ORSA in Practice: Moving Beyond Compliance to Strategic Value

The Problem With Most ORSAs

Walk into the risk function of almost any mid-sized insurer across Asia Pacific and ask to see the Own Risk and Solvency Assessment. You will typically receive a substantial document, often running to a hundred or more pages, with sections covering risk identification, risk appetite, capital projections and stress scenarios. It will have been reviewed by the board risk committee and signed off by the chief executive.

Ask how it influenced the most recent business planning cycle and the conversation becomes more difficult.

The ORSA has become one of the more demanding compliance exercises in the insurance regulatory toolkit. It has also, for many insurers, become primarily a compliance exercise, produced annually, reviewed in committee, filed with the regulator and then largely set aside until the following year. That is a significant missed opportunity, and increasingly, it is a position that regulators are no longer accepting as adequate.

This briefing sets out what a genuinely useful ORSA looks like, how it integrates with business management rather than sitting alongside it, and how regulators across Singapore, Malaysia and Hong Kong evaluate submissions.

What the ORSA Is Actually Meant to Do

The ORSA requirement in Singapore flows from MAS Notice 126 for life insurers and MAS Notice 133 for general insurers. At its core, the ORSA has three interlocking purposes.

First, it is a self-assessment of the adequacy of the insurer's risk management framework relative to the risks it actually runs. This is not a box-ticking exercise against a risk taxonomy. It requires genuine evaluation of whether the tools, data, governance and expertise the insurer has in place are proportionate to its risk profile and are working in practice.

Second, it is a forward-looking solvency assessment. The question is not whether the insurer is solvent today under a prescribed capital calculation, but whether it expects to remain solvent over a multi-year planning horizon under a range of scenarios, including stressed conditions. This requires projecting capital requirements as the business evolves, not simply running last year's numbers.

Third, it is a governance document that demonstrates board engagement with risk and capital management. The ORSA should be a product that the board can credibly claim to have shaped, not a technical document the board acknowledges and approves.

Integrating Risk Appetite Into Business Decisions

Risk appetite is frequently the weakest link in an ORSA. Insurers articulate risk appetite statements with appropriate categories and limits but struggle to demonstrate that those limits are operationally meaningful.

A risk appetite framework that works in practice has several characteristics that are often absent in compliance-focused ORSAs.

It is connected to business planning. Risk appetite limits on premium growth, geographic concentration, product mix and reinsurance retention should directly constrain or inform the business plan. Where the business plan pushes against an appetite limit, there should be a visible decision: either adjust the plan, or formally review and revise the limit with appropriate board governance.

It has clear ownership. Each appetite limit should have a named owner responsible for monitoring and reporting. Risk appetite reporting should be a standing agenda item at relevant governance forums, not an annual exercise.

It captures emerging risks. Static risk appetite frameworks often miss risks that are growing in significance. An effective framework has a mechanism for identifying and incorporating emerging risks, including cyber exposure, climate-related financial risk and conduct risk.

Breaches and near-misses are documented and acted upon. The ORSA should demonstrate that when limits are approached or breached, the governance machinery works: alerts are triggered, escalation paths are clear and the board is informed in a timely way.

Building Credible Capital Projections

The capital projection component of the ORSA is where many submissions are weakest. Common deficiencies include projections that extend only one year into the planning horizon, stress scenarios that are too mild to be credible, and projections that do not connect to the business plan.

A credible capital projection does the following:

It runs over a minimum three-year horizon aligned to the business plan. If the business plan projects material premium growth, the capital projection must reflect the capital consequences of that growth, including the impact on risk-based capital requirements.

It considers a range of scenarios, including at least one severe but plausible stress scenario specific to the insurer's risk profile. For a Singapore life insurer with significant interest-rate-sensitive liabilities, for example, a credible stress must include a severe interest rate shock and model its impact on both the liability side and the investment portfolio.

It includes reverse stress testing: identifying the scenarios that would cause the insurer to breach its capital requirements or become unviable. This is not primarily a regulatory exercise. It is a management tool that identifies the business model vulnerabilities that matter most.

It is connected to management actions. Capital projections should include the realistic management actions the insurer would take under stress conditions, with an honest assessment of their likely effectiveness and speed of execution.

How Regulators Evaluate ORSA Submissions

Regulatory evaluation of ORSA submissions across Asia Pacific has matured considerably. Regulators now have multiple years of submissions to benchmark against and are increasingly skilled at identifying submissions that are technically compliant but not genuinely useful.

In Singapore, MAS evaluates ORSAs against the quality of governance evident in the process as much as the content of the document. Submissions that show clear board engagement, genuine stress scenario development and integration with the business plan attract more constructive feedback than submissions that are comprehensive but generic.

MAS inspection teams also review whether what is described in the ORSA actually happens in practice. If the ORSA describes a board risk committee that reviews capital projections quarterly but meeting minutes show this rarely occurs, the gap will be noted.

In Malaysia, Bank Negara Malaysia's requirements under the Risk-Based Capital Framework for insurers include ORSA-equivalent self-assessment expectations. BNM has been sharpening its expectations around scenario analysis, particularly in relation to climate and pandemic risk following the experience of recent years.

In Hong Kong, the Insurance Authority has moved to a group-wide supervision model that requires the ORSA to consider risks at the group level, not just the licensed entity. This has particular relevance for multinational insurers where capital and risk are managed centrally.

Board Engagement and the Governance Trail

Regulators look for genuine board engagement with the ORSA, and they have become skilled at distinguishing genuine engagement from formal sign-off. The governance trail matters.

What genuine engagement looks like:

The ORSA process starts well before the document is finalised. The board risk committee is involved in setting the scope of the stress scenarios and reviewing early-stage capital projections. Material assumptions are presented to the committee for challenge before being locked into the final analysis.

Board and committee minutes record actual discussion, not just that the ORSA was reviewed and approved. Where directors asked questions, raised concerns or requested changes, those interactions are visible in the record.

The ORSA is discussed in the context of strategy. The most effective ORSAs are presented to the board alongside the business plan, so the board can see how risk and capital considerations have shaped the plan and can challenge where they have not.

Management has a clear owner for the ORSA process, typically the Chief Risk Officer or equivalent, who is accountable for the quality of the output and for ensuring the process genuinely informs management decisions.

Practical Steps to Improve Your ORSA

If your ORSA currently functions primarily as a compliance document, the pathway to a more useful process is gradual but achievable.

Start with the capital projection. Extending the time horizon, connecting it explicitly to the business plan and developing one or two genuinely stressed scenarios will improve both the quality of the document and its usefulness to management. This does not require new systems. It requires more deliberate analytical work.

Review the risk appetite connection. Map each risk appetite limit to a business metric that management monitors. Identify the gaps: where are limits set but not monitored in practice? Fix those gaps before the next ORSA cycle.

Change the governance process, not just the document. Bring the board risk committee into the stress scenario development process, not just the final review. The quality of board engagement in the process will improve the quality of the document and produce a governance trail that reflects genuine oversight.

Build internal capacity. Many insurers rely heavily on external consultants for ORSA production. That is not inherently a problem, but internal ownership matters. The people who run the insurer should understand and be able to explain the ORSA. If they cannot, the governance value is lost.

If your organisation is working through an ORSA improvement programme or preparing for a regulatory review, we work with insurers across Asia Pacific on ORSA development, stress testing frameworks and board risk governance. Our broader enterprise risk management practice covers the governance framework in which the ORSA sits. Our team includes practitioners with direct experience of MAS, BNM and IA supervisory engagement.