Towers Watson

Solvency II - Background

Solvency II was initiated by the European Commission (EC) in 2000 to implement a fundamental change to European insurance regulations. The project aims to create a more harmonised, risk-orientated solvency regime resulting in capital requirements that are more reflective of the risks being run. The EC’s objectives are:

• Deepening the integration of the EU insurance market
• Improving the protection of policyholders and beneficiaries
• Improving the international competitiveness of EU insurers
• Better regulation of the EU insurance markets.

The existing EU Solvency I framework for insurers is based on the need to maintain sufficient assets to cover prudent technical provisions, with a minimum level of required capital derived from a simple formula. These calculations are often made using assumptions that contain unquantifiable levels of prudence which are not easily comparable between companies or across territories. The result is a solvency standard that has little sensitivity to the nature and scale of the risks being run and offers limited transparency over financial strength.

The EC requested that the Committee of European Insurance and Occupational Pension Supervisors (CEIOPS) act as an advisor on the development of the Solvency II standard. In particular, the EC asked CEIOPS to advise on calibrating the solvency standard and the economic consequences on the insurance industry, financial markets and policyholders through a series of quantitative impact studies (QIS). QIS results, which comprise of specified solvency calculations provided voluntarily by insurers from around the EU, will form a key input into the EC’s proposal for the Solvency II Directive. The new laws are expected to be in force by 31 December 2012.

Political process

Solvency II is being enacted under the Lamfalussy Process. This allows agreement of the new framework to be obtained in stages.

Under Lamfalussy, allocation to different levels is important in determining the level of harmonisation expected in the application of Solvency II across Europe. Level 1 and Level 2 measures will be applied in a harmonised manner across all member states from the outset, while Level 3 allows some national discretion — although practice is expected to converge over time. Ultimately, the split between Levels 2 and 3 (and hence the amount of initial discretion available to national supervisors) will be decided by the European Commission in conjunction with the European Parliament and Council.

The Three Pillars approach

The proposed Solvency II framework, is similar to the Basel II three pillar approach.

Pillar 1

Pillar 1 defines the financial resources that a company needs to hold in order to be considered solvent.  In particular, it contains guidance on the valuation of assets, liabilities and capital requirements. 

Liabilities relating to insurance contracts are referred to as technical provisions, which can be broken down as the sum of best estimate liability and risk margin.  These technical provisions should be sufficient, on a market-consistent basis, to run-off the liabilities or transfer them to another insurer.

• The best estimate liability will typically be the present value of the probability weighted average of future cashflows, with no allowance for prudent margins or surrender value floors
  
• Risk margins are required to be calculated for all non-hedgeable risks.  A risk is classed as non-hedgeable if there exists no deep and liquid financial market that would allow the insurer to purchase (or sell) a financial instrument that effectively offsets the risk.  For example, equity risk will usually be a hedgeable risk, while lapse risk will almost always be non-hedgeable
  
  The calculation of the risk margins for a non-hedgeable risk in the technical provisions is based on a cost-of-capital approach, with cost of capital defined as the cost of financing future Solvency Capital Requirements (SCRs) to support the business

Pillar 1 defines two capital requirement thresholds: The Minimum Capital Requirement (MCR) and the Solvency Capital Requirement (SCR). 

• The MCR is the lower of the two, and represents a trigger point for mandatory supervisory intervention.  It will need to be covered by eligible resources within one year of the effective date of the Solvency II legislation.  The MCR is calibrated to 85% value-at-risk over a one-year time horizon, subject to specified minimum floors.  Although the exact details of the calculation are yet to be decided, it should be clear and simple, and is likely to be a linear formula based on the SCR
  
• The SCR is the higher of the two, and represents the capital required to protect against adverse events that may occur over the next 12 months.  It is calibrated to a 99.5% value-at-risk measure over a one-year time horizon.  Failure to maintain sufficient financial resources to cover the SCR will require immediate notification to the supervisory authority, and the submission of recovery plan.  Standard formulae (including standard stress tests and correlations) or internal models may be used to calculate the SCR, although internal models will need to be approved by the relevant supervisory authority.
  

