Making ORSA work

On the face of it, the Office of the Superintendent of Financial Institutions’ (OSFI) E-19 Own Risk Self-Assessment (ORSA) Guideline, introduced in January 2014, may appear to be straightforward. The guideline sets out principles that insurers do the following:

• self-assess risk;

• determine own capital needs and establish internal targets as part of their ORSA;

• capture and articulate the internal capital target and ORSA processes in an annual report; and

• not just manage and mitigate risk, but govern it.

As much as this sounds straightforward in principle, in practice it can get very complex. How can an organization’s Board of Directors, which is ultimately responsible for the ORSA, be reassured that the ORSA is representative of the insurer’s risks? And how can senior management be reassured that its assessment of the risks and associated capital requirements is appropriate?

Fortunately, the E-19 guideline builds in a key factor to achieving success – the objective review. Consider, for example, what the objective review involves.

THE LONG AND THE SHORT

Objective reviews examine ORSA practices across the organization – everything from compliance with the E-19 guideline’s stated principles to whether or not practices are fit-for-purpose to the size and complexities of a given organization and its business – all within the context of board-approved risk appetite and the organization’s strategic and operational business plans.

As such, the reviews provide independent assurance over the current state of an insurer’s ORSA practices and assist the board with its governance responsibilities. These responsibilities include completing the OSFI-required review and challenging both the appropriateness of the insurer’s ORSA practices and the level of internal capital targets determined by the insurer.

Objective reviews, in other words, validate insurers’ current ORSA practices and identify those aspects that require further development, enhancement and maturation. As such, objective reviews are critical to the long-term effectiveness and evolution of all ORSA activities.

Just as internal controls within an organization are to be assessed in terms of their design, implementation and operating effectiveness, an insurer’s ORSA practices also are to be reviewed on a regular basis. The E-19 guideline is very clear on this.

The scope of the reviews will vary, however, depending on a range of factors, such as how confident the organization is in its current practices, the actual areas of interest and/or concern being reviewed, whether the board requires assurances independent of management, and how well the organization understands ORSA’s complexities, including internal capital target determinations, capital modelling and operational risk.

Ultimately, the lower the level of ORSA technical understanding, the greater the necessary scope of the objective review.

But it is not solely the board that will benefit. Objective reviews also provide various other stakeholders with a range of assurances. These include that the insurer is, in fact, applying the ORSA principles contained within the E-19 guideline and that an insurer’s ORSA practices are not only appropriate for the size and complexity of the business, but are also forward-looking, dynamic and linked to strategy.

Further, such reviews are designed to ensure that ORSA practices, roles and responsibilities across the organization can be evidenced by the objective reviewer, and that opportunities to enhance or evolve those practices are identified – complete with plans and timeframes.

The E-19 guideline is also very clear, if not necessarily exhaustive, on the relevant areas that should be reviewed. Highlights include the following:

• processes for identification of risks, large exposures, risk concentrations, dependencies and interactions;

• appropriateness of the methodologies, distributions and measures, and accuracy and completeness of financial and quantitative data inputs;

• reasonableness and validity of the ORSA results, including embedded assumptions and inputs from stress tests, scenarios, models and other methodologies and tools used in the assessment process;

• appropriateness of the documentation that supports the ORSA and the contents of the ORSA report to the board;

• effectiveness of the information systems that support the ORSA; and

• consistency and linkages of the ORSA process and results with the risk management, strategic, business and capital-planning processes.

It is important to note that the E-19 guideline requires organizations to review such matters on a regular basis, with specifically objective reviews being conducted more periodically.

In terms of who should conduct the objective review, it may be done by “an internal or external auditor, by a skilled and experienced internal or external resource or by a skilled and experienced individual, who reports directly to, or is a member of, the board.” Regardless of who carries out the review, it is important for its integrity that the reviewer has not been actively involved in developing or building the part of the ORSA being reviewed.

BABY STEPS

A full year after ORSA’s implementation, the objective review remains an activity that most insurers have not yet undertaken. A Deloitte survey of 24 property and casualty insurers and 17 life insurers, conducted in late 2014, showed that only 28% of the former and 37% of the latter had had objective reviews completed that first year. Of the remaining respondents, 15% of p&c insurers and 5% of life insurers indicated that reviews would be conducted in the fourth quarter of 2014. It is also true that 38% of p&c insurers and 50% of life insurers taking part in the survey had either not yet determined when an objective review of their ORSA practices would be conducted or had not yet planned to do so.

None of this should be surprising; it had only been a year. But given this fact and that much of the industry has not yet attained maturity of ORSA practice, it is likely safe to predict that enhancement and refinement plans to progress insurers’ ORSA practices will continue to be a priority going forward.

Because completing their first year or two under ORSA is only the beginning of Canadian insurers’ journeys, irrespective of whether they have planned for an objective review, insurers’ 2015 outlook and plans should include validation activities to assess the reasonableness of risk assessments conducted as part of their 2014 ORSA cycle. These activities, moreover, should include back-testing exercises to assess the reasonability of modelled scenarios/events and to ensure the internal capital targets included in the ORSA report reconcile to the capital levels included in the Key Metrics Report.

Beyond 2015, the industry should be reflecting on, and challenging the quality of, not only their ORSA practices and reports, but also the extent to which ORSA is embedded in business-as-usual operations. This, after all, is about taking something that is very risk- and actuarial-driven and incorporating it into decision-making across the organization.

IN A NUTSHELL

Objective reviews seek to ensure that the ORSA processes, per the E-19 guideline, have “integrity, accuracy and reasonableness.” In those terms, boards are expected to “satisfy” themselves that their systems of internal controls are adequate for “well-ordered and prudent conduct of business.”

The ultimate value of the objective review, then, is that it removes much of the guesswork and uncertainty from the equation for all concerned. After all, it remains insufficient simply to trust that activities occur within an organization; they need to be verified and demonstrated.