Solvency Assessment and Management: Steering Committee Position Paper 34 1 (v 5) Own Risk and Solvency Assessment

Transcription

1 Solvency Assessment and Management: Steering Committee Position Paper 34 1 (v 5) Own Risk and Solvency Assessment EXECUTIVE SUMMARY 1. INTRODUCTION AND PURPOSE The purpose of this document is to present the currently available international guidance on the Own Risk and Solvency Assessment (ORSA), to discuss its relevance to the South African context and to make recommendations as to the secondary legislation on the ORSA to be adopted under the Financial Services Board s (FSB s) Solvency Assessment and Management (SAM) framework. As this discussion document has been written based on the currently available international guidance, it specifically excludes the Solvency II Level 3 guidance on the ORSA that has yet to be published. Solvency II does not contain Level 2 implementing measures on the ORSA and hence only the EIOPA (formerly CEIOPS) issues paper on the ORSA is discussed in this document. Mappings and recommendations have been made assuming the issues paper is reflective of the final guidance expected under Solvency II. If the Level 3 guidance differs significantly from the issues paper, this discussion document, and the recommendations herein, will need to be revised. The ORSA and Use Test Task Group is of the opinion that the secondary legislation under the SAM Framework should not be too prescriptive, but should rather be set as high-level principles to which each insurer or insurance group (insurer) must adhere in performing its Own Risk and Solvency Assessment. The ORSA is intended to be an insurer s own individual assessment of its risk management framework and the resulting capital requirements specific to it. An insurer therefore needs to focus on and think about its own individual circumstances. The Task Group agrees that high-level principles are required in order to guide the insurer s thinking in this regard. There is a concern that legislation which is too prescriptive would limit the focus of the assessment to only those areas specifically covered by the legislation and this could result in significant, insurer-specific risks being excluded from the assessment. This may also reduce the ORSA from a valuable risk identification and quantification process to a compliance boxticking exercise. The Task Group recognises the importance of the ORSA to be a document submitted under the private disclosure sections. The ORSA may contain commercially sensitive information which may compromise insurers (and insurance groups ) competitive positions. The Task Group recognises that where insurers (groups) have opted for an internal model for regulatory purposes, the internal model will also be used to produce ORSA results. To this effect, insurers (groups) may include additional information in the ORSA about the 1 Discussion Document 34 (v 5) was approved as a Position Paper by the SAM Steering Committee on 5 December 2011.

2 internal model such as the performance of the internal model, or additional results derived from the internal model such as profit attribution. 2. INTERNATIONAL STANDARDS: IAIS ICPs The International Association of Insurance Supervisors (IAIS) is the international standards setting body for insurance supervisors. The FSB as a member of the IAIS aims to adhere to these standards. The IAIS is currently revising its Insurance Core Principles (ICPs) and corresponding standards and guidance material, with an intended adoption date of October The IAIS has indicated that further changes may be made to the ICPs. The most relevant of these proposed ICPs to the ORSA is ICP 16 on enterprise risk management. The ICP reads: The supervisory regime establishes enterprise risk management requirements for solvency purposes that require insurers to address all relevant and material risks. 2 The ORSA, which forms part of an overall enterprise risk management framework, is included under this ICP and is discussed further under the related standards and guidance. The IAIS insurance core principles (ICPs) that were adopted in do not make explicit mention of an ORSA. Aspects of the ORSA are however alluded to through a number of ICPs. The most relevant of these ICPs are: ICP 6 - Licensing: An insurer must be licensed before it can operate within a jurisdiction. The requirements for licensing are clear, objective and public. An essential requirement of this ICP is information from the applicant for licensing on its business plan projected out for a minimum of three years. The business plan must reflect the business lines and risk profile, and give details of projected settingup costs, capital requirements, projected development of business, solvency margins and reinsurance arrangements. This ICP will be replaced by ICP 4 intended to be adopted in October ICP 10 Internal control: The supervisory authority requires insurers to have in place controls that are adequate for the nature and scale of the business. The oversight and reporting systems allow the board and management to monitor and control the operations. This ICP requires the establishment of a risk management system that includes setting and monitoring policies so that all major risks are identified, measured, monitored and controlled on an ongoing basis. ICP 17 Group-wide supervision: The supervisory authority supervises its insurers on a solo and a group-wide basis. As a supplement to solo supervision, this ICP requires group-wide supervision of insurers which are part of insurance groups or financial conglomerates, including adequate policies on and supervisory oversight of group structure and interrelationships, capital adequacy, reinsurance, risk concentrations, intra-group transactions and exposures, internal control mechanisms and risk management processes. This ICP may be relevant in the setting of requirements for solo and group-wide ORSAs. ICP 18 Risk assessment and management: The supervisory authority requires insurers to recognise the range of risks that they face and to assess and manage them effectively. This ICP requires risk management policies and risk control systems that are appropriate to the complexity, size and nature of the insurer s business. The insurer must establish an appropriate tolerance level or risk limit for 2 ICP 16 of the IAIS ICP material adopted October 2010 (to be included in full set of ICPs to be adopted in 2011) 3 IAIS Insurance core principles and methodology (2003) Page 2 of 26

