Building trust is the cornerstone to operational resilience

In December last year, the FCA – in conjunction with the Bank of England and the Prudential Regulation Authority (PRA) – launched a joint consultation on operational resilience.

In a corresponding speech at The Investing and Saving Alliance’s (TISA) Operational Resilience Forum, the FCA’s executive director of supervision – investment, wholesale and specialists Megan Butler said the consultation was designed to achieve “a shift in mindset”.

She continued: “The proposals in the consultation papers make it clear that we expect you to understand your vulnerabilities, invest in protecting those and protecting yourselves, consumers and the market.”

These proposals include expectations of firms to identify important services, considering how disruption to these services can have impacts beyond the organisation’s commercial interests; setting a tolerance for disruption for each key business service; and requiring businesses to map and test their services in order to find vulnerabilities in their operational resilience and drive change where needed.

For the insurance sector specifically, however, Justin Elks, managing director and UK enterprise risk management (ERM) and insurance lead at consultancy Crowe believes that operational resilience is centred in trust.

He explained: “It’s about building trust: trust that an organisation can adapt to changing circumstances - withstanding, absorbing and recovering from stresses and disruption [while] delivering on promises to customers and achieving critical business objectives.

“Trust is foundational to insurance, which is fundamentally about a customer trusting the industry to take, pool and manage risk.”

Benefits of resilience

The connection between good operational resilience and customer trust is vital if insurers wish to stand out from their rivals, added Elks.

“If services are less likely to be disrupted, the downside risk of customer harm is reduced,” he said. “Some companies outside of insurance [are] using operational resilience as a competitive differentiator; I expect to see more of this in insurance going forward, as insurance is a ‘trust’ business.

“I believe customers will increasingly only use companies they trust to deliver services, so operational resilience will be a crucial competitive differentiator.”

Other advantages of finessing operational resilience, according to Elks, is that firms can glean valuable insights into business models and processes, evaluating what contributes or detracts from achieving set goals.

Furthermore, operational resilience helps to bring risk management to the fore. “Operational resilience can make risk management more real – enhancing the value, practicality and ownership of operational risk management by shifting the focus from assessing to managing risk and driving operational risk awareness to the front line of the business,” Elks said.

Strategy

But, how can insurers and brokers achieve this holy grail of effective operational resilience?

Alongside the FCA’s advice regarding operational resilience, these strategies should ensure to take a collective business view rather than separating into siloes, to “join the dots” through internal collaboration and shared responsibilities.

Elks said: “To enable an effective programme of activity, organisations need first to get their arms around these disparate areas, understand their current position and their aspirations, then ruthlessly focus and prioritise what’s important for their business.

“Conducting an independent-minded gap analysis across existing processes, capabilities and resources will enable the business to focus and prioritise their effort in the right areas and not waste money where it won’t add value by mobilising a large, costly programme.

“Insurers should look to join the dots between existing capabilities and approaches by building on established operational components that contribute to resilience.”

Elks added that firms should be aware of how third and fourth parties can impact upon their operational resilience, and that engaging board members and non-executives is also important.

“Non-executive directors are typically very interested in operational resilience, as it helps them focus on the important operational issues where their experience and expertise should be focused,” he said.

Operational risk

However, could operational resilience itself actually be a risk factor for insurers and brokers? These firms collect and store a lot of personal data from customers, and with technology developing in leaps and bounds every few months, surely keeping pace with operational risks is a challenge?

“Operational resilience is an outcome of good operational risk management,” Elks confirmed.

“In thinking about managing operational risks and operational resilience, insurers and brokers need to recognise that the operational risk environment [has] shifted in the past decade.

“Factors such as the increasing use of technology and increasing use of third parties means the business world is increasingly interconnected; insurers rely on technology in almost all processes from front-end customer interaction to management, analytical, administrative and settlement functions, and rely on third parties to both supply technology and provide enhanced capabilities.

“This is why regulators are focusing on operational resilience now – they want firms’ operational readiness to be on a par with their financial and strategic readiness.

“In some insurers under solvency II, these non-financial risk areas have been under-invested and have often felt like the ‘poor relation’. I believe the focus on operational resilience will change and enhance operational risk management to enable it to more effectively provide insight, impact decision-making and support the delivery of strategic objectives. This will help firms to enhance returns as well as manage regulatory compliance risk.”

Elks further warned not to underestimate how people can influence these risks too. He explained: “We’re increasingly focusing on helping clients address the role people play as the first line of cyber security defence, their values and behaviours, and the implications on risk exposures.

“We are seeing an increasing focus on influencing culture and educating people on security behaviour to effectively mitigate the risk.”

Coronavirus impact

Undoubtedly, one of the greatest tests of operational resilience this year is the Covid-19 pandemic; Elks described this as a “live test” of current operational resilience models.

He continued: “Prior to coronavirus, pandemic scenarios were incredibly difficult to engage businesses in thinking about, as the sort of requirements and behaviour we are now expecting from people wasn’t something business people were thinking was plausible.”

David Miller, insurance regulatory partner at KPMG, agreed. He added: “Operational resilience, until now, was seen by many firms as a theoretical planning exercise in response to the requirements set out by the PRA, FCA and Bank of England.

“In a matter of weeks, Covid-19 has demonstrated the intrinsic link between operational resilience in theory and crisis management in real-time, as firms battle to maintain operational continuity under some of the tightest restrictions our society has ever seen.”

For Miller, the key for organisations looking to survive the economic impacts of the coronavirus outbreak is to identify key business services and the infrastructures that these rely on, as well as understand the firm’s tolerance for any service outages.

He further recommended using past experiences of crisis to analyse any potential blind spots and that contingency planning should not revolve solely on processes, but also around senior leaders and their deputies.

Elks concurred: “People and culture are key in an effective response, so it’s important to balance meeting customer needs with a duty of care to your people.

“My advice to insurers is don’t waste the crisis – use the current challenges to learn lessons and improve your approaches to operational resilience.”

He added that business resumption plans should also be reviewed – these typically centre around localised events, like location outages, however many firms will have to manage employees returning from remote working en masse.

A proactive mindset

Despite all the forward planning that firms can implement in order to become operationally resilient, Elks added that it also comes down to having “a proactive mindset”.

He continued: “Being operationally resilient can deliver significant competitive advantages, but benefits will only be realised if firms adopt a proactive mindset that assumes events will happen, and think in advance about how to deal with them when they do, building in flexibility to adapt and deal with the unexpected.

“Companies can be operationally resilient by dealing with problems quickly, by timely and effective direct communication, understanding the impact of disruption and making sure customers don’t lose out.”