Insurance regulators in the U.S. are bringing about a quiet revolution in terms of how they monitor company solvency. The new Own Risk and Solvency Assessment (ORSA) fundamentally changes the conversation in two ways: shifting responsibility and looking forward.
Shifting responsibility. The opinion about solvency will now come from company management, based on their own judgment of what is needed (hence the name). This contrasts sharply with prior practice, in which U.S. regulators specified the solvency standard and laid out specific procedures for determining whether companies met that standard. Asking insurers themselves to make their own assessment of solvency is a major shift in philosophy and responsibility. While some companies have long been making their own assessment, many have been relying on regulatory and rating agency surplus requirements and expectations.
Management will need time to understand the relevant topics; getting their buy-in will be crucial.
Looking forward. The ORSA takes a forward-looking approach. Whereas previous practice looked backwards to assess whether surplus was sufficient at the end of the last year, under ORSA insurers must look at solvency for the next year or even the next several years into the future.
Who Must Prepare?
According to the Risk Management and Own Risk and Solvency Act (RMORSA) model law adopted by the National Association of Insurance Commissioners (NAIC) in 2012, ORSA requirements come into effect in 2015; these requirements apply to groups writing over $1 billion of direct premium and single companies writing more than $500 million of direct premium. So, larger companies and groups certainly must be ready.
But the model law also gives the commissioner the authority to request any company to provide an ORSA—and requires an ORSA from particularly troubled companies regardless of size. Many of those involved with the process of developing the new standard believe that once regulators see the insights offered by a good ORSA report, they will want to have ORSA conversations with all insurers as a part of their quadrennial examination. Insurers exempt from the formal requirements would therefore still benefit from reviewing the NAIC ORSA guidance manual, and they may want to consider a much less formal internal solvency assessment process that puts them in position to immediately answer ORSA-type questions.
What Will It Take For Companies To Get Ready?
Companies without an established ERM program or risk evaluation system may need two to three years to lay the groundwork for their first ORSA report. But even companies that do have established ERM programs and are using an economic capital model may still need a year or more of work to expand their processes to meet the broad requirements of the ORSA and to create the supporting documentation.
Acclimatizing management and the board of directors to the new process will also be a major consideration. Like the Sarbanes-Oxley requirement on financial statements, ORSA requires management (not the company actuary) to submit their opinion on surplus adequacy—and also requires that the board receive a copy of the ORSA report. Management will need time to understand the relevant topics; getting their buy-in will be crucial. And obviously, the board should be able to review preliminary versions of the ORSA report and become familiar with its content well before it is finalized for sending to the regulator.
Don’t Expect a Walk in the Park
For insurers who have done ERM and economic capital modeling for some time without significant outside scrutiny, the heightened ORSA documentation requirements may come as a shock. In the summer of 2012, a committee of insurance regulators reviewed some voluntary ORSA reports; presumably, these voluntary submissions came from companies who felt they had the process well in hand. The committee found only half of the reports submitted to be satisfactory, with lack of specificity being the major complaint against reports judged unsatisfactory.
Although regulators expect concrete details in the ORSA report, this report is actually expected to be a summary of much more detailed materials that will be made available for inspection during the quadrennial exam.
What Does This Mean for Actuaries Involved in ERM?
In order to be prepared for the January 1, 2015, deadline, U.S. insurers need to start thinking about their ORSA compliance requirements now. Following are some suggestions for actuaries who may be compiling or contributing to their company’s ORSA report.
1. Be prepared for a lengthy walk-through discussion with the regulator. The ORSA Report is intended as a summary document; the regulator will want to review supporting documentation and speak with key personnel to understand the full story. This will be your opportunity to demonstrate that the risk management process is more than a “checking-the-box” exercise—that it is truly woven into the business processes of the firm.
2. Provide a flowchart of your risk management and control processes. This will help the regulator get a high-level understanding of how things are done at your company. Also, it’s a useful reference point to have handy when going through more detailed documentation, to emphasize where each piece fits into the process.
3. Give concrete supporting details. For example, show actual risk limits to support the assertion that the company has risk limits in place and provide examples of how those limits are enforced. Graphical exhibits can add a lot of value to text and tables. Be sure that your attachments and supporting exhibits demonstrate the rigor of your process.
4. Explain the company’s risk identification and mitigation processes. How are risks identified, and what methods are used to evaluate their significance? Under what circumstances is risk reduced, offset or transferred? What strategies are employed to achieve the desired degree of mitigation? Again, in discussions with the regulator, it will be useful to offer specific examples to illustrate the process in action—for example, provide examples of risk heat maps and explain how they are used.
5. Perform robust stress testing. This has multiple advantages. While economic capital modeling may be used in the NAIC ORSA process, stress tests are required. But beyond the requirements, many companies find that stress tests offer their management and board extremely useful insights. Stress testing uses concrete scenarios that help to make the risk measurement “real” by offering a narrative frame—so take full advantage of this. In addition to single stress scenarios, perform combined stress scenarios and a reverse stress test; include stress testing on liquidity as well as other major risk factors.
For insurers who have done ERM and economic capital modeling for some time without significant outside scrutiny, the heightened ORSA documentation requirements may come as a shock.
6. Explain any use of economic capital models. If you’re using an economic capital model (ECM), provide an overview of how it works, how it was validated and how its results are used in the business. If multiple capital models are used, compare the various results and explain how a final selection is made. Explain how the ECM is related to or reconciled with stress tests.
7. Describe the treatment of diversification effects. What dependencies have you assumed among the different risk drivers? How were these selected, and what validation or sensitivity testing has been done? If economic capital is allocated to sub-units (for example, operating entities or lines of business), how is this done, and is any benefit of diversification also allocated or simply held centrally?
8. Compare the most recent results to previous ones. If your methods have changed over time, be prepared to explain the change, its rationale and its effects. Benchmark results using the most recent data against prior analyses and be prepared to explain the differences.
9. Discuss emerging risks and other difficult-to-quantify factors. By their very nature, emerging risks are difficult to identify and quantify, but the regulators expect companies to have thought about this issue. Similarly, operational risk can be quite difficult to quantify, but it should not be ignored. As part of your ERM program, your company should be assessing these and other issues that may or may not factor directly into solvency calculations. A clear explanation of your company’s approach will help assure the regulator that such issues are being addressed appropriately.
10. Explain management actions if needed to support solvency in some scenarios. The ORSA allows the forward-looking solvency test to be supported by changes in plans under extreme duress. Those changes or management actions may be things like changes to business levels, reinsurance programs, product offerings, prices, capital raising or other actions that would be seen as major business decisions.
In summary, this will be a challenging process, but it will prove worthwhile. In fact, it would be sensible for even those companies below the regulatory threshold for the mandatory ORSA to voluntarily perform a similar (albeit less formal) process. A company that has its own view of risk and solvency is in a much better position to make strategic decisions and plan for a profitable future.
Alice Underwood, FCAS, CERA, is executive vice president for Willis Re Inc. in New York City, and she serves as the CAS vice president-research and development. David Ingram, FSA, CERA, FRM, PRM, is executive vice president for Willis Re Inc. in New York, and he chairs the Enterprise & Financial Risks Committee for the International Actuarial Association.
