An ORSA summary report is the confidential, high-level report of an insurer's own risk and solvency assessment that the NAIC's Risk Management and ORSA Model Act (#505) requires once a year from insurers writing $500 million or more of premium, or belonging to a group writing $1 billion or more. Its structure comes from the NAIC's ORSA Guidance Manual: background and an attestation, then Section 1 on the enterprise risk management framework, Section 2 on the assessment of risk exposures under normal and stressed conditions, and Section 3 on group risk capital and prospective solvency. Real reports are confidential by law, so this guide builds an annotated example outline from the manual's own requirements. The figures in an ORSA, surplus, required capital, retentions, stress losses, reappear in the annual statement, rating agency questionnaires and the corporate governance disclosure; Botminds' Rating Agency & Exam Response keeps those figures and statements consistent across every audience.
The ORSA summary report in four numbers
$500M
individual insurer premium at or above which the ORSA applies
$1B
group premium at or above which the ORSA applies to the group’s insurers
3
sections the NAIC’s guidance manual asks the report to cover
1a year
filing, signed by the chief risk officer or equivalent
What is an ORSA summary report?
It is the regulator's window on the insurer's own assessment. The manual defines the ORSA as "a confidential internal assessment" of the material and relevant risks of the insurer's current business plan and of the sufficiency of capital to support them, and the summary report as the high-level account of it filed with the lead state commissioner (NAIC ORSA Guidance Manual, 2026). The ORSA itself is the process; the summary report is the document. Regulators read the report and may ask for the internal material behind it during analysis or an exam.
The 2026 manual frames the report around four core questions: what the insurer's key risks are and what framework governs them; how large they are under normal and stressed conditions; what controls manage them; and how much risk capital they require now and over the plan horizon, compared with the capital available. Every section of a good report answers one of those questions.
Who has to file an ORSA? The thresholds and the triggers
An insurer is exempt only if its own annual direct written and unaffiliated assumed premium is under $500 million and, where it belongs to a group, the group's is under $1 billion. Premium includes international business and excludes premium reinsured with the Federal Crop Insurance Corporation and the National Flood Insurance Program. An insurer that crosses the threshold has one year after the year it is exceeded to comply.
Exemption is not absolute. The commissioner may still require an ORSA because of the type of business, the ownership structure, or concerns about fast-growing concentrations of risk, and may require it of an insurer that has triggered a risk-based capital company action level event or shows the qualities of a troubled insurer. An insurer that does not qualify may apply for a waiver on unique circumstances. The NAIC lists the ORSA model act among its accreditation standards for state law (NAIC accreditation standards, 2026).
What sections are in an ORSA summary report?
Three, plus background. The checklist sets out what each must contain under the 2026 manual and, for each, the figures and statements an analyst will compare with other documents.
The sections of an ORSA summary report, and what to cross-check in each
- Background and attestation
Signed attestation by the chief risk officer or equivalent; entities in scope (often an organisation chart); basis of accounting and the date the figures represent; a summary of material changes since last year. Cross-check: entities against the holding company filings; dates against the statements used.
- Section 1 · the ERM framework
Risk culture and governance; risk identification and prioritisation; risk appetite, tolerances and limits; risk management and controls; risk reporting and communication. Cross-check: committee structure and reporting lines against the CGAD.
- Section 2 · assessment of risk exposures
Each material risk in normal and stressed conditions, the methods and key assumptions, the controls and limits, and model validation. Cross-check: retentions and reinsurance against the programme in force; stress losses against what rating agencies were told.
- Section 3A · group assessment of risk capital
Available capital against risk capital, with each material risk’s contribution, the valuation basis, time horizon and security standard, and a comparison with last year. Cross-check: available capital against filed surplus; regulatory capital against the RBC report.
- Section 3B · prospective solvency
Projected capital over the business plan in normal and stressed conditions, prospective risks, and management actions if capital falls short. Cross-check: the plan figures against the board-approved plan and the rating questionnaire’s outlook answers.
