Own risk assessments (ORAs) for UK pensions: when do you need one?

Who needs an ORA?

Trustees or managers of an occupational pension scheme with 100 or more members must carry out and document an ORA.

What is an ORA?

The Pensions Regulator (TPR) describes an ORA as an assessment of how well a scheme’s “effective system of governance” (ESOG) is working and how potential risks are managed.  The requirement to have an ESOG was introduced in January 2019, to implement requirements of the second European IORP (occupational pensions) directive.

An ORA should be proportionate to the size, nature and complexity of the scheme.  In practice, well-run schemes will already be assessing and documenting many of the areas required.  The ORA may index or refer to these existing records.

What is the deadline for a scheme’s first ORA?

A scheme’s first ORA must be prepared within 12 months of the last day of the first scheme year which begins after TPR has issued a Code of Practice on the ORA.  TPR’s new General Code includes its expectations for an ORA and came into force on 28 March 2024. 

By way of example, a scheme with a scheme year starting on 1 May must complete its first ORA by 30 April 2026:

• First scheme year after Code is issued is 1 May 2024 to 30 April 2025;
• 12 months from the end of this scheme year is 30 April 2026.

There are other alternate deadlines by reference to dates trustees are “next” required to obtain actuarial valuations (for DB schemes) or chair’s statements (for DC schemes).  However, following recent confirmation from TPR, these are likely to be relevant only to new schemes.

How often must an ORA be updated?

The ORA must be completed at least every three years, although it is not necessary to review all parts of the ORA at the same time. Some areas must be reviewed more frequently; for example, trustees’ knowledge and understanding should be reviewed at least annually.   Trustees should establish (and document) a timetable for review of each element of the ORA.

The ORA should also be assessed where parts of the ESOG, or risk management processes, are updated or renewed or there is a material change in risk.

What must an ORA cover?

Areas to be covered in the ORA include:

• How the trustees integrate risk assessment and mitigation into their decision-making and management;
• Trustees’ knowledge and understanding;
• Prevention and management of conflicts of interest;
• Funding and covenant support (for DB schemes);
• Administration risks, including the correct calculation and payment of benefits;
• Scams and poor choices by members;
• Investment governance processes; and
• Assessment of new and emerging investment risks, including in relation to climate change and environmental factors, social risks, and risks resulting from regulatory change.