Strategic Transformation and Future of Life Insurance

Introduction

Life insurance is entering a period in which competitive advantage will depend less on the size of an insurer’s balance sheet and more on the quality, adaptability and trustworthiness of its operating model. Traditional insurers have historically been organised around products, functional departments and periodic policy servicing. This model is increasingly challenged by digital distribution, changing customer expectations, embedded insurance, insurtech competitors, advanced analytics, demographic ageing, climate-related disruption and more demanding regulatory expectations.

Strategic transformation is therefore not simply the replacement of paper forms with digital forms. It is the deliberate redesign of how an insurer creates value, controls risk, serves customers and works with external partners. Transformation may affect strategy, products, processes, technology, people, governance, data and organisational culture simultaneously.

For life insurers, transformation is especially complex. Policies may remain in force for decades; liabilities depend on mortality, morbidity, persistency, expenses, interest rates and investment performance; and customers often purchase products involving difficult concepts such as protection gaps, guarantees and retirement income. A transformation that improves speed but weakens advice quality, privacy or solvency management is not strategically successful.

This chapter examines operating-model transformation, ecosystem partnerships, insurtech, embedded insurance and agile change. It also develops a framework for evaluating business cases and anticipating the effects of longevity, climate change, demographic transition and regulatory developments.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain why life insurers require strategic operating-model transformation.
2. Diagnose process inefficiencies and redesign customer-centred value streams.
3. Evaluate ecosystem partnerships, insurtech propositions and embedded insurance models.
4. Construct a business case using financial, customer, risk and strategic measures.
5. Apply agile and governance principles to large-scale insurance change.
6. Assess the implications of longevity, climate, demographic and regulatory developments.
7. Critically evaluate ethical, operational-resilience and data-governance issues in transformation.

1. Strategic Transformation in Life Insurance

1.1 Transformation compared with digitisation and improvement

Three ideas should be distinguished:

Digitisation may reduce storage costs, while digitalisation may reduce processing time. Transformation asks a more fundamental question: should the process, product, channel or organisational responsibility exist in its current form at all?

1.2 The operating model

An operating model describes how strategy is converted into repeatable activity. Its principal components are:

• Value propositions: the protection, savings, retirement or estate-planning outcomes offered to customers.
• Value streams: end-to-end activities such as quote-to-issue, premium-to-investment, claim-to-payment and lapse prevention.
• Organisation and accountabilities: business units, decision rights, committees and performance ownership.
• Processes and controls: activities, approvals, segregation of duties and exception management.
• Technology architecture: policy administration, customer relationship management, data platforms, workflow and application interfaces.
• Data and analytics: data definitions, quality controls, models, reporting and model governance.
• People and capabilities: underwriting, actuarial, claims, distribution, engineering, cyber-security and change skills.
• Partners: reinsurers, distributors, medical providers, platform firms, technology vendors and service providers.

A strategically coherent operating model aligns these components. For example, a promise of immediate life cover cannot be delivered reliably if underwriting remains dependent on manual documents, fragmented medical evidence and batch policy issuance.

1.3 Value-stream perspective

A functional view asks which department performs a task. A value-stream view asks how the customer outcome is produced from beginning to end. Consider new business:

Figure: A value-stream view of life insurance transformation.

Process redesign should identify customer waiting time, rework, duplicated data entry, unnecessary approvals, failure demand and control weaknesses. A process map is not an end in itself. It should lead to decisions about elimination, simplification, automation, standardisation or redesign.

2. Process Redesign and Digital Architecture

2.1 Principles of redesign

Effective redesign generally follows these principles:

1. Start with the outcome. Define what the customer, adviser, claims professional or regulator needs to receive.
2. Design once, use many times. Capture validated customer and policy data once and reuse it through controlled interfaces.
3. Separate standard work from judgement. Automate routine validation while preserving expert review for complex or vulnerable cases.
4. Make exceptions visible. Straight-through processing is valuable only when exceptions are routed, monitored and resolved.
5. Build controls into the workflow. Compliance should not depend exclusively on an after-the-event checklist.
6. Measure end-to-end performance. Departmental productivity can improve while total customer cycle time worsens.

2.2 Straight-through processing and human intervention

Straight-through processing (STP) means that a transaction passes through defined stages without manual intervention, subject to rules and controls. It is appropriate where data are sufficiently reliable, risk is within approved boundaries and outcomes can be explained. It is not synonymous with full automation.

