The first own risk assessment (ORA) deadline has “exposed gaps” in pension schemes’ internal controls, with trustees urged to use the deadline as an opportunity to strengthen governance rather than treating it as a compliance exercise.

Pension schemes with 100 members or more and a 31 March year-end will be required to submit their first ORA by 31 March 2026 for the 12-month period ending 31 March 2025.

The ORA assesses how effectively a governing body’s effective system of governance (ESOG) is operating, and was introduced as part of The Pensions Regulator's General Code of Practice.

Isio director in A&C, Ellie Dobson, said a clear theme was emerging as schemes approached their first ORA deadlines.

“While governance frameworks are often well documented, internal controls are not always receiving the same level of scrutiny,” she stated.

“On paper, many trustee boards have an ESOG they can feel confident in. Policies are in place, responsibilities are mapped, and review cycles are clearly defined. But the picture is often less clear when it comes to whether key controls are working in practice.

“The General Code is explicit that trustees must assess not just the existence of controls, but their effectiveness, and in reality, many schemes are still finding their feet here. Controls may exist, but evidence can be limited or not easily accessible, meaning risk management can feel more like a collection of processes than a joined-up system.

“Having controls without testing them is the governance equivalent of owning a smoke alarm but never checking the batteries. It might work, but it is hardly reassuring.”

Dobson added that delegation remained a key challenge, as trustees relied on administrators, advisers, and third parties to operate many controls, but accountability did not transfer.

Therefore, she argued that oversight needed to evolve alongside this, especially where critical controls remained outside of the trustee board’s immediate view.

“Proportionality will also be important,” Dobson continued. “It is not about doing less, but focusing effort where it matters most.

“A scheme approaching buyout may prioritise high-level oversight, while one planning to run on may need a sharper focus on operational resilience.

“With ORA deadlines looming, this should not be treated as a one-off compliance exercise. Schemes that use the process to strengthen how they evidence and monitor internal controls will be better placed to demonstrate good governance and manage risk effectively over the long term.”

To support schemes submitting their first ORA, LCP published five ‘practical steps’ to help them produce an effective ORA.

It urged schemes to ensure ORAs were evidence-based, to focus on governance risk, be proportionate, prioritise clarity and usability, and be forward-looking.

“In a landscape where reforms are accelerating across both defined benefit and defined contribution, trustees need more than compliance checklists,” commented LCP partner and head of governance, Rachika Cooray.

“They need a governance tool that helps them steer. A well-crafted ORA does exactly that. It shines a light on how decisions are really made, exposes blind spots early and turns governance into something active and forward-looking.

“At a time when trustees are being asked to do more with less, that clarity isn’t a luxury - it’s essential to running a resilient and future-ready scheme.”

---