Last Updated: 10/26/2026

Issue: Insurers operate in an environment of complex and interconnected risks. Enterprise Risk Management (ERM) provides a coordinated process for identifying, assessing, managing, monitoring, and reporting risks that could affect an insurer’s operations, strategy, capital, or solvency. State insurance regulators expect material risks to be managed on an enterprise-wide basis and incorporated into governance, strategic planning, and capital decision-making.

Overview: Benefits and integration: A well-designed ERM framework gives management and the board a clear, comprehensive view of the insurer’s aggregate risk profile. Effective ERM can improve strategic decision-making, reduce earnings volatility, support capital adequacy, strengthen risk governance and controls, and improve operational efficiency. ERM should complement established risk management practices, including asset-liability management, and should address underwriting, investment, liquidity, operational, and other material risks. Business functions—including finance, actuarial, underwriting, investments, operations, and strategy—should incorporate risk management into their day-to-day activities. Those activities should be coordinated through an enterprise-wide governance framework that supports management and board decision-making.

Drivers of ERM adoption: Company size, complexity, products, markets, and organizational structure influence the design and maturity of an ERM framework. Larger or more complex insurers may require specialized expertise and more formal processes to identify and manage risks across legal entities and business lines. Regulatory expectations, rating-agency criteria, market discipline, and evolving risk conditions also encourage insurers to strengthen their ERM practices.

U.S. Regulatory Framework: In the United States, ERM is addressed through a combination of model laws, accreditation standards, regulatory filings, and solvency-monitoring requirements. Principal components include:

• Risk Management and Own Risk and Solvency Assessment Model Act (#505): Requires insurers above specified premium thresholds to maintain a risk management framework, conduct an ORSA, and submit a confidential annual ORSA Summary Report to the lead state insurance regulator.
• Form F: Addresses enterprise risks arising from activities within the insurance holding company system, including risks associated with non-insurance entities.
• Corporate Governance Annual Disclosure (CGAD): Provides information about an insurer’s or insurance group’s corporate governance structure, policies, and practices.
• Internal audit requirements: Support independent evaluation of governance, risk management, and internal control processes.
• Risk-based capital (RBC) requirements: Address specified risks, including catastrophe and operational risks, within the broader solvency framework.

The U.S. framework broadly reflects International Association of Insurance Supervisors (IAIS) Insurance Core Principle (ICP) 16 on ERM and ORSA, ICP 7 on corporate governance, and ICP 8 on risk management and internal controls. The United States does not adopt the ICPs directly. Instead, state insurance regulators implement comparable principles through model laws, accreditation standards, regulatory handbooks, and related requirements.

Model #505 became effective January 1, 2015, and is an NAIC accreditation standard. It requires insurers above specified premium thresholds to maintain a risk management framework, conduct an ORSA, and submit a confidential annual ORSA Summary Report to the lead state insurance regulator. The NAIC ORSA Guidance Manual provides guidance to insurers on conducting an ORSA and documenting related risk management policies and procedures. The manual is updated as warranted to reflect developments in supervisory expectations and international standards.

• 2022 updates: Reflected elements of the IAIS Common Framework and added guidance relevant to Internationally Active Insurance Groups (IAIGs), including liquidity risk, stress testing, reverse stress testing, and the use of economic capital models.
• 2026 updates: Clarified expectations for current and prospective solvency assessments, including summaries of how material risk categories contribute to overall risk capital calculations; clarified relevant controls and the core questions addressed by an ORSA; and addressed use of the Group Capital Calculation (GCC) at the head of the IAIG.
• Regulatory Focus and Next Steps: Monitor implementation of the 2026 ORSA Guidance Manual revisions and identify areas in which additional regulator education or implementation support may be appropriate.
• Evaluate whether further guidance is needed on integrating cybersecurity and other emerging risks into insurers’ ERM frameworks, including board and senior management reporting and risk identification and assessment processes.
• Coordinate any related updates to financial analysis or examination guidance to maintain consistency across the U.S. solvency-monitoring framework.

Collectively, these requirements are intended to ensure that insurers identify and manage material risks on an enterprise-wide basis and maintain capital commensurate with their current and prospective risk profiles.