‍Model Risk Management for PBR: What VM-30 Covers and What It Doesn't

VM-30 and its companion sections regulate the reserve result and the actuarial opinion on it. How the underlying models are built, validated and monitored is largely left to the insurer.

PBR Compliance and Model Risk

Why a reserve model can meet every Valuation Manual requirement and still be wrong, and what a life insurer needs beyond the regulatory minimum.

Two Disciplines Treated as One

VM-30 gives regulators an actuarial opinion on whether a life insurer's reserves are adequate. It says almost nothing about whether the models that produced those reserves are well governed. Model risk management and PBR compliance are often discussed as one discipline. They are two, and the space between them is where the error in the case below went undetected for three years.

Principle-based reserving (PBR) lets an insurer calculate reserves with its own projection models, assumptions and judgement, within the boundaries of the NAIC Valuation Manual: VM-20 for life products, VM-21 for variable annuities and, in the 2026 edition, VM-22 for non-variable annuities. That flexibility is what makes the models a material source of risk. A projection model running on a stale mortality improvement assumption, or carrying an undocumented spreadsheet adjustment, can satisfy every documentation requirement in the manual and still produce the wrong number.

Case Study: A Reserve Model That Passed Every Opinion for Three Years

A mid-sized life insurer's actuarial team found, while preparing for a system migration, that its VM-20 reserve projection model had carried a hardcoded error in a mortality improvement calculation for three valuation cycles.

• Finding: The error sat in the model's calculation code and flowed into three consecutive year-end reserve runs.

• Impact: Three annual actuarial opinions and three PBR Actuarial Reports were completed on schedule, each resting on the same flawed output.

• Root cause: Nothing in the process was designed to catch it. The appointed actuary's opinion addressed reserve adequacy. The PBR Actuarial Report documented assumptions, margins and the qualified actuary's own validation work. No step put the model's logic in front of anyone independent of the team that built it, and the Valuation Manual does not require one.

• Takeaway: The company then set up an independent validation function, separate from model development, with a defined change-control process. Neither change altered what it submits to regulators. Both changed whether a similar error is caught in the following year instead of the fourth.

Why It Matters: What VM-30 and Its Companion Sections Require

VM-30, Actuarial Opinion and Memorandum Requirements, governs the appointed actuary's annual opinion and the memorandum supporting it. Read alongside VM-31, VM-G and Section 12 of the Standard Valuation Law, the obligations for PBR business come down to five:

• Actuarial opinion (VM-30): the appointed actuary's opinion that reserves, including those calculated on a principle-based approach, make good and sufficient provision for policyholder obligations, supported by asset adequacy analysis.

• Actuarial memorandum (VM-30): documentation of the asset adequacy analysis and the liability and asset assumptions behind it, including mortality, lapse, interest crediting and expense.

• PBR Actuarial Report (VM-31): prepared by the qualified actuaries responsible for PBR business, covering the data, modelling decisions and model validation results, and available to the domiciliary commissioner on request.

• Qualified actuary certifications (VM-G, VM-31): that assumptions not prescribed by the Valuation Manual are prudent estimates with appropriate margins.

• Corporate governance (VM-G): board and senior management oversight of the PBR valuation function, including an annual senior management certification that internal controls over PBR are effective.

Where the Valuation Manual Stops

Each of these obligations is anchored to the reserve result and the actuaries' judgement about it. VM-31 does ask the qualified actuary to explain how the company became comfortable with its cash-flow model, including comparisons with historical experience and numerical static and dynamic validation results. It does not require that work to be done by anyone independent of the modelling team or the actuary who signs.

The difference has practical consequences. Static validation reconciles the model's starting values with in-force records. Dynamic validation compares early projection results with recent actual experience. A mis-coded improvement factor has little effect in the first projection years and compounds after that, so it can pass both tests while distorting the reserve.

The gaps that matter most in practice:

• Independent validation: no requirement for a reviewer separate from model development and from the signing actuary.

• Lifecycle governance: no defined model lifecycle covering development, validation, approval, production use, change and retirement.

• Ongoing monitoring: no requirement to track a reserve model's performance between valuation dates.

• Scope: nothing that reaches models outside the reserve and asset adequacy work. Pricing and capital models, and asset liability management (ALM) models used for anything beyond cash-flow testing, sit outside the framework.

What Adjacent Frameworks Require

US insurance regulation does not generally require a company-wide, risk-tiered inventory of actuarial models. The closest instruments are scoped to AI and consumer outcomes. The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted in December 2023 for states to issue individually, expects insurers to maintain a written AI Systems Program that includes inventories of predictive models. Its scope covers AI used across the insurance life cycle, including underwriting, rating and pricing, so an AI-driven pricing model can fall within it. A conventional reserve or capital projection model generally does not. Colorado's Regulation 10-1-1 goes further for insurers using external consumer data, requiring an up-to-date inventory of those data sources and the models that use them, again with a consumer-fairness focus.

