[OR] [GEL] [E1] [C5] Identifying Critical Business Services

eBook 1: Chapter 5

Critical Business Services of Great Eastern Life for Operational Resilience

Introduction

Operational resilience has become a strategic priority for financial institutions globally and in Malaysia. For insurers such as Great Eastern Life, ensuring that essential services remain available during operational disruptions is fundamental to maintaining customer trust, protecting policyholders, and safeguarding the stability of the financial system.

Disruptions may arise from cyber incidents, technology failures, natural disasters, third-party outages, or operational errors. In an increasingly digital insurance environment, where customers depend on online platforms for policy servicing, claims submissions, and financial transactions, the ability to sustain critical services is a core organisational capability.

In Malaysia, operational resilience expectations are being shaped by regulatory developments from Bank Negara Malaysia (BNM). The 2025 Discussion Paper on Operational Resilience highlights the need for financial institutions—including insurers and takaful operators—to ensure that they can prevent, respond to, recover from, and adapt to operational disruptions while maintaining critical financial services.

This chapter identifies the Critical Business Services (CBS) of Great Eastern Life and explains how these services align with emerging operational resilience expectations for Malaysian insurance companies.

What is a ‘Critical Business Service’?

In operational resilience, a Critical Business Service (CBS) refers to a service that, if disrupted, would cause intolerable harm to customers, policyholders, the organisation, or the wider financial system.

A service is typically considered critical when its disruption would lead to:

• Significant financial harm to customers or policyholders
• Inability for customers to access insurance protection or benefits
• Material reputational or regulatory consequences for the insurer
• Systemic risk to the financial system

Operational resilience frameworks focus on maintaining the delivery of services to customers, rather than simply restoring internal systems. This means the emphasis is on customer outcomes and market impact, not just IT recovery.

Examples of critical services in financial institutions often include:

• Payment services
• Deposit access
• Digital banking access
• Customer support services

Similarly, for an insurance company, services such as claims payment or policy servicing are typically considered critical because disruptions could directly harm policyholders.

Regulatory Expectations for Operational Resilience in Malaysia

Although Malaysia does not yet have a single consolidated operational resilience regulation, several regulatory expectations already exist and are being strengthened.

Key Regulatory Drivers

The operational resilience expectations from BNM for insurers include:

• Identification of Critical Business Services
  Financial institutions must identify services that are essential to customers and financial stability.

• Impact Tolerance Setting
  Institutions must determine the maximum acceptable disruption level for each critical service.

• End-to-End Service Mapping
  Critical services must be mapped to:

• Processes
• People
• Technology
• Third-party providers

• Severe but Plausible Scenario Testing
  Institutions should test disruptions such as:

• Cyber-attacks
• Cloud provider outages
• Data centre failures
• Pandemic workforce disruption

• Governance and Accountability
  Senior management and boards must oversee operational resilience strategies

These expectations build upon existing regulatory frameworks, including:

• BNM Business Continuity Management (BCM) Policy
• ICT Risk Management Guidelines
• Outsourcing Risk Management
• Cybersecurity expectations

The objective is to ensure that critical financial services remain available during stress events to preserve financial stability and public confidence.

Identifying Critical Business Services of Great Eastern Life

As a major life insurance provider in Malaysia, Great Eastern Life delivers multiple services across the insurance value chain. From an operational resilience perspective, the following services are typically considered critical because their disruption could significantly affect policyholders.

Proposed Critical Business Services for Great Eastern Life

Description of Key Critical Business Services

Claims Processing and Claims Payment

Claims processing is one of the most critical services for any insurance company. Customers rely on insurers to provide financial support during events such as:

• Death
• Hospitalisation
• Disability
• Critical illness

Disruptions to claims processing could cause severe financial hardship to policyholders and damage the insurer’s reputation.

Key processes involved include:

• Claim submission
• Claim validation
• Medical verification
• Fraud detection
• Claims approval
• Payment disbursement

Operational resilience measures must ensure that claims payments can continue even during major disruptions.

Premium Collection and Policy Administration

Premium collection ensures that policyholders maintain active coverage. Failure in this service could lead to:

• Policy lapses
• Loss of insurance protection
• Customer dissatisfaction

Operational resilience requires insurers to ensure that:

• Payment systems remain available
• Billing systems function properly
• Premium reconciliation processes are resilient

Policy Issuance and Underwriting

This service enables customers to obtain insurance protection. Disruptions could prevent customers from obtaining coverage when needed.

Operational resilience considerations include:

• Underwriting system availability
• Customer onboarding processes
• Agent distribution systems
• Medical underwriting systems

Digital Insurance Platform Services

Digital transformation has made online services a key delivery channel.

Examples include:

• Policyholder portals
• Mobile applications
• Online claims submission
• Customer support chat systems

These platforms have become critical because customers increasingly rely on digital access to manage their insurance policies.

Supporting Infrastructure and Dependencies

Each critical business service depends on multiple operational components.

Typical dependencies include:

People

• Underwriters
• Claims officers
• Customer service teams
• IT operations teams

Technology

• Core insurance administration systems
• Claims management systems
• Payment processing platforms
• Customer portals

Third-Party Providers

• Cloud service providers
• Medical verification providers
• Payment gateways
• Distribution partners

Infrastructure

• Data centres
• Network infrastructure
• Cybersecurity platforms

Operational resilience requires insurers to map these dependencies end-to-end to understand where disruptions could occur.

Examples of Severe but Plausible Disruptions

BNM encourages financial institutions to test their resilience against severe but plausible scenarios.

Examples relevant to Great Eastern Life include:

These scenarios help organisations test whether they can maintain service delivery within acceptable impact tolerances.

Governance and Accountability for Critical Services

Operational resilience requires strong governance.

Key governance elements include:

Board Oversight

The board is responsible for ensuring that operational resilience is integrated into the organisation’s risk management framework.

Senior Management Accountability

Each critical business service should have a designated service owner responsible for:

• Service continuity
• Impact tolerance compliance
• Scenario testing participation

Risk and Compliance Oversight

Risk management teams ensure alignment with regulatory expectations and operational resilience frameworks.

Operational resilience requires insurers to move beyond traditional business continuity planning and focus on maintaining critical services for customers during disruptions. For Great Eastern Life, identifying critical business services such as claims processing, policy administration, and digital customer access provides the foundation for a structured operational resilience program.

By aligning with regulatory expectations from Bank Negara Malaysia and adopting best practices in operational resilience, Great Eastern Life can strengthen its ability to withstand operational disruptions while continuing to serve policyholders effectively.

Establishing clear ownership of critical business services, mapping dependencies, setting impact tolerances, and conducting scenario testing will enable the organisation to build a robust resilience capability that protects customers, strengthens market confidence, and supports the stability of Malaysia’s insurance sector.

Blogs marked [x] are under construction.

Implementing Operational Resilience in Insurance: A Practical Guide for Great Eastern Life
eBook 1: Understanding Your Organisation: Great Eastern Life
C1	C2 [x]	C3 [x]	C4 [x]
C5	C6 [x]	C7 [x]	C8 [x]

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.