Operational Resilience has become a strategic priority for financial institutions operating in increasingly complex, interconnected, and digitally dependent environments.
Insurance companies are expected not only to manage risks but also to continue delivering critical services during severe disruptions.
Customers, regulators, shareholders, and business partners expect uninterrupted access to essential insurance products, digital services, claims handling, and customer support regardless of the nature of the disruption.
This eBook uses AIA Bhd as a practical case study to demonstrate how an Operational Resilience programme can be developed and implemented within a large insurance organisation operating in Malaysia.
The organisation serves as a representative example of a modern financial institution whose operations depend upon people, technology, third-party providers, facilities, information, and regulatory compliance working together seamlessly.
The purpose of this case study is not to describe the actual internal operations of AIA Bhd. Instead, it provides an implementation-focused framework that Operational Resilience practitioners can adapt when developing similar programmes within their own organisations.
Where organisation-specific information is unavailable, this chapter presents reasonable assumptions based on common practices within the insurance industry.
Operational Resilience extends beyond traditional Business Continuity Management. Rather than focusing solely on recovering systems after disruption, it seeks to ensure that important business services remain within acceptable levels of operation throughout disruption, protecting customers and maintaining confidence in the financial system.
This introductory chapter establishes the organisational context required before developing an Operational Resilience programme.
Understanding how an organisation operates, what it delivers, the environment in which it functions, and the risks it faces provides the foundation upon which every subsequent resilience activity is built.
Before identifying Critical Business Services or establishing Operational Resilience strategies, it is essential to understand the organisation itself.
This chapter provides the contextual foundation required throughout the remainder of this eBook series by introducing:
The information developed here becomes the reference point for all subsequent planning activities including:
Without a clear understanding of the organisation, resilience planning risks becoming fragmented and disconnected from business priorities.
For any Operational Resilience programme to succeed, planners must first understand how the organisation creates value for its customers and stakeholders.
AIA Bhd operates within Malaysia's Financial Services sector, providing life insurance, health protection, savings, retirement planning, and related financial protection products.
As with most modern insurers, its business model integrates traditional insurance operations with extensive digital capabilities that support customer engagement, underwriting, policy administration, premium collection, claims processing, and intermediary services.
From an Operational Resilience perspective, the organisation can be viewed as an integrated operating ecosystem comprising:
These elements work together to deliver products and services continuously while maintaining regulatory compliance and customer confidence.
Understanding these relationships enables resilience planners to identify where disruption could significantly affect customers and the organisation's ability to deliver important services.
AIA Bhd's Operating Environment in Malaysia Governed by Bank Negara Malaysia
Financial institutions operate within one of the most highly regulated sectors of the economy. Operational Resilience programmes must therefore align business objectives with regulatory expectations.
Within Malaysia, financial institutions operate under the oversight of Bank Negara Malaysia (BNM). BNM expects regulated institutions to maintain sound governance, effective risk management, strong operational controls, cyber resilience, third-party risk oversight, and business continuity capabilities to ensure the stability of the Malaysian financial system.
For an insurance organisation such as AIA Bhd, the operating environment is characterised by several external factors that influence Operational Resilience planning.
The organisation operates under prudential regulations, supervisory requirements, and industry standards that promote financial stability, consumer protection, governance, and operational soundness.
Operational Resilience planning should therefore support compliance with regulatory expectations concerning:
Economic conditions influence:
Operational Resilience planning should consider both stable and stressed economic conditions.
Insurance organisations increasingly rely on:
While these technologies improve efficiency, they also increase operational complexity and dependency on technology providers.
Customer expectations continue to evolve.
Modern policyholders increasingly expect:
Operational Resilience must therefore focus on maintaining service continuity during disruption rather than simply restoring systems after an outage.
Modern insurers depend heavily upon:
Understanding these external relationships is essential when identifying potential sources of operational disruption.
Operational Resilience cannot be owned by a single department.
It requires coordinated governance involving senior management and multiple business functions.
