Why the Risk Function Matters in ORSA
An insurer’s ORSA brings together a view of its material risks, solvency position, and ability to manage risk under changing conditions. That view depends on contributions from people who understand different parts of the business. The risk function helps connect those contributions: it supports a coherent process, checks whether results can be compared, and makes uncertainty visible to decision-makers.
Coordination does not mean taking over the risks being assessed. The business areas that create or manage exposures remain responsible for their information and actions. Executives retain accountability for the insurer’s ORSA, while the risk function supports a sufficiently consistent and challenging assessment. A useful distinction is: the risk function coordinates and challenges the assessment; it does not become the owner of every risk, assumption, or management decision included in it.
Coordination Without Taking Ownership
The risk function can make ORSA more useful by helping contributors work to a shared basis. For example, it can establish common instructions for describing a stress, reporting a result, and explaining a material change. It can also check whether a contribution uses the agreed entity boundary, valuation date, time horizon, and treatment of management actions. The purpose is not to dictate every technical judgment. It is to identify where different judgments make results difficult to interpret together.
When a discrepancy appears, the risk function should make it visible and seek clarification from the person or business area responsible for the input. It may challenge whether the explanation is supported, ask for a sensitivity, or present unresolved alternatives. It should not silently replace an input merely to make the overall report look consistent. A consistent presentation can still show different methods or views, provided the difference and its significance are explained.
| Risk function contribution | What it does not imply |
|---|---|
| Promotes common reporting instructions and definitions | Owning the business exposure being reported |
| Checks whether results use compatible bases | Certifying that every underlying model is correct |
| Facilitates challenge and follows up on unresolved differences | Choosing a business action on behalf of management |
| Explains uncertainty and limitations in the ORSA view | Removing uncertainty or presenting an estimate as certain |
| Connects findings to decision-makers through appropriate reporting | Replacing executive accountability for ORSA conclusions |
These distinctions matter particularly when the risk function has broad access to information and a central role in preparing a consolidated view. A process coordinator may assemble results without becoming the source of every result. The documentation should make that distinction clear: who supplied the input, who explained its assumptions, what challenge occurred, and who is responsible for any resulting action.
Making Contributions Comparable
A comparison is meaningful only when the quantities being compared are sufficiently alike, or when their differences are disclosed. Before presenting two risk results side by side, the risk function should ask what each number measures. Relevant features may include the date, entity, exposure definition, currency, gross or net basis, time horizon, scenario severity, and whether proposed management actions are included. A mismatch does not always make a result unusable, but it can change what conclusions are justified.
The same discipline applies to changes over time. A reported increase may reflect a larger exposure, a changed assumption, a new method, or a combination. A movement bridge can help separate the explanations. Suppose a hypothetical risk measure starts at \(120\) million dollars. The business area reports that exposure growth adds \(18\) million, a revised assumption adds \(7\) million, and a specified mitigation reduces the measure by \(5\) million. The bridge is:
The bridge reconciles to a closing value of \(140\) million dollars. It does not establish that the assumptions are valid or that the mitigation will be implemented. Those points require evidence and accountable judgment from the relevant owners. The risk function can coordinate the explanation, check that the terms use a consistent basis, and identify where challenge remains.
Worked Example: Reconciling a Change in a Risk Measure
A hypothetical insurer reports a catastrophe risk measure of \(86\) million dollars at the start of its ORSA assessment period and \(103\) million dollars at the end. The catastrophe team attributes the movement to \(+12\) million from a larger insured portfolio, \(+9\) million from updated event assumptions, and \(-4\) million from a contract change that reduces retained exposure. The risk function is asked to prepare the explanation. Determine the reconciliation and the appropriate governance conclusion.
Method. Build an arithmetic movement bridge, then distinguish reconciliation from validation and ownership.
Step 1: Add the reported drivers to the opening measure. The intermediate result after portfolio growth is \(86+12=98\) million dollars. After the event-assumption change it is \(98+9=107\) million dollars.
