[OR] [MCIS] [E3] [CBS] [1] [MD] Map Interconnections and Interdependencies

CBS-1 Policy Issuance and Underwriting

Introduction

Mapping Interconnections and Interdependencies is a fundamental activity within the Operational Resilience implementation methodology because it enables an organisation to understand how a Critical Business Service is delivered through an interconnected network of operational processes, people, technology, information, facilities, third-party providers, and external stakeholders.

Rather than viewing each operational process in isolation, the mapping provides a comprehensive end-to-end view of the service delivery ecosystem and the dependencies that must remain available for the service to operate within its defined Impact Tolerance.

For MCIS Insurance Bhd (MCIS), CBS-1: Policy Issuance and Underwriting is one of the organisation's most critical customer-facing services.

It involves numerous operational processes that span customer engagement, underwriting, regulatory compliance, policy administration, and customer communication.

Each of these processes depends on timely information, reliable technology platforms, specialist expertise, and coordinated interactions across multiple business functions and external parties.

Mapping these interconnections supports MCIS's Operational Resilience programme by enabling the organisation to:

Understand the complete end-to-end delivery model for Policy Issuance and Underwriting.
Identify critical operational hand-offs between business units and supporting functions.
Recognise single points of failure and concentration risks.
Assess upstream and downstream dependencies that may affect service continuity.
Support dependency mapping, impact tolerance assessment, and scenario testing.
Demonstrate to Bank Negara Malaysia (BNM) that operational resilience has been analysed using a structured and evidence-based methodology.

The following tables document both the operational interconnections and the supporting interdependencies for each Sub-CBS that collectively deliver CBS-1.

Table 2: Map Interconnections

Name of Sub-CBS	Connected Component	Connection Type	Interconnection Description	Upstream Interconnections	Downstream Interconnections
CBS-1.1 Customer Application Intake	Distribution channels, customers, agents, CRM platform	Process	Receives applications and customer information from multiple channels.	Customers, agents, brokers, digital portals	CBS-1.2 Application Validation
CBS-1.2 Application Validation and Completeness Review	Customer records, document management	Process / Information	Validates completeness and supporting documentation before underwriting begins.	CBS-1.1	CBS-1.3, CBS-1.5
CBS-1.3 Customer Risk Profiling	Underwriting function, customer databases	Process	Develops customer risk profile using submitted information and historical records.	CBS-1.2	CBS-1.4
CBS-1.4 Medical and Financial Underwriting Assessment	Medical evidence, underwriting specialists	Process	Performs detailed underwriting assessment using financial and medical information.	CBS-1.3	CBS-1.5, CBS-1.6
CBS-1.5 Fraud Screening and Compliance Verification	Compliance function, AML/KYC processes	Control	Screens applicants for fraud, sanctions, AML and regulatory compliance.	CBS-1.2, CBS-1.4	CBS-1.6
CBS-1.6 Underwriting Decision Management	Senior underwriters, approval authorities	Decision	Produces underwriting decision and determines acceptance, decline or special terms.	CBS-1.4, CBS-1.5	CBS-1.7
CBS-1.7 Premium Calculation and Pricing Confirmation	Pricing engine, actuarial rules	Process	Calculates premium based on underwriting outcome and approved pricing methodology.	CBS-1.6	CBS-1.8
CBS-1.8 Policy Documentation Preparation	Document generation platform	Process	Produces contractual documents and policy schedules.	CBS-1.7	CBS-1.9
CBS-1.9 Policy Approval and Issuance	Policy Administration System	Process	Final approval and policy activation following successful underwriting.	CBS-1.8	CBS-1.10, CBS-1.11
CBS-1.10 Customer and Distribution Notification	Customer communication platform	Service Delivery	Delivers policy confirmation, notifications and policy documents.	CBS-1.9	Customer servicing, CBS-4 Customer Policy Administration
CBS-1.11 Policy Record Administration	Policy Administration System, records repository	Information	Maintains policy records and updates operational systems.	CBS-1.9	CBS-4 Customer Policy Administration, CBS-3 Claims Management
CBS-1.12 Exception and Referral Management	Specialist underwriting teams	Governance	Escalates exceptional or high-risk underwriting cases requiring specialist review.	CBS-1.4, CBS-1.5	CBS-1.6
CBS-1.13 Underwriting Quality Assurance and Compliance Monitoring	Internal audit, compliance monitoring	Assurance	Reviews underwriting quality and regulatory compliance.	CBS-1.11	Continuous improvement, CBS-8 Regulatory Reporting
CBS-1.14 Underwriting Incident and Service Recovery Management	Incident management, BCM and IT recovery teams	Resilience	Coordinates operational response during disruption and restores underwriting services.	All Sub-CBS	Restored CBS-1 operations and supporting CBSs

