An insurance perspective: How prepared is your business for COVID-19?

DOWNLOAD THE VIEWPOINT

Who is responsible?

Section 18 of Australian Prudential Regulation Authority (APRA) CPS 232 holds the board ultimately responsible for business continuity. Board members are therefore advised to consult with their executives on the preparedness of the business for COVID-19 and familiarise themselves with obligations under APRA’s prudential business continuity standard (CPS 232) and the guidance in pandemic planning (CPG 233).

Review business plans

If not recent, the board must carefully review the organisation’s business continuity management policy – as well as the business continuity plan (BCP) and its testing to ensure it adequately covers a pandemic. If not already reviewed externally, it may be prudent to have the plan and testing independently audited or benchmarked against standards such as ISO 22301.

There still remains time to ensure the BCP is up-to-date, tested and any shortfalls addressed. It is also imperative that the BCP is widely communicated and understood ahead of being invoked.

Pandemics are different

Pandemics differ from other scenarios by virtue of their impact on an organisation’s people, their extended duration and the extent of simultaneous impact on the supply chain, partners and counterparties.

The board needs to understand how and to what extent the business will function at various levels of absenteeism. APRA’s practice guide (CPG 234) suggests following World Health Organisation (WHO) guidance of modelling the loss of 30% of on-site resourcing, and as much as 50% over 18 months.

Immediate actions

The board can expect that its executive has already implemented a cross-functional working group to monitor and manage the pandemic. This team is often referred to as a crisis management team (CMT) and its current focus should be on preparedness and prevention. The CMT will have to make the critical decision of when to invoke the BCP. Board members must familiarise themselves with the triggers, which are usually based on confirmed cases of infection in and around business operations, so that they are not caught unaware when actions are taken in order that services can still be delivered.

It is important that the thresholds for acting have been carefully considered to avoid unnecessarily compromising productivity. In extreme circumstances, the board may need to accept that certain activities such as project work, sales and business development are suspended.

Look after employees

With WHO having declared COVID-19 a pandemic, pay attention to employee wellbeing through social distancing policies and regular communications that provide direction and offer reassurance. Social distancing policies aim to reduce employee exposure by curtailing business travel and attendance at conferences and encouraging employees to work from home.

Practice social distancing

Given the nature of transmission, give thought to social distancing of critical personnel that work in close proximity – for example claims, underwriting, finance and the CMT itself. This extends to other decision-making and accountability roles required to manage business continuity as events unfold. Provide guidance on social distancing during personal hours; there is little point in distancing staff in the workplace if they congregate socially.

Communicate with customers

The board also needs to ensure the executive has considered broader stakeholder communications – including contacting policy holders and explaining whether their coverage excludes pandemics and how pandemic-related claims will be assessed if the exclusion is not explicit.

Obligations to APRA

All insurers must use the latest information from credible sources such as WHO and government agencies to understand the impact of COVID-19 on their liabilities, assets and capital. APRA requires notification within 24 hours of major business disruptions with the potential for material impact on an institution’s risk profile or financial position.

Counterparties and technology scaling

Pandemics have a broad impact, so board members have to be satisfied that the continuity plan adequately anticipates counterparties or various parts of the supply chain being affected. If third-party operations are material to business activity, there may be a need to notify APRA as required under CPS 231 (outsourcing) that they are at risk, and consideration given to alternate suppliers or insourcing.

The board needs to:

Frequently, there is an overreliance on systems with insufficient ability to scale or that have not been tested at the scale required in a pandemic. This may be the product of avoiding excess capacity in networks, server and licenses in normal operations. During a pandemic, supply chain disruption may prevent this additional capacity being procured in a timely fashion. It may be prudent to increase capacity now as a precautionary measure, or to accelerate the adoption of digital technologies. Many organisations are already diverting resources to ensure sufficient laptops are procured and configured to support remote working, which is having an impact on productivity and supply chains.

Mitigate risk with technology

Cloud computing, robotics (applied in both the business and technology operations) and artificial intelligence can mitigate many of the issues that arise with traditional information technology in a pandemic as they provide scalability and reduce the need for the involvement of employees.

Many of these technologies can be rapidly adopted given their consumption of ‘as-a-Service’ models – where access is secure and ubiquitous by virtue of being on the cloud.

Accelerating application modernisation can reduce the number of applications being supported and leverage the scale and stability of cloud providers such as Amazon, Google and Microsoft. Moving to Desktop-as-a-Service can significantly reduce the overhead of managing large fleets of PCs and laptops, including the costs associated with on-premise or private cloud connectivity.

Similarly, robotic process automation can remove the reliance on people in repetitive but critical activities such as accounts payable processing or IT systems maintenance.

Accelerating the adoption of these technologies brings efficiency gains, shorter development cycle times and cost optimisation. This will provide a competitive advantage when normal operations are restored.

With all the complexities in business continuity planning and testing and compliance, and with the ultimate responsibility resting with the board, now is the time to seek independent assurance and guidance.

How prepared are you?

Here's a checklist to consider:

Business continuity policy

	Is the policy adequate and current?
	Has the policy been appropriately implemented?

Business continuity planning

	Does the BCP address a pandemic?
	Has the BCP been tested against a pandemic scenario with 30%+ absenteeism?
	At what scale was the BCP tested?
	What were the results of the testing and have any shortfalls been remediated?
	Is there enough awareness and experience to implement the plan?
	Have you conducted an independent review and test of your BCP?

Crisis management team

Have you identified and confirmed a cross-functional working group to manage, monitor and respond to COVID-19?

APRA obligations

Do you have a clear understanding of the relevant APRA standards and reporting requirements?

Communication

	Are communications with employees and customers frequent and currently focused on wellbeing and preventative measures? Are next steps articulated?
	Are stakeholders being kept informed of business continuity preparedness and triggers?

Counterparties and technology scaling

	Is there sufficient system capacity to support extensive social isolation?
	Is continuity of critical supply chain partners and counterparties sufficient to support your BCP?
	Will your systems scale sufficiently to support the increased use of digital channels and remote working?

DXC is proud to be supporting our clients with their business continuity management including the scaling of systems – collaboration applications, network equipment, servers, laptops and mobile devices – during these unprecedented times.

If you or your suppliers need support, please contact me.

Author: Stuart Bremner

Chief Technologist, Insurance
DXC Technology Australia and New Zealand
sbremner3@dxc.com
https://au.linkedin.com/in/stuart-bremner