3 material sources of risk. Insurers are also required to regularly review the market environment in which they operate, draw appropriate conclusions as to the risks posed and take appropriate actions to manage adverse impacts of the environment on the insurer s business. This ICP will be replaced in part by ICP 16 on enterprise risk management intended to be adopted in October ICP 20 Liabilities: The supervisory authority requires insurers to comply with standards for establishing adequate technical provisions and other liabilities, and making allowance for reinsurance recoverables. The supervisory authority has both the authority and the ability to assess the adequacy of the technical provisions and to require that these provisions be increased, if necessary. An advanced criterion requires insurers to undertake regular stress testing for a range of adverse scenarios in order to assess the adequacy of capital resources in case technical provisions have to be increased. ICP 23 Capital adequacy and solvency: The supervisory authority requires insurers to comply with the prescribed solvency regime. This regime includes capital adequacy requirements and requires suitable forms of capital that enable the insurer to absorb significant unforeseen losses. An advanced criterion requires periodic, forward-looking analysis (e.g., dynamic solvency/stress testing) of an insurer s ability to meet its obligations under various conditions. This ICP will be replaced in part by ICP 17 4 on capital adequacy intended to be adopted in October ICP 17 does not make the same references but does make reference to stress testing. In addition to these insurance core principles, there are also IAIS principles on capital adequacy and solvency 5. Relevant to the ORSA is principle 13 on solvency assessment: Insurance supervisory authorities have to undertake solvency assessment. This principle requires insurance supervisory authorities to consider the following elements when undertaking solvency assessment: the adequacy, reliability, consistency and objectiveness of technical provisions, assets and liability valuations and statutory reporting; compliance with the required solvency margin and control levels; the adequacy of the internal risk assessment processes of the insurer; and the risk management systems of the insurer. Although this principle discusses the elements supervisory authorities must consider, it is likely that similar elements would need to be considered in an insurer s own assessment. 3. EU DIRECTIVE ON SOLVENCY II: PRINCIPLES (LEVEL 1) Article 45 of the EU directive on Solvency II is dedicated to the ORSA. It is reproduced here, with explanations of the referenced sections in the EU directive where it would otherwise be unclear. 1. As part of its risk-management system every insurance undertaking and reinsurance undertaking shall conduct its own risk and solvency assessment. That assessment shall include at least the following: 4 ICP 17 of the IAIS ICP material adopted October 2010 (to be included in full set of ICPs to be adopted in 2011) 5 IAIS Principles on capital adequacy and solvency (2002) Page 3 of 26

4 (a) the overall solvency needs taking into account the specific risk profile, approved risk tolerance limits and the business strategy of the undertaking; (b) the compliance, on a continuous basis, with the capital requirements, as laid down in Chapter VI, Sections 4 and 5 and with the requirements regarding technical provisions, as laid down in Chapter VI, Section 2; (c) the significance with which the risk profile of the undertaking concerned deviates from the assumptions underlying the Solvency Capital Requirement as laid down in Article 101(3), calculated with the standard formula in accordance with Chapter VI, Section 4, Subsection 2 or with its partial or full internal model in accordance with Chapter VI, Section 4, Subsection For the purposes of paragraph 1(a), the undertaking concerned shall have in place processes which are proportionate to the nature, scale and complexity of the risks inherent in its business and which enable it to properly identify and assess the risks it faces in the short and long term and to which it is or could be exposed. The undertaking shall demonstrate the methods used in that assessment. 3. In the case referred to in paragraph 1(c), when an internal model is used, the assessment shall be performed together with the recalibration that transforms the internal risk numbers into the Solvency Capital Requirement risk measure and calibration. 4. The own-risk and solvency assessment shall be an integral part of the business strategy and shall be taken into account on an ongoing basis in the strategic decisions of the undertaking. 5. Insurance and reinsurance undertakings shall perform the assessment referred to in paragraph 1 regularly and without any delay following any significant change in their risk profile. 6. The insurance and reinsurance undertakings shall inform the supervisory authorities of the results of each own-risk and solvency assessment as part of the information reported under Article 35 [Information to be provided for supervisory purposes]. 7. The own-risk and solvency assessment shall not serve to calculate a capital requirement. The Solvency Capital Requirement shall be adjusted only in accordance with Articles 37 [Capital add-on], 231 to 233 [Group internal model, group capital add-on, and deduction and aggregation method of calculating the group solvency capital requirement] and 238 [Subsidiaries of an insurance or reinsurance undertaking: determination of the Solvency Capital Requirement]. The proposed SAM primary legislation in respect of the ORSA is similar to Article 45 of the EU directive, amended as appropriate to reference the relevant sections in the SAM primary legislation. 4. MAPPING ANY PRINCIPLE (LEVEL 1) DIFFERENCES BETWEEN IAIS ICP & EU DIRECTIVE The proposed IAIS ICP 16 6 only requires entities to establish an enterprise risk management framework that addresses all relevant and material risks. The EU Directive contains more detailed ORSA requirements, but does not contradict the proposed IAIS ICP 16, nor the dedicated sections on the ORSA included in the standards and guidance related to the proposed ICP 16 (paragraph onwards. 6 IAIS ICP material adopted October 2010 (to be included in full set of ICPs to be adopted in 2011) temp/icp_16_enterprise_risk_management standards_and_guidance_m aterial.pdf Page 4 of 26