A useful design is a segmented decision model:

• low-complexity, low-risk applications: automated decision;
• moderate-risk applications: automated evidence gathering followed by targeted review;
• high-complexity or vulnerable-customer cases: specialist assessment and enhanced communication.

The objective is not to maximise automation percentage. It is to optimise total value while protecting fairness, underwriting quality and customer understanding.

2.3 Application programming interfaces and data architecture

Application programming interfaces (APIs) allow systems to exchange data through defined contracts. In life insurance, APIs may connect quotation engines, identity verification, medical evidence providers, payment systems, distributor platforms and policy administration systems.

A sound architecture requires:

• a single authoritative definition for key data elements;
• consent and purpose limitation;
• authentication, encryption and access control;
• version management for interfaces;
• data lineage and audit trails;
• resilience when a partner or service is unavailable;
• reconciliation between external and internal records.

Legacy modernisation may use replacement, encapsulation, migration, or a staged coexistence model. A “big bang” replacement can simplify the final architecture but increases delivery and operational risk. Incremental modernisation reduces concentration of change but may prolong complexity.

3. Ecosystems, Insurtech and Embedded Insurance

3.1 From value chains to ecosystems

A traditional value chain places the insurer at the centre of product design, distribution, underwriting, administration and claims. An ecosystem distributes these capabilities across several organisations. The customer may encounter the insurer through a bank, employer, digital platform, healthcare provider, retailer or financial adviser.

Partnerships can provide speed, reach, data, specialist capability or lower acquisition costs. They also introduce dependency, conduct, cyber, concentration, data-sharing and reputational risks. Partnership strategy must therefore assess both value creation and control capacity.

A partnership due-diligence framework should examine:

• strategic fit and customer proposition;
• financial strength and continuity plans;
• regulatory permissions and conduct history;
• cyber-security and data-protection controls;
• service-level performance and incident reporting;
• subcontracting and fourth-party exposure;
• ownership and permitted use of data and models;
• exit, portability and transition arrangements.

3.2 Insurtech categories

Insurtech is not one technology. It includes:

• digital distributors and comparison platforms;
• automated underwriting and evidence services;
• predictive analytics and decision-support tools;
• claims and fraud technologies;
• digital identity, payments and consent management;
• cloud and core-system platforms;
• wellness, prevention and health-related services;
• robotic process automation and intelligent document processing.

The insurer should evaluate an insurtech solution against a baseline process, not against technological novelty. Relevant questions include: Does it improve risk selection? Does it reduce customer friction? Is its output explainable? Can it be monitored for drift? Is the vendor financially and operationally reliable?

3.3 Embedded insurance

Embedded insurance integrates an insurance offer into a non-insurance customer journey. Examples include life or accident cover offered through an employer benefits platform, loan-protection cover during borrowing, or protection included in a digital financial-service experience.

Embedded distribution can reduce search costs and reach customers at a relevant moment. However, convenience can conceal poor understanding. Customers may not know that cover exists, what exclusions apply, whether it is portable, or how to claim. Important design controls include:

• clear disclosure before consent;
• active rather than deceptive consent;
• appropriate default and opt-out design;
• transparent pricing and commission arrangements;
• simple claims access;
• portability and continuity when the customer changes employer or platform;
• monitoring of vulnerable customers and adverse outcomes.

The strategic question is not merely whether insurance can be embedded, but whether the embedded context improves protection and customer welfare.

4. Agile Transformation and Change Leadership

Agile transformation applies iterative delivery, multidisciplinary teams, frequent testing and evidence-based prioritisation. It is especially useful where customer needs and technology options are uncertain. Agile does not mean weak governance or the absence of planning.

A practical model combines:

• product ownership: one accountable owner for the customer or business outcome;
• cross-functional teams: operations, actuarial, technology, legal, compliance, risk and customer representatives;
• short delivery cycles: small releases that generate evidence;
• minimum viable controls: controls designed proportionately from the beginning;
• test-and-learn discipline: hypotheses, measures and decision thresholds;
• architecture guardrails: standards for security, data, resilience and integration;
• independent assurance: review of material model, conduct and operational risks.

