Guidance on Insurers' Own Risk and Solvency Assessments

Monetary Authority of Singapore
GUIDANCE ON INSURERS’ OWN
RISK AND SOLVENCY
ASSESSMENTS
MAS Information Paper
July 2017

Guidance On Insurers’ Own Risk and Solvency Assessments July 2017 Monetary Authority of Singapore 2
Table of Contents
1 INTRODUCTION .......................................................................... 3
2 GENERAL OBSERVATIONS ......................................................... 4
3 DETAILED OBSERVATIONS ........................................................ 6
A. Board Deliberations ........................................................................... 6
B. Risk Governance Framework ............................................................ 7
C. Risk Tolerance Statement/Limits ...................................................... 8
D. Risk Management Process ................................................................ 9
E. Continuity Analyses and Stress Tests ............................................ 10
4 QUESTIONS FOR THE BOARD’S CONSIDERATION ................... 13
5 CONCLUSION ........................................................................... 15

Guidance On Insurers’ Own Risk and Solvency Assessments July 2017 Monetary Authority of Singapore 3 1 INTRODUCTION
1.1 MAS 126 on Enterprise Risk Management (“ERM”) for Insurers was introduced
on 2 April 2013 and took effect on 1 January 2014. The Notice requires insurers to perform an Own Risk and Solvency Assessment (“ORSA”) at least annually to assess the adequacy of their risk management and their current and projected future solvency positions.
1.2 An insurer’s ORSA is central to its ERM framework as it links its business
strategy, risk tolerance, risk management and capital management with each other. Specifically, it allows the insurer to better anticipate how potential business risks could crystallise into capital needs, and to make early plans to meet those needs. It also allows an insurer to analyse how its business strategy could be adjusted in line with its risk tolerance. The Monetary Authority of Singapore (“MAS”) takes into account an insurer’s ORSA and its related processes as part of MAS’ assessment of the insurer.
1.3 Section 2 of this paper summarises MAS’ key observations from a focused
review of ORSA reports submitted by direct life, general and composite insurers as well as reinsurers. The review was centred on the board deliberations, risk governance structures, risk tolerance statements and limits, risk management processes, and continuity analyses and stress tests. Based on the review, MAS noted that insurers generally met the requirements for the ORSA stated in MAS 126. However, the effectiveness of the ORSAs can be improved via better integration with the business planning process, more in-depth risk assessments and more robust board level discussions. Insurers that implement ORSAs by pulling together pre-existing risk management documents without further analysis to fulfill a compliance requirement may not reap the full benefits of the process.
1.4 Section 3 of this paper contains more detailed observations from MAS’ review,
and sets out sound practices for performing ORSAs that insurers should adopt, taking into account their risk and business profiles.
1.5 The role of the boards in ensuring that ORSAs are well implemented and used
in insurers cannot be over-emphasised. In this regard, some questions to guide board level deliberations when considering the ORSA are set out in Section 4 of this paper.
1.6 The content of this paper does not modify or supersede any applicable laws,
regulations and notices.

Guidance On Insurers’ Own Risk and Solvency Assessments July 2017 Monetary Authority of Singapore 4 2 GENERAL OBSERVATIONS
2.1 Insurers generally met the requirements for the ORSA under MAS 126. These
include:
a) considering relevant material risks, such as insurance, credit, market, operational and liquidity risks; b) assessing the economic and regulatory capital needed for supporting their business strategy; and c) analysing their ability to continue business under adverse scenarios.
2.2 ORSA Report Format: Most insurers documented their ORSAs using the
illustrative template of an ORSA report in Appendix A of MAS 126, which helped to ensure that the key elements were considered and included in the reports. Some insurers additionally adopted tools such as risk heat maps and dashboards to help their boards obtain a clear and concise overview of an insurer’s risk profile and changes to key risks, thereby facilitating discussions and decision making.
2.3 Use of ORSA in Business Planning: Insurers, and in particular their boards of
directors, should exploit the ORSA process as a valuable and integral part of their ERM frameworks, by linking their risk assessments and capital planning with their business strategy and overall business planning cycle. Insurers should consider both the current and emerging risks that they face when determining their business strategies. At the same time, they also need to be cognisant that their chosen business strategies affect their risk profiles. Therefore, in order for risk management to be effective, there should be an integration of the ORSA within an insurer’s business planning process, and this should be evident in the ORSA report.
2.4 Risk Identification and Measurement: Group risk was not always considered in
the ORSA even when it was applicable to the insurer, and assessments of emerging risks and inter-dependencies between material risks could be improved. In addition, insurers tended to focus more on financial risks, while consideration of non-financial risks such as operational risk was more limited.
2.5 Risk Assessment Process: An effective ORSA features a robust risk
assessment process. ORSA reports that were primarily a collation of pre-existing risk management documentation and processes suggest that the respective insurers might not have adequately identified their material and emerging risks.

