Guidance Note GGN 222.1Guidance Note GGN 222.1

Image unavailable in extracted text

Guidance Note GGN 222.1

Risk Assessment and Business Continuity Management

1. This Guidance Note provides further detail on matters general insurers (insurers) should consider when addressing the requirements contained in Prudential Standard GPS 222 Business Continuity Management (GPS 222 Business Continuity Management).

Risk assessment

2. The risk assessment should be undertaken at least annually and more frequently if there have been significant operational changes at the insurer or new or changed external factors that would alter the insurer’s business continuity risk profile.

3. The worst case disruption scenario should be considered by an insurer and include, but not be limited to:

(a) loss of precinct;

(b) loss of building;

(c) denial of access to building for a limited time;

(d) loss of IT (data);

(e) loss of IT (voice);

(f) loss of vital (non-electronic) records;

(g) loss of key staff (temporary or permanent); and

(h) loss of key dependencies.

4. The critical interdependencies of the insurer’s Business Continuity Plan (BCP) that are not within the direct control of the insurer should be identified and the associated risks assessed. This includes, but is not limited to, dependencies on utilities, third party service providers and key suppliers.

Communication plan

5. The communication plan[5] should incorporate a list of contact names and numbers, including, but not limited to, staff, regulators, customers, counterparties, service providers, market authorities and media. Out-of-hours numbers (including primary/alternate contacts) should be included for all staff with BCP responsibility. The contact list should be reviewed regularly to ensure it is up-to-date.

6. The communication plan should clearly identify the staff authorised to deal with the media if the BCP is invoked.

Outsourcing

7. Business continuity should be considered as part of any proposed material outsourcing agreement with a critical service provider. The insurer should conduct due diligence in this regard as part of the decision making process when assessing service providers.

8. The contract between the insurer and the critical service provider should include a requirement that the service provider have a BCP and testing program in place and provide for regular, and not less than annual, reporting to the insurer.