Internal and external control
Board responsibilities include maintaining effective internal control. To ensure this, the board adopts general policies that describe the framework of AP3’s internal governance and control, on the basis of which the CEO establishes instructions.
Internal control
AP3 follows the three lines of defence principle, under which the fund’s asset management teams are responsible for identifying and managing the risks that arise in day-to-day operations. The second line of defence comprises the fund’s independent risk control and compliance departments, which monitor and check that this is done appropriately.
The control departments report regularly to the risk and audit committee and the board at their scheduled meetings. When a significant incident occurs or the need arises, the board is informed immediately. Internal audit is the third line of defence. Its role is to carry out controls to ensure that AP3’s internal governance and control environment are fit for purpose and effectual and that the Fund is aligned with the policies approved by the board. Internal audit reports are reviewed by the risk and audit committee and reported to the board.
The fund has outsourced the internal audit function to KPMG, which conducted two audits in 2022, an audit of processes related to compliance with the Market Abuse Regulation and an audit of the first and second lines of defence of the fund. KPMG identified areas for improvement that the fund then addressed.
External auditors
AP3’s auditors are appointed by the government, which selected PwC as auditor of the AP funds after a public procurement process. The auditors are Helena Kaiser de Carolis and Peter Nilsson. Peter Nilsson is also responsible for coordinating the audit process between the AP funds. The auditors’ work includes reviewing AP3’s operating activities, including internal control, administration, annual financial statements and accounting records. They express an opinion on the accounting records and the administration based on their audit. Their mandate also includes verifying that AP3 follows the accounting and valuation policies agreed jointly by the AP funds and that the accounting records provide a true and fair view of the fund’s operating activities.
Three lines of defence for managing risk
The first line of defence is the investment organisation, which includes all asset management units and supporting business functions. Responsibility for risk management thus exists where the risk arises. Controls are are performed continuously along the entire transaction flow. Each employee and head of department is responsible for identifying and managing risk within their own area of responsibility.
The second line of defence comprises the risk control and compliance functions. The control teams ensure that the organisation and its relevant parts stay within stipulated limits and comply with applicable restrictions and instructions while the first line of defence manages identified risks effectively. The compliance function oversees regulatory compliance and monitors operational risks. The risk control function supervises financial risks. The risk control and compliance functions are both independent and organisationally separate from the parts of the organisation that make investment decisions. The CRO, who is responsible for the risk control function, and the Compliance Officer report to the CEO and to the board of directors.
The third line of defence is internal audit. The internal audit function is in charge of safeguarding the quality of the fund’s risk management by performing regular audits and evaluations of relevant areas to ensure they are effectual and appropriate. The results of these valuations are used to strengthen the processes of the other lines of defence. AP3 subcontracts internal audit to an external audit firm appointed by the board. The firm reports to the board and the risk and audit committee and is independent of AP3 and its operating activities. The risk and audit committee commissions an annual review of internal audit.
Risk management
Every year, the Board of Directors sets the fund’s operational objectives for the real return on assets under management to be achieved over time. This is based on an overall assessment of the fund’s ability to maximise the benefits of its role as a buffer fund in the state income pension system without exposing the capital to risks that jeopardise age cohort neutrality. The operational objective is expected to be achieved through the investment of the fund’s capital, which exposes it to a range of financial risks. The over-all limits on the fund’s financial risk exposure are set out in the National Pension Funds Act, as briefly described below.
Limits regulated by law for financial risks
Liquidity risk No more than 40% of the fund’s assets may be invested in illiquid assets at the time of investment.
Total risk level At least 20% of the fund’s assets must be invested in fixed income securities with low credit and liquidity risk
Currency exposure Currency exposure may not exceed 40% of the fund’s assets.
Voting restriction The fund may not hold more than 10% of the voting rights in a single listed company.
Ceiling of Swedish listed equities The fund’s investments in Swedish regulated markets may not exceed 2% of the total market value.
Read more
