Insurers can no longer blindly trust credit ratings, but must have frameworks to assess the suitability of both internal and external ratings. Sarah Wall explains what is required