The current pandemic has caused and is continuing to cause significant upheaval and disruption to the normal operation of the financial markets. Firms have had to dust off their Business Continuity Plans and implement them, most likely in a way which was unexpected. You can plan for a whole variety of potentially disruptive events, but history has shown that they often rise from something unexpected and unforeseen and have an impact which was just as unforeseen. Some risk commentators and analysts reports in recent years have listed for example, regulatory change, as a greater risk than pandemic. Even those who included a pandemic as one of the risks in their BCP following the SARs issues in 2003 are unlikely to have anticipated the size, speed of spread or impact of Covid-19.

In financial services the regulators, the PRA, FCA and the Bank of England have been concerned for some time about the possibility of events leading to a significant disruption in service to customers. Significant work has been undertaken by these UK regulators and others globally since the start of the last financial crisis in 2008 to improve the resilience of the financial markets and its members with a vast array of changes to the regulatory environment.

Most recently they have been working on this from the point of Operational Resilience which focuses on how resilient the services of a business provider are. It is a holistic view and takes elements from business continuity planning and risk, but the approach crosses the boundaries of functions and businesses within firms requiring action in IT, operations, underwriting, servicing, claims, HR, risk, compliance and outsourcing all overseen and monitored by senior management. With the Consultations out for some time now firms were expected to meet the new requirements by the end of next year. Rather ironically, the timetable is likely to be disrupted by current circumstances with the timing for responses to open consultations already put back.

However, there is no doubt, both from the recent regulators’ announcements and simply from the market’s response, that the resolve of the regulators once the dust has settled, will be intrusive and uncompromising. Not everything they have done since 2008 has worked and certainly not everything is currently as it should be. But there can be no doubt that there will be a clear intention to progress their approach to Operational Resilience with vigour even though the insurance market appears to have weathered quite a lot of this storm reasonably well at this point, due in part to Solvency II.

There are many reasons for this, but frequency and severity will be near the top of the list. Too many times recently there have been quite significant examples of financial services firms leaving customers in some difficulty. While most of these have been in other sectors insurance has had its examples. Whether arising from firm failures or IT failures and outages, the regulators want to reduce the risk and hopefully be better prepared for future events which are possible, whether through increased cyber risk or other IT issues, the impact of the changing environment or further financial crises.

Opportunity

So how can this current set of circumstances be an opportunity?

The impact of Covid-19 has been considerable and the need to respond very rapid. Business Continuity Plans have been reviewed and quickly appraised. Some have made the grade and been helpful and others anything between somewhat or mostly ignored, often because they were simply not up to date or of any use. In many cases the planning has been helpful to a degree, either because back-up premises were available or the ability to work from home has been reasonably effective. However, it is clear that the outcomes have been quite mixed.

And that is the point. Some firms appear to have done well and others not. What is presented is an opportunity to:

1. Evidence the things that went well and build upon them as a foundation for future disruptive events,
2. Identify the things that have not worked well, analyse why and identify alternative solutions, and
3. Undertake the same exercise with those firms which provide critical services for you.

Given that there is a significant programme of work just around the corner which firms will need to undertake now is the time to capitalise on the opportunity and potentially front-load that work.

We are therefore setting out some of the questions which could be asked now to save time and effort later. Firms which are able to capture some or all of the responses to the questions we pose will find that they are significantly more advanced in their Operational Resilience work than others when the time comes to comply with the regulatory requirements, likely to be finalised next year.

As Operational Resilience as a concept is focused on the delivery of the service provided by firms, we will do this from the point of view of the service lifecycle, and then circle back to look at some of the other issues thrown up by Operational Resilience. Our approach will be to consider the key service requirements and then secondary issues. We will focus on London Market business though many of these questions will apply to the UK market as well.

Underwriting or Broking

The service provided by insurers and brokers is the provision of an insurance product. All delivery of that service must start with broking, quoting and underwriting. Where primarily online for consumers this should not have seen significant disruption though perhaps there may have been a surge in the same way there has with on-line shopping.

