ORSA World Tour

Photo: iStock-1222743196.jpg

As the first years of the 2020s have shown, risks can come from anywhere. Some losses can result from a large systemic event, a blind spot in a business model or even the culmination of a combination of smaller risks. This exciting world of risk management that we all live in as actuaries is apparent in the Society of Actuaries Research Institute and Casualty Actuarial Society’s 16th Annual Survey of Emerging Risks Key Findings.

War was identified as a top emerging risk in the 2022 survey, despite not appearing in the list of top risks in recent years. In contrast, pandemics and infectious diseases became top of mind for 2020 and 2021 survey participants. In a globally interconnected business environment, it is becoming increasingly critical for insurers to look forward to emerging risks and sideways to their blind spots when driving their business ahead.

The Canadian insurance market is not immune to emerging risks. These risks can stem from various sources, including technology, climate change, geopolitical events and pandemics. As a result, they can significantly impact the insurance industry’s profitability and stability. In this article, we will examine the state of the Canadian market and tour the various emerging risk management practices in different jurisdictions across the world.

What is ORSA?

The Own Risk and Solvency Assessment (ORSA) is an important tool for Canadian insurance companies to address emerging risks. The ORSA is a risk management tool insurers use to conduct their assessments and adopt an internal view of risks in relation to capital and solvency. There are several elements of an insurer’s ORSA:

• Identifying and understanding the likelihood and severity of key risks based on its business profile, as well as the wider social and economic environment. Typically, the risks are traditional insurance, strategic, operational, and market and credit risks.
• Based on an internal assessment of key risks, an insurer would then assess if the existing solvency position and available capital are sufficient and consistent with its internal lens on risks. Often, this includes performing scenario and stress testing to assess potential losses from a certain risk under a defined confidence level. This is especially critical for risks identified as part of ORSA but not part of an insurer’s regulatory regime.
• Assessment of other elements of its risk management framework, including the governance structure, internal controls, as well as overall risk reporting.

ORSA with a Canadian Flavour

ORSA has been an integral part of Canadian insurers’ risk management framework for nearly a decade, coming into effect Jan. 1, 2014, through the Office of the Superintendent of Financial Institutions (OSFI) E-19 guideline. The ORSA guideline details the expectations for insurers’ risk management framework and processes around identifying, assessing, and managing key risks, including traditional insurance, operational and market risks, as well as emerging risks that require a forward-looking approach in risk management culture. In combination with other key regulatory guidelines on internal capital management (A-4) and stress testing (E-18), OSFI has established a framework for Canadian insurers to develop an internal lens on risks, capital and solvency position.

With respect to emerging risks, the existing guidelines have outlined specific aspects of emerging or nontraditional actuarial risks that insurers should pay attention to, particularly through the risk identification aspect of ORSA:

• Emerging Risks
  • The priority is to detect risks based on emerging trends or new developments in the internal or external environment. Assessments may indicate that some risks be deemed insignificant, while others may not have been evaluated or defined.
  • Additionally, risks previously considered minor may become significant as the insurer’s circumstances change. The ORSA should assess how risks may change and determine the necessary monitoring and management techniques.
• Risks from Risk Transfer and Risk Mitigation Activities
  • Risk mitigation activities such as hedging, reinsurance or change in operations or business strategy may address the problem. Still, they may become “blind spots” for businesses, resulting in new risks.
  • The mitigating impact of such activities may also be impaired under stress scenarios.
• Risks from Cross-Border Activities
  • Similar to risk transfer activities, cross-border activities may impart additional currency, geopolitical, legal and regulatory risks to insurers.
• Interactions of Risks
  • It is important to pay attention to “knock-on” effects that result from a series of smaller impact events.

Beyond the ORSA framework, both OSFI and the Canadian Institute of Actuaries (CIA) have issued educational guidelines and discussion papers to assist insurers with assessing and quantifying emerging risks. These include guidelines on managing cyber risks (OSFI guideline B-13), notes on climate change and surveys on emerging risks, as well as publications from Bank of Canada on climate risks scenario analysis.

State of the Market

For most Canadian insurers, the focus of ORSAs is primarily on risk categories in the LICAT/LIMAT and MCT/BAAT frameworks. In a typical ORSA, Canadian insurers assess and quantify traditional risks such as mortality, reserving, interest rates and operational risks.

In industry surveys conducted shortly after the official implementation of guideline E-19, insurers have highlighted emerging risk management as an area that requires further guidance and educational material from the CIA, specifically in identifying and modeling emerging risks.

In recent years, insurers have developed ORSA processes for emerging risks such as climate change, cyber threats and pandemics, mainly in the risk assessment and identification phase. For example, insurers would include an emerging risk category in their risk profile or have the impact of emerging risks, such as climate change, on their investments (from both a transition risk and physical risk perspective) in a market risk category.

