Why an ORSA Needs a Mapped Risk Inventory
An ORSA risk inventory is more than a list of labels such as catastrophe, credit, or cyber risk. It should show where each risk arises, which activities or exposures it affects, and who is responsible for understanding it. That mapping helps decision-makers see whether the assessment reflects the insurer’s actual group structure and business model rather than a generic risk taxonomy.
The inventory is a structured input to the broader assessment, not a capital model or a substitute for management judgment. Its purpose here is to establish coverage and traceability: which risks have been identified, where they connect to the organization, and what information or ownership supports the entry. Whether a risk meets a particular materiality threshold is a separate assessment.
A useful inventory distinguishes the risk itself from its location and consequences. For example, a severe convective storm is a potential event; a property portfolio concentrated in a particular region is an exposure; underwriting losses at a property-writing legal entity are a possible consequence. Recording only “catastrophe risk” hides the information needed to understand the insurer’s actual profile.
Inventory Structure and Mapping Dimensions
Start with the organization’s actual structure: legal entities, business lines, material operations, and relevant shared services. Then map risk entries to that structure. A risk may affect more than one entity or line, and one exposure may be affected by several risks. The mapping is therefore generally many-to-many, not a one-risk/one-business-line hierarchy.
A practical inventory entry can include the fields below. The precise format may vary, but each field should help a reviewer understand the risk and trace it to evidence or an accountable person.
| Field | What it records | Why it matters |
|---|---|---|
| Risk description and category | The adverse event or uncertainty, stated specifically, plus a consistent category such as insurance, financial, operational, strategic, or emerging | Prevents broad labels from obscuring the underlying risk |
| Legal entity | The insurer or other group entity that bears, controls, or is otherwise affected by the risk | Shows where obligations, assets, and decision rights sit |
| Business line or activity | The product, service, investment activity, or function associated with the exposure | Connects the risk to the business model and relevant business owners |
| Exposure or dependency | The portfolio, asset, process, vendor, system, obligation, or other channel through which effects may arise | Makes the risk description concrete and reviewable |
| Risk relationships | Links to connected risks, shared causes, or common dependencies | Helps expose concentrations and avoid misleading duplication |
| Owner and information source | The accountable business or control function and the source used to describe the exposure | Supports challenge, maintenance, and follow-up on missing information |
Risk categories should be consistent without forcing every item into a single isolated box. An insurance risk can be amplified by a financial or operational risk. A catastrophe may lead to claims, liquidity needs, and interruptions to claims operations. These are related views of a connected scenario; the inventory should show the connections rather than treating the category labels as a complete analysis.
State what adverse event or changing condition is in view, using a description specific enough to distinguish it from other risks.
Identify the entity, line of business, asset, liability, activity, or dependency through which the risk could affect the group.
Record shared causes, affected operations, and other linked risks so that the inventory reflects how the organization actually operates.
Name the accountable function or business owner and identify the records, reports, or expert input that support the mapping.
Look for risks without a clear exposure, exposures with no identified risk, and entries that appear duplicated or inconsistently classified.
Why the Mapping Is Many-to-Many
Let \(R\) be the set of identified risks, \(E\) the set of legal entities, \(B\) the set of business lines or activities, and \(X\) the set of exposures. An inventory mapping can be represented as a set of linked tuples:
A tuple \((r,e,b,x)\) means that risk \(r\) is relevant to entity \(e\), business line or activity \(b\), and exposure \(x\). This is a relational representation, not a formula for adding risk amounts. For a risk that affects two entities, the inventory may contain two tuples with the same risk description and different entities. For an entity with a shared investment portfolio, several financial risks may link to the same exposure.
The mapping is useful because it can be checked in both directions. Starting with each identified risk, ask whether its affected entities and exposures are known or whether the uncertainty itself leaves a documented gap. Starting with each major exposure, ask whether the inventory identifies the risks that could affect it. This two-way check follows from the definition of a complete mapping: a risk with a relevant exposure should have a traceable link to it, and a relevant exposure should not be left without consideration of its associated risks.
Worked Example: Mapping Risks Across a Two-Entity Insurer
Scenario. A hypothetical group has Harbor Property Insurance Ltd., which writes homeowners and small-commercial property coverage, and Harbor Specialty Insurance Ltd., which writes professional liability coverage. The group uses one shared claims platform and invests through a portfolio held by Harbor Property. A coastal storm could affect homeowners claims and the shared claims operation. A decline in commercial property values could affect the investment portfolio. A professional liability reserve-estimation issue could affect the specialty entity.
Method. Identify the risk, then separately record the affected entity, business line or activity, exposure, and accountable information source. Do not assume that a shared operation belongs only to the entity that owns the system.
Step 1: Identify the storm-related insurance risk. The risk is adverse insured losses from a coastal storm. Its first mapping is Harbor Property Insurance Ltd. → homeowners and small-commercial property → policies and insured locations in the coastal territory. The relevant information source would include the underwriting or exposure records that identify those policies and locations.
