[adsanity_group num_ads=1 num_columns=1 group_ids=234 /]
Type ‘ORSA’ into Google and you will find things like Occupational Road Safety Alliance, Orbit Reconstruction Simulation and Analysis and a locality in Dalarna County, Sweden. But, of course, the ORSA we are talking about here is the Own Risk Solvency Assessment which, as EIOPA described in 2008, is “the heart of Solvency II” – a message that was brought to life at the 5th Solvency II Summit held in London in July.
The importance of the ORSA to Solvency II was stressed by Iwona Krasniewska, Senior Expert – Solvency II at EIOPA, who told delegates, “You must not forget that Solvency II is about three pillars and the ORSA, at the core of the second pillar, is the basis for the Solvency II regime.”
Solvency II ORSA: a process not a report
The ORSA, as many of the speakers pointed out, is not a report – it is a process. There is a report that comes out of the process, but it is a process that affects the entire organisation.
The process should assess the firm’s overall solvency needs beyond the capital adequacy requirements defined in Pillar I. The ORSA raises the awareness of the relationship between the firm’s current and future risk exposure and the capital needs that follow from that exposure.
Fergus Mackie, Insurance Risk Director at Aviva, explained what the ORSA means to firms, “The ORSA is designed to ensure you understand the risks you are taking and to demonstrate to senior management and regulators that you understand those risks. It is also there to make sure you have a process to manage risk rewards.”
In its 2008 guidance, EIOPA (then CEIOPS) described this holistic approach of the regulation (emphasis added): “The Own Risk Solvency Assessment can be defined as the entirety of the processes and procedures employed to identify, assess, monitor, manage, and report the short and long term risks a (re)insurance undertaking faces or may face.”
Furthermore the ORSA will help determine “the own funds necessary to ensure that the undertaking’s overall solvency needs are met at all times.”
Designing the ORSA process
The ORSA process incorporates a strong qualitative element and takes into account the effects of all the material risks (such as underwriting, market, credit, reputational and strategic risks) that could affect the firm’s ability to meet its obligations. It should also consider planned management activity and external factors such as economic outlook. In short it is about management knowing the business.
The ORSA integrates both capital and risk-management dimensions into the business steering of the firm and includes a 3-5 year time horizon for the firm’s activities and risk outlook.
Discussing the future of risk management under Solvency II, Raphael Borrel, Head of Solvency Solutions at Avantage, said, “One of the key elements within the ORSA process is to define a risk appetite framework that will support the delivery of strategic objectives. You can’t have a successful ORSA if the risk appetite framework is not clearly linked to the strategy.”
This link should be established through a mix of both qualitative statements (risk preferences) and quantitative boundaries (risk tolerances and risk limits).
Applying the ORSA process
Speakers described in detail solutions for the ORSA implementation in their respective firms. A number of common themes, such as risk, management sign-on and the specifics of the ORSA report, emerged from the presentations and discussions that followed.
“Risk must be involved in all sections of the report,” according to Nilanjan Mukherjee, Solvency II Project Manager at SecondFloor. Speaking during a panel discussion on the practical application of the ORSA, he stressed the importance of risk considerations when applying the process and writing the report. “Risk must challenge every assumption of the content,” he said. “We tend to isolate risk in a box, but it should be there in every section to create as holistic and linear a view as possible.”
Jan Piekoszewski, Solvency II Programme Manager at Atradius, discussed the importance of early management sign-on. “You must remember that this is not about re-engineering the company but about finding ways of improving and adding value to the company’s existing risk management system. We created an ORSA communication platform to get different parts of the business involved from an early stage so now we have heads of department taking ownership of the ORSA process.”
The ORSA document
Although the ORSA is a process, the discussion on practicalities turned to address the reporting requirements, both for the regulator and internally.
Mr Piekoszewski said the report had to trigger management action. “We already have governance and risk management processes in place. So doing the ORSA, if it is just another document that the Board signs off for Solvency II, then the Board is not going to be happy about it.”
“If you spend a lot of time on something that does not trigger action,” he added, “it does not add any value.”
Brian Abrey, Solvency II Lead at Old Mutual, spoke of the need to create a working document. “The ORSA has got to be something that feels right and real to our Board. It can’t be a theoretical document.”
He cited the problem that the Individual Capital Assessment (ICA) reports – that insurers currently have to produce in the UK – are simply filed away once submitted to the regulator. “With the ORSA you can’t do that,” he said. “It is something that must reflect the day to day running of the business and the underlying ORSA processes within the business on an ad-hoc, daily, monthly, or even annual basis”.
Mr Abrey noted that the ORSA report needs to be submitted to the supervisor at least annually and that Solvency II requires all ORSA reports to be provided. “This is important as some firms may choose not to produce interim reports in an ORSA report format to avoid triggering the submission requirement.”
‘Less is more’
There was also some discussion on the length of the report, with broad consensus being that ‘less is more’.
Because the purpose of the report is to provide a picture of what the Board essentially already knows it should be brief. One panelist suggested that if you can’t describe the risk in ten pages then it is no longer useful to the Board.
While others argued the length of the report should be proportionate to the size of the business, they did agree that the report should be a “light read”, presenting a snapshot of the firm’s risk and solvency position.
Shifting focus to Pillar II
There was a sense amongst many delegates that the importance of the ORSA has not quite sunk in in many firms. Given the prominence of the ORSA to Solvency II, firms will be wise to get involved not just internally but with the regulatory authorities.
Ms Krasniewska confirmed that EIOPA will start public consultation of the ORSA at the beginning of November (more details are available here). She reminded delegates that Solvency II is a learning process, both for firms and regulators, “EIOPA welcomes input and feedback from the industry on draft regulation and guidelines,” she said. “To have an efficient system we need cooperation and a stronger dialogue between undertakings and supervisors.”
But she sounded a cautionary note saying, “At the moment I feel that the industry is too focused on Pillar I and underestimates the proper risk management called for under Pillar II.”
Upcoming event: The 6th Annual Practitioners’ Forum on Stress Testing & Operational Risk for Insurance Firms, 18 -20 October 2011, Central London. (10% discount available for Solvency II Wire readers, quote VIP Code: FKM62258S2W)
[caption id="attachment_2670" align="aligncenter" width="576"]
Orsa, Sweden ©jocke.[/caption]]]>
ORSA – bleak, hostile terrain where only the brave would tread…in Sweden
Nice article Gideon, was surprised to hear of ICAs being locked in cabinets!
It is nice to see that ex-team Solvency 2 team members such as Nilanjan Mukherjee have retained my lesson of a hoslistic approach.
It may be helpful to look at BaFin’s approach to the ORSA. The BMA’s approach is also interesting.
Many insurance organisations have not yet made the link between the business environment, strategy and risk. This new framework sits within the ERM piece and completes the ORSA loop.