Guidance On Insurers’ Own Risk and Solvency Assessments July 2017 Monetary Authority of Singapore 5
2.6 Capital Management: Insurers should consider if regulatory capital
requirements fully reflect their risks before deciding to use regulatory capital as their economic capital, and should clearly document these considerations in the ORSA reports.
2.7 Stress Testing Scenarios: There is scope for improvement in insurers’ use of
stress tests for ERM. Insurers that only used MAS-prescribed stress test scenarios for their continuity analyses and stress tests without clear justifications might have missed out other stress scenarios that are more relevant for their risk profiles. Insurers should also undertake a more thorough assessment of their management actions in response to the stress test scenarios.
2.8 More detailed observations are set out in Section 3.

Guidance On Insurers’ Own Risk and Solvency Assessments July 2017 Monetary Authority of Singapore 6 3 DETAILED OBSERVATIONS A Board Deliberations
3.1 The board of directors is ultimately responsible for the effective risk
management of the insurer. The ORSA facilitates this by providing relevant and timely information on the insurer’s key risks and capital needs under a variety of business conditions for the foreseeable future, thus enabling more effective risk management decisions in connection with business planning. MAS 126 requires insurers to submit to the MAS an extract of the minutes of the board meeting detailing the board’s deliberations on the ORSA report, and indicating the board’s approval of the ORSA report. The minutes should demonstrate that the board has carefully considered the contents of the ORSA report, including the implications for risk management and business planning.
3.2 MAS notes from its reviews that it was often unclear from the minutes if the
board had engaged in active discussion with management on the information contained in the ORSA report. Where board deliberations were documented in the minutes, they mostly focused on capital adequacy, results of stress tests and compliance with MAS 126. Discussions on material and emerging risk areas, plausibility of stress scenarios, integration with business strategy and key assumptions used in the ORSA report were generally lacking. A robust ORSA discussion by the board should cover all material risk areas and their impact on the insurer. These deliberations and decisions should also be properly documented to facilitate follow up actions. Sound Practices (i) The board should have robust deliberations that centre on material and emerging risk areas and their impact on the insurer. (ii) The board should ensure that the insurer has assessed the impact of, and considered the mitigating actions for, an adequate range of plausible stress scenarios. (iii) The board should ensure that a clear process has been established and followed to incorporate the findings from the ORSA in the business planning process of the insurer.

Guidance On Insurers’ Own Risk and Solvency Assessments July 2017 Monetary Authority of Singapore 7 (iv) The board should, where appropriate, provide guidance to management on how the ORSA process can be improved, and how the ORSA report can be enhanced to facilitate its use in discussions and decision making. (v) Insurers should adequately document the deliberations and decisions of the board of directors in the minutes for proper follow up. B Risk Governance Framework
3.3 The risk governance framework of an insurer describes the roles,
responsibilities and risk oversight structure within the insurer for risk management purposes. An effective risk governance framework forms the backbone of an insurer’s ERM framework and is crucial to the achievement of an insurer’s ERM objectives.
3.4 MAS noted that many insurers adopted a “three lines of defence1
” framework.
However, it was not always clearly articulated which business units/functions constituted each line, what their roles and responsibilities were, or how these roles and responsibilities came together to support the objectives of the insurer’s risk governance framework. Where a business unit/function was allocated to more than one “line of defence”, the insurer should consider how this could blur the different lines of defence and erode their effectiveness, and consider if additional controls are needed as a result.
3.5 A clear risk governance framework is necessary to ensure that risk exposures
are adequately monitored, assessed, and managed. Such clarity will better assure the board of the effective operationalisation of the framework. Insurers should review the effectiveness of their risk governance frameworks regularly to ensure that they remain appropriate.

Sound Practices
(i) Insurers should clearly define the roles and responsibilities of business units/functions in their risk management framework to ensure proper

1
This is a model used by some organisations for defining the different layers of risk control. An example of the three “lines” could be operations as the first line, risk management and compliance as the second line, and internal audit as the third line.