For insurers with Solvency II (SII) or Solvency II-equivalent parents or affiliates, practices from such jurisdictions are also applied to the Canadian entity’s ORSA. This includes a more detailed review of the company’s business model from an operational perspective, assessing reputational, strategic and regulatory risks. In addition, from a quantitative standpoint, such insurers may also utilize internal capital models developed by SII-jurisdiction parents in their Canadian ORSA to calculate risk capital.

For Canadian insurers with larger risk management teams, efforts have also been made to address emerging risks further, specifically in risk quantification, where the quantification of emerging risks via scenario testing is often incorporated as part of the Financial Conditions Testing (FCT) exercise.

Around the World in 8 Ways

With vastly different insurance markets and jurisdictions across the globe, Canadian insurers can also benefit from observing and adapting regulatory requirements and industry best practices from around the world.

To do this, we go around the world through eight different jurisdictions, listed in no particular order below. A summary of common practices and regulatory requirements is also detailed in Table 1.

1. Bermuda
2. Chinese Taipei
3. European Union
4. Hong Kong SAR
5. Japan
6. United Kingdom
7. United States
8. Outside the insurance industry

Atlantic Entities

We first take a three-hour flight to somewhere close to home—Bermuda.

Bermuda’s ORSA-equivalent, the Solvency Self-Assessment Report (SSA), has established guidelines for evaluating and measuring emerging risks and identifying and assessing risks from business change development. In addition, in a review of the industry published by the Bermudian regulator, the Bermuda Monetary Authority (BMA) has highlighted the requirements and observed best practices of the SSA, including several areas relevant to emerging risks:

• View of Risks
  • Insurers should take a forward-looking view of their business in the SSA, which would bring about a perspective that captures risks from external sources and potential business developments.
• Risk Measurement and Evaluation
  • Insurers should evaluate foreseeable, emerging and other relevant material risks which may impact their operations.
  • Insurers should also implement a system of assessment and mitigating controls in response to emerging risks that may be difficult to quantify and measure.

In August 2022, the BMA also published an additional guidance note on integrating climate change analysis in insurers’ SSA reports, expecting that climate risks are assessed on both a short/medium-term and long-term basis. In addition, analysis with selected climate scenarios and associated physical and transition risks impact should be incorporated.

In the United States, the National Association of Insurance Commissioners (NAIC) also has similar guidance about ORSA practices. U.S. insurers who are required to produce an ORSA report are also expected to take a prospective view in solvency assessment activities such as capital projections with relation to prospective risks, which includes not only emerging risks but also existing risks that may become increasingly material in the future. Insurers should also consider measures around elevation of emerging risks to current risks in the ORSA’s risk identification and assessment element. For Internationally Active Insurance Groups (IAIGs), there are additional expectations with regard to emerging risks, including having risk management frameworks that consider emerging risks from changes in structure and business strategy.

Traveling across the Atlantic, the European Union has strong practices in relation to ORSA and emerging risks, having introduced ORSA to the insurance industry as part of Solvency II. In recent supervisory statements issued by the European Insurance and Occupational Pensions Authority (EIOPA), several aspects of emerging risk management best practices in ORSA were outlined:

• Risk Identification and Assessment
  • Risk assessments should include all potential material risks (quantifiable or not), including risks from group, op risk, emerging risks and cyber risks.
  • In terms of a longer time horizon, companies may wish to begin considering emerging risks, such as:
    • Climate change (which could affect claims, particularly in relation to non-life catastrophe events).
    • Impacts of technological advances affecting how insurance coverage is underwritten, bought and sold (e.g., the impact of new market entrants focusing solely on internet sales).
  • Climate-Related Risks—Various aspects of the ORSA were identified that could possibly address emerging climate-related risks, listed below. Overall, insurers are expected to assess climate-related transition and physical risks from short-, medium- and long-term time horizons.
    • Risk Profile—Identify climate change risks when defining the insurer’s risk appetite and risk profile.
    • Risk Assessment—Climate change risks can be identified as a risk not addressed in the Solvency II standard capital calculations, with considerations around mitigating measures on climate-related risks.
    • Scenario Analysis—Incorporate climate change risks into scenario analysis and assess whether the insurer can absorb possible shocks.
    • Management Actions—Develop a statement on mitigating corrective management actions to address climate-related risks.

By adopting measures similar to those of the EU, the UK has put in place leading practices in addressing climate risks (specifically scenario testing), with the Prudential Regulation Authority (PRA) providing guidelines on the topic. Insurers have focused on emerging risks through risk assessment workshops, focusing on the possible change in exposure that causes risks to migrate from emerging to emergent. Insurers have also recently increased their focus on the knock-on effects of interconnected risks, such as the combined impact of COVID-19, interest rate movements and supply-chain disruptions.

The Pacific Rim

Traveling to the high-growth economies in the Asia-Pacific (APAC) region, regulators have taken significant steps in recent years to develop the emerging risk management aspects of ORSA frameworks, often as part of a wider effort to move from factor-based to risk-based solvency regimes.

