Own Risk and Solvency Assessment (ORSA) Unlocking Business Value through ORSA Implementation

Own Risk and Solvency Assessment (ORSA) Unlocking Business Value through ORSA Implementation

1 Risk Management ORSA

In a highly challenging economic environment accompanied by increasing regulatory pressure, implementation plans among European insurers are now focused on one of the key measures within Solvency II: Own Risk and Solvency Assessment or ORSA. Many insurers, however, find it hard to design an operational approach for ORSA, often considered as primarily a regulatory requirement. If implemented correctly, ORSA may help insurers to extract additional value from their compliance investments. Risk as a key to value creation Most insurers are well under way in their Solvency II implementation programs. Few, however, have begun to grasp the upper-level consequences of these programs. They have mainly focused on the technical and organizational aspects of risk management. Today, many companies have just begun to implement their ORSA projects, or are still considering how to do so. The challenge of implementing ORSA confronts insurers as they deal with a difficult environment marked by lower premiums, numerous natural disasters and catastrophic events, and the sovereign debt crisis in Europe. In addition, regulatory requirements pertaining to ORSA are (and will remain) based on a few, high-level principles that provide no explicit guidelines for implementation. We expect ORSA to become an integrated management tool, requiring companies to adapt ORSA principles within their organizations. Since ORSA can provide boards of directors and senior management with relevant information about prospective risks, operational specifications for the ORSA process should derive primarily from the C-suite. This information can also be integrated into existing monitoring practices, so the workstream should also focus on adjusting operational practices to reflect insight delivered through ORSA. New regulations and a challenging environment affect companies ability to create sustainable value from their risk-taking activities. Companies should be asking themselves whether the levels and types of risk they take are appropriate and whether taking these risks helps them pursue their strategic objectives. They should also determine to what extent they are able to identify, assess and monitor a wide range of risk exposures especially in comparison to their competitors. Our experience gained in helping leading insurers design and implement their Solvency II projects leads us to believe that ORSA is more than a regulatory issue. If used properly, ORSA may become a source of competitive advantage in the post-solvency II world, as performance and profitability criteria evolve. We have identified some of the main ORSA-related challenges confronting insurers, including: Compliance challenges These include understanding and adapting principle-based regulatory requirements to design an ORSA target operating model, implementing the related processes and solutions that will bring ORSA to life. Business opportunities In addition to meeting regulatory requirements, companies will be developing or adapting integrated risk-adjusted performance management capabilities. Risk Management ORSA 2

ORSA Requirements The scope of ORSA is mainly defined by article 45 of the Solvency II directive. 1 The broad specifications contained in this article are discussed in greater detail in a dedicated consultation paper. We summarize below the main ORSA requirements from the perspective of upcoming Level 3 implementation measures. Under ORSA, companies will set up specific processes and procedures to monitor their own solvency needs. As for Pillar 2 requirements, companies need to adapt an interpretation of ORSA principles that fits the scale, nature and complexity of their activity in a word, their risk profile. The regulations insist that each firm will design and document its specific business case, and demonstrate its ability to use ORSA insight in its decision processes. As seen in Figure 1, each legal entity of the supervision scope is subject to ORSA requirements, but groups may issue a single ORSA under pre-approval from their group supervisor. Figure 1 Summary of ORSA requirements (consultation paper) 1. Documentation ORSA policy Records of ORSA process Internal ORSA report ORSA supervisory report Justification of ORSA runtime frequency 4. Proportionality Firm-specific, tailored to structure Proportional to risk profile (nature, exposure, complexity) 5. Valuation basis Quantitative valuation mandatory Not necessarily sophisticated Reconciliation of various valuation basis 2. Strategic tool Forward-looking tool Projection of capital and solvency over the strategic horizon Covers each year of the period separately Fully integrated 6. Continuous compliance To Solvency II regulatory requirements Facilitates own funds management (e.g., loss-absorbing capacity) 3. Board duties Approve ORSA policy Challenge ORSA results Challenge SCR in the light of ORSA results Sign-off ORSA report Approve long & short term capital planning 7. Group issues ORSA scope = group supervision Solvency drivers and specific risks Single group ORSA subject to pre-approval by regulator Source: EIOPA, Consultation Paper On the Proposal for Guidelines on Own Risk and Solvency Assessment, Nov. 7, 2011. Accessed on May 21, 2012 at: https://eiopa.europa.eu/fileadmin/tx_dam/ files/consultations/consultationpapers/cp08-11/cp8_sii_guidelines_orsa.pdf 1. Official Journal of the European Union, Directive 2009/138/EC of The European Parliament and of the Council of 25 November 2009, on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (recast) (Text with EEA relevance). Accessed on May 5, 2012: http://eur-lex.europa.eu/ LexUriServ/LexUriServ.do?uri=OJ:L:2009:335:0001:0155:EN:PDF 3 Risk Management ORSA

