The first rule of the ORSA: it is both a process and a report
Solvency II puts the responsibility for risk reporting onto Board members. They will have to sign their name at the end of reports and answer to the regulator on all matters of risk and solvency. But do they understand what the report says? Do they know how the information is gathered and how the analysis is done? What will they say if the regulator comes to interview them?
Answering those questions points to the need for a strategic approach to pulling together the information for the Solvency II own risk and solvency assessment (ORSA). Rather than just focusing on the end-goal of the ORSA report, insurers should also consider the processes they have in place.
The ORSA means having to think about the risks the business faces and developing ways to deal with them.
If your company does not have strong enterprise risk management – such as processes for identifying risks, having a risk control cycle, and so on – the ORSA will be a motivation to improve that.
The ORSA also requires firms to recognise their weaknesses and make plans to correct them – and evidence everything at a high level of detail.
This may seem tedious, but these discussions have as much value as calculating the right figures for capital adequacy. No insurer is expected to be doing everything perfectly, so if you learn nothing through the ORSA-creation process, your regulator will be suspicious and start asking questions.
Completing your first ORSA report is clearly a big challenge and many people underestimate the work involved. Having a clear scope from the outset will obviously help everyone focus on the right outcome.
Engaging your colleagues early on – and consulting them repeatedly during the process – will help make it more of a business-wide initiative and less of a report that is the sole responsibility of a small team. First attempts will not be perfect, so be prepared to get it wrong and learn from mistakes.
The re-engineering of capital and risk management processes and the greater need for evidencing may be a good opportunity to think about the IT systems that support ORSA activities.
The ORSA will be an annual task, though you may be required to repeat some analysis more frequently, so there are often good business cases for investing in software to help streamline the work.
Of all the elements of Solvency II, the ORSA has the most potential to add value the business, rather than be a regulatory burden, so insurers have everything to gain from doing it well.
Instructions for a 17-step ORSA process. Dave Ingram