5 5. STANDARDS AND GUIDANCE (LEVELS 2 & 3) 5.1 IAIS standards and guidance papers Several IAIS standards and guidance are directly relevant to or contain elements that would be applicable to the ORSA. The standards and guidance related to the proposed ICP 16 on enterprise risk management have dedicated sections on the ORSA (from paragraph onwards). The broader topics on ERM discussed in the paper such as risk identification and measurement, documentation, the risk management policy, the risk tolerance statement and the risk responsiveness of the ERM framework are also applicable to the ORSA. This guidance states that as part of its ORSA process, an insurer would be expected to prepare a report which includes a detailed description of the relevant material categories of risk that the insurer faces, its overall financial resource needs including its economic capital and regulatory capital requirements as well as the available capital to meet these requirements and projections of how such factors will develop in future. This report should also include detailed descriptions and explanations of the risks covered in the ORSA, the measurement approaches used and the key assumptions made. Other IAIS standards on disclosures have limited relevance to the ORSA. The standards and guidance on ICP 16 appear to replace the prior adopted standard 7 and guidance 8 on ERM for capital adequacy and solvency purposes as much of the material covered is the same. The prior adopted standard and guidance have thus not been explicitly included for the purposes of this document. The guidance paper on the structure of regulatory capital requirements 9, as well as the proposed ICP to be adopted in October 2011, raises additional points about the ORSA. In the context of the ORSA, an insurer would generally be expected to consider its financial position from a going concern perspective (that is, assuming that it will carry on its business as a going concern and continue to take on new business) but may also need to consider a run-off and/or winding-up perspective (e.g. where the insurer is in financial difficulty). Whilst the IAIS recognises that some risks may be difficult to quantify (e.g. operational or liquidity risk), it is important that the insurer nevertheless addresses all material risks in its ORSA. In undertaking the ORSA, the insurer would be expected to have considered the extent to which the regulatory capital requirements (in particular, any standardised formula) adequately reflect its particular risk profile. In this regard, the ORSA can be a useful source of information to the supervisor in reviewing the adequacy of the regulatory capital requirements of the insurer and in assessing the need for variation in those requirements. 7 IAIS Standard no on enterprise risk management for capital adequacy and solvency purposes (2008) 8 IAIS Guidance paper no on enterprise risk management for capital adequacy and solvency purposes (2008) 9 IAIS Guidance paper no on the structure of regulatory capital requirements (2008) 10 ICP 17 of the IAIS ICP material adopted October 2010 (to be included in full set of ICPs to be adopted in 2011) Page 5 of 26

6 The standard on the structure of capital resources 11 for solvency purposes specifies that the solvency regime should require the insurer to assess the quality and adequacy of its capital resources to meet regulatory capital requirements and any additional capital needs. The corresponding guidance paper 12 discusses that if an insurer suffers losses that are absorbed by its available capital resources, it may need to raise capital to meet ongoing regulatory capital requirements and to maintain its business strategies. It cannot be assumed that capital will be readily available at the time it is needed. Therefore, an insurer s own assessment of the quality of capital should also consider the issue of re-capitalisation, especially the ability of capital to absorb losses on a going-concern basis and the extent to which the capital instruments or structures that the insurer uses may facilitate or hinder future re-capitalisation. 5.2 EIOPA S CPs (consultation papers) The European Commission will not be issuing any Level 2 implementing measures on the ORSA but EIOPA (formerly CEIOPS) will be issuing Level 3 guidance on the principles relating to the ORSA. At the time of writing this discussion document, this Level 3 guidance had not yet been published. EIOPA has, however, published its views in an issues paper 13 on the ORSA in May EIOPA s consultation paper on Supervision of Group Solvency for Groups with Centralised Risk Management (former CP66) discusses an ORSA in the context of insurance groups. Where an insurer is part of an insurance group and the group complies with the principles of Consistent Group Wide Risk Management (as set out in section 3.2) or the Group Risk Management Function is centralised in such a way that section 3.3 of former CP66 applies, then it is possible to have one document covering the assessment on solo and group level. 5.3 Other relevant jurisdictions (e.g. OSFI, APRA) The Australian Prudential Regulatory Authority ( APRA ) and the Office of the Superintendent of Financial Institutions Canada ( OSFI ) are the only two jurisdictions that are considered in detail in this section. This is in line with the direction from the FSB to focus on these jurisdictions. A brief reference to Bermuda s version of the ORSA process is however made. Australia Australia does have a similar requirement explicitly as part of its Life and General Insurance Capital (LAGIC) requirements and it is called, as in banking, an Internal Capital Adequacy Assessment Process (ICAAP) which is largely based on the banking ICAAP as per the Basel Accord. As mentioned, this ICAAP has its roots in the Banking Regulations based on Basil II, and only more recently (Insurance Capital Review Seminar Sydney 9 June 2011, effective 11 IAIS Standard no on the structure of capital resources for solvency purposes (2009) 12 IAIS Guidance paper no on the structure of capital resources for solvency purposes (2009) 13 CEIOPS Issues paper CEIOPS-IGSRR-09/08 on the ORSA (May 2008) Page 6 of 26

