ORSA has arrived in Brasil

Last week, we had the opportunity to bring an important topic up for discussion with insurers at the CNseg Risk Management Committee: the Own Risk and Solvency Assessment (ORSA).

At that time, we only had expectations that it would be published soon by Susep. Providentially, CNSP Resolution No. 471 was in fact released to the sector three days later, this past Monday, September 30. The deadlines set for insurers to develop ORSA exercises and reports are: until 12/31/2025 in the case of size S1 insurers, and until 12/31/2026, in the case of S2 insurers (and this deadline is also extended for S1 insurers to carry out reverse stress tests).

Although its agenda is more recent in Brazil, ORSA dates back to a cross-industry organization at an international level, arising from a trend of regulators around the world seeking to guarantee solvency and stability in the financial system (if we are to draw a parallel, colleagues in banking institutions have already integrated ICAAP, a capital self-assessment exercise, into their daily routine).

In the case of the insurance sector, since 2016, with the enactment of Solvency II regulations in the European Union, several European countries have been issuing ORSA reports. These exercises have been gradually being transposed to other regions, disseminating regulations and good practices based on risk management in insurance markets worldwide. The Eurozone, the USA, Mexico, Canada and Australia are all examples of regions that, at different levels of maturity, have already developed these practices.

The publication of this standard by Susep will therefore bring the Brazilian market in line with international risk management practices and standards. In Brazil, ORSA complements existing local regulations – such as minimum regulatory capital requirements (CMR) and the risk management framework (EGR) – and requires a broader scope, so that the exercise considers a longer time horizon, three years, in its analyses. Another relevant aspect is the convergence of this exercise in integrating with other relevant processes of insurers, which are strategic planning and the capital management process.

In general, as consultants, our experience at NFQ implementing ORSA in some of these geographies has allowed us to see that the differences specifically applied in local transpositions do not largely outweigh the common aspects that have been outlined.?

But what exactly does ORSA consist of? It is a regulatory framework that requires insurers to carry out an internal assessment of their risks, in a comprehensive manner and seeking continuous improvement. Its objective is that, through the self-assessment exercise, each insurer understands its risks in greater depth, being able to identify them in order to be able to create mitigation structures, before the materialization of these risks leads to more serious consequences, with systemic effects and the potential to destabilize the entire insurance sector.

What is new is mainly a requirement for cultural change, so that institutions have a greater focus on their risk management (covering underwriting, market, operational, liquidity and other material risks) and that the Senior Management of these entities makes decisions based on better quality and data management. The engagement and commitment of Senior Management is, in fact, one of the fundamental aspects to ensure the success of implementing this new culture.

The goal is that a more rigorous risk assessment will help improve strategic decision-making by institutions, making them more assertive, also implying governance improvements that increase the security of investors, regulators and customers. The gains are not only subjective, going beyond an improvement in risk management, and also making it possible to detect room for optimization in the business and composing a key tool for decision-making and alignment of the strategy and business plan of insurance institutions.

Regarding the investments required to implement ORSA, on the one hand, with a strong focus on data and as a result of a more intense risk management workflow in processes and reporting, each insurer will consequently be required to invest in systems and tools to capture, store and perform analyses of large volumes of data.

On the other hand, insurers must invest in qualifying professionals who will take on these new responsibilities of analysis and risk management, which is more complex and requires constant monitoring and reviews to update assessment models, in a continuous process of improvement, with a tendency to progressively increase the granularity of assessments (increasing their assertiveness and precision) and their scope, such as, for example, with attention to specific aspects of ESG.?

In the Commission, we went over 6 critical steps for the ORSA exercise, which must be contemplated for it to be implemented successfully:

1.????? STRATEGY AND BUSINESS PLAN

The first stage is related to the core business of each institution. It is necessary to draw up a plan and strategic objectives, in which the insurer can answer: Where do I want to go? Where do I want to grow? How much do I want to grow?

Based on these clear objectives, the company's own profile and culture can be understood to understand how much risk an institution is willing to take to achieve these objectives.

2.????? RISK IDENTIFICATION

In a second stage, we seek to understand what risks the insurer is exposed to.

Once identified, we will categorize them by type, materiality and prioritize them according to their probabilities and severities, which will also involve defining how their analysis, calculation, management, metrics and limits, and mitigating actions will be carried out.

In ESG, we draw attention here to the clear trend that sustainability risks are increasingly being reflected in local standards, as well as to the fact that these risks do indeed indirectly impact traditional risks. The physical risks of increased frequency of extreme weather events or rising sea levels can impact the risk of housing underwriting, for example. As for transition risks, it is also quite common to see that sentiments created in the market due to the sustainability policies of some companies are reflected in their market value, either positively or negatively, consequently impacting market variables.

