By Huggins Actuarial Services, Inc.
More Alphabet Soup - What is ORSA?:
If you are familiar with RBC, EBITA, BCAR, and SOX, there is another acronym that you will need to learn to love: ORSA. ORSA stands for Own Risk and Solvency Assessment and it is part of an international regulatory effort to enhance the internal risk management of insurers with an end result of increased solvency. ORSA is designed to make enterprise risk management efforts an integral part of all insurers’ management and day-to-day operations with detailed reporting to both the Board of Directors and regulators.
ORSA is a self review of an insurer’s internal Enterprise Risk Management (“ERM”) practices. ORSA is designed to encourage companies to create ERM procedures and processes that reflect risk management practices “appropriate to the nature, scale, and complexity of the material and relevant risks” within their current business plan. In addition, ORSA requires insurers to make a determination whether the current capital resources can support the identified risks. The move to ORSA is international in scope. However, various regulatory bodies are implementing ORSA differently.
In the Beginning - Background of ORSA:
Solvency, as measured by adequate insurer capital, has been a concern of regulators since the beginning of regulation. However, regulatory requirements have strengthened over time in response to insurer failures or shortcomings and industry declines in surplus. During the 1970’s the E.U. began requiring that its insurance entities perform some testing of adequacy of capital. U. S. regulators also addressed the question of capital adequacy by instituting its Risk Based Capital (“RBC”) in the 1990’s in response to company failures in the late 1980s. Solvency regulation continued to evolve and the International Association of Insurance Supervisors (“IAIS”) incorporated the U.K. concepts into Solvency I used by the European Union (“EU”) regulators for financial years after January 1, 2004.
In 2005, the U. K. regulatory body, the Financial Services Authority (“FSA”), began requiring insurers to evaluate their own risks and, after evaluation, to report on the amount of capital required to support those risks under the Individual Capital Adequacy Standards Regime (“ICAS”). However, the FSA discovered that ICAS was more of a compliance exercise rather than a valued and useful part of the insurer’s internal risk management process. Obviously, this was not the desired result.
To remedy this lack of real involvement, the FSA developed the concept of Own Risk and Capital Assessment which required that the results of a self review be used in insurer’s regular business practices. The concept became endorsed by the European Commission, and the Own Risk and Capital Assessment became known as Own Risk and Solvency Assessment (“ORSA”) to be consistent with Solvency II terminology with its emphasis on solvency. ORSA is one of the three main concepts underlying Solvency II.
In 2010, the ORSA concept was added to the International Association of Insurance Supervisors’ (“IAIS”) list of Insurance Core Principles (“ICP”) beginning with ICP 16.11. The ICPs are rules that are used to measure a country’s insurance regulation systems. The addition of ORSA within the ICPs has caused ORSA to become a worldwide requirement.
All countries whose regulators wish be accredited by the IAIS will have to implement an ORSA requirement in order to comply with the IAIS Insurance Core Principles. However, the ORSA requirements may differ greatly by country. Both Europe and the United States are still in the process of developing and reviewing standard guidelines and requirements for ORSA, and therefore neither jurisdiction has implemented this requirement to date.
The National Association of Insurance Commissioners (“NAIC”) has been moving to a forward looking, proactive regulatory environment and away from a static backward looking examination model in many areas of regulation. As part of that movement to a proactive regulation, state regulators have been performing Risk Based Examinations of domiciliary insurers for the past several years which will be including evaluations of insurance holding companies as well as the individual insurance entities.
In the United States, the NAIC released a preliminary draft of its ORSA guidance manual for comment in 2011. The final results were published in a document entitled NAIC Own Risk and Solvency Assessment (ORSA) Guidance Manual, (November 2011). The NAIC is also proposing an annual ORSA high-level summary report to be filed on request from the domiciliary state, although efforts are underway to make this annual filing mandatory for the larger insurers and groups. The NAIC is currently developing the final guidance manual and model law for implementation of this requirement.
Note that the NAIC ORSA requirements currently apply only to large insurers and large holding companies, although it is expected that the thresholds for compliance will move downward over time. At this time, U.S. regulators are evaluating an ORSA trial run, where select large companies voluntarily submitted sample ORSA reports to the NAIC in the summer of 2012.
The stated purpose of the NAIC’s ORSA Guidance Manual which is based on the draft ORSA Model Act, is to provide U.S. insurers with a framework to improve their ability to manage risk. The commissioners currently hope to have the ORSA Model Act ready for implementation by January 2015. Approval and adoption of Model Acts by the states generally takes place within one to three years after finalization, although details may vary by state.
