The Own Risk and Solvency Assessment (ORSA) is set to be the main engine for embedding Solvency II into the business, requiring insurers to put a prospective view of their risks and their implications at the heart of decision making.
Although the ORSA takes up just a few lines of the Solvency II Directive, for most insurers it is proving to be the most important aspect of the Solvency II project, cutting across all the key elements of risk and value management including risk appetite, risk assessment, capital management and business strategy.
When the Directive was first published, many observers saw the ORSA as a stand-alone report, akin to the Internal Capital Adequacy Assessment Process (ICAAP) in Basel II or simply an extension of the supervisory report within Solvency II. Now the ORSA has come to be seen as part of a continuous process and a key management tool. Given the principles-based approach of Solvency II, this may help to explain why so little guidance was published within the Level 2 implementation measures. Rather than creating a checklist, policymakers want to give management a high degree of discretion in creating a process that can be moulded around their needs and provide a useful aid to decision making.
The ORSA aims to enable the board to monitor and manage its company’s risks and determine its overall solvency needs. As Figure 1 outlines, the assessment should take account of the company’s risk appetite, risk profile and business strategy, covering both present and prospective risks. The prospective view required under the ORSA will take many firms beyond their normal capital allocation horizons, but it should align these horizons more closely with the time frame over which the board makes strategic decisions. This will depend upon the nature of the risks the business is exposed to, but is typically considered to be around three to five years.
Insurers will have to ensure they continuously comply with regulatory capital requirements. Not only does this mean making sure that the company is solvent today, but also solvent over their business planning period. This may require projections of capital requirements over that period, along with the expected level of own funds, to take into account risks that are reasonably likely to arise during this time frame. Should this analysis reveal that the insurer is at risk of breaching its capital requirements, it will be necessary to develop a plausible plan to show how it can strengthen its ability to meet the requirements.
"The own risk and solvency assessment shall be an integral part of the business strategy and shall be taken into account on an ongoing basis in the strategic decisions of the undertaking."
Source: Solvency II Framework Directive
As such, the ORSA goes beyond simply providing warning lights for capital adequacy. It also helps senior management to understand how potential difficulties can be dealt with proactively. Stress testing will therefore be critical in helping to identify potential threats to the business and preparing plans to alleviate the worst of the impact and de-risk the balance sheet. In severe circumstances, stress and scenario analysis will enable companies to assess ways to recapitalise the business, or when all else fails, ensure an orderly run-off.
This ORSA should be conducted regularly to ensure that it continues to reflect the company’s solvency position. This includes rerunning the ORSA following a significant change in the company’s risk profile such as after a takeover, new product launch or significant market stress.
The ORSA can thus be seen as an interactive process between the board and executive team, focusing on the key areas of risk identification, capital planning and scenario analysis, and how the results will impact on the Solvency Capital Requirement (SCR).
The ORSA should also chart how risk is managed, listing who is responsible for what and describing how risk considerations are integrated into decision making. The ORSA will thus be a fundamental driver for embedding Solvency II and underlying enterprise risk management into the running of the business.
The capital evaluations within the ORSA should focus on what management itself believes the business will need, and are therefore quite distinct from the capital requirements set by the regulator. Indeed, regulatory and management assessments could differ quite markedly as regulatory capital is simply the minimum amount insurers need to hold to conduct business. Supervisors will expect boards to consider how much capital they would like their company to hold to achieve their desired risk profile.
This assessment of an insurer’s overall solvency needs is dependent on its understanding of its risk exposures and its appetite for them. It is therefore important that all firms can identify and quantify their exposures. For insurers with an approved internal model, this process will complement the regulatory capital assessment. Companies using the standard formula will also have to demonstrate how they are quantifying their risks and determining their overall solvency needs, as will firms using a partial internal model (where they calculate their SCR using the standard formula, they should still use their own methodology to quantify their solvency needs for their own purposes).