A transformation portfolio should distinguish mandatory regulatory change, foundational modernisation, growth initiatives and experimental work. Without prioritisation, every initiative becomes urgent and scarce specialist capacity is consumed by competing projects.

Change adoption depends on more than communication. Employees need role clarity, training, incentives, psychological safety and opportunities to influence process design. Transformation can fail when a technically successful system is rejected by underwriters, advisers or claims staff because it removes professional judgement without improving work quality.

5. Building and Evaluating the Business Case

A business case should combine financial analysis with customer, risk, strategic and organisational effects. The relevant alternatives are usually not “transform” versus “do nothing”; they may include targeted automation, platform partnership, staged modernisation or replacement of a core system.

5.1 Cash-flow evaluation

For a project with investment and future net cash flows, the net present value (NPV) is:

Here, CF_t is the net cash flow in period t, r is the discount rate per period, and n is the number of periods. Cash flows must be measured consistently, for example in nominal currency with a nominal discount rate, or in real currency with a real discount rate. The model should include implementation costs, run costs, avoided costs, benefits, taxes where relevant, working-capital effects and terminal costs.

The internal rate of return (IRR) is the discount rate that makes NPV equal to zero. IRR can be misleading when cash flows change sign more than once or when projects differ substantially in scale. Payback period is easy to communicate but ignores cash flows after payback and, unless discounted, ignores the time value of money.

5.2 Illustrative business case

An insurer considers a digital underwriting project. The initial investment is 12 million currency units. Expected net benefits are 4 million at the end of each of years 1, 2 and 3, followed by 3 million in year 4. The discount rate is 10%.

The NPV is:

The present values are approximately 3.64, 3.31, 3.01 and 2.05 million. Therefore:

The result is approximately break-even, subject to rounding. Management should not approve the project solely because NPV is marginally positive. Sensitivity analysis should test lower conversion, higher integration cost, slower adoption, control remediation and vendor failure. A project with a small financial NPV may still be justified by regulatory necessity, resilience or strategic capability; conversely, a positive NPV may be unacceptable if it creates material unfairness or unmanageable operational risk.

5.3 Balanced measures

Useful measures include:

Metrics should have definitions, owners, data sources, frequency and thresholds. An STP rate, for example, is meaningless unless the organisation specifies whether withdrawn applications, referrals and post-issue corrections are included.

6. Future Forces Shaping Life Insurance

6.1 Longevity and retirement risk

Increasing longevity can raise the value of protection against survival to advanced ages while increasing annuity and long-term care liabilities. Insurers must manage uncertainty in mortality improvement, morbidity, withdrawal behaviour, interest rates and inflation. Product innovation may include deferred annuities, longevity-income solutions, hybrid protection and care benefits, but guarantees require disciplined pricing, reserving, capital and asset-liability management.

Longevity risk is not simply “people live longer.” It includes basis risk: the insurer’s portfolio may experience mortality improvement different from the population or reference index. It also includes behavioural risk, such as policyholders exercising options when those options are most valuable to them.

6.2 Climate change

Life insurers face direct and indirect climate effects. Heat, pollution, infectious disease, disasters and occupational changes may affect mortality and morbidity. Climate transition may alter employment, household income, asset values and the credit quality of investments. Although property insurance often experiences the most visible physical losses, life insurers are exposed through health outcomes, investments, operations and distribution.

Scenario analysis should examine plausible pathways rather than predict one precise future. It should consider time horizons, geographic concentration, vulnerable populations, asset exposures, underwriting assumptions and management actions. Climate analysis must avoid unsupported claims of precision; uncertainty should be disclosed and decisions should remain adaptable.

6.3 Demographic and social change

Ageing populations, migration, urbanisation, changing household structures, informal employment and unequal access to healthcare alter insurance needs and distribution. A product designed for a stable, single-income household may not fit gig workers, multigenerational families or customers with irregular income.

Inclusive design may require flexible premiums, simplified products, multilingual service, accessible interfaces, alternative evidence and careful affordability testing. Inclusion does not mean eliminating underwriting discipline. It means ensuring that legitimate risk assessment does not become an unjustified barrier to protection.