A typical Operational Resilience implementation team may include the following stakeholders.
|
Role |
Primary Responsibility |
|
Executive Sponsor |
Provides strategic direction and organisational support |
|
Operational Resilience Programme Manager |
Coordinates implementation activities |
|
Operational Risk Management |
Integrates resilience with enterprise risk management |
|
Business Continuity Management |
Develops continuity and recovery capabilities |
|
Information Technology |
Ensures resilience of technology services |
|
Cybersecurity |
Protects digital assets and manages cyber resilience |
|
Information Security |
Safeguards information assets and compliance |
|
Claims Operations |
Represents critical customer-facing operations |
|
Policy Administration |
Supports policy servicing resilience |
|
Customer Service |
Represents customer interaction processes |
|
Finance |
Supports financial resilience and recovery |
|
Human Resources |
Addresses workforce resilience |
|
Procurement |
Oversees supplier resilience |
|
Legal and Compliance |
Ensures regulatory compliance |
|
Internal Audit |
Provides independent assurance |
The precise composition of the team will depend upon organisational structure, governance arrangements, and implementation maturity.
One of the most important activities within Operational Resilience is identifying the services that are critical to customers and the financial system.
Rather than identifying every internal business process, the organisation should focus on services whose disruption could cause unacceptable harm to customers, market confidence, or regulatory objectives.
When identifying Critical Business Services, planners should consider:
Illustrative examples of Critical Business Services within a life insurance organisation may include:
These examples provide the basis for subsequent Operational Resilience planning throughout this eBook series.
Understanding organisational characteristics assists resilience planners in determining where disruption may occur and how resilience strategies should be prioritised.
Typical characteristics of a large insurance organisation include:
Business activities are designed around long-term relationships with policyholders.
Compliance obligations influence governance, operational controls, reporting, and risk management.
Most customer interactions and internal processes rely heavily upon technology
platforms.
Insurance operations integrate underwriting, policy servicing, claims management, actuarial analysis, investment management, and customer support.
Operations depend upon accurate, confidential, and available information throughout the policy lifecycle.
Service delivery relies upon numerous external providers supporting technology, healthcare, payment processing, communications, and specialised services.
Insurance organisations manage contractual obligations that may span decades, requiring sustained operational capability throughout changing business conditions.
These characteristics significantly influence Operational Resilience planning and the prioritisation of resilience investments.
Operational Resilience should support the organisation's strategic objectives while protecting customers during disruption.
Illustrative Operational Resilience goals include:
These goals provide strategic direction for the Operational Resilience programme and establish measurable outcomes that can guide implementation and continuous improvement.
Understanding an organisation is the essential first step in developing an effective Operational Resilience programme.
Throughout this chapter, AIA Bhd has been used as a practical case study to illustrate how organisational context shapes resilience planning within a regulated financial services environment.
The chapter introduced the purpose of the case study and explained why a thorough understanding of the organisation, its operating environment, governance arrangements, and business characteristics is fundamental before undertaking detailed resilience activities.
It also examined the influence of Malaysia's regulatory landscape under Bank Negara Malaysia, highlighted the importance of a cross-functional Operational Resilience team, and outlined the key considerations for identifying Critical Business Services.
Finally, it described the organisational characteristics and strategic goals that should guide the design and implementation of a resilient operating model.
These foundational elements establish the context for all subsequent chapters in this eBook series.
With a clear understanding of how the organisation operates and the resilience outcomes it seeks to achieve, the next chapter will build upon this foundation by introducing AIA Bhd's Operational Resilience Planning Methodology, providing a structured implementation approach for identifying Critical Business Services, mapping dependencies, establishing impact tolerances, developing severe but plausible scenarios, and progressing towards a mature Operational Resilience capability.
The menu and blogs highlighted in the table below are under construction
Understanding Your Organisation
|
|
|
||||
| C1 | C2 [x] | C3 [x] | C4 [x] | C5 | ||
| C6 [x] | C7 [x] | C8 [x] | C9 [x] | eBook Cover | ||
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
|
If you have any questions, click to contact us. |
||
|
|