Governance, ORSA and reporting · RiskAtoms Academy

By the end you will be able to

1Describe the system of governance, the four key functions and the fit and proper requirement.
2Say what the ORSA must cover, how it links to the figures, and what changes in it from 2027.
3Read a year-end QRT excerpt and state the reporting deadlines today and from 30 January 2027.
4Show how a judgement in the business plan moves the SCR through the LAC DT.

Why it matters

Every number in this module so far came out of a formula. But the formula was fed by people: someone chose the plan that justifies €1,204.4m of tax credit, someone signed off the best estimate, someone checked both. Pillars 2 and 3 of Solvency II (L4.6.01: The Solvency II architecture) are about those people: who they must be, what they must assess, and what they must report, to whom and by when.

Core explanation

Who runs the numbers, who checks them, who sees them

Illustrative dataRiskAtoms Insurance SE, under the rules

The same made-up composite insurer as M3.8: Insurance risk, in € millions at 31 December 2025. Its booked figures stand: own funds €9,300m, a Solvency Capital Requirement of €5,000m, a ratio of 186%. L4.6.05: The standard formula: structure rebuilt the standard formula article by article; where Level 3 stated a figure or used its own cat model, the “rules in outline” view computes the formula instead (SCR €5,155.9m, ratio 180.4%). The book applies no long-term guarantee measure, no transitional and no internal model. Every what-if on this page is labelled, holds the deferred-tax adjustment at the book's 19.4% of BSCR plus operational risk, and is before tax. Every policy, bond, treaty and counterparty is invented.

Added here. The QRT excerpt below lays out the booked year-end figures in the shape of the templates; it is not a filed return. The LAC DT test uses the book's plan assumptions. illustrative

The system of governance

Art 41 asks for an effective system of governance proportionate to the business: a transparent structure, clear allocation and segregation of responsibilities, and written policies on at least risk management, internal control, internal audit and, where relevant, outsourcing, approved by the AMSB and reviewed at least annually. EIOPA's guidelines add the four-eyes principle: any significant decision involves at least two of the people who effectively run the firm. Those people, and anyone holding a key function, must be fit and proper, and the supervisor is told when they change (Art 42).

Sort itWhich key function does it?

Sort each task into the key function the Directive gives it.

Coordinates the calculation of technical provisions and reports on their reliability to the board.
Evaluates the adequacy and effectiveness of the internal control system, objectively and independently of operations.
Advises the board on compliance with the laws and identifies and assesses compliance risk.
Runs the system that identifies, measures, monitors, manages and reports the firm's risks, including those the SCR does not capture.
Gives an opinion on the overall underwriting policy and on the adequacy of reinsurance.

A firm may outsource a function but stays fully responsible for it, and must tell the supervisor before outsourcing a critical one (Art 49). Its investments follow the prudent person principle (Art 132) rather than a list of permitted assets. When L3.1.13: Measuring performance said insurers face their own investment rules under Solvency II, this is the article it meant.

The ORSA

The ORSA (Art 45(1)) covers three things: the firm's overall solvency needs given its own risk profile, tolerances and strategy; continuous compliance with the SCR, the MCR and the provisions rules; and how far its risk profile departs from the assumptions behind the SCR. It is run regularly, at least annually under EIOPA's ORSA guidelines, and at once after any significant change in the risk profile (Art 45(5)), and its results go to the supervisor. L3.8.12: Insurer investment risk and the ORSA ran the book's ORSA: a base plan from 186.0% to 205.9% by 2028, and a market stress that takes 2026 to 136.5%.

ExploreFrom the board's strategy to the supervisor

Click a box to see what happens there.

Strategy

The board sets the business plan and risk appetite. The ORSA is part of the business strategy and is taken into account in strategic decisions (Art 45(4)).

Reporting

Pillar 3 has three outputs. QRTs go to the supervisor quarterly and annually. The SFCR is public. The RSR is private. Each has a deadline counted in weeks from the reporting date.