In practice, envisioning the expected outcomes of an ORSA process is a key part of organizing the project. Fundamentally, ORSA is intended to create a demonstrable interaction around risk management between the company s technical and managerial levels. Depending upon the company s risk management framework, it may have to elaborate and report decisionoriented information about prospective risk and capital levels. A target process will generally be structured around a few successive steps as shown in Figure 2: Figure 2 Overview of ORSA process steps Elaborate Risk identification Risk measurement ORSA calculation A final ORSA outcome will include two sets of deliverables: 1. A comprehensive assessment of the company s risk profile Risks within ORSA need not be limited to Solvency Capital Requirement (SCR) risk modules. The standard formula assumptions rarely reflect the actual risks or time horizon that are specific to the company. ORSA is designed to encompass any significant risk the company is exposed to, and to provide a relevant assessment of such risk. Based on this risk profile, ORSA will then provide prospective levels What are the major risks during the strategic period? Which risks are covered by own funds / management actions? How do we measure these risks? How robust are our risk assessment processes? What are the projected scenarios / stressed conditions? What are the impacts on the company s solvency and risk profile? of risk and capital ( ORSA capital ) over the strategic planning timeline. The calculation should account for strategic assumptions as well as potential economic scenarios (most likely as determined through stress tests). The company demonstrates that it can afford its strategic plan, and still retain options under adverse circumstances. 2. Action plans to maintain adequate levels of solvency under these circumstances. If deemed necessary these plans may include: raising new capital, transferring or hedging risk (e.g., through reinsurance), reducing specific risk exposures or even exiting certain product lines. The company documents its proactive capabilities to anticipate risks. As is the case for any regulatory project, maintaining supporting documentation is compulsory. For an ORSA project, this documentation will include, at a minimum: An ORSA policy, validated by the management or supervisory body; A target ORSA process and associated governance, supported by adequate operational documentation; Impact analysis What are the key assumptions for calculating ORSA capital? Are key assumptions consistent with those used for the SCR calculation? Technical specifications for calculating the ORSA capital; and Templates and guidelines to formalize ORSA deliverables such as an internal ORSA report, Regular Supervisory Report (RSR) and other elements. Formalization ORSA reports Use Sign-off Sign-off by management or supervisory body Utilization Proof of concrete use of ORSA insights in the decision processes (e.g., capital management action plans) Source: EIOPA, Consultation Paper On the Proposal for Guidelines on Own Risk and Solvency Assessment, Nov. 7, 2011. Accessed on May 21, 2012 at: https://eiopa.europa.eu/fileadmin/tx_dam/ files/consultations/consultationpapers/cp08-11/cp8_sii_guidelines_orsa.pdf Risk Management ORSA 4

