Articles - Covid19 testing operational resilience in insurance

 By Iain Maclugash, FIA Associate and Actuary and Kim Durniat, FIA, Partner and Head of Life Consulting, Barnett Waddingham

  

 With all that has happened so far this year surrounding Covid-19, this work looks more appropriate than ever before. The regulators’ only regret must be that the proposed requirements are still in the consultation phase and have not already been implemented across the industry. 

  

 Developing a framework for operational resilience
 In these difficult times firms will also be looking to demonstrate to customers and other stakeholders, such as shareholders and pension scheme trustees, that they remain resilient to any further stresses to their business. A framework to test operational resilience would go a long way to building confidence in a firm and demonstrate its ability to keep the business going.

  

 In this article we look at key areas of the consultations’ ‘good practice’, provide our view on the suggested developments and highlight why the regulators’ proposal could be a great starting point for firms who are looking to understand and test their operational resilience in these uncertain times.

  

 What does ‘good practice’ look like?
 In the run up to Christmas last year, the Bank of England, Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) issued their long awaited consultation papers and policy summary titled “Building operational resilience: impact tolerances for important business services”. This sets out an overview on what they deemed to be good measurement of operational resilience.

  

 The regulators envisaged that boards and senior management could achieve better standards of operational resilience through increased focus on setting, monitoring and testing specific impact tolerances for key business services, which define the amount of disruption that could be tolerated.

  

 As the consultation stands, most insurers are likely to require additional analysis and reporting to demonstrate a better understanding of the operational processes within the business. In particular, firms will need to:

  

 Identify their important business services (i.e. the services that, if disrupted, could cause harm to consumers or market integrity, threaten the viability of firms or cause instability in the financial system)

  

 Set impact tolerances for each important business service, which quantify the maximum tolerable level of disruption they would accept (this could be a maximum amount of time that the service could be broken, or a limit to the number of policyholders impacted)

  

 Identify and document the people, processes, technology, facilities and information that support each important business services

  

 Take actions to be able to remain within their impact tolerances through a range of severe but plausible disruption scenarios, while learning from their own experiences. These scenarios should be considered by senior management and be relevant to the firm; i.e. consider near misses, or events seen within the industry

  

 What are firms doing now?
 The Bank of England has defined operational resilience as “the ability of firms and the financial system as a whole to absorb and adapt to shocks, rather than contribute to them”.

  

 You might think that this is exactly what Solvency II was designed to do. This is certainly true. Solvency II does ensure that firms hold enough capital to remain solvent under a range of stress events, but this isn’t the only way a business can fail. The regulators are also asking firms to consider liquidity risk, and now operational resilience, as these risks are more likely to be the areas that will stop a firm functioning and delivering for clients.

  

 "So what about the business continuity plan (BCP)? Surely this is already enough to demonstrate resilience?"

  

 The BCP is certainly linked to operational resilience and will likely have been implemented in some way over the last month.

  

 However, the regulator has made it clear that these proposed requirements are to ensure that firms can deliver all critical services to a given tolerance in a range of scenarios. As such, the operational resilience goes beyond traditional operational risk and recovery capabilities, with a focus on preserving the continuity of the provision of ‘critical economic functions’ to both the UK economy and to a firm’s customers and clients.

  

 It is clear that something more is needed, as we know some Solvency II firms with business continuity plans have struggled to cope with the impact of Covid-19.

  

 The challenges of operational resilience
 For firms looking to implement these ideas, this task is no easy feat. Doing so is made a lot more difficult due to Covid-19.

  

 Insurance companies are complex organisations with a significant number of processes feeding into each key service, including possible reliance on external suppliers such as those who provide payment systems.

  

 There is no doubt that mapping such a business could leave anyone confused. As such, the way that firms will look to conduct such a mapping will be key to developing efficient documentation of processes and enable management to easily highlight where the key services lie, and which processes feed into these.

  

 One aim of the proposed requirements is to apply quantitative stresses to areas of judgement; i.e. defining the key services will clearly be an area of judgement, but calculating the impact of stress scenarios needs to be done in a formulaic way.

  

 Where firms undertake processes that combine qualitative and quantitative measurements, there is a risk of using analysis to back-solve for an answer they already want. Indeed, when judgements change firms can adjust the analysis to continue to get answers that agree with their view of the business. This can remove all value from the process.

  

 "In order to reduce this risk, developing the operational resilience processes will require significant thought and, ideally, the development of an operational resilience framework to ensure that the business applies judgement consistently. This allows the stress and scenario testing to hold more credibility."

  

 What are the next steps?
 In March, the regulators announced that they had delayed the deadline for the consultation to later in the year, with the final outcomes now likely to be closer to 2022 than 2020. This therefore means firms will have longer before these changes are mandatory. However, in our opinion, the consultations highlights work that firms should be considering now, not just when they have to.

  

 Covid-19 is an excellent case study to start making this assessment. A business’ actions undertaken as part of the nationwide lockdown will certainly have highlighted the key processes and identified key strengths and weaknesses. There is no doubt that firms should also be considering how it would cope with operational stresses to areas such as reduction in staffing numbers or issues with third party suppliers. A measurable framework of reviewing these risks will be worth its weight in gold.

  

 At Barnett Waddingham, we want to help firms make the most of their time. Where Covid-19 has highlighted a gap in testing within the business, this should be used as a learning point for long-term development.

  

 There is no doubt that operational resilience is an area where firms will be learning a lot about their business this year and we should make sure we make the most of this.