July 2017 Issue
In the realm of decisionmaking and strategic analysis, the Own Risk Solvency Assessment (ORSA) tool is a valuable resource for helping insurers conduct risk and solvency assessments. This series of processes and procedures is designed to ensure that an entity’s overall solvency needs are being met.
The National Association of Insurance Commissioners (NAIC) characterises ORSA as “an internal process undertaken by an insurer or insurance group to assess the adequacy of its risk management and current and prospective solvency positions under normal and severe stress scenarios. An ORSA will require insurers to analyse all reasonably foreseeable and relevant material risks (i.e., underwriting, credit, market, operational and liquidity risks) that could have an impact on an insurer’s ability to meet its policyholder obligations”.
In terms of reach, ORSA regimes are now in force or under development in most of the significant insurance markets across the world. In Europe, for example, ORSA is an integral part of the Solvency II Directive (2009/138/EC) – the European Union (EU) law which codifies and harmonises the EU insurance regulation – as well as being a key component of the Pillar 2 framework.
Given its prevalence, the development of ORSA implementation and the ability to derive tangible value from the processes and procedures involved is a key concern for insurers, not only in terms of risk assessment purposes, scenario analysis and data management, but also in guiding senior decisionmaking. Indeed, the application of an ORSA is regarded as a ‘top-down’ process, with board and senior management in the loop and fully responsible.
A process requiring accuracy and precision, an ORSA, according to the 2016 Thomson Reuters report ‘Understanding ORSA – a global risk regulatory regime for insurers’, must: (i) be proportional to the nature, scale and complexity of the business concerned; (ii) be assured through internal or external independent review; (iii) encompass all reasonably foreseeable and relevant material risks, creating a holistic risk profile that includes those risks for which there is quantitative information, as well as those that are more difficult to quantify, like operational and business risk (for groups it will include risks that arise from the structure of the group and events within it, and avoid double counting of capitals); (iv) compare the organisation’s risk profile with the risk appetite as set out by the board, demonstrating that the available capital resources are adequate when compared to the risk profile; and (v) be forward-looking and able to assess risk and capital resources for the full period of the company’s strategic business plan.
The Thomson Reuters report also states that, as ORSA is a tool for supervisors to understand the risk exposure and solvency position of insurers, organisations must provide supervisors with appropriate information to demonstrate the adequacy and soundness of their enterprise risk management (ERM) framework and processes. Furthermore, the report suggests that an ORSA should be undertaken regularly, probably on an annual basis, as well as after any significant changes in an organisation’s risk profile.
Having fundamentally changed the way in which management teams approach strategic planning as well as their enterprise risk and capital management, the overriding challenge posed by ORSA is how insurers can extract the maximum value from its application to improve their risk and solvency position.
The risk landscape
ORSA has an important role to play within an evolving risk landscape, with a number of implementation challenges facing insurers. These include major regulatory and political risks on the horizon, as well as continuous pressure on returns.
“The forward-looking element of ORSA is critical to ensuring all risks to the business are robustly assessed and that the insurer remains within its board’s risk appetite and appropriately capitalised as it implements its strategy,” says Mariano Selvaggi, the insurance lead at Bovill. “A major implementation challenge is to align ORSA with other business reporting and strategic planning cycles to make it a useful management tool rather than a regulatory exercise. Also, firms often struggle to complete a sufficiently robust assessment of risks over the longer time-horizon, including the identification of emerging risks.”
“The overriding challenge posed by ORSA is how insurers can extract the maximum value from its application to improve their risk and solvency position.”
Board ownership and involvement are key factors of an ORSA that can successfully mitigate risks in the long-term – helping to streamline processes to focus on the main messages and avoid lengthy reports, which can often obscure key information. In addition, ORSA dashboards and effective visuals can engage boards to retain oversight throughout.
For Gokul Sudarsana, a senior manager in the actuarial, risk & analytics practice at Deloitte, the role of the corporate risk function to an insurance organisation has evolved substantially over the last decade, with ORSA among the more high-profile manifestations in this space. “A driving force is the trend toward risk-based prudential supervision, such as the Solvency II regime and the increased focus on risk governance under Pillar 2, which has transformed corporate risk from a compliance function to a key decisionmaker,” he asserts. “This is a central theme and outcome of the ORSA, whereby insurers must not only complete a solvency self-assessment based on their own risk management practices, but must also demonstrate that this analysis is integrated into their capital and strategic planning processes – the so-called ‘use test’. Most companies can handle the quantitative challenges of assessing capital adequacy under various scenarios; however, the real challenge to a successful implementation is risk culture.”
