• Regulations on data privacy and protection;
• Financial regulations involving bank transfers;
• Authentication of operations and documents.

Contributor non-compliance (especially, deliberate evasion) and the limits of preventive compliance administration measures mean that instances of failure to comply with the law are inevitable.

Therefore, institutions must establish effective mechanisms to prevent and control fraud on social security contribution collection and compliance. These need to be regularly reviewed to update fraud detection approaches to counter new types of fraud.

The diversity in governance practices around the world is a reflection of differences in the political, social, economic and cultural histories of countries. There is common recognition, however, that good governance is aimed at delivering what is mandated and ensuring that what is delivered is responsive to the evolving needs of the individual and society. Improved education and new technologies have increased the expectations of the public for accountable and transparent administration, including constant improvements in the delivery and performance of social services.

For social security institutions that have an investment mandate, legislation, policy or decree establishes the general direction of the investment policy and prescribes the types of allowed investment instruments. Furthermore, in order to maximize the long-term rate of return on reserves and at the same time mitigate investment risks, the range of instruments allowed for investments is sufficiently diversified.

The management is the group of persons who, under the legislation or by-laws establishing the entity, is given the responsibility for the administration and daily operations of the social security programme.

The 23 guidelines for the management support and promote the following five principles of good governance, as applied to social security institutions:

1. Accountability

2. Transparency

3. Predictability

4. Participation

5. Dynamism

The management adopts and abides by a board-approved, workable code of conduct for its officers and staff, which includes a policy on the disclosure and management of conflicts of interest.

The strategic plan embodies a clear statement of the institution’s vision for the planning period. The vision statement is inspiring and easy to communicate. It is guided by the institution’s mandate.

The programme has regular actuarial valuations to monitor sustainability.

The board and management are duty bound to prevent and control any form of corruption and fraud in the collection of contributions for and the payment of benefits of the social security programme.

Corruption and fraud undermine the credibility of the programme to stakeholders, which can lead to a weakening or withdrawal of stakeholder support.

These two guidelines will help prevent and control corruption and fraud in the collection of contributions and the distribution of benefits.

Investments in ICT respond to the short- and medium-term needs of the institution and are always aligned with its strategic plan. The management establishes a standard system of policies and procedures to evaluate and decide on proposals for investments in ICT infrastructure, to enhance accountability, transparency, predictability, participation and dynamism.

The institution ensures the continuity of its services, especially those involving critical operations, and maintains the availability of information at an acceptable level in the event of significant disruption.

The institution carries out unified and formalized data quality management, enabling it to improve the reliability of data and information used in the institution and, therefore, confidence in related processes.

As data is a key asset for social security operations, managing its quality becomes a required activity. The goal of data quality management is to formally and rigorously manage the data quality attributes that are relevant in social security operations.

The institution includes security measures in networks and communication systems, especially those linked with critical systems and information resources.

This involves the security of local area networks, the Internet, and wireless, FTP, email and mobile technologies and systems.

The institution manages the quality (e.g. completeness and accuracy) of the master data through a formalized and single institutional framework, with the aim of improving the reliability of the data used in the institution and, consequently, fostering confidence in related processes.

This section addresses the definition of architectures, specifying the main ICT components that enable the implementation of interaction between institutions putting into practice international social security agreements.

The implementation of agreements involves three architectures:

The institution, in coordination with the other institutions participating in the international agreement, specifies information models for data exchange according to requests, administrative communications and notifications.

These models, which correspond to the usually defined “forms” to exchange data, may include: personal data, labour records, death, marriage, separation, birth, other benefits received in the host or origin country, income declarations, expenses related to procedures on individual cases, etc.

The investment structure and organization of the investing institution is consistent with the legislation, decree or official act of government which established the social security institution, the ISSA Guidelines on Good Governance, the ISSA Guidelines on Investment of Social Security Funds and industry best practice for investments.

The investing institution’s assets are valued in accordance with recognized international or national accounting standards where appropriate, as well as industry best practice. Valuations are performed, or at least verified, independently.

When a decision is made to change external investment managers, a number of governance issues are considered in the transfer. These include information requirements related to the change, consideration of fees or surrender penalties, and communication to those impacted upon by the change, including custodians, members and accountants. While transitioning assets between arrangements the risks associated with the actions are identified and managed appropriately and, at the same time, the institution also seeks to minimize costs where possible.