[OR] [MCIS] [E1] [C5] Critical Business Services (CBS)

eBook 1: Chapter 5

What are the Critical Business Services (CBS) of MCIS Insurance Bhd?

Introduction

Operational resilience begins with understanding which services are essential to customers, regulators, and the broader financial ecosystem.

For an insurance company such as MCIS Insurance Bhd (MCIS), not every business activity carries the same level of importance during a disruption.

While many internal processes support daily operations, only a limited number of services are considered so important that their prolonged disruption would result in significant harm to policyholders, business partners, regulators, or the financial system.

The purpose of this chapter is to introduce the concept of Critical Business Services (CBS) within the context of an operational resilience programme. Rather than focusing on organisational departments or internal functions, operational resilience focuses on the services delivered to customers and external stakeholders.

These services become the foundation for subsequent resilience activities, including dependency mapping, impact tolerance setting, scenario testing, resilience improvement, and continuous monitoring.

For MCIS, identifying Critical Business Services enables management to prioritise resilience investments, allocate resources appropriately, and demonstrate compliance with regulatory expectations while maintaining customer confidence during severe disruptions.

What is a Critical Business Service (CBS)?

A Critical Business Service (CBS) is a service delivered to external customers or stakeholders whose disruption would cause intolerable harm.

The emphasis is on the service outcome, not the internal processes supporting it.

A service is considered critical when its disruption could result in one or more of the following:

• Significant harm to policyholders
• Financial losses to customers
• Regulatory breaches
• Threats to market confidence
• Legal liabilities
• Operational instability
• Reputational damage
• Adverse impact on public confidence

Operational resilience therefore shifts organisational thinking from protecting departments toward ensuring that essential customer services remain available within acceptable levels, even during major disruptions.

Unlike Business Continuity Management (BCM), which traditionally identifies Critical Business Functions (CBFs), Operational Resilience identifies Critical Business Services, recognising that customers are primarily concerned with the continuity of services rather than the internal functions delivering them.

The identification of CBS provides the foundation for:

• Process mapping
• Resource mapping
• Dependency analysis
• Third-party resilience assessment
• Technology resilience
• Impact tolerance definition
• Scenario testing
• Continuous resilience improvement

Key Considerations for Identifying CBS at MCIS

When identifying Critical Business Services, MCIS should adopt a customer-centric and regulatory-driven assessment approach.

Key considerations include:

Customer Impact

Would disruption prevent policyholders from receiving essential insurance protection or accessing benefits when required?

Examples include:

• Claim payments
• Emergency medical assistance
• Policy servicing

Financial Impact

Would disruption expose customers or MCIS to significant financial losses?

Examples include:

• Delayed claim settlements
• Premium collection failures
• Incorrect policy administration

Regulatory Impact

Would disruption result in breaches of regulatory obligations issued by Bank Negara Malaysia (BNM)?

Areas include:

• Consumer protection
• Prudential obligations
• Operational resilience expectations
• Outsourcing requirements
• Incident reporting

Market Confidence

Would prolonged disruption reduce public confidence in MCIS or Malaysia's insurance industry?

Loss of confidence may affect:

• New business acquisition
• Policy renewals
• Customer retention
• Distribution partners

Operational Dependency

Does the service rely upon:

• Core insurance platforms
• Digital channels
• Payment systems
• Call centres
• Third-party administrators
• Cloud services
• Healthcare providers
• Distribution partners

Understanding these dependencies is fundamental to resilience planning.

Recovery Complexity

Some services require multiple business units to recover simultaneously.

Recovery complexity increases when services depend on:

• External vendors
• Regulatory approvals
• Manual workarounds
• Large volumes of customer transactions

Proposed Critical Business Services of MCIS Insurance Bhd

Based on the operating model of a Malaysian life and general insurer, the following services are likely to represent MCIS's Critical Business Services.

 

CBS Code	Critical Business Service	Description
CBS-1	Policy Issuance and Underwriting	Assessment, approval and issuance of insurance policies to customers.
CBS-2	Premium Collection and Billing	Collection of premiums, payment processing and policy continuation.
CBS-3	Claims Management and Settlement	Registration, assessment, approval and payment of insurance claims.
CBS-4	Customer Policy Administration	Policy amendments, renewals, endorsements, cancellations and servicing requests.
CBS-5	Digital Customer Services	Customer self-service portals, mobile applications and online policy servicing.
CBS-6	Distribution and Agency Services	Support for agents, brokers, bancassurance partners and sales channels.
CBS-7	Investment-Linked Fund Administration	Administration and valuation of investment-linked insurance products.
CBS-8	Regulatory Reporting and Financial Obligations	Regulatory submissions, statutory reporting and financial obligations required by regulators.
CBS-9	Contact Centre and Customer Assistance	Customer enquiries, complaints handling and emergency customer support.
CBS-10	Payment and Financial Transaction Services	Claims disbursement, refunds, commissions and financial transaction processing.

