Prudential Standard GPS 222 Business Continuity Management
EXPLANATORY STATEMENT
Issued by the authority of the Australian Prudential Regulation Authority (‘APRA’)
Insurance Act 1973, section 32
Under section 32 of the Insurance Act 1973 (‘the Act’), APRA has the power to determine (in writing) standards in relation to prudential matters to be complied with by general insurers (‘insurers’).
APRA has determined that this standard will come into effect from the date of registration on the Federal Register of Legislative Instruments.
Prudential Standard GPS 222 Business Continuity Management
Effective business continuity management (‘BCM’) is an increasingly important component of the risk management systems of insurers. The absence of appropriate BCM policies can lead to financial, legal, reputational and other material consequences for the insurer. Effective BCM increases resilience to disruptions and thereby assists in ensuring that insurers can meet their financial and service obligations to policyholders and other creditors.
The proposed new standard is intended to ensure that insurers implement a whole of business approach to BCM appropriate to the nature and scale of the operations of the particular insurer. The standard will require an insurer to identify critical business functions, resources and infrastructure, address plausible disruption scenarios that could materially impact upon these, and develop, implement and maintain a Business Continuity Plan. The primary responsibility for BCM rests with the Board of Directors of the insurer or, in the case of a foreign general insurer, the senior officer outside Australia with delegated responsibility from the Board. The Board and senior management must consider the insurer’s business continuity risks and controls as part of its overall risk management systems.
A transitional period of 12 months will apply from when this standard takes effect. During this transitional period, all insurers must report on their compliance with this standard and submit to APRA a plan and timeframe for rectifying areas of non-compliance.
The Office of Regulation Review has determined that a Regulation Impact Statement is required for the new standard. It has accordingly been prepared and is attached to this Explanatory Statement.
REGULATION IMPACT STATEMENT
This Regulation Impact Statement covers a proposal to determine a new Prudential Standard under section 32 of the Insurance Act 1973 (‘Insurance Act’) on business continuity management (‘BCM’) that would apply to all general insurers (‘insurers’). It is also proposed to determine a BCM prudential standard for authorised deposit-taking institutions (‘ADIs’) at the same time and one for life companies at a later stage. Both of these proposed prudential standards will be subject to their own Regulation Impact Statement.
Background
The Australian Prudential Regulation Authority (‘APRA’) was created out of the Government’s financial sector reforms that were implemented as a result of the Financial System Inquiry in 1997. APRA is primarily responsible for the safety and soundness of prudentially regulated financial sector institutions, including ADIs, general insurers, life companies, and superannuation funds. Each sector is subject to prudential requirements as set out in the industry Acts and the prudential standards, regulations and rules made under these Acts.[1] These industry-specific prudential regimes promote financial soundness, stability and appropriate risk management across APRA-regulated institutions.
Losses from disruptions to business discontinuity caused by internal or external events (including terrorism, computer crime and natural disasters) forms a core component of operational risk, a diverse range of risks that the Bank for International Settlements has defined as ‘the risk of loss resulting from inadequate or failed internal processes, people and systems from external events’.[2] BCM seeks to increase an insurer’s resilience to such business disruptions and reduce the impact on its business operations, reputation or profitability as well as ensuring it can meet its financial and service obligations to policyholders and other creditors.
Problem identification
As business operations have become increasingly complex and vulnerable to disruption from external events, effective BCM has become an essential component of an insurer’s risk management framework. Both in Australia and internationally, there is a specialist industry providing information and support services to assist companies on BCM issues. Insurers are currently subject to some BCM requirements under existing prudential requirements.[3] These are minimal however, and it has become evident to APRA that not all insurers are developing and incorporating appropriate BCM practices into their risk management strategies. As insurers may incur substantial losses and even fail as a result of not being able to recover from business disruptions and continue operations in a timely manner, APRA has identified current BCM practices as an area of the prudential framework requiring improvement. Examples of deficiencies found by APRA in the current BCM practices of insurers include:
- deficiencies in the BCM practices of insurers, including incomplete risk assessments, business impact analyses and recovery strategies, poorly documented and out of date business continuity plans, and inadequate and incomplete testing programs. Individually or in combination, these increase the risk of significant disruption and/or loss to an insurer, while leading to weaknesses in the oversight, reporting and monitoring processes of the Board of Directors (‘the Board’) and senior management of the insurer; and
- instances where an insurer’s BCM approaches are out of date as a result of not being subjected to regular internal review. For example, while much business continuity preparation for the Year 2000 date changeover was undertaken, little ongoing development or maintenance of business continuity plans has been done since. This is of concern, for while significant business disruptions in Australia have been rare to date, the business continuity risks, particularly from external threats (e.g. computer crime, terrorism, SARS), are ever changing and increasing. This highlights the need for insurers to continually develop and regularly review their BCM approaches.
