Resources
A Solvency II ORSA review is not an audit of a document. It is your supervisor using the supervisory review process in Article 36 of Directive 2009/138/EC to test whether the own risk and solvency assessment required by Article 45 is a real process: a policy the board approved, an assessment actually performed, results the board challenged, decisions the results changed, a record of each run, and a supervisory report filed on time. Article 36(2)(a) puts the system of governance, "including the own-risk and solvency assessment", first on the list of what supervisors review and evaluate.
Two facts shape everything that follows. The number is not the thing being tested: Article 45(7) says the ORSA shall not serve to calculate a capital requirement. And there is no ORSA certificate and no fixed review cycle in the Directive. Article 36(6) requires reviews to be conducted regularly and leaves the minimum frequency and scope to the supervisor, having regard to the nature, scale and complexity of your business.
| Fact | Detail |
|---|---|
| Legal basis | Article 45 of Directive 2009/138/EC, Articles 262, 304, 306 and 312 of Commission Delegated Regulation (EU) 2015/35, and EIOPA's Guidelines on ORSA (EIOPA-BoS-14/259), which have applied since 1 January 2016. |
| Who reviews you | Your national supervisory authority, through the supervisory review process in Article 36. There is no separate ORSA regulator. |
| What must exist | Guideline 3: a policy for the ORSA, a record of each ORSA, an internal report on each ORSA, and a supervisory report of the ORSA. |
| How often | Article 45(5): regularly, and without any delay following any significant change in the risk profile. Guideline 14: at least annually. From 30 January 2027 the Directive itself says annually, with at least every two years for small and non-complex undertakings and qualifying captives. |
| Filing clock | Delegated Regulation Article 312(1)(b): the ORSA supervisory report goes to the supervisor within two weeks after concluding the assessment. |
| If it goes badly | Article 36(5) powers to require weaknesses to be remedied. Article 37(1)(c) allows a capital add-on where the system of governance deviates significantly from the standards, reviewed at least once a year under Article 37(4) and removed once the deficiencies are fixed. |
What does a supervisor actually review in an ORSA?
Article 45(1) fixes three minimum elements, and a review works through them in turn. The first is the overall solvency needs of the undertaking, taking into account its specific risk profile, approved risk tolerance limits and business strategy. Delegated Regulation Article 262 requires that assessment to be forward-looking and to cover the risks the undertaking is or could be exposed to, including operational risks, together with the nature and quality of the own funds or other resources that cover them. EIOPA's Guideline 7 asks for a quantification of capital needs and a description of other means for all material risks, whether or not they are quantifiable, and, where appropriate, a sufficiently wide range of stress tests or scenario analyses.
The second is compliance, on a continuous basis, with the capital requirements and with the requirements on technical provisions. Guideline 10 spells out what a supervisor expects to see behind that sentence: potential future material changes in the risk profile, the quantity and quality of own funds over the whole business planning period, and how the composition of own funds across tiers may change through redemptions, repayments and maturities. Guideline 11 requires the actuarial function to give input on whether technical provisions will comply continuously and to identify the risks arising from uncertainty in that calculation.
The third is the significance with which the risk profile deviates from the assumptions underlying the Solvency Capital Requirement, whether calculated with the standard formula or an internal model. Guideline 12 allows a qualitative analysis first, and a quantitative one only if the qualitative step indicates a significant deviation. Article 45(2) then adds the requirement that runs through all three: processes proportionate to the nature, scale and complexity of the risks, and a demonstration of the methods used. A supervisor who cannot see the method cannot accept the conclusion.
Article 36(4) tells you how the supervisor approaches it from their side. They assess the adequacy of your methods for identifying possible events or future changes in economic conditions that could hurt your financial standing, and your ability to withstand them. An ORSA that contains a base case and nothing else fails that test on its face.
Which documents will they ask for?
Guideline 3 names four, and a review typically starts by asking for all of them. The policy for the ORSA must be approved by the administrative, management or supervisory body (the AMSB) and, under Guideline 4, describe the processes and procedures for conducting the assessment, the link between the risk profile, the approved risk tolerance limits and the overall solvency needs, and the methods: how and how often stress tests, sensitivity analyses and reverse stress tests are performed, the data quality standards, the frequency of the assessment with a justification of why it is adequate, and the timing of the ORSA together with the circumstances that trigger one outside the regular timetable.
