Insurance Sector - What Next for Op Res?
Protiviti held a roundtable on 5th November 2020 to discuss the topic of operational resilience in the insurance industry. The event focused on a discussion between insurance representatives about their readiness for the new UK regulations on operational effectiveness anticipated in Q12021.
Attendees were first asked how much the COVD-19 pandemic had changed their thinking and/or approach to operational resilience, from ‘not at all’ to ‘significantly’. On a scale of 1-10, the average score was 3.7, with discussions highlighting that for most organisations the pandemic did not significantly alter their thinking or the approach to operational resilience but had certainly helped to increase the focus of boards on the topic and enabled reflection on key lessons learnt from how their organisations responded to the pandemic.
When asked approximately how many important business services each organisation had identified, results showed an average of 28, which indicated the task that lies ahead for organisations that have not yet mapped out those services or assessed the impact their failure would have. It is recognised that the number of important business services will be dependent on the size and complexity of each organisation.
Important business services highlighted included complaints, quote and buy, collecting premiums, paying claims and pricing. Most attendees were currently using Excel to map important services, but some were considering investing in toolsets to support the mapping process in the future.
Challenges faced by operational resilience leaders
The challenge for those leading operational resilience responses is that there are so many demands on resources and budgets, however one impact of COVID-19 has been to change that response with an increasing willingness, desire and/or need to invest in resilience capabilities.
Another challenge highlighted by one attendee, whose firm is in the process of embedding operational resilience across its global business, is that there are varied businesses with diverse regulatory regimes in different countries. This makes it difficult to establish one set of holistic metrics for reporting to the board to demonstrate resilience.
"The volume of legacy systems is also providing a challenge to organisations when seeking to achieve their desired level of resilience, as is the recognition that there is a need to move from establishing frameworks to embedding resilience into their culture."
Identify and mapping important business services
Mapping business services can have an impact and bring benefits beyond preparing for operational resilience regulation, for example enabling organisations to analyse whether a business service is actually designed in the best way to serve customers.
The process could also highlight deficiencies in business continuity plans, many of which proved to be unusable when the pandemic struck. Organisations are starting to apply a business services lens to their business continuity plans. It will be important now to think through all of the events that may occur, and update business continuity plans accordingly. But the chances of actual ‘black swan’ events happening need to be assessed carefully against the investment needed to protect against every risk.
When making investment decisions it is important that the Board and senior executive can demonstrate the rationale for their decisions, and that they had an understanding of the impact of their decisions on the organisation’s operational resilience.
One attendee highlighted that the challenge of mapping services is not new and stressed the importance of starting with a complete list of business services to ensure consideration of importance is applied to the full landscape.
It may not always be necessary to start from ground zero when mapping services, said another attendee.
"It could be that a process mapping exercise had been undertaken, for example, for GDPR purposes or as part of customer journey mapping, and that data could be refreshed for operational resilience purposes."
Looking in more detail at the methodologies that insurance companies are using to identify important business services and the impact of their failure, one attendee said his firm was leveraging methodologies used previously in banking for operational continuity in resolution (OCIR) to identify critical parts of the business that must be maintained. This approach was useful in focussing people’s minds and maintaining a focus on the key customers outcomes.
Customer outcomes was critical for one attendee when establishing impact tolerance, with a focus on the expectations of customers on the timeframes for the outcome to be delivered. For example, customers do not expect life insurance claims to be paid within 24 hours, they have a longer tolerance recognising the time needed to processing these claims due to the level of checks that need to be made and documents gathered. However, for income protection, if the customer is reliant on the payment to be made on day 1 of the month to enable payment of bills, the tolerance would be much lower for disruption and delays.