6.4 Regulation and supervision

Regulatory developments commonly affect four areas:

1. Financial resilience: capital, valuation, stress testing, liquidity and prudent investment.
2. Customer conduct: fair value, suitability, disclosure, claims handling and protection of vulnerable customers.
3. Data and technology: privacy, automated decision-making, cyber-security, outsourcing and operational resilience.
4. Sustainability and governance: climate-risk disclosure, governance accountability and greenwashing controls.

The precise rules differ by jurisdiction. Managers must therefore distinguish universal principles from local legal requirements and maintain a regulatory horizon-scanning process. Regulatory compliance should be designed into products and processes rather than treated as a final approval gate.

7. Artificial Intelligence, Ethics and Governance

Artificial intelligence (AI) can support document classification, customer service, underwriting triage, fraud detection, claims assistance, forecasting and employee productivity. Its use raises significant issues because life insurance decisions can affect access to essential financial protection.

A responsible AI control framework should include:

• a documented business purpose and prohibited uses;
• data provenance, quality and representativeness;
• testing for disparate outcomes and proxy discrimination;
• explainability appropriate to the decision and audience;
• human review and escalation rights;
• model validation, performance monitoring and drift detection;
• security, privacy and prompt or data leakage controls;
• records sufficient for audit, complaint and regulatory review;
• vendor accountability and contractual access to evidence.

Fairness is not one universal statistical measure. A model may have different error rates across groups because of data, prevalence or design choices. The insurer must define the relevant fairness objective, justify it ethically and legally, and examine customer outcomes rather than relying only on aggregate accuracy.

The principle of proportionality is important: a low-impact administrative tool may require less intensive validation than a model that declines or prices life cover. Nevertheless, “human in the loop” is not automatically meaningful if the human merely accepts an opaque recommendation under time pressure.

8. Governance and Operational Resilience

Transformation creates new dependencies. A cloud outage, cyberattack, corrupted data feed or failed third-party API can interrupt premium collection, claims payment or regulatory reporting. Operational resilience requires identification of important business services, impact tolerances, dependency mapping, scenario testing and credible recovery arrangements.

Governance should allocate accountability across the board, senior management, transformation leadership, risk, compliance, technology and business owners. Three lines of responsibility may be used: operational management owns controls; risk and compliance provide oversight and challenge; internal audit provides independent assurance.

Transformation boards should monitor not only delivery milestones but also emerging risk. A project that is on schedule but accumulating technical debt, control exceptions and user resistance is not healthy. Stage gates should assess readiness for pilot, scale, migration and retirement of legacy processes.

9. Illustrative Case: Horizon Life’s Protection Transformation

This is a fictional illustrative case.

Background

Horizon Life is a mid-sized insurer with strong agency distribution and an ageing policy administration platform. New business applications require paper forms, manual medical follow-up and several departmental handoffs. Average policy issuance takes 18 days. Younger customers increasingly purchase financial products through digital platforms, while the insurer’s expense ratio is rising.

Problem

The board proposes a mobile application and an automated underwriting vendor. The technology team argues for rapid implementation, but the chief risk officer identifies concerns about data consent, model explainability, vendor concentration and the treatment of customers referred for manual assessment. Agents fear that digital channels will weaken advice and reduce their role.

Analysis

A value-stream review finds that only 20% of elapsed time is active processing; the remainder is waiting, re-keying or requesting incomplete evidence. Customer research shows that applicants value speed but are confused by exclusions and medical questions. Historical data also reveal higher withdrawal rates among customers who receive repeated evidence requests.

The proposed business case includes three alternatives: retain the current process with minor automation; adopt a vendor solution with staged integration; or replace the core platform before changing underwriting. The second alternative offers the best balance of speed and risk, provided that the insurer retains decision accountability and builds an exit plan.

Approach and solution

Horizon establishes a cross-functional product team. It redesigns the application around plain-language questions, consent management and progressive evidence collection. A rules engine handles low-risk cases, while complex, vulnerable or inconsistent cases are referred to underwriters. The vendor model provides a recommendation, not an unreviewable decision.

The pilot is limited to one product and two distribution channels. Success measures include issuance time, abandonment, complaint rate, referral quality, underwriting mortality assumptions, model performance by relevant customer groups, adviser adoption and post-issue corrections. Horizon negotiates audit rights, data deletion provisions, service-level requirements, incident notification and tested transition assistance.

