[OR] [MLRe] [E2] [C11] Establishing Impact Tolerance of OR Implement Phase for Malaysian Life Reinsurance Group Berhad

Setting Impact Tolerance

Critical services are identified (Chapter 9) and their dependencies mapped (Chapter 10). This chapter covers Stage 3 of the Implement phase: Establish Impact Tolerance for Malaysian Life Reinsurance Group Berhad (MLRe).

What is Impact Tolerance?

An impact tolerance is the maximum level of disruption to a critical business service that MLRe can accept before intolerable harm is caused to cedants, to the market or to MLRe itself. It assumes a disruption will happen and asks how bad it can get before it is unacceptable. It is different from a recovery time objective (RTO): an RTO is a target for a system or process, while an impact tolerance is a limit on harm to the service.

Key characteristics

• Set per critical business service, not per system.
• Expressed in measurable terms, usually time, but also volume or data loss where relevant.
• Set by the Board, based on management's analysis.
• Consistent with risk appetite (Chapter 6).

Tasks Required to Set Impact Tolerance

1. Identify the types of impact that disruption could have on the service.
2. Set a tolerance for each type of impact.
3. Link the tolerances to the risk appetite and risk assessment scales.
4. Agree and approve a tolerance for each critical service.

How to Set Appropriate Impact Tolerances

1. Define impact tolerance levels

For each service, consider maximum acceptable downtime, maximum data loss, maximum financial loss and the effect on cedants. Agree levels with service owners, Risk, Finance and Compliance. Use evidence: contractual settlement terms in treaties, regulatory deadlines, renewal calendars, and cedants' liquidity needs.

2. Consider regulatory and compliance requirements

Check statutory reporting deadlines and any BNM expectations on business continuity, technology recovery and operational resilience. A tolerance must not be looser than what a legal or regulatory obligation allows.

3. Document impact tolerance levels

Record each tolerance with its rationale, owner, measurement method and approval date. Illustrative values:

These values are placeholders to show the format. MLRe must derive its own from its treaties, regulatory obligations and Board decisions.

4. Review and update

Review annually and after incidents, scenario tests or major business changes. Where scenario tests show a tolerance would be breached, the Board must decide whether to invest in resilience or accept a revised tolerance within appetite.

Practical Tips

• Start with the harm, then work backwards to time. Asking "what harm after how long?" gives better answers than "how long can the system be down?"
• Do not set a tolerance equal to current capability just to be compliant.
• Make sure each tolerance can actually be measured.

Summary

With tolerances set, MLRe has a clear test of whether a service is resilient. Chapter 12 tests that in severe but plausible scenarios.

eBook 2: Implementing Operational Resilience for Malaysian Life Reinsurance
C1	C2	C8	C14

	"Implement" Phase of the Operational Resilience Planning Methodology
	C8	C9	C10	C11	C12	C13