Earlier this year, Crescendo Advisors undertook a survey of the insurers’ lessons learnt from managing Covid-19 disruption. This was based on in-depth discussion with 24 senior stakeholders with a turnover of about £120bn. We covered readiness before Covid-19, how the crisis was managed and lessons for the future.
In parallel, regulators were consulting on requirements for operational
resilience. They do not plan to require
firms to meet them before the end of 2021.
This is then the time to think in earnest about implementation. One aspect of the requirements is learning
from events like Covid-19. We thought
that we would review our findings and identify what we can learn for the
implementation of operational resilience.
Broadly speaking we identified two contrasting views. Some saw Covid-19 as an unprecedented event and thought that there was little that could be learnt for the implementation of operational resilience. Others were concerned that the industry’s success at keeping the show on the road could give an impression that operational resilience is not an issue. We do not subscribe to these views and identified five practical lessons, which is more consistent with the Goldilocks approach – not too little, not too much.
Lesson 1: Do
not assume that you will get the same advance warning for the next operational
resilience event
While few firms anticipated a pandemic of the scale of
Covid-19, firms had a 6 to 8 weeks before lockdown to prepare, which many used
very well to prepare for the inevitable lockdown and social mobility
restrictions that were anticipated. Our
survey suggested that industry readiness would have been very poor absent these
preparations.
Looking ahead, it is unlikely that in the type of
operational resilience scenarios that are more likely in the future, e.g.
system failures, firms will have such a luxurious amount of time in which to
enhance your resilience.
Lesson
2: Invest in crisis management as part of operational resilience preparations
Operational resilience requirements rightly focus on
governance, planning (identification of key business services, setting
tolerance and analysis of resilience in severe but plausible scenarios), and
enhancing resilience where it falls below the agreed tolerance.
However, when an operational resilience event takes place
you will also need a well-oiled crisis management capability. Participants who chanced to have tested crisis
management capabilities before Covid-19 noted the benefits from that. It is important to review and test your crisis
management capabilities (e.g. war games) as part of the implementation of operational
resilience.
Lesson 3: Working
from home (WFH) is useful but challenges your potential back-up
The ability to work from home was a key aspect of the
response to Covid-19; at the same time recovery sites proved to be not very
useful in this scenario. This has also
led to a wider discussion about the role of the office and the possibility of
home being the new BAU. But if WFH is the new BAU, what is the back-up for the
next operational resilience event?
Lesson 4: Think about scenarios and stress testing in
an integrated manner
While insurers considered scenarios before Covid-19, few anticipated
a pandemic of this scale with all of its financial and economic implications. Looking ahead at the development of scenarios
for operational resilience, this raises a challenge about the importance of consistently
considering the financial and operational implications of scenarios in ORSA and
operational resilience.
Lesson 5: Outsourcing of key activities is likely to
be a challenge for operational resilience
Participants identified outsourcing as an area where they
would like to spend more time monitoring performance. Where outsourcing was material, the
experience of Covid-19 was mixed. Interestingly, good performance during Covid-19
in outsourcing was associated with a business rationale going beyond cost
savings or managed as an integral part of the business.
These are industry lessons.
But what lessons can you extract from your own business experience of
managing Covid-19? We encourage you to
formalise the lessons learnt exercise.
You may learn something new or unexpected about your business. But more
generally the exercise can inform wider decision making; one insurer had a
clear vision that their Covid-19 lessons learnt should feed into a strategic
review. At the very least it will support your operational resilience planning
and delivery.
This post has been written
by Isaac Alfon (Managing Director) and Shirley Beglinger (Advisory Board
Member) from Crescendo Advisors. It is based on a presentation to
ORIC’s Covid-19 Industry Group.
Crescendo Advisors (www.crescendo-erm.com) is a boutique risk management consultancy. We would be happy to share an overview of the findings from the Covid-19 lessons survey. We can also support your efforts to both learn lessons from Covid-19 using the tools we developed for this survey and implement the regulatory requirements for operational resilience.
Photo by João Cabral from Pexel
