Summary The Own Risk and Solvency Assessment (ORSA) is the insurance analogue of ICAAP: an insurer's own, forward-looking view of the capital it needs to support its strategy. Like ICAAP, its value is destroyed when it becomes an annual document rather than a live decision tool. This article sets out how to run an ORSA that boards genuinely use.
What the ORSA should do The ORSA links strategy, risk profile, capital and stress into a single narrative. It should tell the board: this is our strategy; these are the risks it embeds; this is how much capital it requires under expected conditions and under stress; this is how sensitive the answer is to key assumptions; and these are the actions we would take at defined trigger points.
Governance Ownership sits with the board. The CRO owns the process, the actuarial function owns much of the technical work, and executive management owns the strategic assumptions. Independent review — internal or external — is essential for credibility, particularly around methodology and scenario design.
Scenarios and stress Scenarios should be plausible, severe and consistent. They should stress the specific vulnerabilities of the insurer's business model — long-tail liabilities, catastrophe exposure, credit spread sensitivity, mortality or morbidity shifts — rather than a generic macro shock.
Use test Supervisors expect evidence that the ORSA informs decisions. Committee minutes referencing ORSA outputs, capital planning tied to ORSA projections, and appetite recalibration flowing from ORSA findings are the practical evidence.
CRO and board implications The board should be able to explain, in plain language, what the ORSA tells them about strategy and capital. If the answer requires reading the appendices, the ORSA has not been designed for its audience.
Practical implementation Multi-year ORSA roadmap; scenario design workshops with executive management; independent review of methodology and material assumptions; use-test register linking ORSA outputs to decisions; board sessions dedicated to ORSA challenge rather than briefing.
Limitations Insurance capital needs depend on assumptions about long-term liabilities and rare events. The ORSA formalises uncertainty; it does not remove it. Legal and regulatory interpretations should be confirmed with qualified counsel.
Related reading See [Insurance Risk & Solvency](/expertise/insurance-risk), [Enterprise Risk](/expertise/enterprise-risk) and [Corporate Governance](/expertise/corporate-governance).
Frequently asked questions
What the ORSA should do?
The ORSA links strategy, risk profile, capital and stress into a single narrative. It should tell the board: this is our strategy; these are the risks it embeds; this is how much capital it requires under expected conditions and under stress; this is how sensitive the answer is to key assumptions; and these are the actions we would take at defined trigger points.
What should risk leaders know about governance?
Ownership sits with the board. The CRO owns the process, the actuarial function owns much of the technical work, and executive management owns the strategic assumptions. Independent review — internal or external — is essential for credibility, particularly around methodology and scenario design.
What should risk leaders know about scenarios and stress?
Scenarios should be plausible, severe and consistent. They should stress the specific vulnerabilities of the insurer's business model — long-tail liabilities, catastrophe exposure, credit spread sensitivity, mortality or morbidity shifts — rather than a generic macro shock.
What should risk leaders know about use test?
Supervisors expect evidence that the ORSA informs decisions. Committee minutes referencing ORSA outputs, capital planning tied to ORSA projections, and appetite recalibration flowing from ORSA findings are the practical evidence.
What should risk leaders know about cRO and board implications?
The board should be able to explain, in plain language, what the ORSA tells them about strategy and capital. If the answer requires reading the appendices, the ORSA has not been designed for its audience.