Own Risk Assessment: Personal Reflections

When I first tackled an Own Risk Assessment, I wasn’t sure what to expect. Over time, I saw it’s not just a document, but a process that sharpens judgement, builds confidence, and keeps governance front of mind. In this article, I share my reflections on how the ORA works in practice.

Initial reactions to the ORA

When the requirement to complete an Own Risk Assessment was introduced, my initial reaction was mixed. Like many trustees, I understood why it mattered in principle, but it was not immediately clear how it would differ from existing governance activity in practice. Risk, policies and processes are not the most engaging parts of trusteeship, and there was a sense that much of this ground had already been explored in different ways over the years.

Trustees tend to place a great deal of trust in their advisers and service providers, relying on them to ensure that appropriate controls are in place. Before the ORA, many of the right conversations were happening, but not always in a structured or fully connected way.

The earlier work to document an effective system of governance brought greater clarity around how schemes were run day to day. It required trustees to articulate how decisions were made, how risks were managed, and how responsibilities were allocated. In some areas, this involved formalising approaches to scenarios that had not previously arisen, which helped trustees think more deliberately about how they would respond if circumstances changed.

Where the ORA added real value

It was once we began the ORA itself that the value of this work really became clear. Working methodically through each area of governance prompted a different kind of conversation. Rather than asking whether a policy existed, trustees were encouraged to reflect on whether it genuinely worked, whether it was understood, and whether it remained proportionate to the scheme’s circumstances.

What stood out to me was how much of the ORA was about judgement rather than compliance. Identifying a gap did not automatically mean it needed to be closed. In many cases, the most useful discussions centred on risk appetite, understanding what a residual risk would actually look like in practice and whether trustees were comfortable with it. Capturing those judgements in writing felt challenging at times, but it also brought welcome clarity and focus.

What changed in practice

The actions that emerged from ORA exercises varied significantly between schemes. Some highlighted more strategic areas for improvement, such as the need for clearer objectives or a more joined-up approach to administration. Others were smaller, but still meaningful, better documenting existing practices or making implicit processes more explicit. Training, particularly in areas such as cyber risk and business continuity, featured regularly, reflecting the importance and evolving nature of these risks.

For me, the ORA marked a shift from assumed comfort to evidenced confidence. It prompted trustees to pause, reflect and articulate why they govern their schemes in the way they do. While members are unlikely ever to see an ORA report, they should be able to take reassurance from the fact that trustees have, and will continue to  critically examined their governance arrangements and tested whether they remain fit for purpose.

A practical example of how this played out for a scheme in practice is explored in this case study.

The lasting value of the ORA – not a one-off document

Once the report is filed away, what matters is not the document itself, but the clarity and confidence that come from having gone through the process. That is where the real value of the ORA sits as a way of strengthening trustee judgement and confidence; and ensuring that governance remains front and center on the trustee agenda.

Want to discuss ORA requirements in practice?

Speak to our outsourced governance experts about a practical, scheme specific approach to meeting ORA requirements.

Find out more: https://weareigg.com/ora/

Key Contact