ORSA reports play a special role within the Solvency II reporting system because without them it is not possible to supervise the undertakings' solvency in an appropriate manner and taking a prospective approach. They provide important information about whether insurers have set up suitable and interlinking capital and risk management processes to appropriately monitor and manage their capital requirements – which change depending on risk exposure – and ensure compliance with the regulatory capital requirements on an ongoing basis. In the ORSA reports, BaFin therefore requires detailed information that goes beyond the qualitative and qualitative data found elsewhere in Solvency II reporting.

Need for further improvement

During the preparation phase for Solvency II, the undertakings were already required to conduct a scaled-down version of the ORSA that took account of the fact that the quantitative requirements of Solvency II were not yet applicable at that time. Since then, most insurers have submitted two (and in some cases three) ORSA reports to BaFin, which in turn has subjected them to an initial analysis.

The conclusion drawn is that, overall, the undertakings are making good progress with their ORSA reporting. As was to be expected, many insurers are making intensive and highly detailed efforts in reporting their material risks – such as market risks, default risks and underwriting risks. Assessments of operational risks have also improved in comparison to the first reports received. In addition, in their ORSA reports, many undertakings also deal with risks that do not play any role in the calculation of their solvency capital requirement (SCR), for example strategic, reputational and liquidity risks.

Nonetheless, the analysis has also shed light on a number of shortcomings where further improvement is needed. BaFin's findings have already been used in a supervisory assessment published by the European Insurance and Occupational Pensions Authority (EIOPA) in June. German undertakings should examine the degree to which they are affected by EIOPA's assessment and, where necessary, take the recommended steps for improving their ORSA processes.

In addition to the topics addressed by EIOPA in its assessment, BaFin's analysis of the ORSA reports also identified additional weak spots. These relate in particular to the depth of information in the undertakings' descriptions of their risk situation, how up-to-date the data used is, the submission of ad hoc ORSA reports, the assessment of overall solvency needs and the assessment of continuous compliance with the regulatory capital requirements and the requirements for technical provisions. Here, too, the undertakings should determine the degree to which these findings apply to them and improve their reports accordingly.

Depth of information

Although most of the reports submitted by insurers to BaFin have been quite extensive, they nevertheless do not contain all the essential qualitative and quantitative results of an ORSA. The numbers and conclusions presented are not always understandable because the assumptions, methods, calculations and rationales upon which they are based are neither stated in the reports nor ascertainable from other sources. BaFin therefore expects future reports to contain considerably more background information to enable it to make its own assessment about the undertakings' risk and capital management.

On the other hand, many insurers provide general information on how their risk management systems (RMS) are structured and on the supervisory requirements for the RMS and ORSA. Such information, however, does not belong in an ORSA report and should not be included in the future.

Data basis

BaFin is very concerned that in most cases the data used is not up to date. Although they do not conduct the ORSA until the end of the third quarter or even during the fourth quarter of a given financial year, many undertakings draw on data from the annual financial statements of the previous financial year.

However, an ORSA based on old data is not suitable as a basis for strategic decisions regarding, for instance, risk and capital management. BaFin is therefore giving consideration to setting requirements that limit how old the data used may be.

Ad hoc ORSA reports

Of particular note is the fact that, to date, BaFin has received only a relatively small number of ad hoc ORSA reports, i.e. reports produced by undertakings due to material changes in their risk profile.

BaFin points out that undertakings must always report the results if and to the extent that they carry out an ad hoc ORSA. This also applies if the suspected material change in the risk profile which prompted the ORSA is not actually confirmed once the assessment is conducted.

Assessment of overall solvency needs

When assessing their overall solvency needs, undertakings may deviate from the economic valuation concept stipulated in Article 75 of the Solvency II Directive and the delegated acts on Solvency II which deals with the recognition and valuation of assets and liabilities and which has to be applied when determining quantitative requirements. Undertakings proceeding in this manner, however, have to give reasons why this approach is more suitable for reflecting the undertaking's specific risk profile and business strategy. In future, BaFin will be making greater efforts to ensure that undertakings provide reasonable justification for deviations in accordance with the EIOPA Guidelines on ORSA. If they are unable to do so, BaFin will demand that they change their practices.

Furthermore, the ORSA reports of many undertakings fail to specify the level of confidence or security that underlies their assessment of overall solvency needs. Moreover, some insurers fail to comply with the requirement to precisely analyse significant deviations in their risk profiles from the assumptions underlying their SCR calculations and to take, where required, such deviations explicitly into account when determining their overall solvency needs. Moreover, in many of the ORSA reports, there is no estimation of the potential capital requirements for additional material risks which are not taken into account in the SCR calculation due to their non-quantifiability under a standardised formula. This includes, for example, the aforementioned reputational and strategic risks. Such an estimation could be provided, for instance, by quantifying the knock-on effects from a selection of scenarios predicated on such risks materialising.

