N.Y. Comp. Codes R. & Regs. tit. 11, § 178.4 – Management oversight standards.

(a) In order to address the need for appropriate oversight by senior management and by the board of directors, or a committee thereof charged with the responsibility for supervising investments, and to provide for a comprehensive risk management process for derivative instruments, an insurer shall establish the following with respect to derivative transactions:
1. (1) appropriate limits for various identified risks relevant to the derivative transactions used by the insurer;
2. (2) procedures and practices that control the nature and amount of such risks;
3. (3) adequate systems or processes for identifying and measuring such risks;
4. (4) systems or processes for documenting, monitoring and reporting risk exposures on a timely basis; and
5. (5) systems or processes of internal review and audit to ensure the integrity of the overall risk management process.
(b) The board of directors, or a committee thereof charged with the responsibility for supervising investments, shall receive and review quarterly reports which shall include: information to ascertain that all derivative transactions have been made in accordance with delegations, standards, limitations and investment objectives contained in the derivative use plan; the outstanding derivative positions; the unrealized gains or losses thereon; the derivative transactions closed during the report period; a performance review of the derivative transactions; an evaluation of the risks and benefits of the derivative transactions; and other information necessary to ensure that the internal control procedures are being followed.
(c) The board of directors, or a committee thereof charged with the responsibility for supervising investments, shall establish the following management oversight standards for derivative transactions:
1. (1) The board of directors, or a committee thereof charged with the responsibility for supervising investments, has an affirmative obligation to inform management of its desired risk tolerance levels. Management shall appropriately translate these risk tolerance levels into effective policies and procedures that address both individual transactions and entire portfolios.
2. (2) Management and the board of directors, or a committee thereof charged with the responsibility for supervising investments, shall receive sufficient information to assess the strengths and limitations of the insurer's risk measurement systems in order to determine appropriate risk limits. The board of directors, or a committee thereof charged with the responsibility for supervising investments, shall also review management's response to strengths and limitations identified through oversight processes such as stress testing, independent validation and back-testing of risk measurement models. Management and the board of directors, or a committee thereof charged with the responsibility for supervising investments, shall consider the information identified by the oversight processes, including the potential for indirect effects of downside performance beyond the insurer's finances, when they determine and communicate their risk profile.
3. (3) When management or the board of directors, or a committee thereof charged with the responsibility for supervising investments, identifies weaknesses in the risk management process, they shall consider alternatives and take steps to strengthen that process.
4. (4) Actions shall be taken to correct any deficiencies in internal controls relative to derivative transactions, including any deficiencies determined by the independent certified public accountant in the evaluation of accounting procedures and internal controls.
5. (5) Risk oversight functions shall possess independence, authority, and expertise.
6. (6) Issuer and counterparty credit decisions for each transaction shall be consistent with the overall credit standards of the insurer.