Creating an operating model for ORSA Our experience indicates that teams working on ORSA projects face many of the same operational challenges. A few best practices can help companies structure their approach to ORSA. Figure 3 ORSA framework components Ongoing monitoring Strategic planning Start with the ORSA target framework The main difficulty organizations encounter is in adopting a relevant, cost-effective approach to designing an ORSA framework. It is particularly difficult to decide which of the framework s components should be worked out and what should be designed first. Companies should consider what the overall process will look like; who should be responsible for what; and how they will calculate ORSA capital. Information & reporting Do we receive adequate reporting? Action plans Does the process actually work? What are our strategic objectives? Are our risk management processes and controls adequate? Are our risk management processes and controls adequate? How do we manage our capital base? Can we afford our strategy (solvency risks)? ORSA capital Risk & capital management Source: Accenture 5 Risk Management ORSA

We believe that it is necessary to develop a comprehensive understanding of the key internal constraints, requirements and expectations prior to calibrating the operational aspects. Companies should therefore consider starting their ORSA projects by reaching a common definition of the main components within an ORSA framework. Defining ORSA key concepts and agreeing on key options will set the stage for later operational developments. This framework is useful in structuring the approach with all relevant stakeholders, usually at the group level. The C-suite s input is a preliminary requirement for ORSA specifications. A group should define its ambition level and set requirements from a top-down perspective. This input will then be reconciled with group functions or local entities specifics from a bottom-up perspective, e.g., when determining the necessary granularity of requirements for local entities. Since companies should demonstrate to the regulator that ORSA is actually a decision tool, it is key to obtain proper mobilization from the C-suite during the various stages of the project. ORSA will become a key element within the performance management framework. It is therefore best to design it with people familiar with the existing decision tools, as this will foster its use as a decision process. Leverage existing devices and regroup workstreams Ideally, ORSA should be integrated within the company s existing risk management and reporting capabilities. Thus its design and implementation should be based on a thorough understanding of current frameworks. Firms often do not have a clear, comprehensive view of their different reporting and monitoring frameworks for accounting, planning and budgeting, scorecards, economic capital and other key functions. Undertaking a comprehensive inventory of what is already in place and how it is used is an important first step. This helps identify potential sources for ORSA capital calculation and allows for a mapping of data sources to be used as an input in the upcoming target processes. The inventory also allows project teams to gain a better understanding of what ORSA can and cannot do, and to what extent it can provide additional value within existing practices. Companies may also realize that there is extensive convergence and overlap between ORSA and Pillar 3 reporting issues. In addition, based on draft implementing measures, ORSA will be part of the RSR. 2 Performing an inventory of existing data sources is also a key requirement for Pillar 3 projects. It is therefore useful to regroup ORSA and Pillar 3 inventories to take advantage of overlap and eliminate duplication. ORSA will create an additional layer of reporting, along with Pillar 3. This creates the need to develop an industrial capability to reconcile the various reporting frameworks including statutory accounts, International Financial Reporting Standards (IFRS), Solvency II, Market Consistent Embedded Value (MCEV) among others. Keep calculations simple Operational teams face a heavy workload due to Solvency II constraints. Regulators insist that ORSA is not a new capital requirement 3 and does not necessarily require a complex approach 4. Many companies thus choose a progressive approach, first developing an ORSA v1.0 based solely on existing data, tools and organization. Within this approach, they fully reuse existing regulatory (SCR) or economic capital (EC) calculations. Usually, they do not develop additional calculation capabilities for ORSA in this first stage. Instead, they project the economic balance sheet and capital requirements (SCR or EC) over the strategic timeline, and analyze the impact of business plan assumptions (such as new product targets or market share assumptions) under a number of potential economic scenarios. The key issue then is to reach a common calibration of these scenarios, and bring insights to the C-suite regarding the potential impacts and sensitivity areas of the strategic plan under each plausible scenario. This choice yields a number of benefits: It is easy to understand. The C-suite can easily understand solvency projections developed by a tool they already review for regulatory purposes. They will feel reassured by the absence of a reconciliation process. ORSA is then more likely to become a trustworthy tool for strategy setting, positively contributing to use-test requirements. It does not require additional calculation capabilities. Reusing existing capabilities allows for an optimized ORSA runtime calculation. It may also allow companies to provide ad-hoc ORSA re-runs within a reasonable timeframe. It mitigates model risk. Models are by their nature flawed because they use proxies or estimates, and do not encompass all risks. By choosing to focus more on qualitative inputs than on additional calculation layers, companies demonstrate that they do not rely too much on a complex model, for back in the real world, model results are used to inform operational and strategic decisions. 2. EIOPA, Consultation Paper On the Proposal for Guidelines on Own Risk and Solvency Assessment, Nov. 7, 2011. Accessed on May 21, 2012 at: https://eiopa. europa.eu/fileadmin/tx_dam/files/consultations/consultationpapers/cp08-11/cp8_sii_guidelines_orsa.pdf 3. The European Parliament, Directive Of The European Parliament And Of The Council On The Taking-up And Pursuit Of The Business Of Insurance and Reinsurance (SOLVENCY II) (RECAST), November 25, 2009, Rev. 6, Chapter IV, Section 2, article 45, pages 161 163 4. Consultation Paper On the Proposal for Guidelines on Own Risk and Solvency Assessment, 3.7. European Insurance and Occupational Pensions Authority, November 7, 2011. Accessed on May 5, 2012: https://eiopa.europa.eu/fileadmin/tx_dam/files/consultations/consultationpapers/cp08-11/cp8_sii_guidelines_ ORSA.pdf Risk Management ORSA 6

