NAIC's ORSA Manual for US Insurers - a helping hand?

"Tired and Emotional" - European
Insurance industry in 2013 

After the self-inflicted Solvency II transformational pressures of 2011 and 2012 resulted in more wobbly legs than a teenage disco at midnight, the relative calm of 2013 (to date) will have come as a blessed relief for European regulators and industry alike. Not so over in the States though, as they crack on with their take on the Own Risk and Solvency Assessment, releasing their industry guidance manual a few weeks back, in preparation for a proper crack at implementation in 2015, the driver of course being IAIS ICP obeisance rather than Solvency II equivalence.

They have kindly summarised the changes made since their 2011 version of the same manual on p9, which focus on accounting basis, scope (for groups) and ensuring certain year-on-year changes are appropriately flagged. 

Generic ORSA content - what
regulators "really really want"?

Unlike in the UK where there has been a marked reluctance to offer anything in the way of meaningful assistance to smaller insurers, such as a report template or checklist of suitable content/processes, the NAIC, just like the Spice Girls before them, are happy to "tell ya what I want", regardless of the potential for genericism.

That said, a recent Towers Watson survey suggested that there is still plenty of work to be done and staff to be hired in order to get with their ORSA programme.

The NAIC clarify that the US ORSAs are expected to be conducted no less than annually, with insurers documenting the process and results. After that, a high level "ORSA Summary Report" is to be submitted to the lead/state regulator once a year, which "should contain";

1. Description of the Risk Management Framework
2. Assessment of Risk Exposure (we would read as "risk profile" from what I can see)
3. Assessment of Risk Capital and prospective solvency

The Manual states that "[it] is intended to provide guidance for completing each section of the ORSA Summary Report", which should therefore make the job a doodle!

Some interesting bits jump out, not necessarily in contrast to reported/observable differences from the EU approach, more the fact that they are specified in the manual rather than taken as given;

GENERAL

• Chief Risk Officer/executive head of ERM Framework must sign the ORSA Summary Report
• Timing of supervisory reporting may move to match up to strategic planning cycle of an insurer
• Internal documentation expectations seemingly not as exhaustive as EU "repeatable by independent knowledgeable third party", simply to allow a more in-depth look at a given are at supervisor's request

DESCRIPTION OF RISK MANAGEMENT FRAMEWORK

• Specifies in principle what an "effective ERM Framework" comprises of (p18) - includes our old friends 'risk appetite', 'risk tolerance' and 'risk limits' in this, though they are isolated and defined in a passable manner on p25!
• Asks for various descriptive texts around processes
• Specifies that weaknesses/omissions found in the report here may change the supervisor's approach to the insurer!

ASSESSMENT OF RISK EXPOSURE

• Quantitative and/or qualitative assessments of risk exposure, in normal and stressed environments, for each "material" risk. Noticeably don't list Strategic/Frictional risks in the examples of "material" risk, though do mention Reputational risk as one for which "quantitative methods may not be well established"
• "Simple stress tests or more complex stochastic analyses" may be used in assessing the stressed environment
• Potential for supervisory intervention in the levels of stress assessed (in deterministic scenarios) or  even parameters in the ESG (for firms with stochastic capability)
• On risk correlation, "History may provide some empirical evidence of relationships, but the future is not always best estimated by historical data" - not sure where that leaves everyone!

ASSESSMENT OF RISK CAPITAL AND PROSPECTIVE SOLVENCY

• Provide a non-exhaustive list of considerations that an insurer/group will need to cover when assessing the adequacy of capital over its business planning period, which touches on many of the areas prominent in the EU's work (time horizon of assessment, valuation basis, definitions of "Solvency")
• Defines that this part of the assessment should identify "...the capital needed within a holding company system to achieve its business objectives"

Is this the type of demi-prescription that the smaller EU insurers are looking for? Is it too much to ask for national regulators (Ireland a notable exception) to take a similar stab at communicating what they want to see?

Deloitte with more on the US-of-ORSA

Billed as a "regulatory guidepost to the future", Deloitte in the States have published their thoughts on ORSA developments, following on from recent activity in the space, most notably the NAIC's adoption of the RMORSA Act a few weeks back.

Hard to tell whether Deloitte have borrowed much from their European counterparts, who ponied up with the EIOPA-compliant equivalent document last week, but both documents ultimately point at the same end goal, namely getting the ORSA Process and ORSA Report content right.

Confidently declaring the first regulatory filing of an ORSA Report to be precisely, errr, "Sometime in 2015", the stateside plans are anchored more to ERM and, I guess by association, ratings agency implications. The document does help identify a couple elements which, with the Solvency II hat on, are easy to forget;

• IAIS ICP 16 is bringing ORSA to the table of all signatories at some future juncture (which means I may get a job back home one day!)
• Existing techniques for monitoring solvency, even in a jurisdiction of this size, are seemingly past their sell-by-date in terms of both content and turnaround time (p2) - holds true for many of the Solvency II-covered countries as well (plenty on that topic in here).

The rest of the document draws out the preparatory work which firms should be undertaking, despite the relative lack of certainty at this point in time, such as increasing real-time data availability and changes in reporting, management and governance structures. It also touches on suggested content, process implementation (more like formalisation from experience), and a checklist of operational considerations, resourcing (or even briefing/coaching) being highest priority in my mind in 2012.

Good document for you statesiders to pass round your friendly non-executive directors anyway, as an early socialising of the concept in this format goes a long way when you have tiny windows to educate them on the topic over the next 3 years - looks like you will be filing ORSA Reports before we are!

Interesting footnote is that AIG have been labelled as a potential SIFI today - ORSA may be 5 years too late to have saved the behemoth it once was, but let's hope it can help its slimmed down current-day version.

IAIS - Revised Insurance Core Principles

Only an optimist would think that, at 400 pages, the revised ICP document is a light read, but it has been approved after the IAIS meeting in Seoul (press release here). May be worth a quick cross-cast against Solvency II CEIOPS/EIOPA advice in the ERM, Capital Adequacy and Internal Model-related sections, but as these borrowed heavily on Solvency II at outset, the final revision is not likely to contradict.

In addition, the latest IAIS Annual Report and Accounts has also been published - some good commentary within this around the purpose and scope of the ICPs and ComFrame. The latter perhaps has more significance for anyone in the UK, on the basis that the FSA are citing groups as one of the reasons for extending the go-live date and IMAP approval process.