Compounding Risk: Business Continuity For Insurance Companies

Insurers writing protection for property and casualty losses need to plan for business continuity and disaster recovery (BC/DR) at several levels. From a basic actuarial approach, they need to calculate the risk of a particular event occurring in order to be able to meet claim payout demands. Their own operations need BC/DR plans to ensure they can quickly provide the help needed by policyholders in the event of an emergency.

But there’s a third aspect that could easily be overlooked and more catastrophic to an insurer’s bottom line: planning for disasters that happen outside the bounds of standard actuarial computation.

To wit, planning for the unplannable. Insurance companies have an obligation to policyholders to make them as close to whole as possible after disaster. In order to be able to meet those obligations — both fiduciary and moral — an insurance company needs to be able to absorb critical blows and still provide the service its customers expect.

This shouldn’t be out-of-the-box thinking for insurance companies. As mentioned above, they’re used to calculating their risks against the chances of certain events occurring and requiring payouts. The problem is that circumstances are changing.

For instance, weather is no longer following established patterns. The World Meteorological Organization reported in 2021 that weather disasters have increased by a factor of five over the past half-century.

Related to weather disasters is the increase in wildfires. These happen closer to populated areas with increased scope and severity increase as civilization encroaches on formerly uninhabited places and climate change alters established patterns. According to First Street Foundation, approximately American 71.8 million homes have some level of wildfire risk in 2022, with about half of those people living in the South and about half in the West.

Similarly, the risk of floods means that 25% of all critical infrastructure in the country are at risk of becoming inoperable according to First Street Foundation. Add 23% of all road segments in the country at risk of becoming impassable, 20% of all commercial properties, 17% of all social infrastructure facilities, and 14% of all residential properties with operational risk — all before factoring in climate change.

According to global reinsurer Swiss Re, the world’s losses as a result of natural catastrophes between 2011 and 2020 was more than $2 trillion; insurance covered only about one-third of that. The pandemic shone a light on the world’s against health risks, with Swiss Re saying that health protection gaps in Asia alone totaled $1.8 trillion in 2017 — before the pandemic.

Bain & Company recently used a proprietary analysis to show that the world itself is more turbulent than ever. From 1950 to 2000, its turbulence index was 0.8; since the turn of the millennium, it has doubled to 1.6 as a result of multiple factors, primary of which have been the 2008 global financial crisis, climate change, and the global pandemic.

Matryoshka Insurance

We’ve all seen the famous nesting dolls in which a small doll is contained in subsequently larger dolls. They’re charming, of course, but they’re also quite efficient with space and all serve the same purpose.

The world in which insurance companies function today is similar. An individual insurance company indemnifies individual policyholders for risks to property, exposure to product liability, or business interruption (or in the case of an individual, home, health, or livelihood). In this way, policyholders have identified risks and their backup plan includes their insurance.

The individual insurance companies similarly compute chances of these events occurring, then adjust rates and revenue from investments in order to have the funds needed to make payouts on actual occurrences while generating a profit and paying for operating expenses. They are like the middle doll in the matryoshka.

But insurance companies have exposure they never previously had because of the environmental changes discussed above. If coffer-emptying disasters are bigger and happening more frequently, that alters the previous actuarial charts. If the US life expectancy continues to decline, if new pandemics become more likely (we’re now worried about monkeypox), if war continues to move to the IT realm, insurance companies may not be prepared for sudden payouts. At that point self-insurance may not be the solution, or, at the very least, insurers will need to adjust to new paradigms. This is the big matryoshka doll of the contemporary insurance landscape.

BC/DR Approaches for Insurance Companies

With so many potential problems ahead, insurance companies can get a handle on the ungraspable by adopting a BC/DR approach. Some of the groundwork already exists for larger insurers: In the wake of the 2008 AIG bailout during the global financial crisis, the National Association of Insurance Commissioners (NAIC) established a review program called Own Risk and Solvency Assessment (ORSA), which took effect in 2015. Insurers must report to state insurance commissioners or regulators — with a patchwork of rules and requirements — on underwriting, credit, market, operations, liquidity and any other risks that could affect their ability to meet their obligations. However, the specifics of how the ORSA should be conducted or be organized were not provided to insurers. One can only imagine the wide range of approaches insurance companies take to providing these reports, and how each company crossing the $500 million threshold finds itself building its first ORSA from scratch.

The parallel to BC/DR is noteworthy, however. Companies like Infinite Blue, with our BC in the Cloud platform, have systematized the process with a powerful relational database, default functions, and ability to customize on the fly. With a preloaded range of threats to continuity such as employee health and safety, man-made, natural, political, technology, and infrastructure, an insurance company can identify the same issues its policyholders will be confronted by and seeking to insure.

Just as a business with multiple locations and functions will have different needs, an insurer’s portfolio of policyholders will have different risks (insured or otherwise) and circumstances. Applying their issues and how they’re related to the insurer will turn what most companies call a business impact analysis (BIA) — the systematic process to determine risks that could compromise continued operation in the event of foreseeable emergencies — into an insurer’s ORSA. The policyholder’s risks, in effect, become the insurer’s risks, and the aggregate of these risks provides the overall menu of risks to the insurer. At that point, the insurer can again call on the versatility of BC in the Cloud to write a plan for how the threats to its policyholders will affect the insurance company overall, whether climate change means increased exposure to wildfires and floods, or financial disaster leads to reduced revenue and more crime for its policyholders. A tool like BC in the Cloud is the equivalent of a nail gun when other insurers are building their BC/DR plans with hammers.

Insurance companies have excelled at assessing risk since Babylonian times. Preparing to meet their own challenges might be slightly meta, but this 21st century way of making themselves their own clients will also help them meet their responsibilities and shore up their position as civilization’s safety net.