Governance, risk management and ORSA

Read the PDF edition (2 pages)

The VAG of 2004 already required insurers to have an organisation that enables them to identify, assess, monitor and control their risks. FINMA developed these requirements over the following years into detailed rules on corporate governance, risk management and the internal control system.¹ The members of the board of directors and of the executive management must meet requirements of fit and proper conduct, which FINMA assesses at the time of their appointment. Insurers must establish independent control functions for risk management, compliance and internal audit. The appointed actuary must have direct access to the board of directors.

The own risk and solvency assessment (ORSA), introduced by FINMA with a circular in force from 2016, obliges insurers to assess their risk profile and capital needs on a forward-looking basis over the horizon of their business planning.² ORSA differs from the SST in that it is the insurer's own assessment, based on its own view of its risks and its business strategy, whereas the SST follows a prescribed method. It must consider risks that are not captured, or not fully captured, by the SST, such as strategic risks, reputational risks, liquidity risks and emerging risks like those related to climate change. The board of directors is responsible for the ORSA and must approve the report, which is submitted to FINMA at least annually.

The ORSA follows the Insurance Core Principles of the IAIS and corresponds to the ORSA of Solvency II. Its value depends on whether insurers treat it as a genuine management tool or as a reporting exercise. In supervisory practice, FINMA has noted considerable differences in quality between insurers and has used its reviews of the ORSA reports as an entry point for discussions on strategy and risk appetite.³ For a group such as the combined Basel insurer, whose merger raised questions of integration, of the transfer of portfolios between entities and of the consistency of risk management in several countries, the ORSA is the place where such questions are expected to be addressed by the board in a structured manner.

Notes

1. Arts. 14 and 22 VAG and Arts. 96 ff. AVO (as revised) on organisation, risk management and internal control; FINMA Circular 2017/2 "Corporate governance – insurers". Numbering and current version to be verified. ↩
2. FINMA Circular 2016/3 "ORSA", in force since 1 January 2016; integrated into the revised AVO/AVO-FINMA in 2024. To be verified. ↩
3. On FINMA's observations on the quality of ORSA reports, see FINMA annual reports and supervisory communications. To be verified. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of August 2025.