The record of each ORSA is the evidence that the process ran as the policy says. The internal report is what the AMSB approved and, under Guideline 6, what is then communicated to all relevant staff. The supervisory report is the one artefact with fixed contents and a fixed clock.
| Document | What it must contain | Source |
|---|---|---|
| ORSA policy | Processes and procedures, the link between risk profile, tolerance limits and solvency needs, the methods, frequency and its justification, timing and ad hoc triggers. Approved by the AMSB. | EIOPA Guideline 4 |
| Record of each ORSA | Evidence and documentation of each assessment and its outcome. | EIOPA Guideline 5 |
| Internal report | Results and conclusions, communicated to relevant staff once the AMSB has approved the process and the results. | EIOPA Guideline 6 |
| ORSA supervisory report | The qualitative and quantitative results and the conclusions drawn from them; the methods and main assumptions; the overall solvency needs compared with the regulatory capital requirements and own funds; and where significant deviations exist, a quantification of the quantifiable risks not reflected in the SCR. | Delegated Regulation Art. 306 |
| Regular supervisory report, ORSA section | How the ORSA is performed, internally documented and reviewed, and how it is integrated into management and decision-making. | Delegated Regulation Art. 308(4) |
Delegated Regulation Article 304(1)(c) ties the supervisory report to the assessment rather than to a calendar: it comprises the results of each regular ORSA and is due whenever an assessment is performed under Article 45(5), including the ones triggered by a significant change. Article 312(1)(b) gives you two weeks from concluding the assessment to file it. Article 304(2) then requires the summary of the regular supervisory report to include information on the ORSA, which is why an ORSA that contradicts the RSR is one of the quickest routes to a follow-up question.
How is the board's role tested?
Guideline 2 calls it the top-down approach: the AMSB should take an active part in the ORSA, including steering how the assessment is to be performed and challenging the results. EIOPA's introduction to the Guidelines adds that it is crucial the AMSB is aware of all material risks, whether or not they are captured by the SCR and whether or not they are quantifiable. Article 40 of the Directive underpins this by placing ultimate responsibility for compliance on the AMSB.
The evidence a supervisor looks for is not a signature page. It is minutes that show challenge: questions asked about the scenarios, assumptions sent back, a risk appetite discussion that references the assessment. Article 45(4) requires the ORSA to be an integral part of the business strategy and to be taken into account on an ongoing basis in strategic decisions, and Guideline 13 names where the results must show up as a minimum: capital management, business planning, and product development and design. A supervisor can ask for the board paper on a product launch or a dividend and look for the ORSA in it. If it is not there, the assessment was noted rather than used.
When does an ORSA review happen?
The Directive fixes no date. Article 36(6) says reviews are conducted regularly and leaves the frequency to the supervisor. Article 35(2)(a) gives supervisors the power to require information at predefined periods, upon predefined events, and during enquiries into an undertaking's situation, so an ORSA review can be scheduled, triggered, or opened as part of a wider look at your governance. In practice three moments dominate: the weeks after the supervisory report lands, a significant change in the risk profile that should have triggered an ad hoc ORSA under Article 45(5), and a broader governance review where the ORSA is one section among several.
From 30 January 2027 the frequency written into Article 45(5) becomes annual, with a derogation allowing small and non-complex undertakings and captives that meet the conditions to perform the assessment at least every two years, unless the supervisor concludes that a more frequent assessment is needed. The exemption does not touch the duty to identify, measure, manage, monitor and report risks continuously.
What changes on 30 January 2027?
Directive (EU) 2025/2, published in the Official Journal on 8 January 2025, must be transposed by 29 January 2027 and applied from 30 January 2027. It adds three elements to Article 45(1): consideration and analysis of the macroeconomic situation and possible macroeconomic and financial market developments; on a reasoned request from the supervisor, analysis of macroprudential concerns and of the undertaking's own potential to become a source of systemic risk; and the overall capacity of the undertaking to settle its obligations to policyholders and other counterparties when they fall due, even under stressed conditions. A new paragraph 1a lists what the macroeconomic analysis must cover at a minimum: interest rates and spreads, financial market indices, inflation, interconnectedness with other market participants, and climate change, pandemics and other mass-scale events. Small and non-complex undertakings, and undertakings with prior supervisory approval, are not obliged to run the macroprudential analysis.
A new Article 45a adds climate change scenario analysis. Every undertaking must assess whether it has material exposure to climate change risks and demonstrate that materiality in the ORSA. Those with material exposure must specify at least two long-term scenarios, one where global temperature increase remains below two degrees Celsius and one where it is significantly higher, analyse their impact on the business at intervals no longer than three years, and review the scenarios at least every three years. Small and non-complex undertakings are exempt from the scenario work but not from the materiality assessment. The wider set of governance changes, including the requirement in the new Article 41(2a) to appoint different persons to the four key functions, is covered in our guide to Solvency II Pillar 2 requirements.