Step 2: Map the connected operational exposure. The same storm may disrupt the shared claims platform or the staff who use it. Record the operational risk separately, linked to the storm as a common cause: group claims operation → shared claims platform and claims-processing dependency. Note that Harbor Property bears property claims, while claims processing is a shared group dependency. If Harbor Specialty also relies on the platform, add that entity and its affected activity rather than silently treating the platform as a Property-only exposure.
Step 3: Map the investment risk. The commercial-property-value decline is a market risk affecting Harbor Property Insurance Ltd. → investment activity → the portfolio held by that entity. The fact that the insurer writes property coverage does not itself establish that this investment risk affects its underwriting business line; the mapped exposure is the investment portfolio.
Step 4: Map the reserve risk. The uncertainty in professional liability claims estimates belongs to Harbor Specialty Insurance Ltd. → professional liability → its claims liabilities and reserve-estimation process. The entry should identify the relevant actuarial and claims information sources. It should not be assigned to Harbor Property merely because both entities share a parent.
Check. Each of the four entries has an identified channel of impact: insured locations, a shared claims dependency, invested assets, or claims liabilities. The mapping also makes the group-level shared operation visible without moving the legal obligations of either insurer. A common mistake is to record “storm risk—Harbor group” and stop there; the correction is to show both the property exposure and the operational dependency, with the relevant entities and activities attached to each.
Coverage Across Risk Categories
A disciplined inventory considers the categories that can affect the insurer, while keeping each entry connected to a real exposure or clearly stated uncertainty.
- Insurance risks: underwriting, claims, reserving, catastrophe, longevity, or other risks arising from insurance obligations. Map them to the affected products, policyholder populations, claims liabilities, reinsurance arrangements, or underwriting processes.
- Financial risks: market, credit, liquidity, and related financial risks. Map them to investments, counterparties, funding needs, collateral, or other relevant balance-sheet and cash-flow exposures.
- Operational risks: failures of people, processes, systems, controls, or external service dependencies. Map them to the affected process, system, location, vendor, or entity, even when the operation is shared.
- Strategic risks: uncertainty arising from choices or changes in the insurer’s strategy, competitive position, distribution, or business model. Map them to the strategic initiative, product, channel, or business line affected.
- Emerging risks: developing or poorly understood conditions whose pathways, likelihood, or consequences may be uncertain. Record the observable exposure and uncertainty rather than omitting the risk because it is difficult to quantify.
These categories are not mutually exclusive descriptions of cause and effect. For instance, a new distribution strategy may create operational dependencies and change insurance exposure. The inventory should preserve those relationships and make clear whether entries represent distinct risks, linked parts of one scenario, or different descriptions of a common cause.
Worked Example: Distinguishing a Shared Risk From Duplicate Entries
Scenario. A hypothetical insurer group has a life entity and a non-life entity. Both depend on one cloud service provider for policy administration. The provider experiences a prolonged service outage. The life entity’s policy changes and premium processing are delayed; the non-life entity’s claims intake and payments are delayed. Each entity records the provider dependency in its operational risk register.
Method. Separate the common risk event from the entity-specific exposures and consequences. Then check whether the group inventory preserves the shared cause without erasing the fact that each legal entity has its own affected operations.
Step 1: State the common risk. The common event is a prolonged outage at the shared provider. It is one group-level dependency risk because both entities rely on the same provider and may be affected by the same outage.
Step 2: Map the life exposure. Link the outage to the life entity, its policy administration activity, and the processing of policy changes and premiums. Identify the business owner responsible for the life processes and the vendor or service records used to establish the dependency.
Step 3: Map the non-life exposure. Link the same outage to the non-life entity, its claims activity, and claims intake and payment processes. Assign the relevant non-life process owner and identify the corresponding service information.
Step 4: Preserve the relationship. In the group view, retain one shared-provider risk with links to both entities and their distinct exposures. If the inventory format requires separate entity-level entries, cross-reference them to the common provider event.
Check and trap. A misleading calculation would count the two entity-level records as “one group risk + one group risk = two independent provider risks.” That arithmetic confuses records with underlying causes. The correction is to recognize one shared cause and two entity-specific mappings; neither the shared cause nor the separate legal-entity exposures should be discarded.
Representing Emerging Risks Without False Precision
An emerging risk can be relevant before the insurer has a stable estimate of its frequency or financial effect. The inventory should state what is known, what is uncertain, and which activities could be affected. It should not manufacture precision simply to fill a numerical field. If the pathways are unclear, record the plausible channels and the source of the concern, then assign a responsible owner to monitor the information.
Worked Example: Mapping an Emerging Automated-Decision Risk
Scenario. A hypothetical insurer is piloting a third-party automated tool to assist with small-business underwriting. The tool uses external data and may influence referrals and pricing recommendations. The pilot operates in two legal entities, but only one has completed a review of the data feeds. There is not yet enough operating history to establish how recommendations behave across unusual applicant profiles.