While it is difficult to quantity either the risks posed to insurers by inadequate BCM given the low frequency of significant events,[4] the potential impact upon customers more generally from business disruption can be garnered from the following examples:
- of the 350 companies affected by the World Trade Center blast, 180 have ceased trading;
- 80 per cent of all firms suffering a major disaster cease business within 13 months; and
- businesses can be destroyed by the loss of a critical resource for more than 10 days.
Finally, Australia’s prudential framework is currently not fully compliant with the operational risk requirements contained in the international core principles that form the international standards on prudential regulation. The Insurance Core Principles (issued by the International Association of Insurance Supervisors in October 2003) states that the Board of an insurer must ensure that risk management systems capable of monitoring and controlling all material risks are established. The supporting material provides further guidance on what constitutes material risks and in the Guidance Paper on Stress Testing, BCM is included as a basic component of operational risk. In recent years, many offshore prudential regulators have introduced comprehensive guidance material and/or regulations relating to BCM.
While there is no compulsion to be compliant with every aspect of these international standards, these core principles provide an internationally accepted benchmark of minimum supervisory standards against which the quality of a country’s prudential supervision system can be measured and assessed.
Objective
Given the identified problems, it is proposed enhanced BCM requirements be applied to insurers.
As part of the general objective of prudential supervision to reduce the risk of financial loss to policyholders, the primary objectives of imposing enhanced BCM requirements on insurers are to:
- reduce the impact of material disruptions on an insurer’s business operations, reputation or profitability caused by internal and external events;
- increase the protection provided to policyholders through effective risk monitoring and control;
- promote confidence and stability in the financial system; and
- ensure Australia’s regulatory framework meets international core principles on prudential regulation.
Identification of options
Option 1 – Introduce a new prudential standard on BCM
Under this option, existing BCM requirements would be removed from Prudential Standard GPS 220 Risk Management for General Insurers and placed in a new prudential standard that would incorporate and augment the current requirements. Because of the very different issues raised by BCM for individual insurers (varying with the size and complexity of the business undertaken), the prudential standard would not be prescriptive at a detailed level, but rather set higher level statutory requirements. Its aim would be to ensure that the Board and senior management of an insurer have thought through the business continuity risks facing the insurer and are satisfied it has adequate risk management systems for identifying, monitoring and managing these risks.
Responsibility for business continuity would still rest primarily with the Board of an insurer, or in the case of a foreign branch, the senior officer outside Australia with delegated authority from the Board. BCM requirements would also be tailored to the nature and scale of the insurer’s operations.
It is proposed the prudential standard would include the following key requirements:
- the Board and senior management of the insurer must consider the insurer’s business continuity risks and controls as part of its overall risk management framework when completing the Board Declaration provided to APRA on an annual basis;[5]
- each insurer must identify, on a whole of business basis, critical business functions, resources and infrastructure that would have a material impact if subject to disruption;
- each insurer must assess the impact of plausible disruption scenarios on all critical business functions, resources and infrastructure, and have in place appropriate recovery strategies to ensure that all necessary resources are readily available to withstand the impact of the disruption;
- each insurer must develop, implement and maintain a Business Continuity Plan (‘BCP’) that documents procedures and information which enable the insurer to respond to disruptions and recover critical business functions. The BCP must be reviewed at least annually by responsible senior management and periodically reviewed through the insurer’s internal audit function or an external expert; and
- an insurer must notify APRA as soon as possible and no later than 24 hours after experiencing a major disruption that has the potential to materially impact policyholders.
A transition period of 12 months would apply from the time the prudential standard is determined. During this transitional period, all insurers would be required to assess their compliance with the BCM requirements in the prudential standard in their annual Board Declaration and have submitted to APRA a plan and timeframe (which may be longer than the 12 month transition period) for rectifying areas of non-compliance.
Option 2 – No prudential standard on BCM is introduced
This option would mean that no new prudential requirements on BCM would be applied to insurers.
Impact analysis
Impact group identification
The two options identified above would impact upon the following three groups: APRA, insurers, and policyholders.
Assessment of costs and benefits
Option 1 – Introduce a new prudential standard imposing BCM requirements
APRA
Benefits
The introduction of new requirements covering BCM would strengthen APRA’s prudential oversight of insurers, significantly reducing the risks (including financial, operational and reputational) posed by disruptions to business continuity.
By placing BCM requirements into a prudential standard, which can be amended as necessary (after public consultation), APRA can ensure the requirements remain relevant to industry and reflect sound practice in this area. This would also provide the basis for more appropriate and targeted supervision.
Further, APRA requirements for BCM would ensure compliance with international standards of best practice in prudential regulation. Aside from the benefits of drawing on this pooled knowledge, compliance ensures Australia’s regulatory framework continues to meet international requirements.
