The board of directors are elected by the owners of a company to act on their behalf; and while taking care of their interests they are also bound by regulation aiming at policyholder protection. There are a number of different board decisions to be made, ranging from recruiting the executive team to setting the business strategy, from choosing a distributional channel to the branding of the company, from mandating the executives to challenging them.

The board work in its totality consists of a diversified portfolio of topics of which only a few are regulated. But there is indeed one area that receives high attention from both regulators and supervisors, and that is the area of risk appetite and risk management. From their perspective there is especially one question that needs to be addressed, and that is: How do you know that you can afford what you plan?

The missing link
In some elementary text books on insurance the pooling of risks in an insurance company is like setting up a betting game. But insurance is not about gambling, but rather about taking on risks in a controlled manner. Nevertheless the balance sheet is highly geared, and to protect policyholders regulators require capital. Capital to meet the bumps on the way stemming from heterogeneity in insurance risks, gains and losses in the investment arm, operational failures and so on.

Regardless of the business model chosen for an insurance company, it is pivotal to know and manage risks or potential risks. Asking executives or board of directors what is a prerequisite of running a successful insurance company, the answer will be: managing risks. Knowing your risks is not some optional business opportunity – it’s like an axiom for financial institutions. So how come politicians are now starting to regulate this area, and calling for a higher sense of capital responsibility at board level?

The financial crisis has exposed a gap that needs to be closed – and the solution has already been embedded in the Solvency II framework. This is the ORSA.

The ORSA, or Own Risk and Solvency Assessment, is a new feature in the Solvency II framework. Usually financial regulation is aimed at tasks or behaviour implemented in a bottom-up manner. In the Solvency II directive, the ORSA process is the only part that has a top-down viewing angle.

This is crucial for the thinking of the ORSA. The assessment is owned by the board and can only be carried out from the board of directors level. We are back to the question of managing risks. From a regulator’s perspective the board of directors receives the responsibility of capital from the owners, i.e. that the company will not take on more risks on the balance sheet than can be met with either capital or management intervention. And since taking on risks has a prospective orientation, sound risk management will imply that you are aware of what risks you are taking and will be prepared to navigate them.

Regulators have set the bar lower by specifying a risk-based capital regime in Solvency II with a 12 month horizon. More precisely, the board of directors has to ensure that the company can only become insolvent if a ‘one in 200 years’ event occurs. Unfortunately, it is the supervisors’ experience that the majority of boards consider capital regulation a simple compliance exercise. It is not the case that boards of directors do not understand that capital is needed; but often the linkage between the chosen business model, the risk appetite, the organisation and then the capital needed is not present.

Another observation is that it is often the case that boards cannot articulate the risk that the company is facing – the basis for proper management of risks. And without the ability to articulate risks the understanding, awareness and communication of risks with the executive team is then lost. It could then be guessed how comfortable the individual member of a board might be when signing off his or her responsibility of capital for the particular company.

The ORSA process step-by-step
With the introduction of the ORSA process in Solvency II, boards are required to identify risks that the company may be facing over the business planning period. It is about merging business strategy with capital management – and therefore the time horizon is more likely to be three or five years ahead, rather the regulatory 12 months. There is no expectation that the board will engage in detailed discussions on technical matters; nor must they be more involved in the daily operation of the company.

In essence the board members need to ask relatively simple questions to the executive team and request answers presented in a way that they, with their respective backgrounds, will be able to understand and willing to exercise their capital responsibility upon. The way that the executive team responds to the requests of the board is by use of the whole organisation. Hence the process is not an examination of the executive team, but rather a joint process of reaching a common understanding of how to run the company.

A very important aspect of the outcome of the ORSA is that the process is an assessment of overall solvency needs, and that where this number is higher than the required regulatory capital it does not in itself imply that the company needs to hold capital above that level.

Boards are free to choose their own way to conduct the ORSA process, but are expected to at least cover the following eight steps. These steps are already being taken in well managed companies today, and hence inspire good practice in this field.

Step one in the process will be initiated by the board asking, “What are the risks that this company might face during the strategic planning period (e.g. three to five years)?” Delivering a full risk picture back, presented in a way that the individual board members comprehend, will qualify a discussion of the common risk picture. This first step should not be interpreted as the probability-severity risk matrix currently exercised in the sector. The implementation of this matrix is often through a discussion of potential future scenarios rather than through a more profound understanding of the risks underlying the company.