7 March 2011) this has also been extended to the Insurance Industry in calculating capital requirements not adequately covered by Pillar I rather than a true ORSA, as part of improving alignment across industries. The ICAAP includes: Board and management oversight Risk assessment in context of appetite Target capital Managing capital around target; triggers Monitoring, reporting and review This is distinct from FCR, involves periodic review, continuous review and is reported to the APRA. The Board and Management are responsible for ICAAP and capital. Principle 1 states Banks should have a process for assessing their overall capital adequacy assessments and strategies, as well as their ability to monitor and ensure their compliance with regulatory capital ratios. Supervisors should take appropriate supervisory actions if they are not satisfied with the result of this process. [Information Paper Implementation of Basel II Capital Framework Supervisory Review Process. 21 December 2007.] Also, in most cases an insurer must have an appointed actuary 14 who must provide an assessment of the overall financial condition and advice on the valuation of its liabilities on an annual basis, in particular a Financial Condition Report and an Insurance Liability Valuation Report ( ILVR ). The Appointed Actuary s Financial Condition Report must include 15, where relevant: a business overview; an assessment of the insurer s recent experience and profitability; summary of the key results of the ILVR; assessment of the adequacy of past estimates for insurance liabilities; assessment of asset and liability management, including the insurer s investment strategy; assessment of current and future capital adequacy and a discussion of the insurer s approach to capital management; assessment of pricing, including adequacy of premiums; assessment of the suitability and adequacy of reinsurance arrangements; and high-level assessment of the suitability and adequacy of the risk management framework. The General Insurance Prudential Standard GPS 220 requires that insurers have in place a risk management framework that includes certain key elements, to be described in a Risk Management Strategy. The Risk Management Strategy would typically not contain policies or procedures that underpin the risk management framework but may refer to them for illustration purposes. Further details of this are provided in Appendix A. Canada There is no specific mention of an ORSA, but the internal modelling requirement and other aspects indicate such an approach. The Office of the Superintendent of Financial 14 GPS 310 and APRA Solvency Modernisation Initiative issued November 2009; in the South African context this would be the Statutory Actuary 15 APRA Solvency Modernisation Initiative issued November 2009 Page 7 of 26

8 Institutions Canada ( OSFI ) first required prospective scenario testing in This has developed into the Dynamic Capital Adequacy Testing ( DCAT ). An annual report on DCAT must be filed, based on the analysis and projection of trends on the insurer s capital position given its current circumstances, its recent past, and its intended business plan under a variety of future scenarios. They too require an Appointed Actuary to perform a series of deterministic adverse scenario tests using the insurer s financial results and must certify that the financial position is satisfactory after these tests. OSFI does not currently require the DCAT to be incorporated into the insurer s risk management process. While some insurers incorporate the exercise into their risk management process, some companies view DCAT as a compliance exercise. Partly for this reason, OSFI is implementing more stress testing requirements. Guidance on stress, scenario and sensitivity testing has been published by OSFI 17 to extend the use of testing beyond DCAT. Stress testing must: Be documented, available to review and be embedded in enterprise-wide risk management. Be utilized in decision making, including setting the institution s risk appetite, setting exposure limits, and evaluating strategic choices in longer term business planning. Help to detect vulnerabilities such as unidentified risk concentrations or potential interactions between types of risk that could threaten the viability of the institution. Be a central tool for assessing liquidity risks. Place special attention on risk mitigation, securitization and warehousing risks, risks to reputation, counterparty credit risk, and risk concentrations. Each federally registered institution is rated by OSFI according to its composite risk rating, which is the institution s overall net risk rating after taking into account the institution s capital and earnings. Net risk is obtained by offsetting the aggregate quality of risk management against the aggregate level of inherent risk of the insurer. Inherent risks 18 are classified into the following groups: Credit risk Market risk Insurance risk Operational risk Liquidity risk Legal and Regulatory risk Strategic risk An insurer is rated as low, moderate, above average or high for each of these categories. The quality of risk management is also divided into groups 19 : Operational Management (i.e., day to day management) Financial Analysis Compliance Internal Audit Risk Management Senior Management 16 NAIC Consultation Paper on ORSA for the Solvency Modernization Initiative Aug OSFI Guideline E -18, December OSFI Solvency Modernization Initiative issued November OSFI Solvency Modernization Initiative issued November 2009 Page 8 of 26

