Top Tips for Preparing your Own Risk Assessment

Stage 1 – Preparation

The ORA will be required at least every three years and will be embedded in your ongoing risk management activity. Preparing and documenting your governance activity on an ongoing basis is key to preparing your ORA.

Tips for preparing for your ORA:

1. Take a step back
   Be clear on your schemes’ long-term objectives and understand the key risks associated with these.
2. Plan a review of your Effective System of Governance (ESOG)
   Think about timing of policy reviews to support you with delivering your long-term objectives.
3. Consider your assurance reporting
   Think about what you need to provide evidence of your controls – try to avoid accumulating unnecessary documents. Be clear on what actions you will take.
4. Maintain a detailed audit trail
   This will make your ORA in three years’ time easier. Consider the software you use to support you with this.

Stage 2 – Completion

While the ORA does not have to be carried out independently, the assessment must be an objective and honest assessment of the scheme’s governance and risk management.

Tips for making your assessment of your ESOG:

1. Document key achievements/projects
   What went well? What could have been done differently? What were any lessons learned?
2. Gather a range of views
   Consider using key advisers to give independent perspectives and insights.
3. Consider different perspectives
   For example, from a financial perspective or a member’s perspective.
4. Use data rather than opinion
   Where possible, use data to provide evidence of the effectiveness of your governance and risk controls – e.g. use your risk scoring pre- and post- controls to give a measure of your risk control effectiveness.
5. Document risk events
   Have your long-term objectives been impacted? What have you learned from these events?
6. Reflect on your highest rated risks
   Can any further risk controls be added to mitigate these? How comfortable are you running these risks? Has anything changed?
7. Think outside the box
   Look at risk events outside of your scheme (e.g. CrowdStrike, cyber security breaches, gilts crisis)– What is your operational resilience if faced with similar incidents or events?
8. Look ahead
   What emerging risks might impact your scheme? What future scheme projects are on your agenda and how might these impact your long-term objectives? How will existing risks change over time?

Stage 3 – Post ORA Actions

The value of the ORA is in the opportunity to look objectively at your controls, to understand any weaknesses and to take away actions to continuously enhance your governance.

Tips for extracting the most value out of your ORA:

1. Clearly identify actions
   Identify any areas for enhanced oversight or deep-dives to enhance the quality of your risk conversations
2. Consider your 3-year business plan
   What are your key projects? How will your scheme’s risk profile change over the next three years?
3. Reflect on roles & responsibilities
   Do you have the right expertise available to manage governance and risk effectively? Do you have sufficient time in your agendas to manage governance and risk?
4. Think about your next ORA
   Reflect on how you will approach your next ORA. What worked well? What would help you to complete your next ORA?
5. Make ‘Business as Usual’
   Consider how to embed the principles of your ORA into your ongoing assessments of your ESOG and risk controls.

We believe huge value can be gained by trustees spending time preparing for, documenting and then following up on actions arising from the first ORA. This will support schemes with their operational resilience when the next big risk incident arises.

First published in Pensions Age in July 2025.

Disclaimer 2025 | Aon