OSFI.ORSA

ORSA (Own Risk & Solvency Assessment) is a tool for helping management understand the connection between risk profile and capital needs. (Basically, a risky business needs more capital.) The intent of ORSA is to consider insurer-specific risks that are NOT covered in industry-wide capital guidelines (MCT).   Forum

Pop Quiz

What are the 7 steps in the DCAT methodology? (You need this to answer a recent exam question on related to ORSA.) [Hint: rBrPr.Act(MR)]

BattlePlan

Based on past exams, the main things you need to know (in rough order of importance) are:

• ORSA v DCAT: similarities & differences
• key elements of ORSA
• advantages of ORSA over MCT
• concepts: general idea behind ORSA, how it can be used to set Internal Capital Targets

reference	part (a)	part (b)	part (c)	part (d)
E (2018.Spring #20)	ORSA v DCAT: - forecast period	ORSA v MCT: - opn'l risk requirement	ORSA v DCAT: - internal capital target 1
E (2017.Fall #21)	ORSA v DCAT: - similarities	ORSA v DCAT: - differences
E (2017.Spring #24)	see OSFI.MCT	see OSFI.MCT	ORSA v DCAT: - is ORSA better?	see OSFI.AA
E (2016.Fall #24)	see CIA.MfAD	see BCAR.Cdn	see OSFI.MCT	(d) see OSFI.AA (e) ORSA v DCAT: internal capital target 1
E (2016.Spring #24)	ORSA v DCAT: - similarities	ORSA v DCAT: - differences
E (2015.Fall #23)	key elements: - identify them (5)	concept: - application of ORSA
E (2014.Fall #29)	key elements: - identify them (5)

¹ See OSFI.TargCap for background on internal capital targets.

In Plain English!

Intro

I do NOT like this reading. At first glance it looks well-organized, but after I started reading it, I found it full of confusing details. I will make a judgment call here and advise that you probably only need to know 2 main items:

• goal of ORSA
• 5 key principles of ORSA

General Goal of ORSA

The goal of ORSA is to enhance an insurer's understanding of the relationship between risk profile & capital needs

I doubt this would be specifically asked on the exam, but it's good to know.

mini BattleQuiz 1 You must be logged in or this will not work.

5 Key Elements of ORSA

Any question on ORSA will almost certainly be based on these key elements. Sometimes you do have to memorize things exactly, but for this, I don't think you have to. If you memorize the 5 main points, then you can probably make up the details based on common sense.

Question: identify and briefly describe the 5 key elements of ORSA [Hint: RRR(M&R)(I&O)]

Risk identification & assessment:

• identify & assess the materiality of foreseeable & emerging risks

Relate risk to capital:

• set internal capital using stress-testing techniques
• must withstand a specified loss without falling below supervisery capital requirements
• review reasonableness & appropriateness of risk profile & capital requirements in the context of board approved risk appetite & risk tolerance

Responsibilities of Board of Directors:

Monitoring & Reporting:

• annual reports to Board of Directors & Senior Management on risk profile & capital assessment

Internal controls & Objective review

• review for accuracy, integrity, reasonableness
• objective reviewer: internal or external auditor OR skilled professional not involved in the ORSA process

The BattleCards have further details regarding these principles. Straightforward questions that simply asked you to list these principles appeared on (2015.Fall #23a), (2014.Fall #29).

mini BattleQuiz 2 You must be logged in or this will not work.

Recent Exam Questions

The ORSA questions on more recent exams have been more conceptual than just listing the key elements. For example: (2016.Spring #24ab). This question asked for similarities and differences between ORSA and DCAT, so it wasn't enough just to have memorized the key principles for either of these topics. A good start to answering this type of question is to list the key principles for each. Then stare at them for moment or two and you should begin to see some similarities and differences. Here is the answer from the BattleCards:

• similarities

• both consider risk id & control
• both are concerned with capital available versus capital required
• both consider base & adverse scenarios

• differences

item	DCAT	ORSA
guidelines	use CIA SOPs	use OSFI guidelines
methods	quantitative	both qualitative & quantitative
reporting	by AA	management responsibility
forecast period	3 years	long enough to capture relevant material risks (Ex: 3-5 years)

mini BattleQuiz 3 You must be logged in or this will not work.

BattleCodes

Memorize:

• general goal of ORSA
• 5 key elements of ORSA

Conceptual:

• You should understand how ORSA relates to readings about risk assessment. This would include CIA.DCAT, as discussed above, but also OSFI.MCT.

Calculational:

• none

Full BattleQuiz You must be logged in or this will not work.

  Forum

POP QUIZ ANSWERS

• 7 steps of DCAT: rBrPr.Act(MR)

1. review: REVIEW 3 yrs operations & financial position @ end of each yr
2. BASE: create the BASE scenario - a set of assumptions on risk factors that are CONSISTENT with business plan (if plan is realistic & consistent) OVER forecast period (2016.Fall #19a), (2013.Fall #29a)
3. risk: RISK CATEGORIES - select relevant risk categories from F-PIP-RIGOR using sensitivity-testing (F-PIP-RIGOR is a mnemonic for remembering P&C insurer Risk Categories and is discussed later in this article)
4. PAS: select plausible adverse scenarios from the risk categories identified in step 3
5. report: REPORT scenarios (with highest surplus sensitivity, those where surplus < supCapReq)
6. Action(mgmt): id management action to facilitate risk mitigation & contingency planning
7. Action(regulator): id possible regulatory action for falling below regulatory capital requirement thresholds (& SIGN opinion)

• If you think about these steps, they really are just common sense:
  • (Steps 1,2): Before doing anything, you have to understand the state of your company. This is why you review operations and create a BASE scenario.
  • (Steps 3,4,5): Then you look at company-specific risks, create a few adverse scenarios, and write a report
  • (Steps 6,7): Finally, management uses the report to take action to mitigate the risks. (If the analysis show bad results, you may need to consider what to do in the case of regulatory action.)