Today: Delegated Regulation 2015/35 Arts 300 and 312. From 30 January 2027: Directive Arts 35b and 51 as amended by Directive (EU) 2025/2.
Report	Weeks today	Due (YE 2025, Q1 2026)	From 2027	Due (YE 2027, Q1 2027)
Annual QRTs	14	8 Apr 2026	16	21 Apr 2028
SFCR	14	8 Apr 2026	18	5 May 2028
RSR (when due)	14	8 Apr 2026	18	5 May 2028
Quarterly QRTs	5	5 May 2026	5	5 May 2027

The formal version

The ratios the QRTs carry are percentages (M-A01: Percentages), and so is the ceiling on the LAC DT: the tax rate times the loss, since Art 207 sets no separate cap. Directive Arts 41–51 and 132; Delegated Regulation Arts 207, 258–275, 300–312.

\begin{aligned} \text{SCR ratio} &= \frac{\text{eligible own funds (SCR)}}{\text{SCR}}, \qquad \text{MCR ratio} = \frac{\text{eligible own funds (MCR)}}{\text{MCR}} \\ \text{LAC DT} &\le \min\Big(\text{booked},\ t \cdot \big(\tfrac{\text{DTL}}{t} + \min\big(L - \tfrac{\text{DTL}}{t},\ \textstyle\sum_{k=1}^{5} P_k\big)\big)\Big), \qquad \text{ceiling } t\,L \\ L &= \text{BSCR} + \text{Op}, \qquad \text{SCR} = L - \text{LAC DT} \end{aligned}

$t$ is the tax rate (25% on the book), DTL the net deferred tax liability already held (€175.0m), $P_k$ the pre-tax profit the plan shows in year $k$ after the shock, and $L$ the loss the SCR describes, €6,204.4m.
How much profit to count, and for how long, is a judgement: the book takes three plan years at 80% of today's profit, cuts years 4 and 5 by a further 50% and 75%, and counts nothing after year 5. Supervisors look hard at it because nothing else in the SCR depends so directly on management's own plan.

Try it

The ORSA's plan feeds the LAC DT. Make the plan more pessimistic and see when the booked figure stops being supportable. The break-even is a fall of 21.6%.

Try itDoes the plan carry the tax credit?

Fall in pre-tax profit in the three-year plan after the shock20%

Years 4 and 5 are cut a further 50% and 75%; nothing counts after year 5. Before the shock the plan shows €1,400.0m a year.

Year 1

€1,120.0m

Year 2

€1,120.0m

Year 3

€1,120.0m

Year 4

€560.0m

Year 5

€280.0m

Existing net DTL

€175.0m

Supported by the test

€1,225.0m

Ceiling: 25% of BSCR + Op

€1,551.1m

Booked LAC DT: €1,204.4m

LAC DT used€1,204.4m

Cut from the booked figure€0.0m

SCR€5,000.0m

Solvency ratio186.0%

The plan supports the booked €1,204.4m with €20.6m to spare.

Illustrative: the profit path and haircuts are the book's assumptions (m4-6, after m3-8), not a rule; tax at 25%, no carry-back.

Worked example

The year-end pack for RiskAtoms Insurance SE

€ millions, 31 December 2025, as booked. The excerpt follows the layout of S.25.01 (SCR on the standard formula), S.23.01 (own funds) and S.28.02 (the MCR of an insurer with both life and non-life activity); it is not a filed return.

Filling the templates, then the narrative

Step 1 of 6

1

S.25.01: the SCR

Module (net)	€m
Market	3,391.4
Counterparty default	150.0
Life underwriting	2,054.0
Health underwriting	198.1
Non-life underwriting	2,801.2
Diversification	−2,828.9
BSCR	5,765.9
Operational risk	438.6
LAC DT	−1,204.4
SCR	5,000.0

Regulatory lens

Directive 2009/138/EC Arts 35, 41–51 and 132; Delegated Regulation (EU) 2015/35 Arts 207, 258–275 and 300–312; Directive (EU) 2025/2, applying from 30 January 2027. Status as at 4 November 2026 as at 4 Nov 2026.

In the EU

EU from 2027 From 30 January 2027 the ORSA must cover the macroeconomic situation and potential macroprudential concerns, and a firm with material climate exposure must analyse at least two long-term climate scenarios (new Art 45a). Small and non-complex undertakings may run their ORSA every two years. The SFCR splits into a part for policyholders and a part for market professionals, and its balance sheet is audited (Art 51a). Deadlines lengthen to 16 weeks for annual QRTs and 18 for the SFCR and RSR (Arts 35b, 51). Firms using the VA also assess how their risk profile departs from its assumptions (Art 45(2b)).

In the UK

UK The PRA removed the RSR from year-end 2023 and, from 31 December 2024, cut the number of templates by a net 107, about a third, while adding a few (PS3/24, 29 February 2024). Governance and the ORSA are unchanged in substance. More in L4.6.13: Solvency UK and global standards.