Outcome

After six months, median issuance time falls substantially and rework declines. The STP rate is lower than the vendor’s original forecast because Horizon deliberately refers some cases for review. Customer complaints about medical evidence fall, while adviser satisfaction improves after training and clearer referral explanations. The board approves gradual scaling, conditional on continued fairness testing, resilience exercises and quarterly vendor review.

Learning points

1. The strongest transformation began with process diagnosis, not technology procurement.
2. Deliberate human intervention can improve trust and risk quality even when it lowers STP.
3. A vendor’s model does not transfer the insurer’s regulatory accountability.
4. Pilots should test customer and risk outcomes, not only system performance.
5. Exit capability is part of partnership value, not an administrative afterthought.

Challenges and Limitations

Strategic transformation can create transition costs, duplicated platforms and temporary productivity loss. Benefits may be difficult to attribute because changes in sales, mortality, interest rates and customer behaviour occur simultaneously. Legacy data can constrain automation, while aggressive simplification may remove valuable professional judgement. Partnerships may accelerate innovation but increase dependency and weaken direct customer visibility. AI may improve consistency yet reproduce historical inequities. Finally, transformation fatigue can reduce adoption when employees experience repeated restructures without credible benefits.

Managers should therefore use staged investment, independent challenge, scenario analysis and explicit stop or redesign criteria. They should report adverse outcomes as seriously as positive benefits. Strategic transformation is a continuing capability rather than a one-time programme.

Best-Practice Implementation Roadmap

A practical roadmap is:

1. Set ambition: define customer, strategic, financial and risk outcomes.
2. Diagnose: map value streams, technology, data, controls, partners and capability gaps.
3. Prioritise: select initiatives according to value, feasibility, urgency and risk.
4. Design: create the target operating model, architecture, governance and measurement plan.
5. Pilot: test a bounded product, channel or process with explicit hypotheses.
6. Assure: validate conduct, models, security, resilience, privacy and regulatory compliance.
7. Scale: expand only when evidence supports the expected outcomes.
8. Institutionalise: embed ownership, training, continuous improvement and benefits tracking.
9. Retire: decommission redundant processes and systems safely, preserving records and customer access.

Chapter Summary

Life insurance transformation is the redesign of the operating system through which an insurer creates customer value, manages risk and fulfils its obligations. It extends beyond digitising documents and requires alignment among value streams, organisation, technology, data, people, controls and partners. Process redesign should begin with customer outcomes, distinguish routine work from expert judgement and make exceptions visible.

Ecosystem partnerships, insurtech and embedded insurance can improve reach and speed but create dependency, conduct, cyber and data risks. Agile delivery supports experimentation when combined with strong architecture, risk controls and accountability. Business cases should use NPV and complementary measures covering customer outcomes, operations, risk, people, resilience and strategic capability.

Future insurers must prepare for longevity, climate change, demographic transition and evolving regulation. AI can support underwriting and service, but fairness, explainability, privacy, model governance and human accountability are essential. Successful transformation is evidence-led, staged, resilient and ethically governed.

Key Terms

Operating model: The arrangement of processes, people, technology, data, governance and partners used to execute strategy.

Value stream: End-to-end activities that produce a customer or business outcome.

Digitisation: Conversion of analogue information into digital form.

Digitalisation: Use of digital technology to improve an existing activity or process.

Strategic transformation: Fundamental redesign of how an organisation creates and delivers value.

Straight-through processing: Processing completed without manual intervention under defined rules and controls.

Insurtech: Technology-enabled innovation applied to insurance activities or business models.

Embedded insurance: Insurance integrated into a non-insurance customer journey or platform.

API: A defined interface enabling software systems to exchange data or services.

Ecosystem: A network of organisations jointly contributing to customer value.

Agile delivery: Iterative, cross-functional delivery using frequent feedback and incremental releases.

Net present value: The present value of future net cash flows less initial investment.

Longevity risk: Uncertainty arising from changes in survival and life expectancy.

Basis risk: Risk that an index, population or proxy does not match the insurer’s actual experience.

Operational resilience: Ability to continue important services within acceptable impact tolerances during disruption.

Model drift: Deterioration or change in model performance as data, behaviour or conditions change.

Explainability: The ability to communicate how a model or decision reached its output.

Fair value: The assessment that a product’s benefits, quality and price are appropriate for its customers.

Technical debt: Future cost created by expedient technology or design choices.