Costs
The introduction of a BCM prudential standard requires the development of a new BCM framework. APRA would also incur associated one-off costs, including public consultation about the proposals and training staff on the new requirements. APRA would also incur ongoing costs in monitoring compliance with the proposed requirements, although these would be mitigated by utilising existing operational risk requirements as a platform on which to add supplementary BCM requirements.
While it is difficult to quantify the additional costs for APRA associated with this option, APRA would not expect these to be significant. The extra supervision required as a result of implementing a new BCM prudential standard, as well as the additional collection of information and ongoing compliance monitoring, could be largely accommodated by APRA’s existing systems and supervisory processes.
Insurers
Benefits
A sound approach to BCM increases the resilience of insurers to business disruptions arising from internal and external events and reduces the impact on the insurer’s business operations, reputation or profitability (benefiting both the customers and shareholders of insurers). This leads to the additional benefit of improving the overall stability of the financial system.
Insurers would also benefit from a prudential framework that APRA considers current good practice with respect to BCM requirements and governance more generally. APRA is in the unique position of reviewing all operational risk areas across the regulated financial sector (largely undertaken by a specialist consulting unit within APRA dedicated to Operational Risk), allowing APRA to provide advice and guidance on the basis of this experience.
Costs
Because Option 1 proposes a qualitative standard (i.e. it is primarily about risk management practices) that provides for flexibility at operational practice level based on the size and complexity of the insurer, it is impossible to quantify the costs of these requirements. Under current arrangements, all insurers should have some BCM arrangements as part of their operational risks systems and APRA is of the view that the proposed prudential standard largely formalises arrangements that are already common practice within the financial sector, at least for well run insurers. Furthermore, the application of these requirements would be commensurate to the nature and scale of an insurer’s operations. This will avoid excessive compliance costs being imposed upon smaller and/or lower risk insurers. Insurers would incur some ongoing maintenance costs, including costs of reporting to APRA in regard to their ongoing compliance with the requirements.
For insurers currently below sound BCM practice, there is the potential for transitional compliance costs as resourcing is directed toward establishing a sound BCM strategy and implementing the underlying components (e.g. testing), although all insurers are already subject to minimal BCM requirements. These costs are not readily quantifiable, and would vary based on the size and complexity of each insurer. As already mentioned, the prudential standard seeks to avoid detailed prescriptive requirements. It is not a ‘one size fits all’ approach, although it does insist that all insurers must think through these risks and establish adequate risk management systems to monitor and manage these risks. Some insurers will have very complex ‘state of the art’ systems, while others may have very simple systems.
Policyholders
Benefits
Policyholders would benefit from the new prudential framework as BCM requirements should serve to strengthen the overall ability of insurers to respond effectively to disruptions to business continuity arising from various internal and external events. While it is difficult to quantity these benefits given the often low frequency of events, experience has shown that business disruption can have significant impacts for customers.
Another benefit for policyholders is reducing the possibility that they may be made to pay for losses incurred from disruptions to business continuity either through increased premiums, or else by reduced service levels.
Costs
Policyholders may be adversely affected if new BCM requirements were to lead to additional costs passed on as increased premiums, although this seems unlikely given the compliance costs for the new requirements are not expected to be material relative to the overall operating costs of individual insurers.
Option 2 – No prudential standard on BCM is introduced
APRA
Benefits
The main benefit for APRA in leaving the current regulatory framework unchanged would be the avoidance of costs that would be incurred in developing and administering new BCM requirements.
Costs
There would be no direct costs to APRA under this option as there would be no change to the existing framework. Intangible costs, however, would result because APRA would be unable to satisfy itself that insurers have sufficiently addressed the material risks to business continuity arising from various internal and external events. This undermines the effectiveness of APRA’s operational risk prudential framework, jeopardising the position of policyholders as well as the insurers themselves. Serious events could also impact on the overall stability of the financial system if key insurers were seriously impacted.
Insurers
Benefits
Under this option, insurers would face no additional costs as they would not have to meet any new BCP requirements, or enhance current procedures that might already be in place.
Costs
Insurers may incur substantial costs, whether to their business operations, reputation and/or profitability, if their current BCM policies and procedures result in an inadequate response and inability to maintain business continuity in the event of a major disruption.
Policyholders
Benefits
The benefits to policyholders under this option would be unchanged from the present. Since insurers would not be required to comply with additional prudential requirements, no extra costs would be incurred that could potentially be passed onto policyholders through increased premiums.
Costs
Retaining the status quo would involve intangible costs for policyholders in that the potential for improvement in the overall quality of risk management in insurers would not be realised. Policyholders could potentially be made to pay for losses incurred from disruptions to business continuity either through increased premiums, or else by reduced service levels.
