[OR] [MCIS] [E1] [C1] Introducing OR Case Study

eBook 1: Chapter 1

Understanding the Organisation

Introduction

Operational resilience begins with a comprehensive understanding of the organisation it is intended to protect.

Before identifying critical business services, mapping dependencies, establishing impact tolerances, or conducting resilience testing, an organisation must first understand its business model, operating environment, governance structure, regulatory obligations, stakeholders, and strategic objectives.

This chapter introduces MCIS Insurance Bhd (MCIS) as the case study organisation for this eBook series.

Rather than providing a corporate profile, the chapter examines MCIS from the perspective of an Operational Resilience (OR) practitioner.

It establishes the organisational context necessary for designing, implementing, and sustaining an enterprise-wide operational resilience programme.

As a licensed insurer operating in Malaysia, MCIS delivers financial protection services that are relied upon by individuals, families, intermediaries, healthcare providers, and regulators.

Maintaining the continuity of these services during severe disruptions is fundamental to protecting customers, preserving market confidence, and complying with the expectations of Bank Negara Malaysia (BNM).

Understanding the organisation is therefore the first step towards building a resilience capability that focuses on maintaining important business services rather than merely recovering systems or facilities.

Purpose of this Chapter

The purpose of this chapter is to establish the organisational context that will underpin every subsequent stage of the Operational Resilience programme.

Specifically, this chapter aims to:

• Introduce MCIS from an operational resilience perspective.
• Explain the organisation's role within Malaysia's financial services sector.
• Describe the regulatory environment influencing resilience planning.
• Identify the organisational characteristics that shape resilience priorities.
• Present a proposed Operational Resilience governance structure.
• Introduce the concept of Critical Business Services (CBS).
• Establish strategic resilience goals that align with organisational objectives.
• Provide the foundation for the planning methodology presented in the following chapters.

By understanding the organisation before designing resilience capabilities, practitioners can ensure that resilience initiatives remain aligned with business strategy, regulatory obligations, and customer expectations.

Understanding Your Organisation: MCIS Insurance Bhd

 

MCIS operates within Malaysia's insurance industry, providing insurance products and related financial protection services to individual and corporate customers.

Like many insurers, its operating model depends upon the effective integration of underwriting, policy administration, claims management, customer service, digital platforms, financial management, intermediaries, and outsourced service providers.

From an Operational Resilience perspective, MCIS should be viewed as an interconnected service organisation whose ability to deliver essential services depends upon the coordinated performance of people, processes, technology, information, facilities, and third-party providers.

The organisation's resilience is influenced by several operational characteristics:

• A strong reliance on digital platforms for customer engagement and policy servicing.
• Significant dependence on core insurance administration systems.
• Integration with banking and payment networks for premium collection and claims disbursement.
• Extensive interaction with agents, brokers, healthcare providers, and other external partners.
• Compliance with prudential, operational risk, and consumer protection requirements.
• Increasing exposure to cyber threats and technology-related disruptions.
• Growing reliance on outsourced technology and cloud-based services.

Understanding these characteristics enables management to determine where resilience efforts should be focused to minimise customer harm during major disruptions.

MCIS's Operating Environment in Malaysia

 

MCIS operates within one of Southeast Asia's well-regulated financial sectors, where insurers are expected to maintain prudent governance, effective risk management, and resilient operational capabilities.

The organisation operates within an environment characterised by:

Regulatory Expectations

Bank Negara Malaysia establishes regulatory requirements covering areas such as:

• Operational risk management.
• Business continuity management.
• Technology risk management.
• Outsourcing governance.
• Consumer protection.
• Financial resilience.
• Cyber resilience.
• Incident reporting.

Operational resilience complements these regulatory requirements by ensuring that important customer services remain available during severe but plausible disruptions.

Digital Transformation

Insurance services continue to become increasingly digital through:

• Online policy applications.
• Mobile servicing.
• Digital customer engagement.
• Electronic claims processing.
• Automated underwriting.
• AI-assisted customer support.
• Cloud computing.

While digital transformation improves customer experience, it also increases dependency on technology and external service providers.

Cyber Threat Landscape

Financial institutions remain attractive targets for cybercriminals.

Potential threats include:

• Ransomware attacks.
• Data breaches.
• Identity theft.
• Distributed Denial of Service (DDoS) attacks.
• Insider threats.
• Third-party cyber incidents.

Operational resilience planning therefore requires cyber resilience to be incorporated into business resilience planning.

Third-Party Dependency

Modern insurers rely upon numerous external organisations including:

• Cloud providers.
• Data centres.
• Payment processors.
• Medical service providers.
• IT vendors.
• Insurance intermediaries.
• Software vendors.
• Telecommunications providers.

Managing these dependencies has become a major component of operational resilience.

Customer Expectations

Customers increasingly expect:

• Continuous online access.
• Rapid claims processing.
• Immediate policy servicing.
• Secure digital transactions.
• Reliable customer support.

Operational resilience therefore seeks to minimise disruption from the customer's perspective rather than focusing solely on internal recovery.

Composition of an Operational Resilience Team for MCIS

Operational resilience requires enterprise-wide participation.

A proposed governance structure is shown below.