These proposed services should be validated through structured workshops involving senior management, business owners, risk management, technology, operations, and operational resilience teams.

Example Severe but Plausible Scenarios Affecting MCIS Critical Business Services

Operational resilience programmes require organisations to evaluate events that are unlikely but credible.

Examples include:

 

Scenario	Potential CBS Affected
Major ransomware attack affecting core insurance systems	CBS-1, CBS-2, CBS-3, CBS-4, CBS-5
Nationwide telecommunications outage	CBS-5, CBS-6, CBS-9
Failure of cloud infrastructure provider	CBS-5, CBS-7
Core insurance application failure	CBS-1, CBS-2, CBS-3, CBS-4
Third-party claims administrator outage	CBS-3
Payment gateway disruption	CBS-2, CBS-10
Data centre power failure	Multiple CBS
Large-scale cyber data breach	All CBS
Pandemic causing workforce shortages	All CBS
Major flood affecting headquarters or operations centre	Multiple CBS
Regulatory sanctions requiring immediate operational changes	CBS-8
Simultaneous failure of multiple outsourced service providers	Multiple CBS

Each scenario should subsequently be used during operational resilience scenario testing to determine whether each CBS can continue operating within defined impact tolerances.

Regulatory Alignment for MCIS

As a licensed insurer operating in Malaysia, MCIS should align its Operational Resilience programme with the expectations of Bank Negara Malaysia (BNM) and recognised international resilience practices.

The identification of Critical Business Services supports several regulatory objectives, including:

• Protection of financial consumers.
• Continuity of essential financial services during disruptions.
• Effective operational risk management.
• Governance and accountability over resilience capabilities.
• Resilience of technology, information assets and outsourced services.
• Third-party risk management.
• Incident management and regulatory reporting.
• Continuous testing and improvement of operational resilience capabilities.

A well-defined CBS inventory enables MCIS to demonstrate that resilience planning is focused on protecting services that are essential to policyholders and the wider financial system rather than merely recovering internal technology or operational functions.

Proposed Critical Business Services (CBS)

 

CBS Code	Critical Business Service	Primary Customers	Business Owner	Key Supporting Functions	Typical Recovery Priority
CBS-1	Policy Issuance and Underwriting	Prospective Policyholders	Underwriting	Sales, Risk Assessment, IT	Very High
CBS-2	Premium Collection and Billing	Policyholders	Finance	Banking Partners, IT	High
CBS-3	Claims Management and Settlement	Policyholders and Beneficiaries	Claims	Medical Assessors, Finance, IT	Critical
CBS-4	Customer Policy Administration	Existing Policyholders	Customer Operations	Contact Centre, IT	High
CBS-5	Digital Customer Services	Customers	Digital Services	IT Infrastructure, Cybersecurity	High
CBS-6	Distribution and Agency Services	Agents and Distribution Partners	Distribution	Agency Management, IT	Medium-High
CBS-7	Investment-Linked Fund Administration	Investment-Linked Policyholders	Investment Operations	Finance, Fund Managers, IT	High
CBS-8	Regulatory Reporting and Financial Obligations	Regulators	Compliance & Finance	Risk, IT, Finance	High
CBS-9	Contact Centre and Customer Assistance	Customers	Customer Service	Telephony, CRM, IT	High
CBS-10	Payment and Financial Transaction Services	Customers and Business Partners	Finance	Banking Network, Payment Providers	Critical

 

Identifying Critical Business Services represents one of the most significant activities in establishing an operational resilience programme. It defines the services that must remain available, or be restored within acceptable limits, regardless of the nature of the disruption.

For MCIS Insurance Bhd, a clear understanding of its Critical Business Services enables the organisation to prioritise resilience investments, focus governance on customer outcomes, and satisfy evolving regulatory expectations.

The proposed CBS inventory presented in this chapter provides a practical starting point that should be refined through cross-functional workshops and validated against business strategy, customer impact, operational dependencies, and regulatory requirements.

In the following chapters, each identified Critical Business Service will become the basis for dependency mapping, impact tolerance definition, scenario testing, and the implementation of resilience improvements that strengthen MCIS's ability to continue serving policyholders during severe but plausible disruptions.

The menu and blogs highlighted in the table below are under construction

Understanding Your Organisation
C1	C2 [x]	C3 [x]	C4 [x]	C5
C6 [x]	C7 [x]	C8 [x]	C9 [x]	eBook Cover

 

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.