3.????? RISK APETITE FRAMEWORK (RAF)

When defining the risk appetite framework, it must be linked to the strategic objectives and risk profile defined in the first stage.

RAF encompasses several fundamental components of ORSA, because it is the process that will link, in practice, the strategic objectives to the monitoring of the operational limits of the metrics of capital, solvency, risks, profitability, concentration levels, etc., and ensure that they are executed in a timely and proper manner.

It must consolidate a structure that helps put the insurer's plan into practice: for each risk that has been duly identified and categorized, a tree with different levels of granularity can be created, in which each risk can be monitored through qualitative and quantitative metrics, from its most aggregated level, to its decomposition, which reaches a level at which it is desired to monitor risk tolerance through operational limits.

In this structure, the level of appetite is framed within the established limits, which, in the event of exceeding these limits, have alerts and contingency plans implemented to take appropriate measures and prevent the risk assumed from exceeding the institution's risk capacity, protecting its capital and its obligations to stakeholders.

4.????? RISK MANAGEMENT AND CALCULATION

In fact, risk management and monitoring are linked to the definitions of the appetite framework. At this stage, indicators, metrics and risk calculations are considered and systematic processes, calculation and reporting frequencies, alert schemes and escalation of limit extrapolations are established.?

Here in our experience, we also see that it is valid for the institution to rely on transversal pillars of data and technology, which will be the key structure, together with the processes, to correctly integrate ORSA into the institutions.

With all these pillars, we provide coverage for the end-to-end process, from defining the capture of inputs, models and calculation tools and dashboards/reporting, which help to control and provide more automated maintenance for these process tracks that were created, reducing operational risk.

5.????? FORWARD-LOOKING

Concerning Forward Looking analyses, one must take into account the projections that must be made of the P&L, Balance Sheet and Capital, once again linked to the risk profile defined by the institution.

At this stage of the ORSA process, the business strategy has already been reviewed, risks have been identified and measured, and which ones will most penalize the institution are known. For these risks that are most representative in the minimum capital structure required, we must make projections for the future of the P&L, Balance Sheet and Capital in base scenarios and stress scenarios, for at least three years.

Here we highlight the relevance, even for insurers that are not yet transitioning to IFRS17, of considering doing these exercises from the beginning in IFRS17, too. This implies not only developing the ORSA process, but also advancing in the transition to the new accounting standard.

This is because, although local transposition has not yet been completed and currently only publicly traded companies are required to report financial statements in IFRS17, it is a fact that we are moving towards convergence with international standards. Additionally, it is important to have these bases in place to be able to compare results and monitor that there are no significant variations against other accounting standards, identifying, for example, impacts of liabilities on the Balance Sheet.

?

6.????? SENSITIVITY AND STRESS TESTING

Finally, the Sensitivity and Stress Testing requirements must also be part of the ORSA exercise, reinforcing risk management through prospective scenarios that will ensure that, even in the face of adverse scenarios, the institution will remain solvent, that is: identifying vulnerabilities and enabling institutions to take mitigating measures in adverse situations.

In this exercise, there may be a combination of statutory scenarios, with shocks and situations prescribed by regulators (which the local regulator has the prerogative to publish requirements in more detail), and adverse scenarios that institutions reflect internally, which may be based, for example, on past situations with the possibility of them occurring again.?

Individual factors can be sensitized, with shocks to standalone variables – whether economic, social, technological, or sustainability – as well as applying multivariable scenarios, in which this prospective vision combines 2 or more factors that could be stressed simultaneously. When we look at situations such as the crisis caused by the Covid pandemic, we see an emblematic example of a case in which multivariable scenarios would be applied, and that projections should also integrate the uncertainties of that historical moment - it was not known for how long and to what level of severity the economy would be impacted, as well as the impacts on mortality and morbidity factors.

In this context, we once again draw attention to the trends in the requirements for ESG scenarios for climate risks, which have already been integrated into European regulations to form part of the ORSA report. These scenarios typically include material risks related to physical or transition risks, and how these relate to the asset, liability or both, reflecting a translation of environmental/transitional impacts into economic impacts. The most commonly used scenarios are Representative Concentration Pathways (RCP), which are effectively recommended for use in Europe.

In short, there is a lot of work to be done in the coming years for insurers to develop their ORSA processes. We cannot fail to treat them holistically, adapting in each institution what should be reflected for their implementation in the areas of: Organization and Processes, Governance, Documentation and Policies, Risk Profile and Appetite, Methodologies and Technological Support.

Finally, Brazil will certainly also be able to benefit from the experiences and formulas that have already yielded good results in other geographies with a greater degree of maturity in the development of practices such as ORSA.