Role	Primary Responsibility
Board of Directors	Provide strategic oversight and approve resilience strategy.
Senior Management	Establish resilience objectives and allocate resources.
Chief Risk Officer	Executive sponsor for Operational Resilience.
Operational Resilience Manager	Coordinate programme implementation across business units.
Business Service Owners	Identify and maintain Critical Business Services.
Operational Risk Team	Integrate resilience into enterprise risk management.
Business Continuity Manager	Align BCM capabilities with Operational Resilience.
Information Technology	Maintain resilient technology infrastructure and applications.
Cybersecurity Team	Protect information assets and cyber resilience capabilities.
Information Security	Safeguard data confidentiality, integrity, and availability.
Compliance and Legal	Ensure regulatory compliance and legal oversight.
Human Resources	Support workforce resilience and crisis staffing.
Communications Team	Coordinate internal and external stakeholder communications.
Procurement and Vendor Management	Manage third-party resilience and supplier oversight.
Internal Audit	Independently assess programme effectiveness.

Operational resilience should not be viewed as a standalone programme but rather as a coordinated enterprise capability involving every business function.

Critical Business Services of MCIS: Key Considerations for Operational Resilience

Operational resilience focuses on maintaining services that are essential to customers and stakeholders.

For MCIS, identifying Critical Business Services requires consideration of:

• The impact on policyholders if a service becomes unavailable.
• Regulatory obligations associated with each service.
• Financial consequences of service disruption.
• Potential harm to customers.
• Market confidence implications.
• Dependence on technology platforms.
• Dependence on third-party providers.
• Recovery complexity.
• Interdependencies between business services.
• Time sensitivity of service restoration.

Typical Critical Business Services may include:

• Policy issuance.
• Premium collection.
• Claims management.
• Customer policy servicing.
• Digital customer services.
• Distribution support.
• Payment processing.
• Regulatory reporting.

These services will be examined in greater detail in subsequent chapters.

Key Characteristics of MCIS Insurance Bhd

From an Operational Resilience perspective, MCIS exhibits several characteristics commonly associated with a modern financial institution.

Characteristic	Operational Resilience Consideration
Customer-centric service model	Focus on maintaining services that protect policyholders.
Highly regulated industry	Strong governance and regulatory compliance are essential.
Technology-enabled operations	Dependence on resilient IT infrastructure and applications.
Digital customer engagement	Continuous availability of digital channels is critical.
Third-party ecosystem	Effective management of outsourcing and supplier resilience.
Financial transaction processing	Accuracy, integrity, and timeliness of financial processing are essential.
Sensitive customer information	Strong cybersecurity and data protection capabilities are required.
Multiple stakeholder groups	Coordinated communication and incident management are vital during disruptions.

These characteristics influence how resilience capabilities should be designed and prioritised.

Establishing Organisational Goals for MCIS's Operational Resilience

The Operational Resilience programme should support MCIS's broader strategic objectives while ensuring that critical business services remain within acceptable levels of disruption.

The following organisational goals are proposed.

Goal	Description
Protect Customers	Minimise disruption to essential insurance services.
Maintain Critical Business Services	Ensure important services continue during severe disruptions.
Strengthen Regulatory Compliance	Align resilience practices with BNM expectations and applicable regulations.
Improve Enterprise Resilience	Integrate resilience into governance, risk management, and business operations.
Enhance Technology Resilience	Improve the resilience of applications, infrastructure, and data.
Strengthen Third-Party Resilience	Improve oversight of critical outsourcing arrangements and service providers.
Increase Crisis Preparedness	Enhance organisational readiness for severe but plausible events.
Protect Reputation	Maintain customer trust and public confidence during disruptions.
Foster Continuous Improvement	Use testing, lessons learned, and assurance activities to strengthen resilience over time.
Promote a Resilience Culture	Embed resilience awareness and accountability across the organisation.

These goals provide strategic direction for the Operational Resilience programme and guide future decision-making across business and technology functions.

Understanding the organisation is the essential first step in developing an effective Operational Resilience programme.

For MCIS Insurance Bhd, resilience planning begins with a clear appreciation of its business model, operating environment, regulatory obligations, organisational characteristics, governance structure, and strategic priorities.

As a financial institution operating under the oversight of Bank Negara Malaysia, MCIS must ensure that its most important services remain available despite severe but plausible disruptions arising from technology failures, cyber incidents, third-party outages, natural disasters, or operational failures.

This chapter has established the organisational context that underpins the remainder of this eBook.

It introduced the purpose of Operational Resilience, examined the operating environment in Malaysia, proposed an Operational Resilience team structure, highlighted the importance of identifying Critical Business Services, and outlined strategic resilience goals aligned with the organisation's mission and regulatory responsibilities.

The next chapter builds upon this foundation by introducing MCIS Insurance Bhd's Operational Resilience Planning Methodology, providing a structured, implementation-focused framework for establishing governance, identifying Critical Business Services, mapping dependencies, defining impact tolerances, conducting scenario testing, and embedding resilience across the enterprise.

The menu and blogs highlighted in the table below are under construction

Understanding Your Organisation
C1	C2 [x]	C3 [x]	C4 [x]	C5
C6 [x]	C7 [x]	C8 [x]	C9 [x]	eBook Cover

 

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.