9 Board Oversight The quality of an insurer s risk management processes is assessed as strong, acceptable, needs improvement or weak. The assessment of aggregate inherent risk and aggregate risk management quality are based on judgments of all of the inherent risk and risk management functions. In addition to the assessment of net risk, the direction of net risk is considered in rating an insurer. The level and frequency of supervisory scrutiny will depend on the risk assessment of the institution. Bermuda The Bermuda Monetary Authority (BMA) has issued guidance 20 on the ORSA, known in their jurisdiction as the Commercial Insurer s Solvency Self Assessment ( CISSA ). This is not reproduced in detail in this section but relevant points have been included where appropriate in this document. 5.4 Mapping of differences between above approaches (Level 2 and 3) This section focuses primarily on mapping the differences between the IAIS standards and guidance and the EIOPA issues paper on the ORSA. As the Level 3 guidance has not yet been published by EIOPA, no mapping has been performed in this respect. Where differences exist to the Bermudan CISSA process, these have been highlighted. Whilst APRA and OSFI contain guidance that is relevant to the ORSA, it is not as directly applicable as the guidance from the IAIS and EIOPA and hence is only mentioned briefly in this section. None of these papers differentiate between life insurers, non-life insurers and reinsurers, and hence the guidance on the ORSA should be viewed as being applicable to all of these undertakings. Overall, the IAIS, EIOPA and BMA guidance are very similar in context, with differences arising primarily in terms of style and the level of detail at which principles are discussed. This section will therefore highlight any contradictions that may exist between these papers and point out for each jurisdiction where it has elaborated on principles more so than the other jurisdictions. Contradictions There are no contradictions in the reviewed guidance on the ORSA. This demonstrates that the principles underlying the ORSA are consistent across jurisdictions. Extensions of one jurisdiction over the others 20 BMA Consultation paper on Commercial Insurer s Solvency Self Assessment (June 2010) Page 9 of 26

10 Definition of the ORSA The EIOPA issues paper provides a definition for the ORSA. The Bermuda Monetary Authority extends on this in their CISSA definition and includes a requirement for entities to hold sufficient capital to achieve its business goals. This is in line with the requirement for the ORSA to be embedded in the business and reflect an undertaking s business plans. Going concern versus wind-up The IAIS specifically mentions that the ORSA should be conducted assuming the insurer will continue to operate on a going concern basis unless the insurer is in financial difficulty. This is not explicitly stated by EIOPA. Frequency of calculation EIOPA requires undertakings to continuously meet the regulatory capital requirement, as well as the internal capital targets they set themselves. This does not mean that an insurance undertaking is required to calculate the SCR and MCR on a continuous basis, but rather that it should comply with these capital requirements continuously. Thus the undertaking will need to estimate the change in its capital requirements and eligible own funds since the last full solvency calculation. EIOPA specifies that the ORSA should be performed at least annually or following a significant change in risk profile. The undertaking should justify the adequacy of the frequency of the assessment. The IAIS guidance states that the ORSA should be performed regularly but does not specify this to be at least annually. The IAIS also requires the ORSA to be performed following significant changes in risk profile, and implies, though does not state explicitly, that the regulatory capital requirements should be met at all times. Risks covered Although all the jurisdictions require the ORSA to consider all current and reasonably foreseeable relevant material risks, the actual risks listed as a minimum differ across the jurisdictions (as can be seen in the table below): Risks EIOPA IAIS OSFI Underwriting / Insurance Market Credit Operational Liquidity Strategic Legal Regulatory Group Page 10 of 26

11 Other Risk mitigation Any other material risks, examples of which are liquidity risk, reputational risk and strategic risk. Consider impact of risk mitigation techniques e.g. reinsurance, diversification effects, loss-absorbing capacity of technical provisions and deferred taxes Consideration of effectiveness of applicable controls to mitigate risks The IAIS and the Bermuda Monetary Authority recognise that some risks may be difficult to quantify but require insurers to effectively consider these risks in their assessment and address them appropriately. Analysis of differences in economic and regulatory capital The IAIS guidance states that although the amounts of economic capital 21 and regulatory capital requirements and the methods used to determine them may differ, an insurer should be aware of, and be able to analyse and explain these differences. The EIOPA paper is worded more strongly, specifying that although an insurer may perform its ORSA at a different time horizon, confidence level and using different assumptions and assumed management actions, it is required to perform the internal calculation on the basis of a 99.5% confidence level and a one-year time horizon. EIOPA is however clear that the purpose of the ORSA is not to duplicate, validate or analyse in detail the parameterisation of the SCR calculation. The BMA makes a recommendation that Class 4 and Class 3B 22 insurers own capital calculation be done at a 99.0% TVaR 23 over a one year horizon (same confidence level and time horizon as the regulatory capital). Forward-looking analysis and stress testing In performing the forward-looking analysis of the ORSA, the IAIS guidance states that the time horizon should be consistent with that needed for effective business planning, an example of which is 3-5 years. EIOPA does not mention a specific time horizon, only that it 21 Economic capital refers to the capital needed by the insurer to satisfy its risk tolerance and support its business plans which is determined from an economic assessment of the insurer s risks, the relationship between them and the risk mitigation in place. 22 As defined in the Bermuda Insurance Act Class 3B insurers include all short term insurance companies which have annual premium income of more than $50m from unrelated business. Class 4 insurers include all short term insurance companies which have statutory capital requirements of $100m or greater and which write excess liability business or property catastrophe reinsurance business provided that more than 80% of this business is in respect of unrelated parties. 23 Tail Value-at-Risk (TVaR) is the expected value of the loss in those cases where it exceeds a predefined confidence level. Page 11 of 26

