How to Prepare a Solvency II ORSA That Satisfies PRA Expectations

The ORSA is the one document where the PRA expects to see the board's own thinking about risk and capital, not a repackaging of the SCR calculation. If it reads like a compliance artefact, supervisors will treat it as one, and the follow-up questions will reveal the gap quickly. The work that distinguishes a credible ORSA from a weak one happens months before drafting begins.

Start With What the PRA Is Actually Reading For

Supervisors read the ORSA to answer three questions. Does the board understand its material risks on a forward-looking basis? Does the firm hold enough capital, under its own view, through plausible stress? And are risk appetite, strategy, and capital planning genuinely integrated, or stapled together at the end?

If your ORSA cannot answer these three questions clearly in its executive summary, no amount of appendix detail will rescue it. Write the executive summary first, in draft, and use it to pressure-test whether the underlying work supports the conclusions.

Get the Risk Profile Assessment Right

The PRA pays close attention to the firm's assessment of whether the standard formula (or internal model) appropriately reflects its risk profile. This is a judgement call, not a calculation, and it is where supervisors probe hard.

Be specific about where the standard formula may understate or overstate your risks: concentration in a particular line, non-standard reinsurance structures, operational risk exposures the formula does not capture well, or asset risks that sit awkwardly in the prescribed buckets. Quantify the gap where you can. If you conclude the standard formula is appropriate, explain why with evidence, not assertion.

Make Stress and Scenario Testing Do Real Work

Weak ORSAs run a handful of mild scenarios that leave capital comfortably above the SCR. The PRA reads this as a lack of imagination or a reluctance to confront the firm's vulnerabilities.

Good practice: build scenarios from your own risk register, not from a generic template. Include at least one reverse stress test that identifies the point at which the business model fails, and describe the management actions, with realistic timelines and second-order consequences. Where management actions depend on market access or counterparty behaviour under stress, say so and test the assumption.

For life insurers, pay particular attention to combined scenarios: longevity shocks alongside credit spread widening, for example. For general insurers, consider the interaction of large losses with reinsurance recoverables and reinstatement costs.

Link Capital, Risk Appetite, and Strategy Visibly

The ORSA should show the business plan projected forward, the capital position under that plan, and how it moves under stress. Risk appetite statements should bite: if the plan breaches appetite under a plausible scenario, the ORSA should say what the board would do and when.

If your three year plan assumes growth in a line, the ORSA should show the capital implications of that growth, including any changes to risk profile and the point at which further growth would require fresh capital or a change in strategy.

Governance and the Board's Fingerprints

The PRA wants to see the board challenging the ORSA, not approving it. Minutes should show substantive discussion: questions asked, assumptions tested, scenarios requested. If the board meeting approving the ORSA ran for forty minutes with no amendments, that is a problem.

The Chief Risk Officer should own the process, but the ORSA is a board document. Non-executives, particularly the Risk Committee chair, should be able to speak to the key judgements without a script.

What Good Looks Like

A credible ORSA is readable by a supervisor in an afternoon, with the critical judgements visible in the main body rather than buried in annexes. It is honest about uncertainty, specific about management actions, and shows a board that has genuinely engaged.

Your next step: before the next ORSA cycle, read your last submission as if you were the supervisor. Where would you ask the hardest questions? That is where this year's work begins.

Frequently Asked Questions

How often should the ORSA be refreshed outside the annual cycle?

Whenever the risk profile changes materially: a significant acquisition, a strategic pivot, a major reinsurance restructuring, or a shift in the external environment that invalidates key assumptions. The regulation requires it, and the PRA will ask why one was not produced if circumstances clearly warranted it.

How detailed should reverse stress tests be?

Detailed enough to identify the specific combination of events that would render the business unviable, and to inform recovery planning. A reverse stress test that concludes "a 1 in 200 event" without specifying what that event looks like is not useful and will not satisfy the PRA.

Should the ORSA reference the internal model validation?

Yes, if you use an internal model. The ORSA should draw on validation findings and be explicit about model limitations and how they affect the capital assessment. Treating the two documents as separate is a common weakness.

How much should the ORSA say about climate risk?

Enough to show the board has assessed materiality over appropriate time horizons, considered physical and transition risks across both sides of the balance sheet, and run scenarios that are challenging rather than token. SS3/19 remains the reference point for PRA expectations.