Enterprise Risk Management & ORSA

Enterprise risk that works as a system

ERM is not a stack of policies. It is the operating architecture that connects the risks a firm is willing to take with the exposures it actually has, the controls it relies on and the decisions management makes. We design, remediate and independently challenge that architecture.

ERM framework & taxonomyRisk universe, definitions, ownership, governance, policy architecture and three-lines responsibilities.

Risk appetite frameworkCapacity, appetite, qualitative statements, limits, tolerances, breaches and escalation.

Risk registerMaterial risk identification, inherent and residual assessment, controls, actions and aggregation.

KRIs & management informationForward-looking indicators, thresholds, trend analysis and Board-level risk reporting.

Controls & RCSAControl mapping, design assessment, evidence, operating effectiveness and issue remediation.

Embedding & risk cultureDecision rights, first-line ownership, challenge, escalation, training and practical use in business processes.

ORSA support for insurers

We support Own Risk and Solvency Assessment work under relevant Solvency frameworks, connecting the ORSA to strategy, the business plan, risk appetite and the wider risk-management system. Support can include risk-profile assessment, overall solvency needs, stress and scenario design, forward-looking projections, governance, Board challenge, documentation and remediation.

Frameworks and jurisdictions

Depending on the engagement, we can work across Solvency UK, EU Solvency II and relevant international risk-management standards such as COSO ERM and ISO 31000, while mapping applicable prudential or sector-specific requirements. The output is tailored to your business model rather than forcing a generic framework onto it.

What good looks like

Risk appetite influences strategy and limits. The risk register reflects real exposures. KRIs provide early warning. Controls are evidenced. Issues are owned. Committees challenge rather than receive. The Board gets a coherent risk story. That is the standard we work toward.