Why the Three Lines Matter in ORSA
An Own Risk and Solvency Assessment (ORSA) brings together information about an insurer’s risks, strategy, controls, and solvency. Its conclusions are only useful if people can tell who owns the underlying risks, who challenges how they are assessed, and who independently assesses whether governance and controls are working. The Three Lines model provides a practical way to make those responsibilities distinct.
The model does not mean that only one group manages risk, nor does it move accountability away from executives or the board. It distinguishes types of responsibility. Business and operational management own and manage risks; specialist risk and control functions support and monitor that work; internal audit provides independent assurance. The labels describe functions, not fixed departments or ranks.
Responsibilities in an ORSA Context
The first line is closest to the activities that create or manage risk. For example, an underwriting unit understands its portfolio, operates delegated underwriting controls, and supplies information about changes in exposure. A business unit cannot satisfy its responsibility merely by sending a spreadsheet to the risk function: it remains accountable for the meaning, completeness, and accuracy of its inputs.
The second line helps make risk management consistent across the insurer. A risk function may set common assessment expectations, provide scenario-analysis methods, aggregate risk information, test whether material risks have been considered, challenge assumptions, and bring concerns to appropriate management. It does not thereby become the owner of the risks created by business decisions. Other functions, such as compliance, may also perform second-line activities within their remits.
The third line evaluates whether the arrangements are designed and operating effectively. Internal audit might examine whether ORSA processes follow approved governance, whether controls over key inputs operate as intended, and whether challenge is evidenced and acted upon. It can make findings and recommendations, but it should not prepare or approve the work that it later claims to assure.
The board’s oversight and executives’ accountability sit across and above these operational distinctions. Board review does not turn the board into the third line, and management accountability does not make the risk function the owner of every risk. External auditors and regulators may provide scrutiny, but they are not the insurer’s third line.
| Line | ORSA contribution | Boundary to preserve |
|---|---|---|
| First | Own risks and controls; make business decisions; provide and explain relevant inputs. | Do not treat risk-function review as a transfer of business accountability. |
| Second | Provide frameworks and expertise; monitor, aggregate, challenge, and escalate risk concerns. | Do not take over first-line decisions or describe monitoring as independent audit assurance. |
| Third | Independently assess governance, risk management, and control effectiveness; report findings. | Do not design, operate, or approve the activity being independently assured. |
Classifying Activities by Responsibility
A sound classification starts with the activity, not the employee’s title. A risk specialist may advise a business owner on a scenario, while that business owner remains responsible for the exposure and the assumptions used to describe it. The same specialist may separately monitor whether the business followed the insurer’s risk framework. Those are distinct activities, even if one person performs both.
A useful justification for separating the lines is that ownership, challenge, and assurance answer different questions. The owner answers, “Who manages this risk and stands behind the information?” The second line asks, “Is the risk being identified and managed consistently, and what requires challenge?” The third line asks, “Is the system of governance and control adequate and working?” If one function both operates a process and independently assures that process, it would be evaluating its own work. Separating the assurance role makes that conflict visible and supports a more credible assessment.
Specify what creates the exposure and what ORSA work is being performed, such as supplying assumptions, aggregating assessments, or testing controls.
Place responsibility for managing the exposure, operating relevant controls, and explaining business inputs with the accountable business or operational management.
Determine which risk or specialist control function sets expectations, monitors the process, tests consistency, and raises concerns without assuming the business decision.
Assign evaluation of governance and control effectiveness to a function independent of designing or operating the activity under review.
Confirm that management retains responsibility for decisions and that findings or challenges have an appropriate route for escalation.
Applying the Model to ORSA Work
An ORSA process contains many activities, so it is not useful to label the entire report as the responsibility of one line. A business unit may own its risk assessment and exposure data; the risk function may aggregate assessments and challenge whether they are consistent; internal audit may later review the governance and controls around that process. Each activity has a different purpose.
The boundaries are not determined solely by a job title. An actuary who develops a business unit’s projection as part of management may be performing first-line work for that activity. An actuary in a central risk function who challenges methods may be performing second-line work. An actuary in internal audit may contribute to third-line assurance if the work is independent and appropriately scoped. The professional designation alone does not decide the line.
Worked Example: Reviewing a New Underwriting Scenario
A hypothetical insurer plans to expand a specialty property portfolio. The underwriting unit proposes a growth scenario and supplies exposure assumptions for ORSA. The central risk function reviews the scenario, and internal audit is scheduled to assess the ORSA process later. Classify the responsibilities and identify a boundary that must not be crossed.
Method: classify each activity by its purpose. The underwriting unit creates and manages the exposure. It therefore owns the business decision, its relevant controls, and the explanation of the exposure assumptions. Providing those assumptions to ORSA does not make the risk function their owner.
The central risk function performs second-line work when it checks whether the scenario is consistent with the insurer’s risk framework, challenges whether material consequences have been considered, and reports concerns. It may request revised analysis, but it should not make the underwriting growth decision on behalf of the business.