Outside US insurance, the structure is more explicit. OSFI's Guideline E-23, finalised on 11 September 2025 and effective 1 May 2027, will require federally regulated insurers to keep an enterprise-level model inventory that is accurate and evergreen, with model risk ratings that set the frequency and intensity of model review and the authority needed to approve a model. The PRA's SS1/24, effective from 31 December 2024, sets expectations for the validation process and tools of insurers that calculate their Solvency Capital Requirement with an internal model. EIOPA's August 2025 Opinion on AI governance and risk management clarifies for national supervisors how existing insurance legislation applies to AI systems, on a risk-based and proportionate basis.

US banking supervisors do not regulate insurers, but their guidance has long served as the reference point for model risk management in US financial services. SR 26-2, issued by the Federal Reserve, OCC and FDIC on 17 April 2026, replaced SR 11-7. It keeps the familiar structure of model development, validation and governance, revises the definition of a model, and places more weight on scaling effort to each organisation's model risk profile.

Building Model Risk Management Around PBR

None of these frameworks binds a US life insurer's reserve models, but together they supply the structure the Valuation Manual leaves out. A defensible practice borrows five elements from them:

• One inventory: PBR reserve models alongside pricing, ALM and capital models, including the spreadsheets and manual adjustments that feed them.

• Risk tiering: a model risk rating that sets validation depth and frequency, approval authority and monitoring intensity.

• Independent validation: a function separate from both model development and the signing actuaries, reviewing calculation logic and conceptual soundness as well as outputs.

• Monitoring between valuations: defined metrics and thresholds, with breaches triggering review before the next year-end run.

• Change control: every change to code, parameters and hardcoded values logged, tested and approved before it reaches production.

The case for going past the regulatory minimum is consistency: one standard for every consequential model in the company, instead of reserving the closest thing to scrutiny for the one model class regulators already ask about.

How Solytics Partners Can Help

Solytics Partners helps life insurers put model risk governance around their PBR process, with a validation and monitoring record that stands apart from the valuation itself.

• A single actuarial model inventory: MRM Vault holds PBR reserve, pricing, ALM and capital models in one inventory, with drill-down on each model's tiering, findings, limitations and lineage.

• Tier-driven workflows: configurable workflows by model risk tier route validation scheduling, approvals and follow-up actions.

• Independent validation: NIMBUS Uno supports full-scope and limited-scope validation, conceptual soundness review, testing of assumptions and limitations, and benchmarking against alternative methodologies, so the validation team can work independently of the qualified actuaries' process.

• Monitoring between valuation cycles: performance monitoring with backtesting and sensitivity analysis, with MRM Vault triggering a review when metrics move outside predefined thresholds.

• Change control and audit trail: a record of major and minor model changes across the inventory, the control the insurer in the case study lacked.

• Evidence for the board: dashboards give senior management and the model risk committee a consolidated view of model risk, so the annual VM-G controls certification rests on a monitoring record rather than an attestation alone.

Related Topics

• Building an Independent Model Validation Function Beyond the Appointed Actuary's Opinion

• What OSFI Guideline E-23 Would Require of a PBR Model Inventory

• Where AI and Machine Learning Fit Inside Actuarial Reserve Models

• VM-G Governance Certification: Meeting the Letter Versus the Substance

• Model Risk Beyond Reserves: Pricing, ALM, and Capital Models

References

1. National Association of Insurance Commissioners (NAIC). Valuation Manual, VM-30 (Actuarial Opinion and Memorandum Requirements), VM-31 (PBR Actuarial Report Requirements), and VM-G (Corporate Governance). January 1, 2026 Edition. https://content.naic.org/sites/default/files/pbr_data_valuation_manual_current_edition.pdf

2. National Association of Insurance Commissioners (NAIC). Model Bulletin: Use of Artificial Intelligence Systems by Insurers. December 4, 2023. https://content.naic.org/sites/default/files/cmte-h-big-data-artificial-intelligence-wg-ai-model-bulletin.pdf.pdf

3. Office of the Superintendent of Financial Institutions (Canada). Guideline E-23, "Model Risk Management" (2027). Finalized September 11, 2025. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/guideline-e-23-model-risk-management-2027

4. Bank of England and Prudential Regulation Authority. SS1/24, "Expectations for Meeting the PRA's Internal Model Requirements for Insurers under Solvency II." February 2024. https://www.bankofengland.co.uk/prudential-regulation/publication/2024/february/expectations-for-meeting-the-pra-internal-model-requirements-ss

5. European Insurance and Occupational Pensions Authority (EIOPA). Opinion on Artificial Intelligence Governance and Risk Management (EIOPA-BoS-25-360). August 6, 2025. https://www.eiopa.europa.eu/publications/opinion-artificial-intelligence-governance-and-risk-management_en

6. Board of Governors of the Federal Reserve System, Office of the Comptroller of the Currency, and Federal Deposit Insurance Corporation. SR 26-2, "Revised Guidance on Model Risk Management." April 17, 2026. https://www.federalreserve.gov/supervisionreg/srletters/SR2602.pdf