Step 2: Apply the reported reduction. The closing result implied by the drivers is \(107-4=103\) million dollars.
Step 3: Check against the reported closing measure. The reported result is also \(103\) million dollars, so the bridge has no unexplained arithmetic residual.
Conclusion. The risk function can report that the change reconciles arithmetically and identify the three drivers. It should ask the catastrophe team to support the exposure, assumption, and contract-change inputs, and make any unresolved challenge visible. A reconciled bridge is not proof that the updated assumptions are appropriate or that the contract change has been executed.
Common mistake avoided: Treating a zero reconciliation residual as evidence that the model and all inputs are correct. Reconciliation checks whether the stated components add to the stated change; validation asks a different question.
Challenge, Evidence, and Limits
An effective risk function does more than collect numbers. It helps ensure that the ORSA account includes the basis for material conclusions and that important uncertainty is not concealed by a single point estimate. Challenge can include asking whether the data are current, whether an important exposure is omitted, whether a scenario is relevant to the insurer, or whether a proposed management action is feasible within the assumed time. The appropriate response may be a revised input, an additional sensitivity, a qualified conclusion, or an explicit statement that the issue remains unresolved.
The risk function’s ability to challenge is not the same as having complete knowledge of every model or business process. A limitation should be described precisely: what is not known, which result it affects, why it matters, and what decision or follow-up is needed. “The result is uncertain” is less useful than explaining, for instance, that a data gap prevents a reliable estimate of one exposure segment and therefore weakens confidence in a particular stress result.
The risk function should also avoid overstating what a comparison means. If a business unit reports a one-year, pre-tax result and the central assessment reports a three-year, after-tax result, subtracting one from the other does not create a valid movement analysis. A conversion would require information about the relevant assumptions and their effects. Without that information, the sound conclusion is that the figures are not directly comparable on the bases provided.
Worked Example: Handling Incompatible Reporting Bases
In a hypothetical ORSA exercise, a property unit reports a stress loss of \(28\) million dollars over one year, before tax, for a single legal entity. A central planning team reports \(41\) million dollars over three years, after tax, for the consolidated group. An executive asks the risk function to state that the group result has increased by \(13\) million dollars. Decide what can and cannot be concluded.
Method. Compare the definitions and bases before calculating a movement. A numerical difference is interpretable as a change only when the measures are sufficiently comparable.
Step 1: Identify the reported difference. The arithmetic difference is \(41-28=13\) million dollars.
Step 2: Identify the basis differences. The first result is one-year and pre-tax for one entity; the second is three-year and after-tax for a group. The horizon, tax basis, and entity boundary differ.
Step 3: Test whether a conversion is supported. No information is supplied to adjust for tax, extend the one-year loss to three years, or map the entity result to the group. Therefore, no defensible conversion can be calculated from the stated data.
Conclusion. The risk function should report the arithmetic difference of \(13\) million dollars only as a difference between the two reported figures, not as an increase in risk. It should request results on a common basis or present the measures separately with their definitions and limitations.
Common mistake avoided: Calling \(13\) million dollars a movement. The subtraction is correct; the interpretation is not supported because the quantities differ in material ways.
Communicating an ORSA Risk View
A useful ORSA communication lets decision-makers distinguish a finding from its qualifications. The risk function can help structure reporting around four questions:
State the risk finding and the relevant entity, period, and measure.
Identify the material inputs, scenario, methods, and accountable source of the analysis.
Describe material data gaps, model limitations, inconsistent bases, or uncertain management actions.
Make clear which issue requires challenge, a decision, further evidence, or monitoring, and who is expected to respond.
This structure helps avoid both extremes: a polished conclusion that hides uncertainty and a list of caveats that leaves decision-makers unable to identify the central issue. The risk function should communicate a limitation in proportion to its importance. A minor data qualification need not obscure the whole assessment; a limitation that could change the solvency conclusion should be prominent.
