Summary Solvency II codifies four key functions — risk management, actuarial, compliance and internal audit — with explicit governance expectations. The risk function's role is broader than the SCR calculation; it is the framework, appetite, ORSA and challenge engine of the insurer. This article sets out how the risk function should operate within Solvency II governance.
The four key functions Each key function has direct access to the board and reports on defined matters. Their remits are distinct but interact: the actuarial function opines on reserving and underwriting; the risk function owns the framework, appetite and ORSA; compliance owns regulatory adherence; internal audit provides independent assurance. Overlap between risk and actuarial functions is common; clarity of ownership is a governance responsibility.
Risk function core outputs The risk function's principal outputs are the risk management system documentation, the risk appetite, the ORSA report, the key risk MI, and the second-line challenge on material risk decisions (product launches, reinsurance changes, investment strategy, model changes).
Model governance Internal models require pre-approval, ongoing validation, model change governance and use test evidence. Standard formula users still require model governance for internal capital, reserving and pricing models. Model risk governance is a core deliverable of the risk function in either case.
Supervisory dialogue Solvency II is characterised by ongoing supervisory dialogue rather than periodic examination. The risk function is often the primary interface for prudential matters. A prepared, honest and consistent dialogue is a strategic asset; drift or defensiveness is a liability.
CRO and board implications Boards should test whether the four key functions have real independence, real access, and real challenge weight. Where any function reports only through executive management, that is a structural issue to address.
Practical implementation Documented remits and interaction protocols for the four functions; risk function work plan tied to strategy and ORSA; model governance framework covering pre-approval, validation and change; supervisory relationship strategy with defined ownership.
Limitations This article does not summarise Solvency II requirements or their national transpositions. Institution-specific application should be confirmed with qualified counsel.
Related reading See [Insurance Risk & Solvency](/expertise/insurance-risk), [Model Risk](/expertise/model-risk), [Regulatory Compliance](/expertise/regulatory-compliance) and [Corporate Governance](/expertise/corporate-governance).
Frequently asked questions
What should risk leaders know about the four key functions?
Each key function has direct access to the board and reports on defined matters. Their remits are distinct but interact: the actuarial function opines on reserving and underwriting; the risk function owns the framework, appetite and ORSA; compliance owns regulatory adherence; internal audit provides independent assurance. Overlap between risk and actuarial functions is common; clarity of ownership is a governance responsibility.
What should risk leaders know about risk function core outputs?
The risk function's principal outputs are the risk management system documentation, the risk appetite, the ORSA report, the key risk MI, and the second-line challenge on material risk decisions (product launches, reinsurance changes, investment strategy, model changes).
What should risk leaders know about model governance?
Internal models require pre-approval, ongoing validation, model change governance and use test evidence. Standard formula users still require model governance for internal capital, reserving and pricing models. Model risk governance is a core deliverable of the risk function in either case.
What should risk leaders know about supervisory dialogue?
Solvency II is characterised by ongoing supervisory dialogue rather than periodic examination. The risk function is often the primary interface for prudential matters. A prepared, honest and consistent dialogue is a strategic asset; drift or defensiveness is a liability.
What should risk leaders know about cRO and board implications?
Boards should test whether the four key functions have real independence, real access, and real challenge weight. Where any function reports only through executive management, that is a structural issue to address.