Protection gap: Difference between the financial protection people need and the cover they possess.

Review Questions

Short Answer Questions

1. Distinguish digitisation, digitalisation and strategic transformation.
2. What are two advantages and two risks of ecosystem partnerships?
3. Why should straight-through processing include exception management?
4. Define embedded insurance and give one life-insurance example.
5. Identify four controls relevant to AI use in underwriting.

Long Answer Questions

1. Explain how a value-stream approach can improve a life insurer’s new-business process.
2. Discuss the benefits and limitations of agile transformation in a regulated insurer.
3. Explain how longevity, climate change and demographic transition may affect life-insurance strategy.
4. Describe the components of a robust insurtech partnership due-diligence framework.
5. Critically evaluate the use of NPV as a decision tool for a major insurance transformation.

Analytical / Application Questions

1. An insurer’s automated underwriting project has a positive NPV but produces materially different referral rates across customer groups. Recommend a governance and decision process before scaling the project.
2. Design a pilot for embedded life insurance offered through an employer platform. Specify the customer proposition, controls, measures and exit criteria.
3. A legacy modernisation programme is late, over budget and technically fragmented, but regulatory resilience deadlines are approaching. Compare replacement, staged coexistence and targeted encapsulation, and recommend a course of action.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes strategic transformation from digitisation?

A. Transformation converts paper documents into scanned files.

B. Transformation redesigns how the organisation creates and delivers value.

C. Transformation removes all human judgement from insurance.

D. Transformation only concerns the information-technology department.

Correct Answer: B. Transformation redesigns how the organisation creates and delivers value.

Question 2

What is the main purpose of a value-stream perspective?

A. To measure only the productivity of individual departments.

B. To eliminate all control activities.

C. To examine end-to-end activities that produce a customer outcome.

D. To replace actuarial analysis with marketing analysis.

Correct Answer: C. To examine end-to-end activities that produce a customer outcome.

Question 3

Which is an important risk of embedded insurance?

A. Customers may not understand that cover exists or what it excludes.

B. It always prevents digital distribution.

C. It eliminates the need for claims processes.

D. It makes portability irrelevant.

Correct Answer: A. Customers may not understand that cover exists or what it excludes.

Question 4

In the NPV formula, what does the discount rate represent?

A. The number of future periods.

B. The present value of the initial investment.

C. The rate used to convert future cash flows into present values.

D. The number of customers acquired.

Correct Answer: C. The rate used to convert future cash flows into present values.

Question 5

A project requires 12 million initially and produces 4 million at the end of each of three years. Ignoring all other cash flows and discounting, what is the simple payback period?

A. 1 year

B. 2 years

C. 3 years

D. 4 years

Correct Answer: C. 3 years

Question 6

Which approach is most appropriate for a complex or vulnerable life-insurance application?

A. Automatic rejection without review.

B. Mandatory straight-through processing.

C. Specialist assessment with enhanced communication and escalation.

D. Deletion of all customer data.

Correct Answer: C. Specialist assessment with enhanced communication and escalation.

Question 7

Why is vendor accountability still necessary when an insurer uses an external underwriting model?

A. The vendor automatically becomes the regulated insurer.

B. The insurer retains responsibility for customer and regulatory outcomes.

C. External models cannot be monitored.

D. Partnership contracts eliminate operational risk.

Correct Answer: B. The insurer retains responsibility for customer and regulatory outcomes.

Question 8

Which development is most directly associated with longevity risk?

A. Uncertainty about future survival and mortality improvement.

B. Uncertainty about the colour of digital interfaces.

C. A decline in application programming interfaces.

D. Elimination of annuity liabilities.

Correct Answer: A. Uncertainty about future survival and mortality improvement.

Question 9

Which control is most relevant to detecting AI model drift?

A. Monitoring performance and outcomes over time.

B. Increasing advertising expenditure.

C. Removing all historical records.

D. Prohibiting human review.

Correct Answer: A. Monitoring performance and outcomes over time.

Question 10

What is a central principle of operational resilience?

A. Assuming that important third parties cannot fail.

B. Focusing only on project delivery dates.

C. Identifying important services, impact tolerances and recovery arrangements.

D. Replacing all insurance products with embedded products.

Correct Answer: C. Identifying important services, impact tolerances and recovery arrangements.