Worked Example: Reporting a Model Limitation
A hypothetical insurer’s risk team estimates a \(64\) million dollar loss under a severe cyber scenario. The estimate uses incident data covering three years, but the business has recently changed its vendor network. The analysts cannot quantify how that change affects the loss estimate. Management asks whether the result demonstrates that the cyber exposure is manageable.
Method. Separate the calculated estimate from the strength of the inference, then specify the limitation and the follow-up needed.
Step 1: State the result with its scope. The modeled loss for the stated severe scenario is \(64\) million dollars under the assumptions and data used. That is the reported estimate, not a guarantee of the actual loss or a complete measure of cyber risk.
Step 2: Identify the limitation. The vendor network changed after the three-year data period. The analysts cannot quantify the effect, so the estimate may not fully reflect the current exposure.
Step 3: Limit the conclusion. The result alone does not demonstrate that the exposure is manageable, because manageability also depends on the insurer’s capacity to absorb the loss and on available responses. The stated evidence does not resolve the effect of the vendor change.
Step 4: Communicate a useful next step. The risk function should report the estimate and limitation together, request analysis of the changed vendor network from the responsible business area, and state whether the uncertainty affects the current ORSA conclusion. It should not invent an adjustment to the \(64\) million dollar estimate.
Common mistake avoided: Presenting the modeled amount as a precise current-risk figure despite a material change in exposure that the analysis cannot quantify.
Common Governance Traps
- Owning the answer because you coordinate the process. Assembling business inputs does not make the risk function the owner of the exposures or assumptions.
- Making incompatible figures look comparable. A shared report format cannot compensate for different horizons, entities, or measurement bases.
- Silently correcting an input. If a business contribution appears unreasonable, document the challenge and obtain a supported response rather than changing it without attribution.
- Confusing arithmetic agreement with analytical soundness. A bridge can reconcile exactly while its drivers remain unsupported.
- Listing limitations without explaining their consequence. State which conclusion the limitation affects and whether further evidence or a decision is needed.
A disciplined risk function strengthens ORSA by making the insurer’s own view more coherent and candid. Its value lies in connecting evidence, perspectives, challenge, and communication while preserving clear responsibility for the underlying risks and decisions. This division supports an assessment that is more useful precisely because it does not confuse coordination with ownership.
Check Your Understanding
For each hypothetical situation, identify the appropriate risk-function contribution and the conclusion that can be supported.
- A business area reports a \(17\) million dollar loss under a one-year stress; another reports \(22\) million dollars under a two-year stress. What must be clarified before describing the \(5\) million dollar difference as a movement? (Answer: The measures’ horizon and other material bases must be made comparable; as stated, \(5\) million dollars is only an arithmetic difference, not a supported movement.)
- A hypothetical risk measure is \(74\) million dollars at opening. The responsible unit attributes \(+11\) million to exposure growth, \(-6\) million to mitigation, and \(+3\) million to an assumption update. What closing value does the bridge imply, and what does that arithmetic establish? (Answer: \(74+11-6+3=82\) million dollars; it establishes reconciliation to that implied value, not the validity of the drivers.)
- A business owner submits a stress result with no explanation of a material data gap. Should the risk function replace the result with its own estimate? What should it do instead? (Answer: No. It should seek the source’s explanation and supporting evidence, document the gap and its effect, and report any unresolved limitation without silently substituting an estimate.)
- A central ORSA summary combines entity-level results, but one business contribution excludes a recently acquired subsidiary. What should the risk function establish before presenting a consolidated conclusion? (Answer: Clarify the entity boundary and obtain or explicitly disclose the subsidiary’s treatment; without resolving or qualifying the omission, the summary cannot be presented as a complete consolidated view.)
- A model produces a stable result, but a significant operational change occurred after the data period and its effect cannot be quantified. What is the most defensible communication? (Answer: State the modeled result and its data scope, describe the operational change and unquantified uncertainty, limit any conclusion affected by it, and identify the needed follow-up rather than inventing an adjustment.)