Supervisors will want to see evidence that the ORSA is an integral part of the insurer’s risk, capital and value management system, and will use the ORSA to understand the firm’s attitude towards risk management. They will also expect the board to be fully conversant with the ORSA and to demonstrate that assessment actually influences their key decisions. It is notable that a number of EU supervisors including the Federal Financial Supervisory Authority (BaFin) in Germany and Financial Services Authority (FSA) in the UK require the delivery of a full ORSA as part of their internal model approval process. This underlines the need to begin preparing for the ORSA as soon as possible.
The ORSA also requires insurers to compare their risk profile to the assumptions in their SCR. This assessment will be of interest to supervisors who will want to ensure the SCR is appropriately calibrated. This is especially important for those insurers using the standard formula, as it is unlikely to be well tailored to their actual risk profiles. This assessment is not a comparison of the SCR with the management’s assessment of the capital it wishes to hold, as these are likely to be calibrated at different levels. Instead, it is an analysis of whether the assumptions in the SCR, calibrated at 99.5% over one year, are appropriate for an individual insurer, given its unique risk profile.
Where insurers use an internal model, it might be assumed that the assumptions in the internal model are appropriate, as otherwise it is unlikely to have been approved. However, this assessment is still required as part of the ORSA, to give an explicit demonstration of the continued appropriateness of the assumptions over time. The ORSA should therefore also validate effectiveness of the internal model change policy.
Figure 2 sets out a four-stage approach to articulating and delivering the ORSA. Many of the elements may already be in place or being developed for other aspects of Solvency II.
Companies that have already moved to a risk-based prudential regime such as the Minimum Requirements for Risk Management by Insurance Undertakings (MaRisk VA) in Germany or Individual Capital Assessment (ICA) in the UK will have a head start. The key is being able to consolidate, coordinate and industrialise all these various elements in a structured and coherent way, enabling senior management to assess and manage the firm’s solvency position without the need to create a needless extra tier of compliance.
To bring all the elements together, we would advocate setting up a workstream to oversee the delivery of the ORSA. The specific components will be developed by dedicated teams. Creating a workstream to deliver the ORSA in its own right is likely to create needless duplication and contention with other streams.
For the ORSA process to function effectively, risk management should have the power to influence and challenge business decisions. Senior management should also be involved from the outset and show that they are taking appropriate responsibility for the process. One of the key challenges of bringing them on board will be helping them to develop a clear understanding of what may be complex or unfamiliar risk and capital analysis. This kind of early engagement is also an opportunity. In particular, it will encourage them to think about their approach to risk and how it impacts on their decisions. It can therefore help them to judge what kind of analysis they should be receiving to help them to make more informed decisions.
Firms that approach the ORSA as a management tool will be more successful at integrating it into their business processes and unlocking the value.
The potential benefits of a well-structured ORSA include the ability to respond proactively to a possible future change in their risk profile, which could affect their capital strategy.
An effective ORSA can also provide useful insights into the capital efficiency of the business and management actions needed in the future. Indeed, the ORSA may reveal that the company is holding more capital than it actually needs and could therefore deploy some of these funds more profitably elsewhere. The ORSA will also enable companies to evaluate the long-term capital efficiency of particular products under the new Solvency II regime and assist in the design of new policies.
Although the internal ORSA report will be more detailed than would be required for public disclosure and supervisory reporting under Pillar 3, elements could be adapted for these reports. The internal ORSA report could also provide a good basis for discussions with analysts and rating agencies.
As part of the principles-based approach, the onus will be on insurers themselves to develop a viable ORSA process and make it work for their business.
Getting the ORSA implementation right will have significant benefits for the effective delivery of the Solvency II project. Early attention to building the ORSA will ensure that key requirements are identified in good time and help to crystallise the goals and outputs of the other work streams. The value to the business includes forward-looking insights into the risks facing the business, the capital required and how capital can be most effectively deployed.
www.pwc.com
© 2010 PwC. All rights reserved. "PwC" refers to PricewaterhouseCoopers LLP, a Delaware limited liability partnership, which is a member firm of PricewaterhouseCoopers International Limited, each member firm of which is a separate legal entity.