The NAIC intends for ORSA to be a component of an insurer’s ongoing ERM process. Once the assessment is complete for the review period, the company must share its findings with the domiciliary state under the appropriate state version of the NAIC’s Risk Management and Own Risk and Solvency Assessment Model Act #505. The Model Act requires that an insurer:
1. Conduct an ORSA annually to assess the adequacy of its risk management and current and projected future solvency position;
2. Internally document the process and results of the ORSA assessment; and
3. Provide annually a high-level summary report to the lead state commissioner if the insurer is a member of an insurance group and upon request to the domiciliary regulator if the insurer is not a member of a group.
In or Out – When is an Insurer Exempt from ORSA?:
According to the NAIC Own Risk and Solvency Assessment (ORSA) Guidance Manual, all insurers are subject to the ORSA requirements unless the insurer meets the conditions:
a. The individual insurer’s annual direct written and assumed premium is less than $500,000,000; and,
b. The insurance group’s annual direct written and assumed premium is less than $1,000,000,000.
If an insurer fulfills exemption requirement (a) but not (b), then the insurance group may supply the ORSA Summary report in any combination as long as every insurance entity within the group is covered by the summations of the ORSA Summary Report.
If an insurance group fulfills exemption requirement (b) but not (a), then only the entity that is over the threshold is required to produce an ORSA Summary Report.
Note that these are the initial conditions for the implementation of ORSA. The premium levels for participation in ORSA may be adjusted downward in subsequent years.
The Score - What are ORSA Goals?:
The NAIC Own Risk and Solvency Assessment (ORSA) Guidance Manual sets forth what the NAIC hopes to accomplish with the implementation of ORSA:
1. To make sure all insurers have an effective level of enterprise risk management, through which each insurer’s material and relevant risks are identified using techniques that are appropriate to the nature, scale and complexity of the insurer’s risks, in a manner that is adequate to support risk and capital decisions; and
2. To provide supplement to the existing legal entity view of group-level perspective on risk and capital.
What are its Components?:
The ORSA report, supported by the insurer’s internal risk management materials, should include the following three major sections:
1. Section 1 – Description of the Insurer’s Risk Management Framework
2. Section 2 – Insurer’s Assessment of Risk Exposure
3. Section 3 – Group Risk Capital and Prospective Solvency Assessment
Section 1 – Description of the Risk Management Policy
This section of the ORSA Summary report should provide a summary of the following key ERM Framework principles (at a minimum):
1. Risk Culture and Governance
2. Risk Identification and Prioritization
3. Risk Appetite, Tolerances and Limits
4. Risk Management and Controls
5. Risk Reporting and Communication
This summary must achieve the following:
- Identify all relevant and material risk categories and describe how those risks are managed on a day-to-day basis as the company executes its business strategy
- Provide a detailed documentation of the company’s investment policy
- Provide a detailed documentation of any underwriting policy used to manage underwriting risk
- Include any claims underwriting implemented to manage risks associated with determining whether the claims are covered under contract
- Provide a description of anti-fraud policies
- Provide a description of any Asset-Liability Management (ALM) activities and their relationship with product development, pricing and investment management functions
- Provide a description of any retention policy or program designed to retain assets, policies in force, or market share
- Provide a description of any reinsurance counterparty policy related to any currently effective reinsurance programs
- Provide documentation of management policies related to identifying, assessing, measuring, monitoring, controlling and mitigating risks associated with group membership
- Provide disclosure of how the company’s management uses its risk management policy in its daily operations. Company information, management processes, and assessment tools (feedback loops) must be disclosed
Section 2 – Insurer’s Assessment of Risk Exposures
For each material risk category in Section 1, this section of the ORSA Summary Report should provide a quantitative and/or qualitative (for risks that cannot be measured quantitatively) measurement of risk exposure in both normal and stressed environments using risk assessment techniques appropriate to the insurer’s specific risk profile.
This assessment should achieve the following:
- Include a quantification of risk under a range of outcomes using risk measurement techniques that are appropriate to the nature, scale and complexity of the risks
- Provide detailed descriptions and explanations of the risks identified
- Provide detailed description of the measurement approaches used
- Provide a description of the key assumptions
- Provide a description of outcomes of any plausible adverse scenarios that were run
- For quantified risks, insurer should provide exposure results for both normal and stressed environments
- Insurer should include consideration of the impact of stresses on capital
- Note: Regulators believe that the stress conditions should be appropriate to each company’s individual risk category. Examples of relevant material risk categories may include, but not be limited to: credit, market liquidity, underwriting, and operational risks
Section 3 – Group Risk Capital and Prospective Solvency Assessment
According to the NAIC, this section of the ORSA Summary Report should:
- Document how the company combines the qualitative elements of its risk management policy and the quantitative measures of risk exposure in determining the level of financial resources it needs to manage its business over the long term business cycle.