12 should be an appropriate planning horizon. An insurer should be able to demonstrate an ability to manage its risks over this longer time horizon under a range of plausible adverse scenarios. Unlike EIOPA, the IAIS guidance states that the insurer should apply reverse stress testing to identify scenarios that would likely cause business failure and the actions necessary to manage this risk. The IAIS guidance notes that whilst insurers must carry out stress testing, scenario analysis and risk modelling that are most appropriate for the business, the supervisor may develop additional stress testing for insurers to perform. The purposes of such testing may be to improve consistency of testing among a group of similar insurers, and to assess the financial stability of the market to stresses such as pandemics that impact a number of insurers simultaneously. Proportionality Both EIOPA and the IAIS advocate the use of the proportionality principle when performing and reviewing ORSAs. This principle requires the ORSA to be proportionate in its sophistication and depth to the nature, scale and complexity of the undertaking s business. The IAIS gives further guidelines on this, specifying that when assessing risks, the methods by which this could be done can range from simple stress testing events to more complex interlocking stochastic modelling as appropriate to the nature, scale and complexity of the risks concerned. The IAIS further comments that supervisors should not take a one-size-fitsall approach to insurers risk management but apply the principle of proportionality. Group-wide and solo ORSAs The EIOPA issues paper provides little guidance on ORSAs to be conducted by insurance groups, barring a comment that EIOPA will likely develop additional guidance in future on the group ORSA requirements. In contrast, the IAIS provides detailed guidance on the areas to consider when performing group-wide and solo ORSAs. Apart from performing a group-wide ORSA, the IAIS requires an ORSA to be done at the insurance legal entity and should include any additional risks that arise as a result of it being part of an insurance group. An insurance group should perform its ORSA to assess the adequacy of the group s risk management and current, and likely future solvency position. This group ORSA should capture all material risks of the group and the assessment of group-wide capital resources including fungibility of capital, the transferability of assets within the group, multiple gearing, leverage and intra-group creation of capital and reciprocal financing. It should also be ensured that capital is not double counted. In normal circumstances, surplus capital at the top of a group structure may be down-streamed to cover losses in group entities lower down the chain. The ORSA should reflect that this parental support may not always be forthcoming or permitted in times of stress. It may also be appropriate to consider scenarios in which the group structure changes. The proportionality principle applies to groups as well as solo entities, with particular care to be given to group risks and group-wide capital resources for large complex groups. Given that risks may be more complex and diverse for an insurance group, it may be appropriate to use an internal model for a group s ORSA even where the use of an internal model is not a proportionate approach for the insurance legal entities that form part of that group. The IAIS provides further guidance to supervisors on how to review the group s ORSA. Where the Bermuda Monetary Authority is the group-wide supervisor, insurers will be required to file a legal entity CISSA in addition to the group CISSA. However, insurers may apply for exemptions or modifications. An example of circumstances where an application for an abbreviated CISSA would be considered includes instances where centralised risk management exists so that the qualitative content of the legal entity and group CISSAs are largely duplicative. For instance, the BMA would consider an exemption entirely from a legal Page 12 of 26

13 entity CISSA, where the scale of the legal entity comprises almost that of the entire group, so that no material difference exists in relation to the quantification of CISSA capital and the qualitative description of risk management in respect of the legal entity and group. Where the BMA is not the group-wide supervisor, the BMA still requires an insurer to submit a legal entity CISSA. Where the group CISSA submitted to the group-wide supervisor is of a broadly equivalent nature and the results for the Bermuda legal entity are discernable, then the BMA may accept the group CISSA submission and require no separate legal entity CISSA. Thus the BMA recognises that there may be instances where the ORSA at the legal entity level may be waived. No such allowance is mentioned in the IAIS guidance. Governance The BMA includes a requirement that those who administer the CISSA be fit and proper. Whilst the IAIS and EIOPA have fit and proper requirements for Board members and all persons who effectively run the undertaking or have key functions, these requirements are not stated explicitly in their guidance on the ORSA. All jurisdictions place ultimate responsibility for the ORSA on the Board and senior management. EIOPA and the BMA explicitly require the Board or senior management to challenge the ORSA/CISSA. Risk appetite The BMA makes an explicit recommendation for the CISSA to include a description of how an insurer s risk appetite is defined and measured as well as details around limits imposed and how these limits are enforced. There is also an explicit recommendation around reconciling the impact of stress and scenario testing on capital to risk appetite. Whilst the IAIS notes that stress testing can help an insurer in ascertaining whether its tolerance limits are suitable for its business, it does not explicitly require such a reconciliation. Documentation standards Each of the jurisdictions has provided different levels of guidance in respect of documentation. The most rigorous of these is Bermuda which supplies reporting templates that undertakings should complete. EIOPA lists the minimum requirements for documentation. It is unclear whether reporting templates will be developed as part of EIOPA s Level 3 guidance. The IAIS does not include documentation standards explicitly but makes broad comments of what insurers would be expected to report to the supervisor. The IAIS states that while disclosing information on risk management helps to improve transparency and comparability of solvency regimes, it recognises that care should be taken in deciding what is publicly disclosed given the commercially sensitive nature of some of the information. 6. ASSESSMENT OF AVAILABLE APPROACHES GIVEN THE SOUTH AFRICAN CONTEXT 6.1 Discussion of inherent advantages and disadvantages of each approach Page 13 of 26