Consultation
Consultation on Option 1 took place from July 2004 to the end of September 2004 as submissions were invited from the public on a draft BCM prudential standard. A draft of the prudential standard was placed on APRA’s website and a media statement released announcing the public release of the document. As APRA proposes to apply, over the longer term, BCM requirements to insurers, life companies and ADIs, submissions were invited from all three industries.
The majority of submissions were supportive of the draft prudential standard in principle, although less so from the general insurance sector. Some respondents in the general insurance sector felt the draft standard overly prescriptive. Specific concerns (and APRA’s response in brackets) included:
- the need for detailed procedures for the ‘return to normal’ phase in the BCP (APRA deems this phase no less important phase of business continuity planning);
- assigning operational responsibility to the Board (the prudential standard already allows the Board to delegate operational responsibility);
- certain requirements may require contractual changes in outsourcing agreements that will be difficult to renegotiate (the requirements are consistent with existing outsourcing requirements already contained in Prudential Standard GPS 220 Risk Management for General Insurers);
- that APRA would require a fully integrated test of the BCP (the requirement is only for an annual program of testing the BCP, although this may include a fully integrated test. In practice an insurer would test selected critical areas which would vary each year); and
- uncertainty over whether compliance would be required immediately (insurers have 12 months in which to report on their compliance and provide to APRA a plan and timeframe for rectifying areas of non-compliance transitional period).
Aside from one submission which talked of regulation costs in general, no concerns were raised over the compliance costs of the proposed BCM requirements.
APRA clarified certain aspects of the requirements in response to these and more minor concerns, as well as accepting a number of suggested changes to the draft prudential standard. However, no substantive changes have been made to the key requirements contained in the draft prudential standard as a result of consultation.
Conclusion and recommended option
Option 1 is the preferred option
Option 1 provides an enhanced framework for managing the risks from disruptions to business continuity caused by various internal or external events, such as acts of terrorism or IT failures. Recent experiences have raised awareness of the seriousness of these risks and highlighted the need for effective BCM practices. Australia’s prudential regulatory framework for insurers is clearly deficient in this regard. This option provides a transparent benchmark against which insurers can assess their risk management procedures, with the proposed prudential standard outlining the minimum BCM requirements that APRA expects insurers to meet. This will help to promote confidence in the general insurance sector and increase protection for policyholders. Prudential standards are supported by a legislative framework that enables APRA to issue a direction for non-compliance with these requirements, and further enforcement actions if an insurer fails to comply with the direction.
This option is likely to involve some additional costs for APRA and insurers, although the use of existing supervisory platforms should mitigate these costs for APRA, while most well run insurers should have no trouble in meeting the requirements of the prudential standard given they formalise current market best practice and build upon current requirements. The additional costs incurred by insurers are unlikely to be of a magnitude that impacts on policyholders. Overall, the benefits accruing from BCM requirements are expected to far outweigh any associated costs.
Option 2 fails to meet the desired objectives or address the identified problem. By leaving the current BCM framework for insurers as is, this option would make APRA’s supervisory task more difficult, and would not afford adequate protection to policyholders. The status quo is not a reflection of best practice risk management, whether as practised within financial markets themselves, or through internationally recognised core principles of prudential regulation.
Implementation and review
It is proposed that APRA determine a new prudential standard under section 32 of the Insurance Act to be called Prudential Standard GPS 222 Business Continuity Management.
The Prudential Standard would come into immediate effect. Over a 12 month transitional period, insurers would report on compliance with the Prudential Standard in their next annual declaration (already required for insurers under existing prudential requirements). Details of any areas of non-compliance would be reported to APRA, along with a plan and timeframe for their rectification.
There has been no discussion to date in regard to the ongoing review of the proposed BCM prudential standard; although APRA monitors on an ongoing basis the effectiveness of all prudential standards determined under the industry Acts.
[1] The industry Acts are comprised of the Banking Act 1959, the Insurance Act 1973, the Life Insurance Act 1995 and the Superannuation Industry (Supervision) Act 1993 (although the latter Act does not provide for the determination of prudential standards).
[2] Basel Committee on Banking Supervision (February 2003), Sound practices for the management and supervision of operational risk, Bank for International Settlements, Basel.
[3] These are contained in Guidance Note GGN 220.5 Operational Risk, which forms part of Prudential Standard GPS 220 Risk Management for General Insurers.
[4] Although evidence suggests a significant proportion of companies will suffer major disruption through fire, flood, storm, power failures, terrorism, or hardware/software failures over a five year period.
[5] Prudential Standard GPS 220 Risk Management for General Insurers requires the Board and senior management of all insurers to complete and provide to APRA on an annual basis a Board Declaration which details the risk management systems of the insurer.