- Demonstrate that, given the current capital requirements, the quality of that capital, the current risk management policy consisting of its current risk tolerance limits, current risk exposure amounts in both a normal and stressed environments and the projected 3 – 5 year business plan, the company has the financial resources necessary to execute its 3 – 5 year business plan
- If the company does not have the necessary financial capital to execute the 3 – 5 year business plan, the company shall describe the management actions it will take or modifications to the business plan that it will make to resolve the adequacy of its financial capital
- The capital assessment is required from each insurer on an individual basis regardless of whether or not it’s a part of an insurance group
A. Group Risk Capital Assessment
This section is intended to provide a determination of group risk capital needs for the insurer, based upon the nature, scale, and complexity of risk within the group and its risk appetite, and to compare that risk capital to available capital to assess capital adequacy. Capital adequacy assessment is the comparison of aggregate available capital against the various risks that may adversely affect the enterprise.
Risk Capital is the minimum level of capital that satisfies a predetermined security standard, and is compared to available capital to determine a measure of capital adequacy. The discussion of current group risk capital in the summary report should also include a comparative view of group risk capital from the prior year.
Insurers are expected to have a sound process for assessing capital adequacy in relation to their risk profile and those processes should be integrated into the insurer’s management and decision making culture.
The analysis of an insurer’s group risk capital requirements and associated capital adequacy description should be accompanied by a description of the approach used in conducting the analysis. This should include key methodologies, assumptions, and considerations used in quantifying available capital and risk capital. Examples of these methodologies, assumptions, definitions, and considerations might include:
Methodologies, Assumptions & Considerations
Description of
Methodologies,
Assumptions & Considerations
Examples
(not exhaustive)
Definition of Solvency
Describe how the insurer defines solvency for the purpose of determining risk capital and liquidity requirements
Cash flow basis, balance sheet basis
Accounting or Valuation Regime
Describe the accounting or valuation basis for the measurement of risk capital requirements and/or available capital
GAAP, Statutory, Economic or Market Consistent, IFRS, Rating Agency model
Business Included
Describe the subset of business included in the analysis of capital
Positions as of a given valuation date, New business assumptions
Time Horizon
Describe the time horizon over which risks were modeled and measured
One-year, multi-year, lifetime, run-off
Risks Modeled
Describe the risks included in the measurement of risk capital, including whether all relevant and material risks have been considered
Credit, market, liquidity, insurance, operational
Quantification Method
Describe the method used to quantify the risk exposure
Deterministic stress tests, stochastic modeling, factor-based analysis
Risk Capital Metric
Describe the measurement metric utilized in the determination of aggregate risk capital
Value-at-risk or VAR (quantifies the capital needed to withstand a loss at a certain probability), Tail-value-at-risk or TVAR (quantifies the capital needed to withstand average losses above a certain probability), Probability of Ruin (quantifies the probability of ruin given the capital held)
Defined Security Standard
Describe the defined security standard utilized in the determination of risk capital requirements, including linkage to business strategy and objectives
AA solvency, 99.X% 1-year VAR, Y% TVAR or CTE, X% of RBC
Aggregation and Diversification
Describe the method of aggregation of risks and any diversification benefits considered or calculated in the group risk capital determination
Correlation matrix, dependency structure, sum, full/partial/no diversification
Source: NAIC Own Risk and Solvency Assessment (ORSA) Guidance Manual
Other considerations include:
- Elimination of intra-group transactions and double-gearing where the same capital is used simultaneously as a buffer against risk in two or more entities;
- Level of leverage resulting from holding company debt;
- Diversification credits and restrictions on the fungibility of capital within the holding company system, including the availability and transferability of surplus resources created by holding company system level diversification benefits;
- The effects of contagion risk, concentration risk and complexity risk in the group risk capital assessment;
- The effect of liquidity risk, or calls on the insurers cash position, due to micro-economic (internal operational) and/or macroeconomic (economic shifts) factors.
B. Prospective Solvency Assessment
This section of the assessment looks at how closely the insurer’s capital assessment process is utilized in business planning. This includes the ability to forecast future capital and its capability to support risk management in the future. This forecasting should consider possible changes to both the insurer’s internal operations and its external business environment (assessing capital in both normal and stressed economic environments).
As can be seen from the discussion above, the current situation with respect to ORSA in the United States remains fluid. The NAIC is working hard to craft a workable Model Law and to provide guidance for meeting the requirements of ORSA to insurers. Those large insurers or large insurance holding companies who will be the first to comply with ORSA are also girding for the impact of the newly emerging regulations.
For more information, contact
Jane C. Taylor, FCAS, MAAA, JD - jane.taylor@hugginsactuarial.com. Ronald T. “Rusty” Kuehn, FCAS, MAAA, CERA, CPCU, ARM, FCA rusty.kuehn@hugginsactuarial.com, Carolyn Dintino
carolyn.dintino@hugginsactuarial.com or visit our Website at www.hugginsactuarial.com
Meet The Experts
Review articles and blog posts by our list of insurance experts!
Click Here For Participating Firms
VIEW RATINGS FOR INSURERS
Enter name of Insurance Company and press GO button.