14 When discussing the approaches that may be followed in conducting an ORSA, and in particular the differences highlighted in section 5.4, it is important to consider the benefits as well as any particular restrictions that may be imposed by following a given approach. The nature of the ORSA The secondary legislation under the SAM Framework should not be too prescriptive, but should rather be set as high-level principles to which each insurer must adhere in performing its ORSA. Legislation that is too prescriptive has the disadvantage of potentially being too restrictive and narrowly-defined as well as setting a standard that insurers may view as a minimum standard which must be met and no more. In the context of the ORSA, the fundamental principle is that insurers should have robust risk and capital assessment and management processes that reflect their unique circumstances. It would therefore be expected that the application of the ORSA principles should be proportionate to the nature, scale and complexity of risks inherent in the business. Further guidance on the implementation of an ORSA, whilst not viewed as prescriptive, can provide clarity to insurers around the ORSA requirements. Similar advantages and disadvantages can be applied to documentation standards. Templates, as proposed by Bermuda, ease the collection and comparison of ORSAs from different insurers. This is more efficient for the regulator than having to review ORSAs with different styles and contents and may be particularly helpful in South Africa where resources at the regulator may be limited. However, as the ORSA is an insurer s own assessment, it follows that an insurer would be expected to discuss its risk and solvency landscape in a way that makes sense for its business, subject to covering all the requirements that may be expected in an ORSA. By not setting formal ORSA templates, this also encourages an insurer to embed the ORSA in its business and decision-making processes and to derive value from it rather than viewing it as a compliance exercise. The IAIS guidance requires an ORSA to be performed at the group level and for each insurance legal entity within the group. The advantage of performing the solo ORSAs at the legal entity level is that it can assure the regulator (and the companies) that policyholder interests within the group and each legal entity are expected to be met and that adequate capital is held. This is also consistent with regulatory reporting that is required at legal entity level. There are however disadvantages to this approach and these are highlighted in the Bermuda CISSA process, where the BMA may waive the ORSA requirement for an insurance legal entity. There may be valid reasons for this, such as one legal entity making up the vast majority of the group such that an individual ORSA would largely duplicate the group ORSA. Furthermore, a group may contain a large number of small legal entities but it may manage the business and its risks not by legal entity but rather according to some other (e.g. business cluster) structure. In such a case, an ORSA for each legal entity would be a drain on resources both for the insurer and the regulator reviewing them, likely add limited value and may even be misleading as it does not reflect how the business is actually managed. This may be a reason for the regulator waiving the solo ORSAs at legal entity level. A group ORSA conducted at the level at which the business is managed, rather than at legal entity level, may be more appropriate. The regulator may still need to be assured that the material risks and capital requirements at the legal entity level have been allowed for adequately. Page 14 of 26

15 Frequency of calculation EIOPA requires entities to perform an ORSA at least annually and following any significant changes in the entity s risk profile. More frequent assessments will have a resultant impact on resources but the additional management information gained may be beneficial. The adequacy of the frequency of the assessment should be justified by the insurer. Risks covered The reviewed international jurisdictions require the ORSA to consider all current and reasonably foreseeable relevant material risks. Although minimum risks may be prescribed, the list is not meant to exclude other risks that may be material to the insurer. This forces insurers to identify and understand the materiality of its own risks. Reconciliations Reconciliations are useful in validating model assumptions and results. EIOPA recommends a high level reconciliation between key items used in the ORSA and those corresponding items in the financial statements. In addition, insurers are required to understand and assess the differences between their regulatory and economic capital requirements. This aids an insurer in better understanding, amongst others, how its business plans, inclusion of additional risks not modelled in the SCR and any differences in confidence level or time horizon impact on its capital requirements. Although not the primary purpose, this reconciliation can aid the regulator in assessing the appropriateness of the calibration of the standard formula SCR. This is particularly useful in South Africa, where parameterisation of the standard formula is challenging given data and time constraints. It is noted that a higher economic capital requirement as shown in the ORSA will not necessarily lead to a capital add-on to the regulatory capital requirement. Capital add-ons may however be applied if significant risks are highlighted in the ORSA which are not covered in the SCR or if the risk management framework as described in the ORSA is considered to be inadequate. Forward-looking analysis and stress testing Under the ORSA, stress testing and scenario analysis are useful tools that insurers may use to understand the risks to which they are exposed. These scenarios should reflect plausible but severe events that may happen over the business planning projection period (e.g. 3-5 years). It can be time-consuming to derive and quantify the impact of the scenarios, but it is very insightful for an insurer to go through the process of discussing possible scenarios, their financial impacts, and possible management actions. It is therefore recommended that the details of the scenarios (e.g. the quantum of the stresses) not be prescribed by the regulator but rather be set by each insurer in accordance with its risk profile and business plans. There can be a use for prescribed stresses by the regulator (e.g. to assess systemic risk across insurers), but this will likely be viewed as ad-hoc or additional information that does not absolve insurers from performing their own scenario analysis. The IAIS guidance recommends testing more severe scenarios, known as reverse stress tests, which could result in business failure or a breach of regulatory or economic capital requirements. The number and complexity of these scenarios should be appropriate to the insurer and is not viewed as unreasonably cumbersome in the South African environment. Governance A strong governance structure is required given the importance of the ORSA. This includes, for example, fit and proper requirements for key personnel, robust documentation and Page 15 of 26

