How Trustees Can Use the ORA Effectively

When Governance Becomes a Burden: Using the ORA to Add Value, Not Fatigue

At the recent ACA conference, I spoke to delegates about the practical reality of implementing the General Code and, in particular, the Own Risk Assessment (ORA). The session prompted a level of engagement that reflected what we increasingly see across the schemes we work with: trustees understand that governance matters, but many are questioning whether the growing governance burden is genuinely adding value.

That tension – between regulatory expectation and trustee capacity – is becoming one of the defining governance challenges facing UK pension schemes today.

Governance Expectations Are Rising, but Capacity Is Not

The Pensions Regulator has been clear that effective trustee decision-making will be critical as schemes navigate endgame planning, consolidation and long-term risk management. Oversight of trustees and administrators is increasing, and the General Code needs to be taken seriously.

At the same time, the practical demands on trustee boards and in-house pensions teams continues to grow. Governance already absorbs a significant amount of time through meetings, policy reviews, adviser oversight and regulatory engagement. The ORA adds another layer – not just the document itself, but the thinking, discussion and evidence gathering that sits behind it.

The result, for many boards, is not resistance to governance, but fatigue. Trustees are engaged and conscientious, yet increasingly wary of exercises that feel disconnected from decision-making or outcomes.

The ORA Is Not About Perfection

One of the strongest messages I emphasised at the conference is that the ORA is not a test to be passed, nor a mechanism for achieving “gold stars” across every governance module.

At its core, the ORA is exactly what it says on the tin: the trustees’ own assessment of their scheme’s internal governance, risks and controls. What the Regulator expects is evidence of thinking. That means being able to demonstrate:

• that the assessment has been carried out;
• that proportionality has been consciously applied;
• that where gaps remain, there is a clear rationale and audit trail explaining why.

The output should be a prioritised action plan, not a sense of failure. Good decision-making – and the ability to evidence it – is the real objective.

Proportionality in Practice, Not in Theory

Although proportionality is built into the General Code, many trustee boards still struggle with what it looks like in practice. Common questions include: “Is this enough?” and “Will the Regulator be comfortable if we don’t address everything at once?”

In practice, responses to the ORA tend to fall into recognisable patterns.

Smaller, cost-conscious schemes need a disciplined focus on the “should do”, not the “could do”. Without that, governance activity quickly becomes unfocused and disproportionate to risk.

Schemes nearing buy-out still need to complete an ORA, but pragmatism is essential. For example, trustee succession planning may not be a priority if no changes are expected, and a full retendering of advisers may add little value in the absence of performance concerns. Where assets are largely insured, in-depth investment governance reviews may not be proportionate unless a material surplus is in play; the Trustees lens will shift to operational, transactional risk and insurer security.

At the other end of the spectrum are schemes that have done very little, on the assumption that the ORA does not need to be submitted. While that is currently true, the Chair’s declaration must be available on request. Doing nothing and hoping to avoid scrutiny is not a strategy.

Policies, Cyber and the Reality Check

The ORA also requires trustees to review both existing and missing policies. This is not a one-size-fits-all exercise. Some schemes remain reliant on employer policies that are not appropriate for scheme business. Others have policies that no longer reflect how the scheme actually operates.

One practical test I encourage trustees to apply is the “new trustee test”. If a new trustee picked up the policy, would they understand the what, when and why? If not, it is likely time for a refresh.

Cyber risk is another area that is becoming impossible to ignore. Despite clear regulatory messaging and high-profile incidents, we still see schemes without a cyber security policy or incident response plan in place. Regardless of size or journey stage, cyber risk must be assessed regularly and reflected on the risk register.

Using the ORA as a Strategic Tool

When used well, the ORA becomes more than a compliance exercise. It provides a structured opportunity for trustee boards to step back and ask whether they are focusing on the right risks, whether controls are proportionate and effective, and whether governance activity is genuinely supporting good decision-making.

Timing and tailoring matter. In some cases, pausing an ORA exercise to allow other governance changes to embed can lead to a far more valuable outcome than pressing ahead prematurely. Anchoring the ORA to recent changes, upcoming decisions or known pain points helps ensure it resonates with both trustees and sponsors.

Looking Ahead

As regulatory expectations continue to rise, governance will remain under scrutiny. Proportionality is allowed, but complacency is not. Trustees need to understand their scheme, their sponsor and their journey plan, and take a tailored approach that balances rigour with realism.

The ORA should be a living, breathing document. Used thoughtfully, it becomes a strategic reference point that supports clearer accountability and better decision-making throughout the life of a scheme.

At IGG, our governance teams work with trustee boards to apply the General Code in a way that is proportionate, practical and aligned to scheme objectives, helping trustees focus on the areas that will deliver the most value while still meeting the Regulator’s expectations. If you would like to discuss how we can support your approach to the ORA, please get in touch.

Key Contact