The Own Risk and Solvency Assessment (ORSA) is a process in which an insurance or reinsurance company assesses, in its own terms, the risks it faces and the amount and quality of capital it needs to remain solvent over its business planning period. Unlike a regulatory capital formula, which applies the same calibration to every firm, the ORSA reflects the insurer's particular risk profile, strategy and risk appetite. Its results are reported to the board and to the supervisor.
The ORSA is required in the European Union and the United Kingdom under Solvency II, in the United States under state laws based on a model act of the National Association of Insurance Commissioners, and in many other jurisdictions following the core principles of the International Association of Insurance Supervisors. It is the insurance counterpart of the internal capital adequacy assessment that banks perform under the Pillar 2 part of the Basel framework.
Purpose
Standard capital requirements look one year ahead and are built on assumptions that may not fit a particular company. An insurer may be exposed to risks the formula treats lightly or omits, such as liquidity strain, reputational damage, climate-related change or dependence on a single distribution partner. It may also be planning to grow, enter new lines or change its investment policy in ways that will alter its risk.
The ORSA asks management to address these points directly, and to connect three things that might otherwise be handled separately: business strategy, risk management and capital planning. Regulators describe it as a tool for the board first and a supervisory report second.
What the assessment covers under Solvency II
European law requires every insurer to carry out the ORSA as part of its system of governance. It must contain at least three elements:
- Overall solvency needs. The insurer's own view of the capital and other resources it requires, taking into account its specific risk profile, approved risk tolerance limits and business strategy. This covers all material risks, whether or not they are included in the regulatory formula, over a multi-year horizon.
- Continuous compliance. An assessment of whether the insurer will continue to meet the Solvency Capital Requirement, the minimum capital requirement and the rules on technical provisions, including under stress.
- Deviation from assumptions. An analysis of how far the insurer's risk profile departs from the assumptions underlying the regulatory capital calculation, whether that is the standard formula or an approved internal model.
The work typically includes projections of the balance sheet and own funds over three to five years, stress tests and scenario analysis, and reverse stress tests that identify what would cause the business to fail. Risks arising from the mismatch between assets and liabilities are examined through insurance asset liability management, and reserving risk through the methods used in claims reserving.
Process and governance
The ORSA must be performed regularly, which in practice means at least once a year, and without delay after any significant change in the insurer's risk profile, such as a large acquisition or a sharp market movement. The board is expected to take an active part: to challenge the assumptions, approve the ORSA policy and use the conclusions in decisions on strategy, capital management and product design. A record of each assessment is kept, an internal report is circulated, and a supervisory report is submitted to the regulator shortly after the board has approved the results.
The requirement is applied proportionately. A small insurer with simple business may produce a short assessment, while an international group will run a group-wide ORSA covering all entities and the risks arising from their interconnection.
The ORSA in other jurisdictions
In the United States, the model act adopted by the National Association of Insurance Commissioners requires larger insurers and groups, above premium thresholds, to maintain a risk management framework, conduct an ORSA at least annually and file a confidential summary report with the lead state regulator. The report describes the framework, the assessment of risk exposures and the group's assessment of risk capital and prospective solvency. It complements the risk-based capital system rather than replacing it, and it informs the measurement of policyholder surplus adequacy.
Other regimes, including those of Bermuda, Switzerland, Canada, Australia, Singapore and South Africa, have equivalent requirements under various names. The common source is the insurance core principle on enterprise risk management for solvency purposes.
Supervisory use and limitations
Supervisors read the ORSA to understand how management thinks about risk and to judge the quality of governance. Where it reveals risks not captured by the formula, the supervisor may, in defined circumstances, impose a capital add-on. A weak ORSA is itself treated as a sign of weak governance.
The main criticism is that the exercise can become a compliance document, produced once a year by the risk function and little used in decisions. Results depend on management's own assumptions, so they are hard to compare between firms. Reviews by supervisors have repeatedly found that scenarios were too mild, that the link to the risk appetite statement was unclear, or that boards had not been sufficiently involved. Recent attention has focused on climate scenarios and on reliance on reinsurance treaty protection.