[OR] [AIAB] [E1] [C5] Identifying Critical Business Services

eBook 1: Chapter 5

What are the Critical Business Services of AIA Bhd when implementing an Operational Resilience Program?

Introduction

For an insurance organisation, disruption can occur at the precise moment when customers are experiencing illness, hospitalisation, disability or bereavement.

The operational consequences of service failure must therefore be assessed from the perspective of customer harm and the organisation's ability to continue delivering essential insurance services.

Identifying Critical Business Services (CBS) is a fundamental step in implementing an operational resilience programme at AIA Bhd.

A CBS provides an end-to-end view of how important services are delivered across people, processes, technology, information, facilities and third parties.

Once these services are identified, AIA Bhd can map their dependencies, establish impact tolerances and test its ability to remain within acceptable disruption limits.

What is a Critical Business Service (CBS)?

A Critical Business Service (CBS) is a service provided by an organisation, or by another party on its behalf, to one or more customers where disruption could cause intolerable customer harm or pose a significant risk to the soundness, stability or resilience of the financial industry.

A CBS should not be confused with an internal department, business unit or individual process. For example, the Claims Department is an organisational function.

In contrast, Claims Assessment and Benefit Payment may be considered business services because they deliver a defined outcome to policyholders and beneficiaries.

This distinction is important for AIA Bhd. A single CBS may depend on multiple departments, digital applications, databases, employees, agents, healthcare providers, payment channels and outsourced service providers.

Operational resilience examines the entire service delivery chain rather than treating each component independently.

The central question is:

If this service were disrupted for an extended period, would the resulting harm to policyholders, beneficiaries or the wider organisation become intolerable?

If the answer is yes, the service should be considered for classification as a CBS.

Key Considerations for Identifying CBS at AIA Bhd

AIA Bhd should adopt a structured, evidence-based approach to identifying its Critical Business Services.

The assessment should begin with the outcomes delivered to policyholders and beneficiaries rather than with existing organisational structures.

Several considerations are particularly relevant.

Potential customer harm. AIA Bhd should assess whether disruption could create financial hardship, delay access to medical treatment, prevent customers from obtaining policy information or delay benefits required during significant life events.

Time sensitivity of the service. Some insurance services become increasingly critical as disruption continues. A short delay in processing a routine policy amendment may be manageable, whereas prolonged disruption to hospital admission support or urgent claims services could have serious consequences for customers.

Volume of affected customers. A disruption affecting a large population of policyholders may reach an intolerable level more quickly than one affecting a limited group.

Financial consequences. The organisation should consider delayed claims payments, premium processing failures, inaccurate transactions and other financial consequences affecting customers or AIA Bhd.

Regulatory obligations. Services supporting policyholder protection, regulatory reporting, information security, and continuity of financial services should be considered when determining criticality.

Digital dependency. AIA Bhd provides customers with digital capabilities to manage plans, make payments, submit claims and access health-related services through AIA+. Disruption to digital channels may therefore affect multiple customer journeys simultaneously.

Third-party dependency. Insurance services may depend on healthcare providers, technology vendors, cloud services, telecommunications providers, payment service providers and other external organisations.  The failure of a third party does not eliminate AIA Bhd's need to understand the resulting impact on customers.

Interconnections and interdependencies. A service may appear operational when examined independently but fail because a supporting identity service, customer database, payment capability or communication channel is unavailable.

These considerations should be documented and approved through AIA Bhd's operational resilience governance structure.

Table: Proposed Critical Business Services (CBS) for AIA Bhd

The following CBS catalogue is proposed to support the development of AIA Bhd's operational resilience programme.

It is an implementation model based on the operating characteristics of a life insurance organisation and publicly visible customer service capabilities.

AIA Malaysia's customer channels encompass service journeys for policy management, claims, payments, employee benefits, and guarantee letter requests.

The proposed list should not automatically be adopted as AIA Bhd's final CBS catalogue. Each service should be assessed against agreed criticality criteria and subjected to senior management review and approval.

Example: Severe but Plausible Scenarios Affecting AIA Bhd Critical Business Services

Operational resilience planning should consider scenarios that are severe enough to challenge normal operating arrangements but plausible enough to require preparation.

For AIA Bhd, relevant scenarios may include:

Scenario testing should examine the end-to-end service rather than only the recovery of individual IT systems. For example, restoring a claims application does not necessarily mean Claims Assessment and Benefit Payment have recovered.

Employees must be available, customer and policy data must be accurate, supporting documents must be accessible, and payment services must function.

Regulatory Alignment for AIA Bhd

As a financial institution operating in Malaysia, AIA Bhd should align its operational resilience approach with the supervisory direction and policy expectations of Bank Negara Malaysia.

BNM's Business Continuity Management policy document explicitly frames the operational resilience of financial institutions as critical to maintaining the continuity of financial services during disruptions.

 BNM's December 2025 Operational Resilience Discussion Paper further outlines an emerging supervisory direction aimed at strengthening operational resilience in the Malaysian financial sector.

The identification of CBS at AIA Bhd should therefore support a broader resilience framework that enables the organisation to:

• identify services where disruption could cause significant customer harm;
• understand the processes and resources supporting each CBS;
• map interconnections and interdependencies;
• determine acceptable levels of disruption through impact tolerance;
• assess technology and cyber dependencies;
• conduct severe but plausible scenario testing; and
• use lessons identified to strengthen resilience capabilities.

Technology resilience is particularly important because customer-facing insurance services increasingly depend on digital platforms and interconnected technology.

BNM's revised Risk Management in Technology policy strengthens expectations for the management of technology and cyber risks, while its cyber resilience provisions address resilience against extreme but plausible cyber threats.

For AIA Bhd, regulatory alignment should not be treated as a separate compliance exercise.

The CBS catalogue should serve as a practical management tool that integrates operational resilience, business continuity, technology resilience, cyber resilience, third-party risk management, and operational risk.

Identifying Critical Business Services provides AIA Bhd with a customer- and service-focused foundation for operational resilience.

Instead of attempting to classify every department, process, or technology system as equally critical, the CBS approach focuses management's attention on services whose prolonged disruption could cause intolerable harm to policyholders, beneficiaries, or other stakeholders.

The proposed CBS catalogue in this chapter provides a starting point for AIA Bhd.

The next stage is to validate these services with business and senior management stakeholders, define clear service boundaries and identify the processes and resources required to deliver each service.

AIA Bhd can then map interconnections and interdependencies, establish impact tolerances and design severe but plausible scenarios to test whether each CBS can remain within acceptable disruption limits.

Through this structured approach, AIA Bhd can move from traditional recovery-focused planning towards an operational resilience model centred on maintaining the delivery of its most critical insurance services during disruption.

 

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer and OR-5000 Operational Resilience Expert Implementer courses.

	If you have any questions, click to contact us.