Spark Atoms

Guess first, then open

Spark AtomPricing is governance too

Solvency II's prudential rules sit beside conduct rules. EIOPA's supervisory statement on differential pricing practices (16 March 2023) reads the Insurance Distribution Directive's product oversight rules as covering pricing, and names price walking (raising renewing customers' premiums for reasons unrelated to risk or cost, such as their low propensity to shop around) as a practice that can treat customers unfairly. That is the oversight of pricing L3.8.02: Non-life underwriting and pricing pointed to.

Spark AtomWhy the four functions are separate

Key functions must be operationally independent so that each can raise a problem without being overruled by the people whose work it checks. Internal audit must also be independent of the other key functions (Delegated Regulation Arts 268 and 271(1); EIOPA governance guidelines, 2015).

Key takeaways

The system of governance (Art 41) needs written policies reviewed at least annually, a board that owns them, and fit and proper people in charge (Art 42).
Four key functions: risk management, compliance, internal audit and actuarial (Arts 44–48), each operationally independent.
The ORSA assesses overall solvency needs, continuous compliance and the gap to the SCR's assumptions; it sets no capital requirement (Art 45).
Today annual QRTs and the SFCR are due 14 weeks after the year end (8 Apr 2026 for 2025); from 2027, 16 and 18 weeks.
On the book, the LAC DT of €1,204.4m rests on the ORSA's plan: a profit fall above 21.6% would cut it and raise the SCR.

Reaction

Check what stuck

Glossary

System of governance: System of governance: the organisation, policies and functions through which an insurer is run soundly and prudently, with clear allocation and segregation of responsibilities (Directive Art 41).
AMSB: AMSB: the administrative, management or supervisory body, in practice the board. It has ultimate responsibility for compliance with Solvency II (Art 40).
Key function: Key function: one of the four functions the Directive names: risk management, compliance, internal audit and actuarial (Arts 44, 46, 47 and 48). Other functions may be key if the firm treats them so.
Fit and proper: Fit and proper: those who effectively run the firm or hold key functions must have the qualifications, knowledge and experience for the job (fit) and be of good repute and integrity (proper) (Art 42).
ORSA: ORSA: the own risk and solvency assessment, the firm's own view of its overall solvency needs, of continuous compliance with its capital and provisions requirements, and of how far its risk profile departs from the SCR's assumptions (Art 45).
QRT: QRT: a quantitative reporting template, the tables a firm sends its supervisor each quarter and year (Implementing Regulation (EU) 2023/894).
SFCR: SFCR: the solvency and financial condition report, published every year (Art 51).
RSR: RSR: the regular supervisory report, a private narrative report to the supervisor, sent at least every three years today (Delegated Regulation Art 312).
Prudent person principle: Prudent person principle: the investment rule of Art 132. A firm invests only in assets whose risks it can identify, measure, monitor, manage, control and report, so as to ensure the security, quality, liquidity and profitability of the portfolio as a whole.
LAC DT: LAC DT: the loss-absorbing capacity of deferred taxes, the fall in tax that would follow the SCR loss, deducted from the SCR only to the extent the firm can show future taxable profit to use it (Delegated Regulation Art 207).

Deep Dives & Origins

Deep Dives

L3.8.12: Insurer investment risk and the ORSA: the book's ORSA, stresses and three-year plan. Intermediate.
L4.6.08: Own funds and the MCR: own funds, tiering and the MCR behind the QRT excerpt. Intermediate.

Origins

European Parliament and Council, Directive 2009/138/EC, Arts 13, 35, 37, 41–51 and 132 as adopted.
European Commission, Delegated Regulation (EU) 2015/35, Arts 207, 268, 271, 300 and 312 (EIOPA Interactive Single Rulebook; legislation.gov.uk).
European Parliament and Council, Directive (EU) 2025/2 of 27 November 2024, amendments to Arts 35, 41, 45, 45a, 51 and 51a (LawPlayer copy of the Official Journal text).
EIOPA, Final Report on Public Consultation No. 14/017 on Guidelines on system of governance (EIOPA-BoS-14/253), 28 January 2015.
EIOPA, Supervisory statement on differential pricing practices, 16 March 2023.
Prudential Regulation Authority, PS3/24 Review of Solvency II: Reporting and disclosure phase 2, 29 February 2024.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 12-minute video will sit here, made from this page's script.