Step two will be deciding on which risks should be met by capital and which should be mitigated by management actions only. Often risks can and should be met by capital but for some risks – like the reputational risk of the company – the mitigation is likely to be by other means, in this case by implementing a general code of conduct among employees.

In step three the organisation will quantify the risks to be met with capital, and develop suitable mitigating actions for other risks.

In step four the board asks, “How robust is the assessment of risks? What is the quality of key processes involved (e.g. claims handling)?” and will be presented with results from sensitivity analyses. At this point the board will have the basis for an initial overall assessment of the risks and be ready to stress that assessment.
Step five will be company specific stresses, i.e. “What are possible future scenarios that we will have to navigate, and what is the likely impact?” Here the competitive landscape is just one of the topics to be discussed.

Step six covers stress scenarios that affect the whole sector, which are often due to changes in legislation, high court decisions, structural changes in insurance risks, or changes in the financial markets not captured in the calculation of required regulatory capital.

In step seven the assumption of going concern is revisited, requiring a discussion of what the important aspects of remaining in going concern are. The importance of this discussion is illustrated below.

Finally, step eight is the digestion phase, considering if there is anything that has been learned about the risk profile that impacts on the assessment of regulatory capital.

As should be clear from this walkthrough, the thinking of the ORSA process is that simple questions should go from the board of directors to the executive team, and they should be answered in an appropriate and understandable way – not necessarily requiring a background in economics or the skills of an actuary.

Furthermore, is it not about transferring a huge pile of papers upwards in the system, obscuring the full picture with highly technical detail. It is about achieving a clear communication using a common language on risks, and ensuring that there exists an informed basis for proper decisions at board level.

The going concern discussion
The importance of understanding the basis for going concern can be illustrated from what happened for some insurers in the Nordic European region in 2010. Before entering 2010 the top performing general insurers were running their businesses with a combined ratio (CR) in the range of 88 to 92. That is, for every €100 of premium, claims costs and expenses were amounting to between €88 and €92. With a fully fledged business this would allow them to fund their risk based capital through the remaining €8-12 per €100 premium.

There was then a tough winter with an excess of snow claims, followed by a very wet spring with flooding. Suddenly these prior top performers were now running at CR close to 100 or above, and hence were not able to fund their capital. Some of them were even realising bottom lines in the red.

Bearing in mind that it usually takes 18-24 months to recover from such a hit by premium increases, swift action needed to be taken. Strangely, during that spring, only a few of the boards initiated the discussion of how to fund capital – they were simply not aware of the impact of results on going concern.

Reality today or trend tomorrow
It is almost unnecessary to say that the objective of the ORSA process in Solvency II is not only related to the insurance business but spans the majority of the financial sector. There are initial indications that similar regulations could be the broader political response to the financial crisis and government support in the banking area, and the analysis steps could soon be considered good practice in financial institutions.

In monitoring this upcoming political debate it should be remembered that compared to banking, where there is a natural inherent imbalance in the business model in borrowing short and lending long, the business model for insurance is a far more stable one.

Case study: Denmark
As a response to the preparatory work of Solvency II, the Danish Financial Supervisory Authority forced in the autumn of 2009 a change of regulation introducing an ORSA-esque process as a mandatory requirement, in addition to the existing risk based capital regime. Key triggers for the regulatory change was the missing link between risk identification and decision making at board level on what capital to hold, and the lack of articulation of risks.

Having had the regime in place now for 18 months, the experience to share is: boards are often not aware of their capital responsibility, and do not find the simple questions on risks and how to navigate them as natural. Moreover, they are struggling with the appropriate division of responsibility between themselves and the executive team, and finding the balance between lack of technical expertise and at the same time being responsible for the company’s capital.

They are moving from the passenger’s seat to become the navigator of the company – which indeed is what the owners expect them to be. The Danish Financial Supervisory Authority assesses the change in regulation to have improved the quality of the board work with more joint discussions of risks taking place and a better understanding of what to manage. But it does not change overnight. It is like a cultural change – it takes time to settle.

Jan Parner is Deputy Director General at the Danish FSA