The Own Risk and Solvency Assessment (ORSA): Driving high-quality risk management processes across the Hong Kong insurance industry
After submission of the first ORSA reports in Hong Kong, what will the insurance regulator and the insurance industry do next?
The regulator and the industry alike will want to turn their attention next to how the risk management processes that are articulated in these first ORSA reports can be improved, and especially how risk management processes can be embedded, through the ORSA, in the running of the company.
In this two-part video, we outline three key areas of continued focus for the Hong Kong insurance industry in embedding high-quality risk management processes through the ORSA.
Part 1
Part 2
Assessing embeddedness of ERM processes
In performing the required regular independent review of the effectiveness of the ERM processes, as required by GL21 1, independent reviewers will want to look at this question of embeddedness 2, and look beyond the words and figures in the ORSA report to the underlying processes of risk identification, risk management and risk measurement against risk appetite, and mitigating actions.
[1] Hong Kong Insurance Authority, Guideline 21 on Enterprise Risk Management, paragraph 8.2.1: “ The effectiveness of the ORSA should be regularly validated through independent review by suitably experienced individual(s) who report directly to, or are themselves members of the Board.”
[2] GL21 sections 6 and 7 – “Embedding the ERM Framework”
Using the ORSA to embed ERM processes
So, based on our work across the industry what are the key areas where we observe – quite naturally at this stage in the Hong Kong insurance industry’s development of ORSAs – more work might need to be done in the coming years?
Risk appetite – a dynamic framework to support decision-making
The first is in the embedding of the risk appetite framework in the operation of the business.
The risk appetite framework should be more than just statements.
A dynamic process to drive strategy and day-to-day operations
It needs to be a living and breathing process, that the company uses to drive strategy at the top level, and day-to-day operations – including distribution, underwriting, investment management, day-to-day customer service and engagement, and claims management.
Dimensions of capital, earnings, and sources of risk, including ESG
The risk appetite framework should be defined in the dimensions of strategy – typically about delivering returns on investment and protecting capital – but also in terms of one of the vital pillars of risk management today of environment, social and governance aspects of how the company is run.
Delivering the risk appetite framework to incorporate those dimensions, and making it work for the company to drive strategy through day-to-day management, is a key initiative for risk management functions to drive.
Risk management information to bring the ORSA to life
Making the risk appetite framework dynamic and effective brings us to a second key area of future development – high-quality management information to support risk management.
The ORSA report itself is not the key to embedding
Regulators in other markets have commented that while the 100+ page ORSA report is interesting and a good place to start the supervisory process, it’s day-to-day risk management information that shows whether ERM processes are truly embedded. Risk management information is the life blood of effective risk management, and should show the company’s responses to breaches – or near breaches – of risk limits, and management’s next steps.
Dashboard reporting to steer decision-making and demonstrate active risk management
So a key development for many companies is to develop useable, risk dash-board reporting that captures all of the current and forward-looking quantitative and process-related elements of the ORSA, first and foremost for management and the Board to steer decision-making, but also as a means of recording and demonstrating the effects of decisions over time.
High-quality financial modelling to drive high-quality risk management
Finally, while the ORSA depends on high quality risk management processes, it also depends on high-quality quantification of risk through models.
Embedding ERM requires the modelling of risk using RBC and economic capital techniques to become second nature. This means improving modelling capability to be able to deliver on capital and earnings metrics that feed into the risk appetite and risk management information process.
Assumptions, stresses and scenarios, consistent with the company’s own view of risk exposures and probability distributions
This is not just about having a better modelling system, but more specifically better approaches to assessing assumptions about the probability distribution of risks to reflect inherent uncertainty of market and insurance risks, and to set these assumptions, and the stresses and scenarios modelled in the ORSA, in a way that is consistent with the way the company views risks.
Parsimony and transparency of modelling techniques
The modelling process does not necessarily need to be sophisticated – indeed models that are parsimonious and transparent are more likely to do the job effectively than models that few can understand. High-quality, transparent financial modelling offers the key to embedding high quality ERM and decision-making throughout the company, and paves the way for positive future relationships with the regulator, as well as analysts and ratings agencies.
Embedding high-quality ERM processes takes time – and needs a plan to deliver success
This question of embedding of high-quality enterprise risk management processes is not something that happens overnight. Indeed, the experience of regulators launching ORSA reporting elsewhere in the world has shown the ORSA to be a catalyst for improved risk management – but over a period of years rather than months.
There is wide acceptance that the first ORSAs will not be perfect, and will need to be improved and embedded over time. But good risk management is about having a plan – especially a plan to improve and to embed – and the time for Hong Kong insurers to further develop and deliver that plan is now.