Internal audit performs third-line work if it independently assesses whether the ORSA process and its controls were appropriately designed and operated. It should not prepare the underwriting assumptions or approve the scenario before the review, because that would compromise its ability to assess that work independently.
Conclusion. Underwriting owns the exposure and its inputs; risk supports and challenges; internal audit independently evaluates the process. The common mistake is to say “risk owns the scenario because risk reviews it.” Review and challenge do not transfer ownership.
Worked Example: Classifying a Data-Control Failure
A hypothetical insurer finds that a business unit’s monthly exposure file omitted a class of policies. The business unit operates the data process, the risk function aggregates the file for ORSA and performs a reasonableness check, and internal audit is asked to examine control effectiveness. State the responsibilities and the appropriate response to the finding.
Method: separate control operation, monitoring, and assurance. The business unit is first line because it operates the source process and is responsible for correcting and explaining its file. It should identify the omitted policies, correct the input, and assess whether the error affects its risk assessment.
The risk function is second line. It should assess the implications for aggregation, challenge whether its reasonableness check was sufficient, and communicate the concern through management channels. Its aggregation does not remove the business unit’s responsibility for source data.
Internal audit is third line when it independently examines whether controls over the data process are suitably designed and effective in operation. It may report the control weakness and recommend remediation, but the business unit’s management remains responsible for implementing the correction and operating the control.
Conclusion. The originating unit corrects and owns the input; the risk function monitors and challenges; internal audit independently assesses controls. The common mistake is to assign remediation ownership to internal audit because it identified the failure. Assurance findings do not make the auditor the control operator.
Worked Example: When a Specialist Has More Than One Role
In a hypothetical insurer, a catastrophe specialist in the central risk function helps a business team select a scenario methodology and later tests whether the resulting scenario analysis follows the insurer’s common standards. The specialist is also asked to sign an internal-audit opinion on the same analysis. Determine which activities can be assigned to the specialist and what should happen to the assurance request.
Method: classify each task separately and test independence. Advising on methodology is support to the business. If the specialist is acting in the central risk function, this is generally a second-line contribution. The business team remains responsible for the scenario assumptions and the business interpretation of the results.
Testing consistency with common standards is also a second-line monitoring or challenge activity, provided it does not become approval of the business decision. But signing an independent-audit opinion on the same analysis is different: the specialist helped shape the method and performed the monitoring. The specialist would be asked to provide assurance on work in which the specialist already had a role.
Conclusion. The specialist can support and challenge, but should not provide third-line assurance on the same work. The assurance assignment should be made to an appropriately independent reviewer, with the scope and any relevant prior involvement considered. The common mistake is to classify every activity by the specialist’s title and assume that a “risk” title automatically makes every task second line, or that a later audit label creates independence.
Common Mistakes and Practical Checks
The Three Lines model is a way to clarify accountability, not a rigid organization chart. Some organizations combine functions or use different reporting structures. In those cases, responsibilities and safeguards still need to be clear, and any limits on independent assurance should be recognized rather than hidden by labels.
- Calling the risk function the owner of all risk. The function may coordinate ORSA and challenge assessments, while business management continues to own the underlying exposures and decisions.
- Treating a review as assurance. Second-line monitoring can be valuable, but it is not automatically independent third-line assurance.
- Assigning ownership by job title. Classify the specific activity and accountability, not just the department or professional designation.
- Making internal audit responsible for remediation. Audit can report findings and follow up; management owns corrective action and the controls it operates.
- Counting board oversight as a line. The board oversees governance; it is not a substitute for first-line risk management, second-line challenge, or third-line assurance.
For an ORSA responsibility map, ask who provides and stands behind each business input, who sets expectations and challenges it, and who independently evaluates the process. If the same person or function is assigned both operation and independent assurance of the same activity, clarify the conflict and arrange independent coverage.
Check Your Understanding
Classify the responsibilities in each original scenario before checking the answer.
- A hypothetical claims unit operates a process for identifying emerging claims trends and supplies its assessment to ORSA. The risk function checks consistency with the insurer’s framework. Which line owns the assessment, and what is the risk function’s role? (Answer: The claims unit is first line and owns its assessment; the risk function is second line when it checks consistency and challenges it.)
- A risk analyst writes a central method for assessing a material exposure. A business manager supplies the exposure assumptions and decides how to manage the risk. Classify these contributions. (Answer: The analyst’s method-setting is second-line support; the business manager’s assumptions and risk-management decision are first-line responsibilities.)
- Internal audit identifies a weakness in controls over a business unit’s ORSA data. Who should correct the weakness, and what is internal audit’s role? (Answer: The business unit’s management owns correction and control operation; internal audit reports the finding and independently follows up on remediation.)
- A compliance specialist monitors adherence to a risk policy and also operates a transaction approval control in a business area. Must both activities have the same line classification? (Answer: No. Classify by activity: monitoring the policy is a second-line function, while operating the business control is first-line work.)
- A specialist helped design a scenario process and is later asked to independently assure that process. What is the governance concern, and what is the appropriate response? (Answer: Prior design involvement creates a potential self-review threat; assign independent assurance to a suitably independent reviewer and disclose or manage the specialist’s involvement.)