Guidance On Insurers’ Own Risk and Solvency Assessments July 2017 Monetary Authority of Singapore 8 accountability. Insurers should also clearly articulate how these roles and responsibilities come together to achieve the objectives of their risk management framework. (ii) Insurers should regularly assess the effectiveness of their risk governance frameworks as part of their ORSA process. Where there are gaps in the risk governance structure, insurers should identify appropriate measures to address the gaps. Insurers should document these assessments and the necessary follow up measures in the ORSA report to facilitate accountability. C Risk Tolerance Statement/Limits
3.6 MAS 126 requires each insurer to establish and maintain a risk tolerance
statement that defines its overall quantitative and qualitative risk tolerance limits, and that takes into account all relevant and material categories of risk and their inter￾relationships. Each insurer is also required to define risk tolerance limits for various aspects of its business operations.
3.7 Risk tolerance statements and limits adopted by insurers used metrics such as
solvency targets, earnings volatility, liquidity thresholds and rating agency targets. The insurers with better ORSA reports had clear risk tolerance statements and limits that incorporated both quantitative and qualitative elements. MAS also noted instances where insurers’ risk tolerances were not clearly defined, including the use of vague phrases such as “generally no appetite for…”, “… accepted to an appropriate degree”, and “… are sufficient and liquid enough” without further elaboration. These indicated a lack of clarity within the insurer as to what its risk tolerance limit was.
3.8 Clearly articulated risk tolerance statements and limits are important in
facilitating consistent understanding and monitoring across the organisation of the types and levels of risks that are acceptable to the insurer. Such clarity will facilitate the board and senior management’s consideration of the insurer’s risk tolerance during the business planning process, to ensure that the business strategy adopted is within its risk tolerance.

Guidance On Insurers’ Own Risk and Solvency Assessments July 2017 Monetary Authority of Singapore 9 Sound Practices (i) Insurers should establish clear risk tolerance statements and set corresponding limits where appropriate. The terms and thresholds used in the risk tolerance statements and limits should be clearly defined. (ii) The board and senior management should consider the insurer’s risk tolerance during the business planning process, and ensure that there is internal consistency between the risk tolerance and business strategy. D Risk Management Process
3.9 MAS 126 requires each insurer to ensure that its ERM framework identifies and
addresses all reasonably foreseeable and relevant material risks. Each insurer should also highlight the material risks and possible key indicators to its senior management at least quarterly, and update the board and senior management of its risk profile at least annually.
3.10 Generally, insurers identified and assessed most of the mandatory risks
required under MAS 126, but greater attention could be given to:
a) group risk, especially when the insurer has significant exposure to related entities; b) emerging risks (such as cyber or environmental risk); and c) dependencies between different material risks.
3.11 Insurers’ ORSAs generally appeared to give due consideration to financial risks,
but insurers could also seek to perform more robust analysis on non-financial risks such as operational, business and strategic risks. Also, insurers should ensure that assessments of their material risks are consistent with actual circumstances. For example, insurers’ risk assessments should give regard to material deficiencies that have been highlighted by auditors or during MAS on-site reviews that have yet to be resolved.
3.12 Insurers could articulate more clearly in their ORSA reports how material risks
were identified and how these evolved or emerged relative to prior years. Insurers with more robust ORSA processes tended to have more comprehensive frameworks for

Guidance On Insurers’ Own Risk and Solvency Assessments July 2017 Monetary Authority of Singapore 10 identifying risks. These included, for example, environmental scans to help identify material or emerging risks arising from changes in the global and domestic macro￾economic environment that could impact the insurer’s risk profile. Good ORSA reports also contained a clear mapping of material risks to risk owners, specified risk indicators, and risk mitigating factors, thus helping to promote more effective risk monitoring and management.
3.13 A robust risk management process is important in ensuring that material risks
of an insurer are adequately identified, measured, evaluated, monitored, reported and mitigated. These processes should be properly documented, clearly communicated and regularly reviewed to ensure sound risk management throughout the insurer. Sound Practices (i) Insurers should have a clear framework to identify relevant and material risks, including emerging risks (e.g. cyber or environmental risks), business risk, strategic risk, group risk, regulatory risk, and risks arising from changes in the macro-economic environment. (ii) Insurers should take into account relationships between material risks during the risk assessment process. (iii) Insurers should clearly articulate material risks and their corresponding risk indicators, risk monitoring processes and risk owners in the ORSA report. (iv) Insurers should clearly articulate changes in their risk profiles from the prior year (if any). E Continuity Analyses and Stress Tests
3.14 As part of their ORSA processes, insurers are required to conduct regular
forward-looking continuity analyses comprising both qualitative and quantitative elements. In this regard, stress tests and reverse stress tests are to be carried out for each relevant insurance fund that is maintained by the insurer under section 17 of the Insurance Act. The tests should include a projection of the financial and capital adequacy positions, under a sufficiently broad range of plausible adverse scenarios and over a time horizon that is consistent with business planning. Action plans to

