Operational Risk, Business Continuity and Resilience

Introduction and Context

Insurance organizations operate through interconnected processes, people, information systems, intermediaries, service providers and control mechanisms. A failure in any one of these elements can prevent an insurer from underwriting policies, collecting premiums, paying claims, protecting confidential information or complying with regulation. Operational risk management therefore concerns much more than preventing clerical mistakes. It is the disciplined management of losses arising from inadequate or failed internal processes, people and systems, or from external events.

Operational risk is especially important in insurance because the industry makes long-term promises under conditions of uncertainty. A breakdown in claims administration may cause financial loss, regulatory sanctions and reputational damage simultaneously. A cyberattack may interrupt policy systems while also exposing customer data. A failure at an outsourced cloud provider may affect thousands of policyholders even when the insurer’s own offices remain open.

Business continuity management addresses how critical activities will continue during disruption. Disaster recovery focuses particularly on restoring information technology and infrastructure. Operational resilience is broader: it asks whether the organization can continue delivering important business services within acceptable limits despite severe but plausible disruption. These disciplines are related but not identical.

Learning Objectives

After studying this chapter, students should be able to:

1. Explain the nature, sources and consequences of operational risk in insurance.
2. Apply risk and control self-assessments, key risk indicators and incident analysis.
3. Assess risks arising from processes, people, systems, outsourcing, fraud, cyber threats and conduct.
4. Conduct a business impact analysis and distinguish RTO, RPO, MTPD and critical business services.
5. Design business continuity, disaster recovery and crisis-management arrangements.
6. Evaluate operational resilience through scenario testing and tolerance-based assessment.
7. Analyse governance, regulatory, ethical and managerial issues in operational risk.

1. The Nature and Scope of Operational Risk

A widely used definition describes operational risk as the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. The definition includes legal risk but generally excludes strategic and reputational risk, although operational events may produce both strategic and reputational consequences.

Operational risk has several distinctive characteristics:

• It exists in every business activity, not only in specialist risk departments.
• It is often generated by normal operations rather than extraordinary events.
• Historical loss data may be incomplete, especially for rare and severe events.
• Causes are interconnected: a system failure may reflect poor change management, inadequate staffing and weak vendor oversight.
• Risk may accumulate across legal entities, products, locations and suppliers.
• The same event can create financial, regulatory, customer and social consequences.

A useful causal classification is:

Operational risk differs from underwriting risk. Underwriting risk concerns the uncertainty of insured losses and pricing assumptions. Operational risk concerns failures in how the insurer performs its activities. The two may interact: weak underwriting controls can produce poor portfolio decisions, while an outage can prevent accurate exposure monitoring.

2. Governance and the Three Lines Model

Effective operational risk management begins with governance rather than with software or documentation. The board is responsible for approving the organization’s risk appetite, overseeing material operational risks and ensuring that senior management has adequate resources. Senior management converts that direction into policies, responsibilities, controls and escalation thresholds.

The commonly used three-lines model separates responsibilities:

1. First line—management and operations. Business units own the risks created by their activities, operate controls and correct deficiencies.
2. Second line—risk and compliance functions. These functions establish frameworks, advise management, monitor risk profiles and challenge business decisions.
3. Third line—internal audit. Internal audit provides independent, risk-based assurance on governance, risk management and control effectiveness.

The model is not a substitute for accountability. Risk functions do not “own” risks merely because they report them. Nor does internal audit design controls that it must later assess. Clear ownership is particularly important for outsourced processes, where accountability remains with the insurer even when execution is delegated.

A sound governance framework normally includes:

• an operational risk policy;
• a risk taxonomy and event-classification system;
• documented process ownership;
• risk appetite and tolerance statements;
• incident escalation and reporting rules;
• control testing and issue-remediation procedures;
• third-party risk governance;
• board and committee reporting; and
• independent assurance.