For further details of the process required for internal model approval, please refer to our analysis here.

The sucecssive Quantitative Impact Studies (QIS) exercises have enabled companies to test the proposed Pillar 1 regulations, and to provide feedback.  These exercises have been, and will continue to be, instrumental in defining the final regulations, and for helping companies to understand the likely impact of Solvency II on their businesses. 

The fifth and final exercise (QIS5) is due to begin shortly, with results expected to be submitted by late 2010. 

For further information on QIS5 (and previous QIS exercises), and all of the Pillar 1 items mentioned above, please refer to our analysis here.

Pillars 2 and 3

Pillar 2 focuses on the governance and risk management systems are an insurer is expected, together with the requirements for supervision of these systems and controls.  In particular, this includes a review of the SCR and the firm’s Own Risk and Solvency Assessment (ORSA).

The ORSA is an assessment of the firm’s capital needs taking into account the specific risk profile and strategy of the firm. It analyses areas in which the SCR does not fully reflect this risk profile. It also requires a multi-year projection of available capital and capital required. Perceived deficiencies in the ORSA may result in additional capital requirements.

Pillar 3 revolves around the disclosure of a firm’s financial condition.  The finalised Directive indicates detailed disclosure requirements, including descriptions of the firm’s business, governance procedures, risk exposures and valuation bases. Breaches of the MCR and significant breaches of the SCR are also required to be disclosed.

Current issues

Around this general framework, there continues to be a number of technical and practical issues that remain to be resolved. In particular, the feedback from CEIOPS on the results of QIS4 highlighted the following areas as being significant issues for further consideration in future impact studies:

• the classification of future profits within own funds
• the allowance for illiquidity premiums
• the treatment of future premiums
• the approach to equity risk
• the approach to counterparty default risk
• the calculation of risk margins
• the treatment of the risk absorbing properties of future management actions
• the allowance for operational risk
• the treatment of group diversification and capital transferability

For further details of the issues arising out of QIS4, and the subsequent developments in QIS5, please refer to our analysis here.

Internal Models

In order to be Solvency II compliant, a (re)insurance undertaking must calculate its technical provisions and Solvency Capital Requirement (SCR) using either a standard formula or an internal model developed by the undertaking.

Results derived from an internal model can only be used for Solvency II purposes if the model is approved by the appropriate regulator. The process for approval normally involves two distinct stages, though the first stage is not mandatory:

• pre-application – culminating in an opinion on the entity's readiness to formally apply
• application – assessment and ultimately approval or refusal.

If the application is approved, the undertaking will be able to use the internal model to calculate the SCR. The approval may, however, be subject to conditions such as imposition of a capital buffer and/or other conditions with a plan to show how these conditions will be met.

On rejection, the undertaking will be given the option to withdraw the application and a waiting period may be imposed before the submission of a new application (even if the application is withdrawn).

The regulator may grant partial approval in the case that an application for a partial internal model on a stand-alone basis would be approved.

Why an internal model?

According to the Chief Risk Officers Forum: “Risk management without risk modelling is not an option: the complexity of the insurance business model requires sophisticated techniques to measure and manage risk exposures.”

So what are the major advantages?

Reduce regulatory capital – internal models track risk more accurately and, virtually without exception, will result in the need to hold less regulatory capital.

Improved wider risk management – firms that invest time and resources in internal models are investing in an understanding of the risks themselves at a more fundamental level. They can manage their business better as a result.

Operational effectiveness – internal models help drive business efficiencies in areas like reinsurance strategy, catastrophe cover and asset management. The reach of internal models goes far beyond regulatory submissions. Business performance dashboards developed in models can be valuable strategic decision making support tools for senior management.

Stakeholder assurance – a demonstrably robust approach to risk management is increasingly important for relations with rating agencies and in helping to raise new business funds.