Broking and underwriting is therefore the logical place to start. The questions we think worth looking at now are:

• How has your firm adapted?
• Is this likely to be the best adaptation in all circumstances where a disruption may occur or only most appropriate for a pandemic or similar disruption to the place of work?
• If the latter, you will need to be thinking about what other ways a disruption may arise and how that might be dealt with.
• Has the model that has been adopted worked fully?
• If not, what have been the issues, and have you been able to resolve them?
• How has the supply chain operated? For insurers, have brokers been able to cope with the changes adopted by the insurer and for brokers, have the insurers been able to cope with changes adopted by the brokers?
• Have communications between insurers and brokers been clear and helpful?
• For brokers, has the approach by insurers been varied leading to different operating processes for different insurers? Has this created a significant increase in work? How have brokers adapted? Has it been effective?
• Have either brokers or insurers been afforded help by markets and market associations? Can these be relied upon in the future?
• Have individual brokers and underwriters been able to continue to receive the back up and support of their underwriting and broking assistants, wordings teams etc?
• Are senior underwriters overseeing their underwriting teams effectively and is the hierarchy developed through individual Underwriting Authorities working effectively?
• How have brokers and underwriters accessed pricing actuaries when required?
• Has PPL and/or any other online trading platform operated effectively?
• Have underwriters and broking staff been able to operate their underwriting and trading platforms from home? If not, what have been the back-up plans and have they worked effectively?
• Has your other IT been able to cope with a volume of individual underwriters working from home or at all? Do you need to have underwriters or brokers in the office because remote access is not working or cannot work effectively and/or collectively?
• Have supporting operators provided continuity of service? For example, the use of external sanctions checking firms?
• How has the peer review process for underwriters been adapted or for brokers the file review process?
• Where underwriting has been outsourced by way of a Binding Authority:
  • How is the coverholder DUA management team operating?
  • Is oversight still effective?
  • Are coverholders managing in the crises? How do you know? What indicators do you have?
  • Are coverholders continuing to report in the usual way?

Servicing and Mid-Term Adjustments

Customer fulfilment and dealing with mid-term adjustments are a key element of the overall service provided to insured customers. In the London Market the mid-term adjustments are often dealt with by junior underwriters or underwriting assistants.

• How has your firm adapted?
• Is this likely to be the best adaptation in all circumstances where a disruption may occur or only most appropriate for a pandemic or similar disruption to the place of work?
• How are underwriting assistants and junior brokers getting access to their underwriter or brokers to ensure they are making the correct decisions and effecting the appropriate changes?
• Have they had access to the back up and support of wordings teams and others?
• Is customer fulfilment operating effectively with Policy documentation, Policy summaries or IPIDs, Customer Terms of Business and other documents being issued on time for new business, mid-term adjustments and renewals as appropriate?

Claims

There is no doubt that the provision of the claims service is considered by policyholders as the most important aspect of the service provided by the insurance market. It is here where a customer finds out whether they will receive the service they believe they have paid for and it is the area where most complaints arise, and reputations can be most easily damaged. Continuity of service and clarity of coverage are therefore critical during disruptions.

• Are brokers able to access the insurer’s claims team(s)?
• Has there been clarity in communications between insurers and brokers over temporary operating procedures?
• Has there been clarity on policy coverage for policyholders who have been impacted, for example by being quarantined while travelling?
• Have policyholders been able to obtain advice and assistance when required?
• For brokers, has the approach by insurers been varied leading to different operating processes for different insurers? Has this created a significant increase in work? How have brokers adapted? Has it been effective?
• Have claims staff been able to access the claims systems and operate them effectively?
• Has the hierarchy within the claims team created by individual claims authorities been operating effectively? Were temporary changes required?
• Have claims staff been able to access and appoint lawyers, third party adjusters or others?
• Where claims management has been outsourced to a third party:
  • How is the DUA management team or claims team operating?o Is oversight still effective?
  • Are TPAs managing in the crisis? How do you know? What indicators do you have?
  • What communications with TPAs have been necessary? Would they be necessary in the event of all possible disruptions to service?
  • Are TPAs continuing to report in the usual way?
• Is the necessary information on potential reserving issues being made available to the reserving actuaries and to the firm’s management as appropriate?

Other Thoughts

1. Management of the Crisis
At the hub of all the challenges which the firm must deal with is the need to ensure that the firm has a plan for any disruption. Operational resilience is conceptually much wider than a business continuity plan not the least because of the risk management approach built in with the use of disruption thresholds and tolerances but also its focus on the service provision.

At the centre of this must be information. Management cannot make informed decisions without solid and sound information and facts and once decisions are made clear communication of those decisions to all stakeholders, that is employees, clients, service providers, shareholders and regulators, is key. To carry on thereafter management must continue to receive sound information (both external and internal) in order to be able to respond to the changing environment.