Method. Describe the uncertainty without assuming that harm has occurred. Map the tool to the entities and underwriting activities that use it, then identify the data, vendor, and decision-process dependencies that could transmit the risk.
Step 1: State the emerging risk. The risk is that weaknesses or limitations in the tool, its data, or its use could produce unsuitable underwriting recommendations or inconsistent treatment of applicants. This description identifies possible adverse outcomes without asserting that they have occurred.
Step 2: Map entities and business lines. Record each legal entity using the tool and the small-business underwriting activity affected. Do not map the pilot only to the entity that conducted the data review: the second entity’s use is itself an exposure that requires an entry and an accountable owner.
Step 3: Map dependencies and uncertainty. Link the risk to the external data feeds, vendor service, human referral process, and the underwriting decisions that may use recommendations. Record that operating history is limited and that behavior for unusual applicant profiles is not yet established.
Step 4: Record ownership and follow-up information. Identify underwriting as the owner of decisions, with appropriate technology, vendor-management, and control functions contributing information. Note the difference in review status between the two entities so that the inventory does not imply identical evidence or oversight.
Check. The inventory now includes the risk even though its effects are uncertain, distinguishes the two entities’ use and review status, and names the relevant dependencies. A common mistake is to omit the risk until the tool has a long loss history. The correction is to document the current exposure and uncertainty, then update the entry as evidence develops.
Common Inventory Traps
- Using a category as the entire description. “Credit risk” does not identify a counterparty, transaction, entity, or exposure. Add those links where applicable.
- Mapping only to the parent group. Group-level reporting can obscure which legal entity bears an obligation or relies on an operation. Record entity-level links and retain the group connection when the cause or dependency is shared.
- Confusing the owner with the exposure. A risk manager may coordinate monitoring, but the affected activity may be underwriting, claims, investments, or a shared service. Record both the accountable owner and the exposure.
- Counting duplicate descriptions as separate independent risks. Similar entries may reflect one shared cause, distinct exposures, or genuinely different risks. Cross-reference them and state the relationship instead of assuming either duplication or independence.
- Omitting uncertainty because it is hard to quantify. An uncertain emerging risk can still be mapped to known dependencies and activities. State the knowledge gap instead of presenting an unsupported estimate or excluding the risk.
A useful final review asks whether a knowledgeable reviewer can move from each risk description to the relevant entity, activity, and exposure—and can also start from each significant exposure and see which risks have been considered. Unanswered questions are not automatically proof of a missing risk, but they are useful inventory gaps to document and resolve through the insurer’s governance process.
Check Your Understanding
For each hypothetical situation, identify the key mapping decisions and the inventory trap to avoid.
- A group has a mortgage insurer and a warranty insurer. Both use the same customer identity system, while only the mortgage insurer holds mortgage insurance policies. A system outage disrupts new business processing for both. State the common risk and map the distinct entity exposures. (Answer: Record one shared operational outage risk linked to both entities; map it to mortgage new-business processing and the mortgage-policy activity at the mortgage insurer, and to warranty new-business processing and warranty activity at the warranty insurer.)
- A life insurer owns a bond portfolio and also sells annuities. A hypothetical deterioration in one bond issuer’s credit quality could affect the portfolio, while a change in annuity policyholder behavior could affect insurance obligations. Identify the different exposure for each risk and explain why “life business” alone is not a sufficient mapping. (Answer: Map credit risk to the life entity’s bond portfolio and issuer exposure; map the policyholder-behavior risk to the annuity business and related insurance obligations. “Life business” alone does not distinguish the investment asset from the annuity liability exposure.)
- A hypothetical insurer uses one external claims vendor for two subsidiaries. One subsidiary has documented its claim-file transfer process; the other has not. The vendor reports a possible service interruption. What should the inventory show about the shared risk, entity mapping, and evidence gap? (Answer: Show the common vendor interruption risk linked to both subsidiaries and their respective claims processes; record that process documentation differs and identify the second subsidiary’s evidence gap rather than implying both mappings are equally supported.)
- A small commercial insurer is considering a new digital sales channel. It may affect distribution, underwriting information, and reliance on a software provider, but the channel has not launched. How should the inventory represent the risk without asserting realized losses? (Answer: Record the strategic and operational uncertainties as applicable, map them to the proposed channel, underwriting information, provider dependency, and responsible entity or business activity, and state that the channel is planned rather than operating.)
- A group’s inventory lists “cyber risk” once under each of three entities, all of which use the same identity platform, but only two use a shared claims application. What review should be performed before the entries are treated as three independent risks? (Answer: Determine whether the entries share one or more cyber causes, map identity-platform dependency to all three entities and claims-application dependency to only the two users, and cross-reference common causes while preserving each entity’s distinct exposure.)