Ultimately, senior managers are responsible for getting the organisational culture right by setting a tone at the top which encourages the cross-functional collaboration that is essential to turning the ORSA from a compliance exercise into a value-added management process.
Valuable tool
Undoubtedly, an ORSA is a valuable tool for embedding the risk management function across the breadth of a business. “Advanced risk functions use ORSA to structure more intelligent conversations about material risks and capital planning with the board,” explains Mr Selvaggi. “Since regulators have also adopted a non-prescriptive approach to ORSA, firms do have the required flexibility to make the process and report both proportionate and reflective of their own idiosyncrasies. Insurers have strengthened their scenario analysis and stress testing capabilities, however this remains an area of relative weakness; particularly reverse stress testing as firms find it difficult to contemplate feasible extreme scenarios in which the world looks significantly different from what they know. The consideration of potential remedial management actions in these extreme scenarios is also paramount.”
For Mr Sudarsana, the value of the ORSA process is in assessing capital adequacy and forecasting a firm’s solvency position. “Pillar 1 quantitative requirements are primarily supervisory metrics that are intended to ensure the financial system is adequately capitalised on aggregate,” he affirms. “They do not necessarily reflect, nor are they intended to reflect, the true risk profile of each specific company. A robust risk governance framework, and corresponding ORSA, is required to appropriately represent a company’s solvency position, taking into account portfolio-specific attributes and company-specific processes not captured under Pillar 1.”
Operational approach
One area of contention with ORSA is that insurers can see the process primarily as a regulatory requirement. In this respect, while some good practices have emerged over the years, insufficient alignment between ORSA and practical business planning and reporting cycles is still an issue in some quarters.
“They should inform each other, but this is not always the case,” says Mr Selvaggi. “For example, an ORSA update is needed when the business considers significant events or strategic decisions, such as an acquisition, to ensure the ORSA reflects any changes in the risk profile of the business. However, insurers are not always operationally equipped to do this efficiently, as it may be very costly and time consuming to re-run an internal model.”
Another operational challenge is the need to ensure that board members have a sound understanding of the details and key assumptions which underpin the ORSA, so as to challenge conclusions effectively, regardless of whether the assessment is based on internal models or a standard formula.
Holy grail
For many organisations, of course, value is the holy grail. In terms of an ORSA, this means integrating the process with existing capital and strategy policies and procedures, so as to extract the maximum value from its implementation.
“Firms should try to integrate ORSA as much as possible within strategic and capital planning processes, so that these analyses inform each other and maximise efficiencies,” suggests Mr Selvaggi. “All the good work and information that underpin the ORSA should be leveraged for other regulatory and statutory reporting purposes. In terms of boards, they are expected to understand key inter-linkages between business strategy, risks and capital to make informed decisions, but timely and sound management information is clearly a prerequisite.”
While it is true that some insurers have a narrow perspective, viewing the ORSA as nothing more than a regulatory reporting requirement, other, more forward-thinking firms see the process as a good opportunity to enhance their strategic and operational planning. Moreover, companies that successfully implement a value-added ORSA recognise that risk and capital are inextricably linked, and that any organisational model in which the corporate risk and corporate finance functions operate in isolation cannot extract maximum value from the process.
“It is important to represent the ORSA as a management process rather than a regulatory requirement,” says Mr Sudarsana. “At a minimum, results of the ORSA should directly inform the company’s risk appetite statement, from which risk decisions are ultimately made. This feedback loop between solvency assessment and risk strategy is essential to a robust risk governance framework. Companies will find that the integration of ORSA into this process adds a new lens into capital optimisation, and in order to truly appreciate and extract value from the ORSA, companies will need to include this new perspective in their strategic decisions.”
A formal requirement in Europe since January 2016, the ORSA is fast becoming an internationally adopted concept – for example, it is enshrined in Insurance Core Principle (ICP) 16 of the International Association of Insurance Supervisors – and a purveyor of emerging good practice across the forward-looking risk and capital assessment landscape. Adding value to the regulatory and risk management toolkits of many insurers, the ORSA shows all the signs of being on an upward trajectory in global adoption.
© Financier Worldwide
BY
Fraser Tennant