[OR] [MLRe] [E2] [C7] Developing and Embedding Governance of OR Plan Phase for Malaysian Life Reinsurance Group Berhad

Developing and Embedding Governance

This chapter covers Stage 5, the final stage, of the Plan phase: Develop and Embed Governance. The aim is a structured framework that defines roles, responsibilities, policies, and processes for operational resilience at Malaysian Life Reinsurance Group Berhad (MLRe), so that resilience activities are coordinated, measurable, and aligned with organisational priorities and regulatory requirements.

What is Governance?

Governance is how an organisation decides, assigns accountability, and checks that decisions are carried out. For operational resilience, it answers four questions: who is accountable, who decides, who does the work, and who checks.

Challenges at the Board Level

Boards typically face three challenges: operational resilience is technical and cuts across departments, so no one person sees the whole picture; reports focus on incidents rather than readiness; and the Board needs to approve things (critical services, tolerances, appetite) that it may not have been asked to approve before. BNM's expectations on Board and senior management responsibility for resilience mean MLRe should plan for the Board to receive clear, decision-oriented information.

Strong Change Management

Resilience can be weakened by change: a new system, a new outsourcing arrangement, a new treaty line or a reorganisation. Governance should require that changes are assessed for their effect on critical services and impact tolerances before approval.

Review Adequacy of OR Governance

MLRe should first check what exists: its BCM, technology risk, outsourcing and enterprise risk governance. The aim is to extend and connect these, not duplicate them.

How to Develop and Embed Governance

1. Develop the governance framework

Define roles, responsibilities, and accountability. An illustrative structure:

Define decision-making processes, escalation paths and reporting lines. Use the Three Lines Model so that business, risk and audit roles stay distinct.

2. Implement policies and procedures

Create or update an OR policy, along with procedures for incident management, recovery, testing, third-party resilience and change management. Align them with BNM requirements and with MLRe's existing BCM and technology risk policies.

3. Conduct training and awareness

Make sure Board members, senior management, service owners and staff understand their roles. Detailed planning of training is covered in Chapter 17.

4. Establish monitoring and reporting

Report a small set of indicators to senior management and the Board: status of critical services against tolerance, scenario tests completed and their results, open actions and overdue items, third-party resilience issues, and incidents. A one-page dashboard is usually enough.

Practical Tips

• Name individuals, not only committees, as accountable owners.
• Put OR on the standing agenda of an existing committee before creating new ones.
• Test the governance itself: run an escalation drill and check that the right people were reached.

Summary

Strong governance completes the Plan phase: MLRe knows where it stands, where it must go, how much risk it accepts, and who is accountable. The Implement phase begins in Chapter 9 with identifying critical business services.