What the other results get wrong
The first error is treating the ORSA report as the deliverable. Article 45(7) says the assessment does not calculate a capital requirement, and Guidelines 2 and 3 make the policy, the record and the board's challenge as much a part of the ORSA as the report. A polished report with no record of how it was produced is what an experienced supervisor is trained to notice.
The second is describing the supervisory report as an annual filing due with the quantitative templates. It is not. Delegated Regulation Article 312(1)(b) sets the clock at two weeks after concluding the assessment, and Article 304(1)(c) makes a report due for every assessment performed, including ad hoc ones after a significant change.
The third is quoting the 2009 text as final. The three new elements in Article 45(1), the annual frequency in Article 45(5) and the climate scenarios in Article 45a apply from 30 January 2027. An ORSA policy reviewed this year against the old text will need to be rewritten next year.
Could you pass a review next quarter?
Fill this in from your own records. A blank row is the question a supervisor asks first.
| Question | Your answer | Why it matters |
|---|---|---|
| When did the AMSB approve the current ORSA policy, and does it state the frequency and the ad hoc triggers? | Guideline 4. A policy without triggers cannot show that Article 45(5) was respected. | |
| Can you produce the record of the last ORSA, not only the report? | Guideline 5. The record is what proves the process ran as the policy says. | |
| Where in the minutes did the board challenge the scenarios or assumptions? | Guideline 2. Noting is not steering. | |
| Which capital, planning or product decision in the last year cites the ORSA? | Article 45(4) and Guideline 13. | |
| How many days passed between concluding the last ORSA and filing the supervisory report? | Delegated Regulation Article 312(1)(b): two weeks. | |
| Have you assessed whether climate change risk is material, and set two scenarios if it is? | Article 45a from 30 January 2027. |
If several rows are blank, the useful next step is a baseline rather than a rewrite. Our Solvency II ORSA and governance checklist scores the process items in a spreadsheet, our guide to what Solvency II is and how the three pillars fit together places the ORSA against Pillars 1 and 3, and a free compliance check tells you which rows you can evidence today. Our Solvency II Pillar 2 software runs the ORSA as a governed process, with the policy, the triggers, the approval trail and the record in one place; the solvency numbers themselves stay with your actuarial and capital tools.
Frequently asked questions
Is there an ORSA certification?
No. The ORSA is reviewed by your national supervisor under Article 36 of Directive 2009/138/EC. There is no certificate, no accredited ORSA auditor and no fixed supervisory cycle in the Directive.
How often do we have to run the ORSA?
Article 45(5) currently says regularly, and without any delay following any significant change in the risk profile. EIOPA Guideline 14 says at least annually. From 30 January 2027 the Directive says annually, with at least every two years available to small and non-complex undertakings and qualifying captives unless the supervisor requires more.
Who has to sign off the ORSA?
The AMSB approves the ORSA policy under Guideline 4 and approves the process and results before they are communicated internally under Guideline 6. Guideline 2 expects the board to steer the assessment and challenge its results, not only to approve them.
Does the ORSA set our capital requirement?
No. Article 45(7) says the ORSA shall not serve to calculate a capital requirement. The SCR is adjusted only through the routes the Directive names, including a capital add-on under Article 37. What the ORSA does is compare your own view of solvency needs with the regulatory requirements and own funds, which is exactly what Delegated Regulation Article 306(c) requires the supervisory report to show.
What is the difference between the ORSA report and the ORSA supervisory report?
The internal report is what the board approves and staff receive under Guideline 6. The supervisory report is the version sent to the supervisor, with the contents fixed by Delegated Regulation Article 306 and the two week filing window in Article 312(1)(b).
Primary sources
Article references above are taken from Articles 35, 36, 37, 40 and 45 of Directive 2009/138/EC, the amendments to Article 45 and the new Article 45a in Directive (EU) 2025/2 including its Article 4 on transposition, Articles 262, 304, 306, 308 and 312 of Commission Delegated Regulation (EU) 2015/35, and EIOPA's Guidelines on own risk and solvency assessment (EIOPA-BoS-14/259). How a review is scheduled and conducted is a matter for your national supervisor. Confirm the current text and your supervisor's published expectations before relying on a specific provision.