In the ORSA, the undertakings must take a prospective view on the risks they are or might be exposed to and on their solvency situation, basing this assessment on a medium-term horizon of at least three to five years. Risks that are only foreseeable over a longer period must be broken down to fit this time frame. Most insurers examine the necessary medium-term period with about half of them working on the basis of a five-year outlook. However, some undertakings provided projections for less than three years in their reports. Even if their business planning period was shorter in the past, this is not acceptable given the volatility of the capital requirements under Solvency II. Therefore, the undertakings concerned must, where necessary, extend their planning periods in order to take these new conditions into account.

Supervisory capital requirements and requirements for technical provisions

In many of the ORSA reports, the results provided from the assessment of continuous compliance with the regulatory capital requirements consist merely of projections of the expected amount of the SCR, the minimum capital requirement (MCR), and own funds over the next several years and a statement on whether, based on these projections, there will be a capital shortfall. These details are not sufficient. Without information on the assumptions about the external and internal conditions underlying the projections and details on how the numbers are arrived at, BaFin cannot assess whether continuous compliance with regulatory capital requirements is ensured. Furthermore, in order to assess whether the undertaking has to take capital management measures, BaFin expects information on the target coverage ratio level and on the undertakings' motivations for specifying this level.

Little concern is shown for the topic of compliance with the requirements for technical provisions in most of the reports. The information provided is usually very brief and lacks detail. BaFin expects significantly more detailed information in this area in the future, in particular about potential future problems concerning compliance with the requirements and about the actuarial function's assessment of compliance with the requirements.

Undertakings that make use of measures for long-term guarantees (LTG) or transitional measures (such as the volatility and the matching adjustment, the transitional measure on technical provisions or the transitional measure on risk-free interest rates) must take account of these measures when assessing their continuous compliance with the regulatory capital requirements and the requirements for technical provisions and also conduct the assessment both with and without these measures. The assessment may not consist of merely listing the quantitative effects in the medium term. The insurers must also examine and report what the identified effects mean for them and what conclusions they draw from this. If group undertakings make use of LTG or transitional measures, then the effects are to be considered at group level in the ORSA.

A feature specific to Germany is that undertakings which provide long-term guarantees – typically life insurers – must also examine their long-term risk-bearing capacity in the ORSA. In such cases, an outlook for the next 20 years can be appropriate. In this context, it is not sufficient to determine whether or not an undertaking has problems maintaining its long-term risk-bearing capacity. Rather, if an undertaking identifies difficulties in this area, it must also describe how it intends to deal with them in specific terms. The ORSA report must provide details of the causes, effects and solutions as well as the rationale for each.

Role of senior management

Senior management is expected to play an active role in the ORSA process. Furthermore, it must consider the ORSA results in its strategic decision-making process.

Based on the reports which have been submitted, however, it is not clear in many cases whether senior management has actually met these requirements. For example, there is often a lack of specific details on how exactly senior management played an active role and influenced the ORSA process. Nor is the degree to which the ORSA results have influenced strategic decisions always ascertainable from the reports. Most of the information here consists merely of blanket statements asserting that the relevant requirements have been complied with. The undertakings provide a similarly sparse amount of information about which strategic decisions considered by senior management were examined in the ORSA with a view to their consequences. This is particularly true of ORSA reports at group level.

BaFin therefore expects future ORSA reports to contain more detailed information on the contribution of senior management and on how the ORSA results have been drawn on in senior management's strategic decisions. Furthermore, it is necessary to provide more detailed information about which potential strategic decisions were examined in the ORSA and what the results were.

Quality of the stress tests

In the context of the ORSA process, stress tests are an important factor in determining an undertaking's capital requirements. BaFin requires sufficient information on which scenarios were selected for which reasons and what exactly the results of the stress tests were – not merely statements about the conclusions drawn by the undertaking from the results.

Only in this way is it possible for BaFin to judge whether the stresses applied are appropriate for the undertaking's risk profile and suitable for uncovering potential weak spots, identifying the main risk drivers and determining the capital requirements accurately. Therefore, BaFin expects future ORSA reports to contain significantly more detailed information on the stress tests conducted in the ORSA by the insurers.

Significance of the risk profile's deviation from the SCR assumptions

In order to assess the significance of their respective risk profile's deviation from the assumptions underlying the SCR calculation, a number of undertakings "offset" underestimated and overestimated risks. However, such offsetting is only possible under narrowly defined and stringent conditions. The report must describe to what extent these conditions have been met.

If such grounds are not stated or do not seem plausible, BaFin can demand additional evidence that the conditions have been met or opt to disregard the offsetting.

Outlook

In light of the importance of the ORSA report for prospective supervision, BaFin will be paying greater attention in future to ensuring appropriate and targeted reporting. Where necessary, BaFin will demand improvements from individual undertakings. If ORSA reports are found to lack the necessary quality in the future, BaFin will provide specific details on the relevant requirements.