​

Your Own-Risk Assessment (ORA)

​

The ORA is a Living Document

The Pensions Authority considers the Own-Risk Assessment one of the most important documents a trustee board produces. It is not a one-time filing or a regulatory checkbox — it is a living governance tool that reflects the board’s current understanding of the scheme’s risk environment. The ORA must be:

• Trustee-owned — not delegated entirely to a consultant or KFH; trustees must engage with the content, not just sign it
• Comprehensive — covering all 8 risk categories defined by the Pensions Authority
• Scheme-specific — genuine analysis of your scheme’s risk profile, not generic template language
• Current — reviewed at least every 3 years, or whenever a significant change occurs
• Board-discussed — the ORA must appear as a substantive item in board meeting minutes, not just as a document circulated for signature

---

​

What the PA Commonly Finds Missing

Based on the Pensions Authority’s IORP II supervisory reviews, the most common ORA weaknesses are:

Viability and sustainability risks omitted

Many ORAs focus on investment and operational risk but omit scheme-level existential risks: the long-term financial viability of the sponsoring employer; the sustainability of the scheme’s funding model; the risk that the scheme may need to wind up and what would happen to members if it did. These risks must be addressed — particularly in DC schemes where member contributions depend on employer financial health.

Outsourcing risks underweighted or absent

Where all key functions are outsourced — as they commonly are — the ORA must assess the risks arising from that concentration of outsourcing. Generic statements that “service providers are monitored” do not satisfy the PA. The ORA should name the key providers, assess the risk of provider failure or underperformance, and document the scheme’s exit strategy.

DORA and ICT risks not reflected

From January 2025, DORA applies to all schemes with 16 or more members. The ORA must reflect ICT and cyber risks proportionate to the scheme’s digital exposure. Many schemes still have no ICT risk entry in their ORA, or address it only as “cyber risk is managed by the administrator” — which is not an adequate risk assessment.

Risk appetite not linked to current risk status

IORP II requires trustees to define their risk appetite — how much risk they are willing to accept in pursuit of scheme objectives. But the PA’s threshold is higher: the ORA must also confirm whether each risk currently sits within or outside that tolerance. An ORA that states a tolerance but does not assess whether the scheme is currently within it is incomplete.

No member cohort analysis

For DC schemes, the ORA should reflect the specific characteristics of the member population — age profile, contribution rates, projected retirement dates, default fund exposure. A risk that is tolerable for a scheme with young, active membership may be material for a scheme with a large cohort approaching retirement. Generic risk assessments that ignore member demographics will not satisfy the PA.

Board minutes show no substantive engagement

The PA checks board minutes to verify that the ORA was genuinely discussed — not just adopted. Where board minutes record only “The ORA was reviewed and adopted”, the PA will question whether the board engaged with the content. Minutes should record the key risks discussed, any disagreements or concerns raised, and any actions arising from the review.

​

When is an ORA Required?

​

The 8 Risk Categories

The Pensions Authority requires the ORA to assess risks across 8 categories:

​

How to Complete the ORA in PensionPortal.ai

Navigate to Governance → Own-Risk Assessment and click Start New ORA or open an existing ORA.

​

1. Board Risk Appetite Statement

At the top of the ORA form, complete the Board Risk Appetite Statement — a brief, plain-language statement of the overarching level of risk the trustee board is willing to accept in pursuit of scheme objectives. This is a trustee judgment, not a formula. Example: “The trustee board has a low appetite for investment risk given the scheme’s mature membership profile, a moderate appetite for operational risk where adequate controls are in place, and zero tolerance for regulatory non-compliance.”

​

2. Per-Category Risk Appetite and Tolerance

For each of the 8 risk categories, the ORA form includes a Risk Appetite & Tolerance section: Alert banner: If any risk category is Outside or Approaching tolerance, an alert banner appears at the top of the ORA form. These categories must have documented remediation actions.

​

3. Risk Library

For each category, a collapsible “Common risks for this category” panel provides 32 pre-seeded IORP II reference risks across the 8 categories. Click any risk to pre-fill the mitigation text for that risk in your ORA. Edit the pre-filled text to reflect your scheme’s specific circumstances. The risk library includes IORP II and DORA regulatory references for each entry — ensuring your ORA cites the correct regulatory context.

​

4. AI-Assisted Narrative Drafting

​

5. Sign-Off

• Chair of Trustees signs off the completed ORA
• Risk Key Function Holder provides a second sign-off confirming the assessment is adequate
• The signed ORA is timestamped and stored in the scheme’s compliance record
• The platform sets a 3-year review reminder automatically

​

6. ORA Summary Card

The ORA list page displays a Current ORA Summary Card showing:

• Your board risk appetite statement
• 8 per-category tolerance status badges (✅ Within / ⚠️ Approaching / 🔴 Outside)
• A count of categories currently outside tolerance that require action

This card provides at-a-glance governance oversight and is included in the SRP Evidence Pack export.

​

Keeping the ORA Current

The ORA review cycle is 3 years — but the ORA should be a living document that is considered at every significant change event. PensionPortal.ai tracks trigger events and prompts you to consider an ORA review when: Where a trigger event occurs, document the review outcome in board minutes — even if the conclusion is that no ORA changes are required.

---

​

ORA and the Board Agenda

The ORA should not sit in a document library between sign-offs. It should be an active board governance tool:

• Annual review item: Include a standing ORA review item on the annual board calendar — even in non-review years, the board should confirm that the current ORA remains adequate
• Tolerance monitoring: The ORA Summary Card on the list page shows current tolerance status for all 8 categories; any category Outside tolerance should be a board agenda item until remediation is complete
• Board pack inclusion: Include the ORA Summary Card in regular board packs so trustees maintain visibility of the scheme’s risk position
• Pre-ACS review: The ACS Wizard references the ORA when asking about risk assessment compliance; ensure the ORA is current before commencing ACS preparation

---

​

Tips for a Good ORA

---

​

Further Reading

• Supervisory Review Process — Risk Management Pillar →
• Key Function Holders →
• ORA — Technical Reference →