The IESS approves the comprehensive reform of its risk management manual

The Board of Directors of the Ecuadorian Social Security Institute (IESS) approved and issued the Comprehensive Reform of the Comprehensive Risk Management Process Manual through Resolution C.D. 714, signed in Quito on September 2, 2026, and published in the Second Supplement of the Official Registry No. 391 on Friday, October 16, 2026. The resolution repeals the manual that had been in effect since December 2024 and entrusts its immediate application to the National Directorate of Institutional Risks. The instrument governs the risk management of the country’s largest social security entity and all its funds.

The new manual was issued in compliance with the First Transitory Provision of Resolution C.D. 702 of April 7, 2026, which comprehensively reformed the IESS Comprehensive Risk Management Scheme and ordered the update of the Management Model and the Process Manual. The regulation is further supported by Resolution C.D. 695 of September 19, 2025, which reformed the regulations of the Comprehensive Risk Management Committee, and Resolution C.D. 704 of April 29, 2026, which established the Risk Appetite Framework.

The external framework comes from the Superintendency of Banks, which, through official letters SB-INCSS-2026-0105-O of April 27, 2026, and SB-INCSS-2026-0196-O of July 31, 2026, required the IESS to have a formal, comprehensive, and documented process for preparing, validating, submitting, reviewing, and approving Comprehensive Risk Management reports. The resolution is based on letter c) of article 27 of the Social Security Law.

The approval route

The National Directorate of Institutional Risks submitted the project with memorandum IESS-DNRI-2026 0492-M of August 7, 2026, supported by technical report IESS-DNRI-INF-TR-ADM-2026-053 of August 5, 2026. Following those steps:

• The Comprehensive Risk Management Committee (CAIR) approved the reform in the session of August 11, 2026, according to Resolution IESS-CAIR-2026-360, with item 1 by unanimity and item 2 by majority.
• The General Attorney’s Office of the IESS issued a favorable legal report through memorandum IESS-PG-2026-0338-M of August 31, 2026.
• The General Directorate elevated the project to the Board of Directors with memorandum IESS-DG-2026-1967-M of August 31, 2026.
• The Board of Directors approved the text in the session of September 2, 2026.

Mandatory scope and internal deadlines

The manual, identified with code GRI-P01 version 1.1, is of mandatory application for all funds, the administrators of Specialized Insurance, and the central, decentralized, and deconcentrated dependencies of the IESS. Its objective is to identify, measure, control, mitigate, and monitor institutional risks to maintain the risk profile within the appetite defined by the entity.

The document sets specific deadlines for each responsible party:

• The Attorney General’s Office has two days to issue the legal pronouncement of the monthly reports.
• The General Directorate has one day to manage the regulatory compliance review and formalize the delivery to the Board of Directors.
• The preparation of monthly reports takes two days; their review and presentation to the CAIR, three days; and the Committee’s review, five days.
• Annual reports are requested in the first quarter following the close of the fiscal year and are prepared in the second.
• The process indicator is the percentage of implemented controls, with a target of 100% and quarterly measurement.

The measurement rates risk events across four levels: low, moderate, high, and critical. The manual incorporates three technical annexes: the flow chart GRI-P01-A01, the control reports Gantt chart GRI-P01-A02, and the escalation mechanism GRI-P01-A03.

Signatures, repeal, and validity

The resolution bears the signatures of Bernardo Antonio Cordovez Cereceda, president of the Board of Directors; María de los Ángeles Rodríguez Rosero, member of the employer sector; Jorge Luis Moncayo Chica, member of the insured sector and president of the CAIR; and Jorge Antonio Villarroel Chalán, acting general director and secretary of the Board of Directors. The final approval act of the manual also records the technical review by Sara Pérez Insuasti and the preparation by Luis Rodas Toledo, Amanda Heredia Zapata, and Bradley Machado Balladares.

The Sole Repealing Provision nullifies Resolution CAIR.002 of December 30, 2024, which contained the previous manual, along with any provision of equal or lower hierarchy that contradicts it. Dissemination is the responsibility of the National Sub-directorate of Document Management, and the regulation is effective from its approval, without prejudice to its publication in the Official Registry.

The change is important to affiliates and retirees because it dictates how the IESS identifies and mitigates the financial and operational risks of its funds and specialized insurance, and because it establishes verifiable deadlines for risk reports to reach the Board of Directors and the control body. With the repeal of the 2024 manual, the entity is obliged to report under a single procedure, with defined responsible parties and timelines for each stage.

Source: Official Registry, Second Supplement No. 391, Friday, October 16, 2026, p. 21 (official reference: Resolution C.D. 714).