[OR] [MLRe] [E2] [C4] Analysing Gaps Stage of OR Plan Phase for Malaysian Life Reinsurance Group Berhad

Analysing Gap

Chapter 3 gave Malaysian Life Reinsurance Group Berhad (MLRe) a baseline view of its resilience. This chapter covers Stage 2 of the Plan phase: Analyse Gaps. It compares the current state with the target state and turns the differences into an action plan.

What is Gap Analysis?

Gap analysis compares where an organisation is with where it needs to be, and identifies what is missing. The target may come from regulation, from standards, from the Board's expectations, or from MLRe's own strategy. The result is a prioritised list of gaps, each with an owner and a plan.

How to Conduct a Gap Analysis at MLRe

1. Define scope and objectives

Decide what is being analysed and why. For MLRe the scope would normally cover the end-to-end services that cedants, regulators and the Board care most about: treaty underwriting and renewal, claims recovery and settlement, retrocession, regulatory and financial reporting, and investment operations. The objective might be: "Identify what MLRe must change to meet BNM's operational resilience expectations and its own risk appetite by the end of the roadmap period."

2. Identify relevant standards and regulations

List every requirement the programme must satisfy. For MLRe:

• BNM's Policy Document on Business Continuity Management and its operational resilience discussion paper (19 December 2025).
• BNM requirements on technology risk (RMiT), outsourcing and management of customer information.
• The Financial Services Act 2013 and related governance expectations for the Board and senior management.
• International references such as the Basel Committee's principles for operational resilience and ISO 22301 for business continuity.

Because MLRe is a reinsurer rather than a bank, the team should confirm with Compliance how each requirement applies to it, and record that interpretation.

3. Conduct a risk assessment

Identify credible disruptions, estimate likelihood and impact, and note existing controls. Typical events for MLRe include cyber-attack on treaty and actuarial systems, failure of a major cloud or outsourced IT provider, loss of access to the head office, a pandemic that affects key staff, and failure of a custodian or retrocession counterparty.

4. Perform the gap analysis

Compare the findings to current policies, procedures and controls. A simple register works well:

These entries are illustrative and show the format; MLRe's real register must be built from its own evidence.

5. Develop an action plan

For each gap define the initiative, owner, deadline and milestone. Rate gaps by regulatory exposure, effect on critical services and effort to close. High-rated gaps go first on the roadmap.

Practical Tips

• Keep the register short enough that the Board can read it. Group related gaps.
• Do not mix gaps with ideas. A gap is a measurable shortfall against a stated requirement.
• Re-run the analysis after each major change, such as a new treaty line, a system migration or new BNM guidance.

Summary

The gap analysis gives MLRe a defensible list of what to fix and in what order. Chapter 5 turns that list into a strategy and roadmap.

eBook 2: Implementing Operational Resilience for Malaysian Life Reinsurance
C1	C2	C8	C14

	"Plan" Phase of the Operational Resilience Planning Methodology
	C2	C3	C4	C5	C6	C7