• How has the firm managed the crisis?
• Has it been in line with the BCP?
• If not, what were the differences?
• Has the management of the crisis been effective?
• What lessons can be learned, and improvements made?
• Were those making the decisions well informed of the necessary facts?
• How did the CIO, Risk, HR, Compliance and/or Legal functions support management with ensuring they were in receipt of appropriate information?
• Was the Board engaged or were all the decisions executive?
• Did the CEO work with the Chair or SID?
• Did the Committee structure help or hinder?
• Was a crisis management team utilised? Did it work effectively?
• Was there enough and/or clear communication?
• Once new operating arrangements were decided upon, how was implementation effected and overseen?
• With the new operating arrangements in place have there been any necessary changes to the management approach or structures?
• With a considerable number of individuals working from home how are senior and team managers managing their teams?
• How can the firm be certain that the management processes are still effective?
• Has HR issued or prepared for management to issue any guidance?
• Were any policyholder complaints received? How were they reported and dealt with during the crisis?

2. Support Services
The three phases focused on above all require support whether it be IT, Finance, Operations, Actuarial, Risk, Compliance, Legal, HR or otherwise. Some of this support will be primary, that is support which is required specifically to ensure continuity of service, for example, Underwriting systems and advice from lawyers or compliance on a potential sanctions issue and others will be secondary, such as compliance monitoring.

In a crisis situation the primary support is absolutely critical and the secondary not so critical. However, once a firm has passed the initial issue of maintenance of the service the secondary services will be expected to be maintained. A firm cannot simply decide to ignore the question of whether business is subject to sanctions or whether to continue peer review to ensure that the underwriter’s decisions were appropriate and the risk was written within risk appetite, pricing expectations and within the firm licenses.

This crisis in particular looks like it could lead to disruption which may last longer than, for example, an IT outage or a failure by a third-party supplier. Firms therefore need to include in their planning and implementation of their response to this crisis the implementation of secondary support services to ensure the temporary processes and procedures become business as usual.

This in turn will lead to the firm being able to ensure the continuation of the firm’s control environment if only in a temporary form. There is no less need to ensure that the control environment is operating during a crisis than during business as usual and in many ways it is more important to ensure the management and board are receiving sound information so that they may ensure they are making well informed decisions.

We are not proposing questions here. That will be the subject of a later piece. However, we would recommend that firms consider their planning and implementation of their temporary operating model with a view to looking at how they have ensured controls within the firm are still operational.

Thresholds

In due course firms are going to be required to have and monitor against tolerance and threshold levels of service disruption. The process each firm has or may still be going through provides an opportunity to gain insight into what these might be in due course and to what they may need to be applied.

For example, Travel insurance will have had a deep focus in the past few months. Where issues have arisen will give a clear indication of the sort of issues which might arise again.

• Can the firm make conclusions about what its tolerance would be for a failure to deliver a service to a client who is overseas and may need repatriation or medical attention?
• Have there been examples of where a third-party provider has been unable to assist? What would the firm’s tolerance for this failure of service be?

Each of the three elements of the service we have identified will require thresholds and tolerances and these may even be much more detailed. Tolerance levels for a failure to provide a claim service to retail customers may for example be considerably lower than for commercial customers and may also vary between products. Taking Travel as an example again, a failure to be able to repatriate an individual may cause considerably more harm to a customer than the failure to be able to ensure someone whose vehicle has been stolen is provided with a payment in a short period of time, though that may not be the case where the individual needs their vehicle for work purposes.

Similar considerations will apply for underwriting. Businesses which must have compulsory insurance can hardly afford to not have their policies renewed or not be given early warning that the policy will not be renewed.

The current crisis presents an opportunity to give some thought to these things. It is very likely that the thought process has in fact taken place. Management will have identified and prioritised those services for those customers which needed the highest level of attention. Firms which can document that prioritisation will again be taking good strides towards preparing for Operational Resilience.

Summary

Significant work is being undertaken by firms at this point in time in response to the current crisis which can be utilised over the next 6 months to help prepare for Operational Resilience (and possibly evidence if good practice already exists).

It may not feel like the right time to be investing in projects but there is no doubt the regulators will be expecting this one to be a high priority for firms. Some investment now could make a considerable difference to the investment required later.

Many firms have started the process of preparing for Operational Resilience, though perhaps some have mothballed those projects in recent weeks. In either case the opportunity this pandemic presents to create some efficiency should not be lost.

ICSR is open for business and has individuals with appropriate experience who are available to help right now. We are able to support firms to ensure that this opportunity does not become a lost opportunity. We can work metaphorically alongside your teams as they operate under Business Continuity mode permitting your employees to focus on the urgent priorities of continuing the service for customers. Our operating model means that we have the ability to work remotely while using video technology to communicate with clients and progress projects on Operational Resilience or otherwise.

If you would like to know more or need assistance, please contact us.

Yvonne Lancaster

Independent Consultant