Risk Advisory · ORSA
RiskTAE’s ORSA service writes, reviews or rebuilds the Own Risk and Solvency Assessment for UK insurers under the PRA’s rules and for insurers in other jurisdictions with an equivalent requirement. Practitioners who have run risk functions build the forward-looking solvency projection, the stress and scenario tests and the board’s challenge, then hand the ORSA report and its model to your team.
Your board approves an ORSA that drives decisions rather than records them, and your supervisor reads a report whose numbers explain themselves.
By Mark Dougherty, CPA (CAN)Updated
Definition
The ORSA, or Own Risk and Solvency Assessment, is an insurer’s own assessment of the risks it runs and the capital it needs to carry them, looking forward over its business plan. In the UK it is required by chapter 3 of the Conditions Governing Business Part of the PRA Rulebook, the UK’s version of the Solvency II regime. The firm must perform the ORSA regularly and without delay after any significant change in its risk profile, make it an integral part of its business strategy, and report the results to the PRA in an ORSA report.
It applies to PRA-regulated insurers and reinsurers, with Lloyd’s running its own process for syndicates through their managing agents. Other jurisdictions ask the same question under their own names: Bermuda’s Commercial Insurer’s Solvency Self-Assessment and Guernsey’s Own Solvency Capital Assessment, among others.
For a bank the equivalent is the ICAAP, and the two share more than their initials: a forward-looking view of capital, severe but plausible stresses, and a board that has to own the result.
Sources: PRA Rulebook, Conditions Governing Business Part, rules 3.9, 3.10 and 3.11.
Contents
The right-hand column is what we find in drafts we review.
| Element | What the rule asks for | Where drafts fall short |
|---|---|---|
| Overall solvency needs | The firm’s own view of its solvency needs, taking account of its specific risk profile, approved risk tolerance limits and business strategy (rule 3.8(2)(a)). | The regulatory SCR restated as the firm’s own need, with no view of where the standard formula fits the business badly. |
| Continuous compliance | Compliance on a continuous basis with the SCR, the MCR and the requirements on technical provisions (rule 3.8(2)(b)). | A point-in-time ratio, with no projection of the capital position through the plan and under stress. |
| Deviation from SCR assumptions | How far the firm’s risk profile deviates from the assumptions underlying the SCR (rule 3.8(2)(c)). | A paragraph asserting the standard formula is appropriate, with no analysis behind it. |
| Forward-looking view | The risks the firm faces, allowing for potential future changes in its risk profile and in the nature and quality of its own funds (rule 3.8A(1)). | Risks listed as they stand today, with the business plan’s growth and the own funds it needs left to the finance team. |
| Use in decisions | The ORSA as an integral part of business strategy, taken into account on an ongoing basis in strategic decisions (rule 3.9). | An annual document produced for the supervisor and not opened again until the next one. |
| The report | Qualitative and quantitative results, the methods and assumptions used, a comparison of solvency needs with the regulatory requirements, and information on risks not quantified (rule 3.12). | Results without the methods, so the reader cannot tell what would change them. |
Sources: PRA Rulebook, Conditions Governing Business Part, rules 3.8, 3.8A, 3.9 and 3.12.
The board
Rule 3.9 is the one boards most often miss: the ORSA has to be an integral part of business strategy and taken into account in strategic decisions on an ongoing basis. An ORSA the board receives once a year and files has met the reporting rule and failed the purpose.
In practice that means the board sets the risk tolerance limits the ORSA tests against, challenges the scenarios before they are run rather than the results afterwards, and sees the ORSA’s projection beside every decision that changes the risk profile: a new product, a reinsurance change, a capital distribution, an acquisition.
We write the board’s challenge into the process as a step with minutes, not a sign-off, and directors who want to prepare can take a session from Risk Education.
Sources: PRA Rulebook, Conditions Governing Business Part, rules 3.8(2)(a) and 3.9.
Stress and scenario testing
The forward-looking requirement in rule 3.8A is what turns the ORSA from a statement into a test. The projection runs the business plan forward, then runs it again under scenarios severe enough to matter: an underwriting shock, a reserving deterioration, a market fall that hits the asset side and the SCR together, an operational loss, and whatever combination the board fears most. Reverse stress testing asks what would break the firm and how far away it is.
Each scenario shows own funds, the SCR and the ratio through time, with and without management actions, and the actions are the ones the board has agreed it would take. The same engine supports the solvent exit analysis the PRA requires of most insurers from 30 June 2026, because the exit scenario is a stress like any other, run to the last policy.
Sources: PRA Rulebook, Conditions Governing Business Part, rule 3.8A; PRA PS20/24 Solvent exit planning for insurers, 18 December 2024.
How we help
Take one, or combine them.
We hold the pen: risk profile and tolerance limits agreed with the board, the projection built, the scenarios run, the deviation analysis written, and the ORSA report taken through the risk committee to the board. Your team works alongside us, so the next ORSA is theirs.
You keep the pen. We test the draft against chapter 3 of the Conditions Governing Business Part and give the board a written gap report, each gap ranked by how likely the PRA is to raise it, with the fix.
A forward-looking solvency model in open Excel, every formula visible, that your validators and internal audit can test, linked to the business plan so the ORSA moves when the plan moves.
A former chief risk officer sits with the board or risk committee for the ORSA session, challenges the scenarios and the management actions, and leaves a written record of the challenge for the report.
Credentials
The work is led by Mark Dougherty, CPA (CAN), our technical lead, and done by senior practitioners who have held the roles: former chief risk officers and heads of risk, former regulators and interim executives, with model and quant specialists, including people who have led risk in general and life insurance as well as banking.
The same team writes ICAAPs for banks and ICARAs for investment firms, so the ORSA draws on tested stress testing and capital planning methods. The team works across Risk Advisory.
FAQ
Regularly, and without delay following any significant change in its risk profile, under rule 3.10 of the Conditions Governing Business Part. Each ORSA is reported to the PRA in an ORSA report under rule 3.11.
Under rule 3.12, the qualitative and quantitative results of the assessment, the methods and main assumptions used, a comparison between the firm’s overall solvency needs and its regulatory capital requirements, and information on the risks it has not quantified.
The ORSA assesses the firm’s own solvency needs. Rule 3.8(2)(c) asks the firm to assess how far its risk profile deviates from the assumptions underlying the SCR, whether that is calculated on the standard formula or an internal model.
Yes. We test the draft and its model against chapter 3 of the Conditions Governing Business Part and give the board a written gap report before it approves the report.
Insights
An ORSA, or Own Risk and Solvency Assessment, is an insurer's own assessment of the risks it faces and the capital it needs to stay solvent over its business plan, including under stress. Under Solvency UK the PRA expects the board to own it, use it in decisions and report the results to the PRA.
By Mark Dougherty, CPA (CAN) · 7 min read
Which prudential assessment a firm needs depends on its regulator and its business. UK banks and building societies write an ICAAP, an ILAAP and a recovery plan, plus a solvent exit analysis if non-systemic; FCA investment firms run an ICARA; Solvency UK insurers write an ORSA; and the FCA expects payment and e-money firms to keep a wind-down plan.
By Mark Dougherty, CPA (CAN) · 7 min readDated PRA changes that affect a UK bank's risk function, with a link to the source for each, updated on the first working day of each month.
RiskTAENext step
Tell us when the ORSA is due and where it stands. We will tell you what it would take to make it a document the board uses, and whether you need us to write it, review it or model it.
Tell us what needs doing and by when. A partner will come back to you. Treated in confidence.
Prefer email? advisory@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.