Risk appetite expresses the amount and type of risk an organization is willing to accept in pursuit of its objectives. A tolerance is usually more specific, such as the maximum acceptable duration of a claims-service interruption or the maximum number of unresolved critical vulnerabilities.

3. Identifying and Assessing Operational Risk

Risk and Control Self-Assessment

A risk and control self-assessment (RCSA) is a structured process through which managers identify risks in their processes, evaluate existing controls and determine residual risk. A typical RCSA asks:

• What objective does the process support?
• What could go wrong?
• What would cause the event?
• What would be the impact on customers, finances, regulation and operations?
• Which preventive and detective controls exist?
• Are controls appropriately designed and operating effectively?
• What actions are required?

Inherent risk is the exposure before considering controls. Residual risk is the exposure remaining after controls. A simple qualitative matrix may classify likelihood and impact as low, medium or high. Such matrices are useful for communication but can create false precision if scales are poorly defined or if users simply multiply arbitrary scores.

Loss Data and Incident Management

An operational risk event is an event or near miss that causes, or could have caused, an operational loss. Incident management should record the date, process, cause, affected services, customers, financial effect, control failure, response and corrective actions. Near misses are valuable because they reveal weaknesses before a loss materializes.

Incident management normally follows this sequence:

1. Detect and validate the event.
2. Classify severity and determine immediate containment.
3. Escalate to accountable managers and crisis teams where necessary.
4. Protect customers, evidence and critical data.
5. Restore or substitute affected services.
6. Investigate root causes rather than only symptoms.
7. Remediate weaknesses and verify completion.
8. Capture lessons and update scenarios, controls and plans.

Root-cause analysis may use the five-whys technique, fault-tree analysis or causal mapping. A credible investigation distinguishes the immediate trigger from latent conditions such as unrealistic workloads, unclear authority, inadequate testing or poor incentives.

Key Risk Indicators

Key risk indicators (KRIs) are measures that provide warning of increasing exposure. Examples include claims backlogs, system availability, failed reconciliations, staff turnover in critical teams, phishing-report rates, overdue access reviews and unresolved high-risk audit findings. A KRI becomes useful only when it has a defined owner, measurement method, threshold, reporting frequency and escalation response.

4. Principal Operational Risk Exposures in Insurance

Process Risk

Process risk arises when activities are poorly designed, inconsistently performed or inadequately supervised. Examples include incorrect policy data, duplicate payments, missed regulatory deadlines, weak premium reconciliations and inadequate segregation of duties.

Process design should identify inputs, outputs, decision points, handoffs, dependencies and control evidence. Preventive controls—such as approval limits, automated validation and segregation of duties—usually reduce the probability of error. Detective controls—such as reconciliations, exception reports and quality reviews—identify problems after occurrence. Corrective controls restore the process and prevent recurrence.

Automation may reduce manual error but can also amplify systematic error. An incorrectly configured claims rule can process thousands of cases inaccurately. Consequently, automated controls require change governance, test data, access restrictions, exception monitoring and periodic validation.

People Risk

People risk includes mistakes, inadequate competence, fatigue, insufficient staffing, poor supervision, conflicts of interest and malicious behaviour. Control responses include role-based training, competence assessment, job rotation where appropriate, mandatory leave, background screening consistent with law, supervision and clear disciplinary procedures.

A punitive culture may suppress reporting of mistakes and near misses. A strong control culture distinguishes honest error from reckless or intentional misconduct while holding decision-makers accountable. Performance targets should not encourage unsuitable sales, claim denial without adequate investigation or concealment of service failures.

Systems and Technology Risk

Systems risk includes hardware failure, software defects, capacity constraints, data corruption, incompatible interfaces, weak access controls and failed changes. Important controls include resilient architecture, backup and restoration, patch management, vulnerability management, identity and access management, logging, monitoring, segregation of development and production environments, and controlled release procedures.