Develop risk-adjusted performance management Market analysts expect that Solvency II will trigger a substantial evolution in the insurance business. ORSA will actually foster a closer integration between risk and performance management. It will thus push insurers along the riskadjusted performance maturity curve as seen in Figure 4. Figure 4 Risk-adjusted performance maturity curve Improved strategic planning Leading practices Value-added capabilities Improved business management Improved performance measurement Business benefit driven capabilities Regulatory mandated Better data quality Improved risk measurement Focus on compliance only Source: Accenture Low Business value of capability High 7 Risk Management ORSA

Implementing ORSA processes may lead insurers to update their existing performance monitoring practices: At a strategic level, by refining risk strategy and risk appetite. Insurers will probably use additional ORSA indicators and targets in their strategic framework, for example, to set a minimum target for SCR coverage. At a business monitoring level, by allocating risk-adjusted capital to the different business units or portfolios. Capital has become a scarce resource, and must be used efficiently. Allocating and following risk-adjusted capital through risk budgets allows the company to assess to what extent a business is actually both profitable and capital-intensive, allowing them to allocate risk-adjusted capital to a specific business unit with an expected target return. At an operational level, by refining day-to-day processes with a risk perspective. Many key, risk-intensive processes will be reviewed with ORSA insight; for example, the company may require a formal review by Risk Management for any new product; Risk Management may also become a permanent member of the company s New Product Committee. The operational consequences of ORSA will be far-reaching. We expect that they will provide impetus for insurers to systematically design and use risk-adjusted performance management criteria. Designing a risk-adjusted performance framework is supported by the development of a specific dashboard, and structured as follows: Identify expected key performance indicators (KPIs) Risk-adjusted performance measurement aims at aligning shareholder value creation and strategy definition and execution. With this in mind, the project identifies the different dimensions that the company wants to influence, including products, underwriting, and client management. These dimensions are then translated into measurable KPIs such as staff compensation and product pricing at all organizational levels, preferably through a top-down approach. Map with organizational constraints The dashboard construction process is based on three complementary workstreams: First, identification and definition of the segmentation requirements such as product types, business unit levels, and client segments; second, formalization of an organizational view of information requirements, that is, who needs which information, for what purposes, and when; and third, formalization of specifications for producing this information, including calculation processes, integration into existing IT and reporting workflows, and validation processes. Monitor group-wide implementation Companies usually perform a test run on a pilot scope to understand and mitigate the operational constraints arising from implementation. Based on this experience, they adapt and refine their implementation approach. The new framework is then rolled-out across all group entities, through a dedicated project management structure. Risk Management ORSA 8