Table 3: Map Interdependencies

Name of Sub-CBS	People	Systems and Technology	Data and Information Flows	Facilities	Third Parties / External Entities	Interconnected CBS	Nature of Dependency	Disruption Impact
CBS-1.1 Customer Application Intake	Customer service staff, agents	CRM Platform, Digital Application Portal	Customer applications, identity documents	Branches, contact centre	Insurance intermediaries	CBS-5 Digital Customer Services, CBS-6 Distribution & Agency Services	Dependent on timely receipt of complete applications from distribution channels.	Application backlog, delayed underwriting commencement.
CBS-1.2 Application Validation and Completeness Review	Operations officers	Document Management System	Application documents, KYC records	Operations centre	Customers	CBS-5	Requires accurate customer documentation before assessment.	Incomplete applications delay policy issuance.
CBS-1.3 Customer Risk Profiling	Underwriters	Underwriting Platform	Customer history, financial information	Underwriting office	Credit information sources where applicable	CBS-4 Customer Policy Administration	Depends on accurate customer information and historical records.	Incorrect risk assessment and inconsistent underwriting decisions.
CBS-1.4 Medical and Financial Underwriting Assessment	Medical underwriters, financial underwriters	Underwriting System	Medical reports, income information	Head office	Medical service providers	CBS-3 Claims Management	Relies on timely receipt of supporting evidence for underwriting decisions.	Delayed policy approval and increased operational risk.
CBS-1.5 Fraud Screening and Compliance Verification	Compliance officers	Compliance Screening Platform	AML/KYC, sanctions, fraud indicators	Compliance office	Government databases, regulators	CBS-8 Regulatory Reporting	Dependent on regulatory screening and compliance validation.	Increased regulatory risk and potential financial crime exposure.
CBS-1.6 Underwriting Decision Management	Senior underwriters	Underwriting Workflow System	Risk assessment outcomes	Underwriting department	Specialist consultants (where required)	CBS-4	Depends on complete underwriting recommendations and approvals.	Decision delays affecting customer service commitments.
CBS-1.7 Premium Calculation and Pricing Confirmation	Actuarial analysts	Pricing Engine	Pricing tables, underwriting decisions	Head office	None significant	CBS-10 Payment & Financial Transaction Services	Relies on approved pricing models and underwriting outcomes.	Incorrect premiums affecting revenue and compliance.
CBS-1.8 Policy Documentation Preparation	Policy administration staff	Document Generation System	Policy wording, benefit schedules	Operations centre	Printing and secure document providers (where applicable)	CBS-4	Depends on accurate policy data and approved templates.	Incorrect policy contracts and delayed issuance.
CBS-1.9 Policy Approval and Issuance	Authorised approvers	Policy Administration System	Approved policy information	Operations centre	None significant	CBS-10, CBS-4	Final policy creation depends on completion of all preceding processes.	Customers cannot obtain valid insurance coverage.
CBS-1.10 Customer and Distribution Notification	Customer service staff	Communication Platform	Policy documents, customer notifications	Contact centre	Email, SMS and postal service providers	CBS-5, CBS-6	Depends on reliable communication channels.	Customers and intermediaries remain uninformed of policy status.
CBS-1.11 Policy Record Administration	Policy administrators	Policy Administration System, Records Repository	Policy master records	Data centre	Cloud/Data Hosting Service Provider	CBS-3 Claims Management, CBS-4 Customer Policy Administration	Accurate records are required for servicing and future claims processing.	Claims and servicing activities become impaired.
CBS-1.12 Exception and Referral Management	Senior underwriters, specialists	Workflow Management System	Referral cases, supporting evidence	Head office	Medical specialists, legal advisers	CBS-8 Regulatory Reporting	Specialist expertise required for complex or exceptional cases.	High-value applications remain unresolved.
CBS-1.13 Underwriting Quality Assurance and Compliance Monitoring	QA reviewers, compliance officers	Reporting and Analytics Platform	QA findings, compliance reports	Head office	Internal and external auditors	CBS-8 Regulatory Reporting	Depends on operational data from all underwriting processes.	Reduced assurance, increased regulatory exposure and recurring operational weaknesses.
CBS-1.14 Underwriting Incident and Service Recovery Management	Incident managers, BCM team, IT recovery specialists	Incident Management Platform, Disaster Recovery Environment	Incident logs, recovery status	Primary and alternate operating sites	Cloud/Data Hosting Service Provider, telecommunications providers	All CBS supporting policy issuance	Relies on coordinated recovery across people, technology, facilities and third parties to restore service within impact tolerance. Concentration risks include dependence on the Policy Administration System, underwriting platform, document management repository, and telecommunications connectivity. Critical hand-offs occur between business operations, IT recovery, customer communications and distribution channels.	Extended disruption may halt policy issuance, create significant application backlogs, delay premium collection, impact customer confidence, and increase regulatory scrutiny if service remains unavailable beyond established impact tolerances.

The completed mapping provides MCIS with a comprehensive end-to-end view of CBS-1: Policy Issuance and Underwriting, illustrating how the fourteen Sub-CBS processes are interconnected through operational workflows and supported by a network of people, technology, information, facilities, third-party providers, and related Critical Business Services.

Rather than considering each process independently, the mapping demonstrates how disruption in one component can propagate across the service delivery chain and affect the timely issuance of insurance policies.

The analysis also highlights potential vulnerabilities, including reliance on core policy administration and underwriting platforms, document management capabilities, communications infrastructure, specialist underwriting expertise, and external providers such as medical service providers and insurance intermediaries.

These dependencies identify potential concentration risks, critical operational hand-offs, and areas where additional resilience measures may be warranted.

From an Operational Resilience perspective, this mapping provides the foundation for establishing and validating Impact Tolerances by identifying which dependencies are essential to maintaining Policy Issuance and Underwriting within acceptable disruption thresholds.

It also supports the design of severe but plausible scenarios—such as prolonged system outages, third-party service disruptions, cyber incidents, loss of specialist personnel, or failures in customer communication channels—and enables structured scenario testing to evaluate the organisation's response and recovery capabilities.

Finally, the mapping serves as a living operational model that should be maintained as business processes, technology platforms, organisational structures, third-party arrangements, regulatory requirements, or the operating environment evolve.

Regular review ensures that MCIS continues to have an accurate understanding of its operational ecosystem, enabling informed investment decisions, targeted remediation activities, and continuous improvement of its Operational Resilience capabilities in line with regulatory expectations and prudent risk management practices.

eBook 3: Starting Your OR Implementation
CBS-1 Policy Issuance and Underwriting
CBS-1 DP	CBS-1 MII	CBS-1 ITo	CBS-1 SbPS	CBS-1 ST

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.