16 internal and/or external validation of the process. The Board and senior management are responsible for and should ask probing questions on the ORSA. This challenging of the ORSA is a vital part in ensuring the business derives value from this process and will require Board members and senior management to become knowledgeable in this area. Embedment in the business The ORSA should be embedded in the business. It therefore makes sense to extend the EIOPA definition to include that the ORSA is used to ensure that own funds are sufficient for the insurer to achieve its business strategy. This is not viewed as being too restrictive. Indeed, certainly if an approved internal model (partial or full) is used in the calculation of the SCR and ORSA process, it would need to be shown that the model is being used in the decision-making processes of the business to pass the use test. If not using an internal model, this does not absolve insurers from using the ORSA as a means to assess its ability to achieve its business goals. 6.2 Impact of the approaches on EU 3 rd country equivalence APRA and OSFI do not directly address the ORSA, but contain references and requirements to principles addressed under the ORSA as defined by EIOPA. Thus considering adopting the principles of these regimes as is, may not achieve third country equivalence. The IAIS guidance, similar to EIOPA s guidance, is principles based. There are numerous similarities between the IAIS guidance and EIOPA s issues paper on the ORSA. It should however not be recommended that the IAIS guidance is adopted as is in South Africa since the issues paper addresses areas not referred to by the IAIS (one such example is that there is no clear definition of an ORSA in the IAIS guidance). Bermuda guidance has been developed with the specific aim of achieving third country equivalence and the BMA requirements are generally more onerous than those of EIOPA. EIOPA is currently performing its assessment of Bermuda for purposes of third country equivalence. The approach that the Task Group has followed in developing the South African guidance is to start with EIOPA s issues paper as the basis and adding on guidance from the IAIS, BMA and other supervisors where applicable. It should also be noted that the Task Group s information from EIOPA was limited, because Level 3 guidance on the ORSA has not yet been issued by EIOPA and there is no Level 2 implementing measures. Thus to fully assess the impact on third country equivalence of the suggested approach for South Africa, more work needs to be performed once the Level 3 ORSA guidance has been issued. 6.3 Comparison of the approaches with the prevailing legislative framework There is no prevailing South African legislation that is comparable to an ORSA. As part of its interim measures, the FSB has requested insurers to conduct stress testing. This stress testing however differs from the stress testing envisioned under the ORSA in the following ways: Page 16 of 26

17 The FSB s interim stress testing involves applying instantaneous stresses and calculating a metric such as the Capital Adequacy Requirement thereafter. Under the ORSA, the stresses are applied gradually over a multi-year projection period and the metrics of interest are the financial position, regulatory capital requirement and economic capital requirement for each year of the projection. The type and quantum of the FSB s stresses are prescribed. Under an ORSA, however, stresses should not be prescribed but should rather be determined by each insurer in accordance with its own risk landscape and risk management framework. Any stresses that may be prescribed by the FSB under the SAM framework should thus fall under the ambit of the stress testing task group and not form part of the ORSA. 6.4 Conclusions on preferred approach In summary, the Task Group considered the following sources as input to the recommendations set out in the next section: Solvency II Level I Directive, Article 45 EIOPA s ORSA Issues Paper, dated May 2008 EIOPA s former CP66 on Supervision of Group Solvency for Groups with Centralised Risk Management IAIS Principles, specifically ICP16 and Guidance Paper Bermuda Monetary Authority (BMA), Consultation Paper on Commercial Insurer s Solvency Self Assessment (June 2010) APRA framework (specific references indicated in the sections above) OSFI framework (specific references indicated in the sections above) Generally, there is very little reference to the ORSA (or a similar concept) in both the APRA and OSFI frameworks. The Task Group did however consider the relevant references and factored those into the recommendation below. The BMA Consultation paper was considered and although the Task Group s overall view was that the paper establishes requirements that are perhaps too prescriptive, certain areas were adopted in the recommendations set out below. The Task Group supports a principle based approach to subordinated legislation for purposes of the ORSA. Thus the majority of the recommendations set out in the section below stem from EIOPA s Issues Paper on the ORSA and ICP RECOMMENDATION Minimum Requirements for the ORSA This section could be included as secondary legislation. Definition of an Own Risk and Solvency Assessment (ORSA) The ORSA is defined as the entirety of the processes and procedures employed to identify, assess, monitor, manage, and report the short and long term risks an insurance undertaking (and insurance group) faces or may face and to determine the own funds necessary to ensure that insurers (and groups) overall solvency needs are met at all times and are sufficient to achieve its business strategy. Page 17 of 26