9 Risk Management ORSA

A comprehensive interpretation of ORSA requirements potentially yields significant business benefits. Thus companies should consider their ORSA implementation project beyond a compliance perspective. Adopting an overarching perspective may also help to secure substantial competitive advantages in the post- Solvency II landscape. Conclusion ORSA can foster efficient capital management and allocation processes, by weighing risks and profitability of the group s businesses or product portfolios and understanding the risks inherent to the strategic plan. It can also enhance decision-making processes by developing closer integration between risk and performance management at all levels. ORSA also improves the company s operational management, by increasing risk awareness and monitoring within key business processes such as product design and asset management. Figure 5 Integrating risk, capital and value contribution in decision making Efficient use of risk Managing the value contribution of the inherent value drivers Value Integrated performance management High return on capital We believe that ORSA will become a major lever for insurance companies in their ongoing efforts to develop an integrated approach to managing value, risk and capital in the course of reaching their strategic objectives. ORSA can also provide them with a toolkit to define and sustain the balance among these three fundamental value creation components. Risk Quantifying and managing the economic risks embedded in business Source: Accenture Securing solvency Capital Managing the economic capital and funding future growth Companies that adopt this perspective from the inception of their ORSA projects are more likely to succeed within the changing business environment and to extract value from their compliance investments. Risk Management ORSA 10

About the Authors Eva Dewor Eva Dewor is an executive director, responsible for Risk Management in Germany, Europe, Africa and Latin America, Insurance area. Based in Munich and with over 16 years of consulting experience, Eva Dewor specializes in helping organizations enhance their risk management capabilities through its integration in decision making, steering and reporting. Working with risk executives of multinationals from across financial services industries, Eva helps them become high-performance businesses. Eric Jeanne Eric is an executive director Risk Management, based in Paris. Specialized in Risk Management and Finance for the Insurance Industry, and with a focus on Enterprise Risk Management framework, Solvency II and Risk & Finance architecture, Eric has been with Accenture for more than 15 years. Leading large transformation projects at major insurance and reinsurance companies, Eric helps clients transform their risk capabilities and Finance processes. Sébastien de la Lande Sébastien is a senior manager Risk Management, based in Paris. Specialized in operational frameworks for riskoriented functions (Risk Management, Internal Control & Compliance, Internal Audit), Sébastien works with insurance companies to help them define, implement and monitor their Solvency II programs, and provides in-depth expertise in Pillar 2 related assignments. About Accenture Management Consulting Accenture is a leading provider of management consulting services worldwide. Drawing on the extensive experience of its 16,000 management consultants globally, Accenture Management Consulting works with companies and governments to achieve high performance by combining broad and deep industry knowledge with functional capabilities to provide services in Strategy, Analytics, Customer Relationship Management, Finance & Enterprise Performance, Operations, Risk Management, Sustainability, and Talent and Organization. About Accenture Risk Management Accenture Risk Management consulting services work with clients to create and implement integrated risk management capabilities designed to gain higher economic returns, improve shareholder value and increase stakeholder confidence. About Accenture Accenture is a global management consulting, technology services and outsourcing company, with approximately 259,000 people serving clients in more than 120 countries. Combining unparalleled experience, comprehensive capabilities across all industries and business functions, and extensive research on the world s most successful companies, Accenture collaborates with clients to help them become highperformance businesses and governments. The company generated net revenues of US$27.9 billion for the fiscal year ended Aug. 31, 2012. Its home page is www.accenture.com. Disclaimer This document is intended for general informational purposes only and does not take into account the reader s specific circumstances, and may not reflect the most current developments. Accenture disclaims, to the fullest extent permitted by applicable law, any and all liability for the accuracy and completeness of the information in this document and for any acts or omissions made based on such information. Accenture does not provide legal, regulatory, audit, or tax advice. Readers are responsible for obtaining such advice from their own legal counsel or other licensed professional. Copyright 2013 Accenture All rights reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. 13-0074 / 11-5806