The social security institution must have a legal and financial mandate for its role as a workplace health promoter. The mandate defines the institution’s scope of action and allows individualized services as well as community-based workplace health promotion activities. The mandate establishes a statutory right to health promotion services for insured persons. It may also state that a specified amount of the social health insurance budget may be used for (workplace) health promotion.

The social security institution supports a workplace review to identify existing structures and activities which support workplace health promotion and develop a health profile of the target population.

The institution encourages and enables good communication practice in workplace health promotion.

The valuation methodology is consistent with the social security scheme financing approach and enables the actuarial assessment of its sustainability measures or indicators. The actuary provides an opinion on the appropriateness of the methodology.

The social security institution applies automatic adjustment mechanisms in accordance with the laws and regulations governing the scheme. The social security institution analyses how the application of these adjustment mechanisms affects benefit adequacy and/or the financial sustainability of the scheme.

Automatic adjustment mechanisms link certain decisions on benefits and financing to internal or external parameters or indicators. This guideline should be read together with Guideline 43.

Once risk has been identified and measured, the social security institution makes appropriate decisions regarding the mitigation and treatment of risk.

Actuarial involvement is required when both parametric and structural changes to the social security scheme are considered.

The institution develops partnerships with various organizations for the purpose of reaching potential beneficiaries, reducing administrative costs and increasing service quality and integrity.

The institution defines a strategy on administrative error risk management, evasion of contributions and fraud control for difficult-to-cover groups as part of its overall compliance strategy that gives due consideration to the processes, people (internal and external), data and technology.

Communication for social security administrations requires establishing policies and practices to carry out the wide spectrum of communication-related activities in support of the overall mandate of the institution and of the specific needs of internal units. Such policies and practices aim to guide the institution to:

The communication unit develops a set of indicators to assess the effectiveness of the materials, forms of media and tools that are used to communicate with internal and external stakeholders.

The institution clearly defines its mandate, mission and internal governance mechanism concerning the contribution collection and compliance system, in line with national regulations.

If applicable, the institution participates in defining the governance mechanism for the inter-institutional level through its position on governing committees.

The institution improves its processes of audit and fraud control by using advanced ICT tools and any other available and consistent resource.

Relevant tools include data mining, business rules, multidimensional data analysis and external data (e.g. satellite photography and geographic information systems).

Most mandatory social security programmes are created by legislation, decree or some official act of government, to define the mandate of the institution that is responsible for the implementation of the programme. The mandate often draws a distinction between the “board” and “management”, with the board as the governing and policy-making body of the institution and the management as the body that administers the programme and implements the resolutions of the board.

Open dissemination of key information about the social security institution does not necessarily imply transparency. To be transparent, such information, which is a basic right for stakeholders, members and beneficiaries of the social security scheme, should be timely, reliable, relevant, accurate and objectively verifiable.

Legislation, policy or decree defines the powers and responsibilities of the management. The powers and responsibilities of the management are clearly delineated from those of the board. There are no areas of ambiguity, dilemma or conflict of interest.

Members are regularly and promptly informed about the benefits due to them under the social security programme.

The strategic plan is cascaded to all units of the institution. Implementation is regularly monitored and assessed. The strategic plan is revisited, evaluated and fine-tuned, if necessary. Management aligns the performance trinity of strategy and vision, leadership and management, and institutional culture and values in implementing the strategic plan.

For institutions that have investment reserve funds, standards and benchmarks are established for the returns on fund investments to support the financial sustainability of the programme.

The board and management protect the institution from all forms of corruption and fraud in the payment of programme benefits.

The management ensures the integrity of existing ICT infrastructure and averts any threat of system failure. The overall goal is to ensure the high availability of the social security services.

The institution clearly defines its own concept of value and the management practices devoted to generating the results expected from ICT-related investments (in ICT-enabled initiatives, services and assets) throughout their economic life cycle.

This involves defining the value of the outcomes to be achieved, analysing the cost-result of ICT investments and evaluating the return on investment of ICT-related initiatives.

The institution establishes mechanisms to enforce security policies in ICT operations.

This includes software and patch management, protection against computer viruses and malicious codes, administration of operating systems and backups.

The institution implements measures to ensure adequate quality levels in the master data and to improve the quality when necessary.

These measures, which are based on data quality goals and indicators, typically consist of corrective master data profiling and master data cleansing operations. In order to be cost effective, the data quality goals have to be clearly defined.