Guidance On Insurers’ Own Risk and Solvency Assessments July 2017 Monetary Authority of Singapore 11 restore or improve capital adequacy and cash flow positions should also be clearly identified and assessed.
3.15 Most insurers conducted continuity analyses and stress tests over a timeframe
consistent with their business planning horizon and considered the impact of these on their overall capital positions. However, not all insurers considered the impact to individual insurance funds. In addition, where insurers only adopted the MAS-defined stress test scenarios, an assessment of the suitability of these scenarios for their risk profile should have been conducted so as to ensure that insurers’ material risks are appropriately stress-tested and considered in their continuity analyses. MAS also noted that insurers’ assessments of (i) the plausibility of stress scenarios used in their analyses; and (ii) the feasibility of the management actions proposed could be improved. Furthermore, insurers that adopted their regulatory capital as their economic capital should explain the basis for their decision.
3.16 Effective continuity analyses and use of stress tests can illustrate the interaction
of material risks and their potential impact on the insurer. This also serves as a mechanism for assessing the insurer’s capital management and its ability to deal with business disruptions and stressed conditions. The board and senior management of each insurer should ensure that the use of stress tests forms an integral part of the risk management process. They should also consider the stress test results as part of their business continuity planning and decision making. Sound Practices (i) Insurers should ensure that a sufficiently broad range of plausible stress test scenarios that are reflective of their key risks are used. (ii) The results of the stress tests and reverse stress tests should serve as effective inputs for risk management decisions. (iii) Insurers should consider the impact of stress tests and the action plans holistically and at each insurance fund level. (iv) Insurers should assess and clearly articulate the feasibility and adequacy of action plans identified to address the stress test scenarios.

Guidance On Insurers’ Own Risk and Solvency Assessments July 2017 Monetary Authority of Singapore 12 (v) Insurers should state the reason for adopting regulatory capital as their economic capital, where applicable.

Guidance On Insurers’ Own Risk and Solvency Assessments July 2017 Monetary Authority of Singapore 13 4 QUESTIONS FOR THE BOARD’S CONSIDERATION
4.1 The board is ultimately responsible for the business strategy and risk
management of an insurer. In this regard, an insurer’s board should consider the value of the ORSA and its usefulness in guiding business decisions, and take ownership of the ORSA process as an integral part of its oversight of the insurer. A list of possible questions for the board to consider is appended below. This non-exhaustive set of questions is meant to facilitate the board’s review and assessment of the robustness of the insurer’s ORSA and ERM processes. Key questions for Board of Directors to consider - (i) Are the risk tolerance statement and risk limits sufficiently clear? (ii) Is the insurer’s risk governance framework sufficiently clear and robust, and commensurate with its size and complexity? (iii) Have all relevant and material risks been identified? Are there emerging risks that should be more closely monitored? (iv) Are the risk mitigation measures for the risks identified as part of its ERM adequate? (v) Have risk-focused deliberations of the ORSA that centre on material risk areas and their impact on the insurer been conducted? (vi) Have the changes in the insurer’s risk profile compared to the prior assessment, and the reasons for these changes, been sufficiently deliberated? (vii) Was the insurer’s risk tolerance considered during the business planning process, and is there consistency between the risk tolerance and business strategy of the insurer? (viii) Have the stress test scenarios and their results provided a meaningful view of the insurer’s risk profile, particularly in relation to the insurer’s material risks, both existing and emerging?

Guidance On Insurers’ Own Risk and Solvency Assessments July 2017 Monetary Authority of Singapore 14 (ix) Are proposed management actions under each scenario feasible and practicable in the light of the insurer’s internal processes as well as market conditions under each specific adverse scenario?

(x) What improvements to the insurer’s ERM framework and ORSA process are needed to facilitate better integration between business planning and risk management? (xi) Does the ORSA report set out relevant and timely information in a sufficiently clear manner to facilitate deliberations and decision making?

Guidance On Insurers’ Own Risk and Solvency Assessments July 2017 Monetary Authority of Singapore 15 5 CONCLUSION
5.1 A sound ERM framework and a robust ORSA process helps insurers better
identify, understand and manage the risks they face. In particular, the ORSA facilitates early identification of risks that could emerge from an insurer’s existing business strategy over a range of plausible adverse scenarios, thereby allowing early consideration of how those risks could be mitigated, or perhaps averted through adjustments to the insurer’s business strategy, given its risk tolerance.
5.2 The board of directors plays a crucial role in ensuring that the ORSA is
implemented robustly and that their results are carefully considered as part of an insurer’s business planning process. MAS fully expects insurers’ boards to engage in thorough deliberations on the outcomes of their ORSAs, and to guide insurers to continually enhance the quality of their ORSAs in a manner that best facilitates timely and informed decision making at the board level.
5.3 As insurers make refinements to their ERM frameworks and ORSAs, due
consideration should be given to the observations and sound practices described in this paper.