ORSA Group Risk Assessment in Singapore: Closing the Gap MAS Keeps Finding

ORSA group risk is the part of the assessment that Singapore insurers most often under-deliver: the ORSA report describes the licensed entity's own risks in detail but treats the parent, sister companies and shared service providers as background context rather than as sources of risk to the entity's solvency. Under MAS Notice 126, the ORSA must reflect the insurer's actual risk profile, and for any insurer that belongs to a group, that profile includes exposures that originate outside the Singapore balance sheet. This article explains where group risk belongs in an ORSA report, which gaps appear most often, and how to review your report before the next submission.

Why ORSA group risk is a recurring supervisory theme

MAS has repeatedly signalled in its supervisory communications that the quality of ORSA submissions varies, and that board ownership, forward-looking analysis and coverage of all material risks are areas it examines. Group risk sits across all three. A Singapore-licensed insurer that is a branch or subsidiary of a regional or global group is exposed to decisions it does not control: group capital allocation, intra-group reinsurance, shared investment mandates, group-wide IT platforms and the financial strength of the parent.

The difficulty is structural. The ORSA is prepared by the local risk function, often from a template supplied by head office. The template may be calibrated to a group economic capital model, while the local report must address the Singapore regulatory solvency position under the RBC2 framework. Where the two do not meet, group risk is either omitted or described qualitatively without any link to the local capital plan.

For insurers that are part of a group, a credible ORSA report treats group risk as a risk category in its own right, with its own identification, assessment, limits and management actions, rather than as a footnote to strategic or operational risk. Our ORSA advisory work commonly begins by testing whether the report can answer that question.

What MAS Notice 126 expects the ORSA to cover

Notice 126 requires a licensed insurer to maintain an enterprise risk management framework and to carry out an ORSA, with the results documented in an ORSA report that is reviewed and approved by the board. In practice, the ORSA requirements Singapore insurers must meet can be read as five tests:

• The report must be forward-looking, covering the business planning horizon and not only the current position.
• It must assess overall solvency needs relative to the insurer's own risk profile, not only the regulatory minimum.
• It must include stress and scenario testing that reflects the insurer's material risks.
• It must link risk appetite, capital planning and business strategy.
• It must show that the board and senior management own and use the process.

Each of these tests has a group dimension. A forward-looking projection that assumes the parent will continue to provide capital, reinsurance capacity or operational support needs to say so and to test what happens if that support weakens. A solvency needs assessment that ignores concentration to a single group reinsurer understates the risk profile. A scenario set that never includes a group-originated event is incomplete.

Insurers should confirm the precise wording of the current Notice and any related guidelines directly with MAS publications, since the detailed expectations are set out there and are updated from time to time.

The five group risk gaps we see most often

Experienced reviewers tend to find the same weaknesses when they read an ORSA report from a group-owned insurer.

Parent and sister company dependency

The report states that the parent is well rated and leaves the point there. A stronger report documents what the Singapore entity relies on the group for: capital injections, reinsurance, investment management, actuarial or claims services, and technology. It then assesses the consequence of each reliance failing, and records the contingency.

Intra-group reinsurance concentration

Many Singapore insurers cede a large share of risk to an affiliated reinsurer. The ORSA should quantify the credit exposure, the collateral or funding arrangements, the termination rights and the impact on the local solvency position if recoveries were delayed or disputed. Where affiliate reinsurance is material, concentration limits and a counterparty stress belong in the report.

Contagion and reputational transmission

A group event overseas, such as a downgrade, a regulatory sanction, a large claims event or a data breach, can reduce new business, increase lapses or trigger policyholder concern in Singapore even where the local balance sheet is unaffected. The ORSA should include at least one scenario in which a group event transmits to the local entity, and it should state the assumed channels.

Group-driven strategy and capital extraction

Dividends, management fees, recharges and capital repatriation decided at group level affect the local solvency trajectory. The report should show that the projection reflects realistic group expectations, and that the board has considered whether those expectations are consistent with the insurer's own risk appetite and its obligations to Singapore policyholders.

Inconsistent group and local assumptions

Economic scenarios, risk correlations and capital metrics are sometimes imported from the group without adjustment. The report should reconcile the group assumptions to the local portfolio and explain material differences. Where it relies on group models, it should record the validation and the limits of reliance. This overlaps with the work described in our enterprise risk management practice area.

How to embed group risk in the ORSA process

A practical sequence for the risk function is as follows.

First, build a group dependency map. List every material service, funding line, reinsurance arrangement, system and governance function that the Singapore insurer receives from or provides to other group entities. Record the contract or policy that governs each one and the owner within the insurer.

Second, assign each dependency to the risk taxonomy. Credit exposure to an affiliate belongs with counterparty risk; reliance on group technology belongs with operational and technology risk; capital support belongs with liquidity and capital management risk. Add a group risk heading that cross-references these, so that the board sees the aggregate picture.

Third, set indicators and limits. Concentration to a single affiliate reinsurer, the share of critical services supplied by the group and the sensitivity of the solvency ratio to a withdrawal of group support are all measurable. Put them in the risk appetite statement with escalation triggers.

Fourth, design the stress tests. At minimum, test a failure or downgrade of the affiliate reinsurer, a withdrawal of expected capital support, and a group-level operational outage affecting a shared platform. Show the effect on the RBC2 solvency position over the planning horizon and the management actions available to the local board.

Fifth, document the governance. Record who at the insurer reviewed the group assumptions, how conflicts between group and local interests are managed, and how the board challenged the analysis. The minutes of the board discussion are part of the evidence that the ORSA is owned and used.

Running an ORSA report review

An internal or independent ORSA report review should test group risk explicitly. A useful checklist for the reviewer:

• Does the report identify every material group dependency, and is each one traceable to a contract, policy or service agreement?
• Are group-originated scenarios included in the stress test set, with stated channels and quantified results?
• Is intra-group reinsurance assessed for credit, liquidity and termination risk?
• Are group assumptions reconciled to local experience and to the RBC2 basis?
• Does the capital plan reflect realistic group dividend, fee and support assumptions?
• Is there evidence that the board challenged the group elements and recorded its conclusions?
• Are the management actions available to the local entity credible if group support were reduced?

Where answers are weak, the remedy is rarely a rewrite of the entire report. More often the insurer needs a targeted addition: a dependency map, two or three new scenarios and a clearer statement of what the board would do. Doing this before the report is finalised is considerably easier than responding to a supervisory query afterwards.

Timing and ownership

Because the ORSA is an annual exercise with a submission deadline, group risk work should be scheduled into the calendar at the start of the cycle, not at the review stage. Group finance and group risk teams usually need weeks to supply the inputs, and the board needs time to challenge them. Our related note on ORSA report submission lapses covers the timetable discipline that supports this.

The chief risk officer or equivalent should own the group risk section, with named contributors from finance, actuarial, compliance and technology. The board should see the group risk analysis as a distinct agenda item at least once in the cycle, not only as part of the final report approval.

Next steps

If your insurer is part of a group and you are unsure whether your ORSA report gives group risk the treatment MAS expects, an independent review against Notice 126 will identify the gaps while there is still time to close them. Speak to our team about an ORSA advisory engagement, covering group dependency mapping, scenario design and board-ready documentation for your next submission.