On the eve of the implementation of Solvency II, back in 2015, Kathryn Morgan, then working at the Gibraltar regulator, published an article in the ORSA Knowledge Centre called ORSA Sprawl. The article contemplates the possibilities of the use of the Own Risk and Solvency Assessment beyond insurance and Solvency II. Today, almost ten years later, she returns to the topic, asking to what extent her views were confirmed?
Since the introduction of Solvency II in 2016, European insurers have amassed close to eight years of invaluable experience, navigating the intricacies of the Own Risk and Solvency Assessments (ORSAs) to fortify their financial resilience.
Or have they?
Leading up to the introduction of Solvency II, the ORSA was referred to as the “beating heart” of the regime, the element that would bring risk management into the decision making of insurers, and so lead to improved decision making and fewer insolvencies or near misses.
Has this happened?
The Bank of England reported in 2018 that since Solvency II had come into force, “insurance firms have continued to perform strongly and sector balance sheets have continued to grow”. It’s hard to get data on insolvencies and near misses, although EIOPA published a report where they stated: “Notwithstanding overall market performance, the capital levels and the quality of risk management systems of insurers have improved since the introduction of Solvency II.”
This appears to point to Solvency II being a force for good in reducing insolvencies and near misses.
But can we give the ORSA the credit for this?
The Bank of England notes that Solvency II is similar to the previous UK regime, although the ORSA was a new feature. So it’s a definitely maybe yes.
How has the ORSA changed behaviour in insurers?
It’s hard to tell as ORSA reports are not published. If we take the Solvency and Financial Condition Report (SFCR) as a proxy, which is reasonable as these contain good information on risk management, then we can see that insurance companies are looking at new risks – environmental; geopolitical; cyber – risks that have emerged since Solvency II was introduced. The regulators’ push for insurers to think about outsourcing risks and resilience are also included in SFCRs.
In my view, as SFCRs are public, insurers are able to see what their competitors are thinking about and then consider whether those risks are relevant for them. The potential downside of this is group think and herding, but I believe that overall standards of risk management will rise, especially as companies need to explain why they think what they think.
SFCRs are also reviewed by external stakeholders and there are many reports and webinars comparing and contrasting them. Again, this can lead to even better practice across the industry.
We are now seeing that prudential regulators are adding tools on resolution of insurers, and recovery options, which are missing from the Solvency II regime. Thinking about how a firm would be resolved is a useful thought exercise (although you are bound to miss something) and is likely to identify more risks, or new aspects to existing ones.
As we reflect on the experience since Solvency II’s implementation, it’s evident that while challenges remain, the ORSA has played a pivotal role in enhancing risk management practices across the industry. The emphasis on identifying and mitigating new risks has undoubtedly led to stronger, more resilient insurers. Although ORSA reports aren’t publicly available, the insights from SFCRs indicate a significant shift towards proactive risk management. This evolving landscape suggests that the industry is better prepared to handle uncertainties and future challenges.
So is the ORSA now part of insurers’ thinking and planning?
I was asked to include some examples from my own experience on how the ORSA is being used. The fact that this took me some time leads me to think that ORSAs are well embedded in companies and they are pretty much taken for granted as part of the normal process of running a company. That is a pretty good outcome for the ORSA – it’s now second nature.
Having said that, I have noticed that the need to have a Board and senior management discussion at least annually makes sure that risks are discussed. For me, being shown a page setting out the top risks based on the risk register means I can check it against what I am most worried about – if something is there that I am not worried about, that leads to a good conversation (which may make me more worried).
If something I am worried about is missing, again we can discuss and potentially change the risk scoring. It’s a good common sense check against the risk register and helps sort the wood from the trees.
It’s always useful to have the CRO in Board meetings to remind the Board of the risk appetites. In my experience I can see Boards testing business plans against the risk appetite using stress tests and scenario testing. Because the risk appetite and the stress tests have been discussed in discussions about the ORSA, there are no surprises and an agreed baseline for the risks to be taken.
Ultimately, Solvency II, with the ORSA at its core, continues to drive a culture of continuous improvement, fostering a more stable and forward-thinking insurance sector.
The author is a non-executive director and actuary. She has previously held roles at the UK and Gibraltar regulators, as well as several insurers.
The Solvency II Wire ORSA Knoledge Centre is a collection of commentary and articles on the Solvency II Own Risk and Solvency Assessment (ORSA)