An ORSA summary report example, annotated
Because real reports are confidential, the outline below is illustrative: a fictional mid-sized property and casualty group, written to the manual's requirements. The annotations say what a lead-state analyst is likely to check against the insurer's other filings and answers.
An illustrative ORSA summary report outline, with an analyst's notes
| Part | What the example says (illustrative) | What an analyst checks |
|---|---|---|
| Attestation | Signed by the chief risk officer; states the board’s risk committee received the report. | Signer and date; that the committee named exists in the CGAD and the minutes. |
| Scope and basis | Eight insurers in the group, shown on an organisation chart; figures on a statutory basis as of 31 December, with economic capital shown separately. | Entities against the holding company registration; that figures labelled statutory tie to the filed statements. |
| Changes since last year | New cyber risk limit; catastrophe retention raised at the mid-year renewal; capital model recalibrated. | That each change appears where it should: the reinsurance summary, the risk appetite statement, the model validation note. |
| Section 1 · framework | Risk appetite: keep capital above a stated multiple of required capital in a 1-in-200-year year; tolerances by risk. | Whether limits are measurable, who monitors them, and how breaches reach the board. |
| Section 2 · exposures | Catastrophe, reserving, investment credit and cyber risks, each with a normal and a stressed result and the controls that limit it. | Stress losses against retentions; reserve risk against the actuarial opinion’s risk of material adverse deviation discussion. |
| Section 3A · capital | Available capital against required capital, with each risk’s share; last year’s figures alongside. | Available capital against filed surplus; the basis used (statutory, economic or a rating agency model) stated clearly. |
| Section 3B · prospective solvency | Capital projected over three years under the plan and two stress scenarios; management actions named if the ratio falls below the appetite. | That plan figures match the board-approved plan, and the actions are within management’s power. |
Two requirements in the 2026 manual sharpen the annotations. Section 3 must now summarise "how each material risk classification or category contributes to the overall risk capital calculation," so a capital figure without a breakdown no longer suffices. And the group capital assessment "should include a comparative view of risk capital from the prior year, including an explanation of the changes." Both put last year's numbers next to this year's, which is where unexplained movements show.
When is the ORSA summary report due?
Once a year, on the domiciliary state's date if it has adopted one, otherwise when the insurer tells the commissioner to expect it. The model act ties the timing to the insurer's strategic planning, and the manual's 2026 edition adds that regulatory oversight is enhanced when the report arrives early enough in the calendar year to be reviewed together with the holding company analysis. Ask your lead state for its expectation and put it on the reporting calendar next to the annual statement and the June filings; the corporate governance annual disclosure shows that year laid out.
Timing creates a consistency problem of its own. An ORSA filed in the spring describes capital and risks as of the prior year-end; a rating questionnaire answered in the autumn describes them again, with half a year of change in between. Both can be right, but the later one should say what changed, and the earlier one should not be quoted as current.
Is the ORSA confidential?
Yes. The model act declares the summary report confidential by law and privileged, outside public records laws, subpoena and discovery in private civil actions, and the manual repeats that any report submitted "shall be confidential under state law." The commissioner may share it with other regulators and the NAIC that agree in writing to keep it confidential. That confidentiality is also why a real example is hard to find, and why an insurer's risk descriptions in public or semi-public documents, such as rating agency materials, need care: they should not contradict the confidential report, and they should not repeat what the company would not want published.
How does the ORSA relate to the risk-focused exam?
Closely. The NAIC's examiners' handbook has a full chapter on reviewing and using ORSA results, organised by the report's sections, and it describes the report's role plainly:
an ORSA Summary Report is expected to be at the center of the regulatory processes.
NAIC Financial Condition Examiners Handbook, 2026, Section 1, Part XI
The lead state's analyst reviews the report first and directs the examiners to areas that need on-site inquiry, observation or testing. The handbook also tells regulators to be cautious about changing supervisory plans on the strength of an ORSA review alone, because sound practice varies with the size and complexity of the insurer. For the company, the practical result is that ORSA statements become exam questions: the examiners will ask to see the limits monitored, the stress tests run and the board reports that the ORSA describes. The seven phases of the exam show where.