For example, in Hong Kong SAR, insurers are moving to a new Solvency II-like Three-Pillar solvency regime, in which ORSA is an integral part of the second pillar (Qualitative Requirements). As part of the new guidelines, 120 insurers provided the Hong Kong Insurance Authority (HKIA) with the first version of their ORSA reports in 2020. Accordingly, the HKIA has made the following observations in the areas of emerging risks:

• Insurers had not assessed emerging risks, particularly climate-related risks. As a response, HKIA published guidance on climate risk assessments in 2022.
• Consistent with the recommendations of the International Association of Insurance Supervisors, HKIA has also listed the following emerging risks for insurers to consider that should be incorporated in the risk identification and assessment element of future ORSAs:
  • Technology—With respect to the emergence of online distribution channels and claims platforms for insurers, as well as data connectivity in insurers’ systems, it is critical for insurers to incorporate changing distribution and marketing practices when assessing their underwriting risks.
  • Climate Change—The physical impact.
  • Climate Change—Impact from national, local and global level regulations.
  • Talent—Increased demand for actuaries, combined with increasing complexity in products and regulations that require actuaries to adapt and evolve.

In nearby Chinese Taipei, there is a similar attitude toward the significance of climate risks. As part of 2021 supervisory tests, insurers were required to include a climate change stress scenario in their ORSA reports. For non-life companies, natural disaster risks were also incorporated into regulatory capital calculations.

In Japan, the Financial Services Agency (FSA) has also reviewed ORSA practices with respect to emerging risks and published findings on best practices observed in the industry. As a result, observed practices are separated into advanced (best), standard and limited practices:

• Limited Practice: Emerging risks are not included in risk management.
• Standard Practice: There is a process for capturing emerging risks with a list of associated risk events, but no mitigating measures exist.
• Advanced Practice: In addition to identifying and measuring emerging risks, mitigating measures and policies are also well developed.

Outside of the insurance industry, the banking industry has highly developed risk management processes that insurers can learn from. For example, in 2022, the Basel Committee on Banking Supervision (BCBS) issued new guidance on upcoming regulatory practices for managing emerging risks. Risks that may also be of interest to insurers include:

• Crypto assets—With growing interest from banks, and a wide range of interconnected channels for crypto assets, there are significant regulatory implications. The BCBS plan is to continue to monitor banks’ exposure to crypto assets.
• Climate Risks—BCBS has produced research reports on specific ways in which climate risks impact banks and has also developed specific supervisory principles with respect to climate-related risks.

What Can We Do in Canada?

Coming back to Canada from our world tour, there are diverse practices on managing emerging risks in ORSA frameworks that can be reflected on.

For Canadian insurers, there are several takeaways from other jurisdictions:

• An increased focus could be placed on the “known” emerging risks, such as cyber, climate-related and geopolitical risks. Various actuarial associations and insurance regulators around the world have heavily analyzed these risks. Canadian insurers can look to Europe, especially in terms of climate-related risks, for ORSA and overall risk management practices, which includes not just the scenario testing that Canadian insurers are familiar with via the FCT requirement, but also the incorporation of these “known” risks in risk profiles, risk appetite statements and development of risk mitigation activities.
• The knock-on effects of interconnected risks are another risk “blind spot” for insurers to pay attention to. With the ORSA/FCT guidance on developing integrated scenarios with multiple stresses, this is perhaps an area that Canadian insurers are well-equipped to handle. However, beyond just the impact of multiple material risks, Canadian insurers can also look to analyze the impact of multiple immaterial risks occurring simultaneously, which could lead to significant losses.
• The emerging risks from changes in the business model are another critical area for insurers to focus on. For example, insurers can look to the increase in online distribution channels in recent years that bring about different types of risks. Canadian insurers can plan to incorporate this type of change in their risk assessment framework. In addition, Canadian insurance companies can take lessons from the dynamic and high-growth APAC region, where business models and products move at a quicker pace, to see how emerging risks from changes in business strategies and business practices are reflected in ORSA frameworks.

For regulators and the CIA, many regulatory and educational guidelines have been issued in recent years to equip insurers with the tools to address emerging risks. By continuing the observation of other markets, particularly outside of the insurance industry, regulators and the CIA will be able to continue to assist insurers in enhancing their ORSA and ERM practices and better prepare for the challenges posed by emerging risks.

Final Thoughts

In an ever-changing world, Canadian insurers are faced with emerging risks that could have a significant impact on financial results. As stated in the SOA slogan—Risk is Opportunity—Canadian insurers should look at emerging risks as an opportunity to look around the world and beyond the insurance industry to bolster and equip their ORSA frameworks with ideas and practices that will help in managing new types of risks.

Note: This article was written prior to the publication of OSFI guideline B-15 in March 2023 on Climate Risk Management, and the March 2023 Climate Change Risk Guidance Note published by the BMA. Canadian insurers should incorporate guidance from B-15 in their ORSA.

Statements of fact and opinions expressed herein are those of the individual authors and are not necessarily those of the Society of Actuaries or the respective authors’ employers.

Copyright © 2023 by the Society of Actuaries, Chicago, Illinois.