[OR] [MLRE] [E3] [CBS] [1] [ST] Perform Scenario Testing

Sub-CBS Code

Sub-CBS

Recommended Scenario Test Themes (incl. Cyber & ICT Integration)

Impact / Effect

Evidence of Proactive Risk Management Action

1.1

Risk Appetite & Strategy Setting

Board-level decision-making disruption due to loss of access to strategic risk dashboards following a cyber incident

Misalignment between underwriting strategy and capital/ risk appetite; delayed strategic responses

Pre-defined alternative decision packs; offline risk appetite statements; Board crisis-decision playbooks

1.2

Data Acquisition & Validation

Corruption or unavailability of cedant data due to a data-integrity cyber breach at the third-party data provider

Inaccurate risk assumptions; delayed underwriting timelines

Data validation controls; secondary data sources; third-party ICT resilience assessments

1.3

Risk Modelling & Pricing Analytics

Prolonged outage of actuarial modelling platforms due to cloud service failure or ransomware attack

Inability to generate pricing models; reliance on outdated assumptions

Model contingency methodologies; manual override pricing thresholds; ICT recovery testing results

1.4

Underwriting Submission Intake

Surge in submissions combined with workflow system failure from DDoS attack

Backlog of submissions; breach of service turnaround expectations

Manual intake procedures; prioritisation rules; cyber incident response integration with underwriting ops

1.5

Underwriting Risk Assessment

Loss of key underwriting specialists during a concurrent ICT outage and a scenario of people's unavailability

Inconsistent risk decisions; increased operational error

Cross-training of underwriters; documented risk assessment guidelines; role substitution planning

1.6

Pricing & Quotation Formulation

Pricing tool malfunction caused by unauthorised system changes or failed patching

Incorrect quotations issued; financial and reputational impact

Change-management controls; pricing validation checks; post-incident pricing review triggers

1.7

Regulatory & Compliance Review

Inability to access the regulatory rules repository due to an internal system compromise

Non-compliant underwriting decisions; regulatory exposure

Offline compliance checklists; regulatory escalation protocols; compliance scenario rehearsals

1.8

Decision Governance & Approval

Failure of the electronic approval workflow during the peak underwriting cycle

Delayed deal approvals; loss of business opportunities

Delegation of authority matrices; manual approval fallbacks; governance continuity procedures

1.9

Documentation & Contract Issuance

Document management system outage following malware infection

Delayed contract issuance; legal uncertainty with cedants

Pre-approved contract templates; secure document backups; alternative issuance channels

1.10

Portfolio Monitoring & Experience Analysis

Data analytics platform disruption is impacting loss experience monitoring

Late detection of adverse trends; capital and pricing risk

Periodic manual portfolio reviews, diversified analytics tools, and resilience testing of MI systems

1.11

Exception & Escalation Handling

Escalation channels are unavailable during a cyber-related communication outage

Delayed resolution of underwriting exceptions; governance breakdown

Multi-channel escalation paths; crisis communication tree; escalation drills

1.12

Reporting & Feedback Loop

Regulatory and management reporting is delayed due to ICT system recovery prioritisation conflicts

Reduced management oversight; delayed corrective actions

Reporting prioritisation framework; alternative reporting formats; post-incident lessons-learned reviews