Which ORSA figures must agree with the annual statement and the rating questionnaire?
Any figure that appears in more than one document should either be the same or come with a stated reason for being different. The comparison below pairs common ORSA figures with where else they appear.
ORSA figures and the other documents that state them
In the ORSA summary report: Statutory surplus (or an adjusted or economic measure, labelled as such).
Where the same figure appears, and what must hold: Annual statement surplus. If adjusted, the adjustment explained and the same adjusted figure used in rating answers.
In the ORSA summary report: Ratio of available capital to required regulatory capital.
Where the same figure appears, and what must hold: The RBC report and every rating or exam answer quoting the RBC ratio.
In the ORSA summary report: Net retention and reinsurance protection in Section 2’s stress results.
Where the same figure appears, and what must hold: The reinsurance programme summary and rating questionnaire answers; a mid-year renewal explained in later answers.
In the ORSA summary report: Reserve stress and the risk of adverse development.
Where the same figure appears, and what must hold: The actuarial opinion and report, Schedule P, and reserve answers to agencies and examiners.
In the ORSA summary report: Section 1 governance description.
Where the same figure appears, and what must hold: The CGAD’s description of the board, committees and critical risk reporting.
In the ORSA summary report: Section 3B’s projected capital and premium.
Where the same figure appears, and what must hold: The board-approved plan and the outlook answers in rating questionnaires.
The basis is the usual source of honest disagreement. The manual lets a group measure capital on statutory, GAAP, economic, IFRS or "rating agency model" bases, and asks the report to say which. A rating agency capital figure in the ORSA and a statutory RBC ratio in a questionnaire are both legitimate; the error is quoting one where the reader expects the other without a label.
The ORSA summary as an exhibit, behind every risk answer
How long is an ORSA summary report?
The NAIC sets no length. The manual says the report "is not expected to fully address all risk management activities," but must give enough detail to present the framework, exposures, controls and capital adequacy, and that depth will follow the nature and complexity of the insurer. It lets the insurer avoid duplication by referring to other documents the regulator can obtain on request. Length is the wrong target; completeness against the three sections and consistency with every other filing are the right ones.
That is also the case for drafting the ORSA's recurring parts, and the answers built on it, from approved text with refreshed figures. To see how risk answers drawn from the ORSA are kept consistent with the annual statement and with what each rating agency was told, start from Rating Agency & Exam Response.
Questions people ask
What is the difference between the ORSA and the ORSA summary report?
The ORSA is the insurer's internal process of assessing its risks and capital, done at least annually and whenever its risk profile changes significantly. The summary report is the high-level document describing that assessment that goes to the regulator. Regulators can ask for the internal documentation behind the report during analysis or an exam.
Who signs the ORSA summary report?
The chief risk officer, or the executive responsible for overseeing enterprise risk management, attests that the insurer applies the ERM process described and that a copy went to the board or the appropriate committee. The attestation is part of the background section.
Can one ORSA summary report cover a whole group?
Yes. The report can be filed for the group or as a combination of reports, for example one for the property and casualty insurers and another for the life insurers if they run under different ERM frameworks, provided every insurer in the group is covered. It goes to the group's lead state commissioner.
What is the ORSA threshold?
An insurer is exempt only if it writes less than $500 million of annual direct written and unaffiliated assumed premium and, if part of a group, the group writes less than $1 billion. Federal crop and flood reinsurance premium is excluded. A commissioner can require an ORSA from an exempt insurer in specified circumstances.
Does the ORSA have to use a particular capital model?
No. The manual lets the insurer choose its methods, from deterministic stress tests to stochastic models, and its security standard, valuation basis and time horizon, as long as the report describes them. U.S. regulators, the manual says, do not believe there is a standard set of stress conditions every insurer should test.