Build a more risk aware business culture – when used wisely and fully embedded in a company, internal models help make people aware of the impact of their decisions on the wider business.

Own Risk Solvency Assessment (ORSA)

What is the ORSA?

The ORSA is a key part of Solvency II, as required by Pillar 2.  In a nutshell, it is an insurer’s own assessment of the capital required for it to run its business, reflecting the company’s risk profile and tolerances.  It must be produced at least annually, and will be subject to external assessment, but not public disclosure.  In many cases, the ORSA is likely to produce a different result to the regulatory capital requirement imposed by Pillar 1.

The detailed form of the ORSA is expected to be included in the Level 3 text, due in December 2011.  In the meantime, there have been a number of publications that build on the high-level definition of the ORSA included in Article 45 of the Directive.  In particular, CEIOPs have published five principles that the ORSA should adhere to:

1. The ORSA is the responsibility of the undertaking
2. It should encompass all material risks
3. It should include adequate measurement/assessment processes, and be embedded in decision making
4. It should be forward-looking
5. It needs to be appropriately evidenced/documented and independently assessed

Key components of the ORSA

1. Risk appetite
2. Risk identification and assessment
3. Risk measurement
4. Risk reporting
5. Link to business strategy
6. Stress testing
7. Governance structure

Key component 1: Risk appetite

The risk appetite is a statement of the nature and level of risks that a company is willing to take on in pursuit of its objectives/strategy.  It must recognise the requirements and constraints of all stakeholders.

Key component 2: Risk identification and assessment

The ORSA requires a firm to have a systematic process to identify all the risks that the insurer is exposed to.  A “risk register” is a commonly used tool for this.  This process will identify any risks not captured, or inadequately reflected in the Pillar 1 capital requirements.  The process of identifying risks must be able to identify emerging risks in a timely manner.

Key component 3: Risk measurement

The risk management systems must feature an adequate process for assessing all the risks identified, and should be sufficiently granular to be used throughout the business.  Compliance with the capital requirements identified by the ORSA should be assessed on a continuous basis.

If a firm uses an internal model to produce the Pillar 1 capital requirements, then it will be expected to use the internal model to produce the ORSA.  Otherwise an internal model is not required.

The limitations and assumptions underlying any system used to assess risks should be understood and recognised.

Key component 4: Risk reporting

There should be a clear link between the assessment of each risk and the risk appetite/tolerances identified earlier.  The results of the risk assessments should be sufficiently granular to be of use in the business.  They should also be clearly communicated.
A risk dashboard is a common tool used to achieve these requirements.

Key component 5: Link to business strategy

The embedding of the ORSA in the information and decision-making processes within the insurer is a critical part of Solvency II, and in particular the “use test”.  The decision-making processes need to be clearly, and demonstrably, based on the output of the previous steps.  Similarly, the decision making processes need to feed back into the processes of identifying, assessing and reporting on risks.  There needs to be an understanding of the risk management systems amongst the senior management of the company.

Key component 6: Stress testing

In addition to identifying and assessing the risks to a company’s objectives/strategy, the company needs to understand the impact that a range of adverse scenarios will have on it. 

Key component 7: Governance structure

Overall responsibility for risk management resides at Board level.

The requirements of Pillar 2 lead to a clear separation of responsibilities within the risk management framework:

1. Business operations.  Responsible for managing risk in line with appetite and limits, performing asset-liability modelling, managing capital, operational risks and reinsurance.
2. Risk management function.  Independent of operations.  Responsible for monitoring and reporting risk profile, designing and assessing the effectiveness of risk management systems, and control of the internal model.
3. Internal audit.  Independent of operations.  Responsible for evaluating internal controls and governance, and for assessing compliance with internal strategy, policy and processes.

Current issues with ORSA

A number of issues have been identified with the ORSA as it is currently stands, including:

• The interaction between ORSA, Pillar 1 results and capital add-ons
• Harmonisation of the ORSA review amongst different supervisors
• Expectations about Group ORSA submissions