Availability alone is not sufficient. A system may be online but produce inaccurate policy or claims data. Therefore, resilience testing should evaluate confidentiality, integrity and availability, as well as recoverability and the ability to operate manually or through an alternative channel.

Outsourcing and Third-Party Risk

Outsourcing can provide specialist expertise, scale and lower costs, but it introduces concentration, dependency and control risks. Relevant third parties include cloud providers, claims administrators, brokers, call centres, payment processors, medical networks and technology vendors.

A third-party lifecycle should include due diligence, risk classification, contract controls, onboarding, ongoing monitoring, incident reporting, assurance, exit planning and termination. Contracts should address service levels, data protection, audit rights, subcontracting, business continuity, location of data, regulatory access, notification periods and secure deletion.

A service-level agreement is not itself a continuity plan. An insurer should understand how the provider will recover, what dependencies the provider has, how multiple clients are prioritized and whether the insurer can migrate or temporarily perform the activity itself.

Fraud Risk

Insurance fraud may be committed by applicants, policyholders, intermediaries, employees, organized groups or combinations of these parties. It includes false claims, staged accidents, premium evasion, identity misuse, application misrepresentation and internal payment fraud.

Fraud risk management combines prevention, detection, investigation and recovery. Controls include customer and intermediary due diligence, segregation of duties, analytics, anomaly detection, claims referral rules, whistleblowing channels and law-enforcement cooperation. Fraud analytics must be governed carefully: a model that disproportionately flags a protected group may create discriminatory outcomes and reputational harm.

Cyber and Information Risk

Cyber risk encompasses unauthorized access, ransomware, phishing, denial-of-service, data theft, manipulation of records and compromise of suppliers. Insurance organizations are attractive targets because they hold identity, financial, health and claims information.

A practical cyber-control architecture includes:

• asset inventories and data classification;
• strong authentication and least-privilege access;
• network segmentation and secure configuration;
• timely patching and vulnerability remediation;
• endpoint detection and centralized logging;
• tested backups isolated from production networks;
• phishing-resistant awareness and reporting;
• supplier-security requirements;
• incident-response playbooks; and
• privacy-by-design and legal notification procedures.

Cybersecurity is not only an information-technology responsibility. Executives must determine acceptable service tolerances, authorize investment, communicate during incidents and balance legal, customer and commercial considerations.

Conduct Risk

Conduct risk concerns the possibility that an organization harms customers or markets through inappropriate behaviour. Examples include unsuitable advice, unclear policy wording, unfair claims handling, unreasonable delays, inappropriate incentives and poor complaint management.

Conduct controls should consider customer outcomes throughout the product lifecycle: design, target market, distribution, communication, servicing, claims and renewal. Management information should include complaints, vulnerable-customer outcomes, claim repudiation patterns, cancellation rates, sales practices and remediation quality. A process may be technically compliant yet produce unfair outcomes; conduct oversight therefore requires judgement and customer-focused testing.

5. Business Impact Analysis

A business impact analysis (BIA) identifies important activities and assesses the consequences of their disruption over time. It should be based on business services and customer outcomes rather than solely on departments or applications.

For each important service, the BIA should identify:

• customers and obligations served;
• maximum tolerable period of disruption (MTPD);
• recovery time objective (RTO);
• recovery point objective (RPO), where data restoration is relevant;
• minimum staffing and facilities;
• critical technology, data and third parties;
• manual workarounds;
• dependencies and upstream/downstream effects; and
• legal, financial, operational and reputational impacts.

The MTPD is the maximum period for which disruption can be tolerated before unacceptable consequences arise. The RTO is the target time by which a service or system should be restored after disruption. The RTO must not exceed the MTPD. The RPO is the maximum acceptable age of data that may need to be recreated after recovery.

For example, if a claims database is backed up every four hours, the nominal RPO is four hours, but the actual achievable RPO depends on backup integrity, replication, access to backup copies and restoration testing. RTO and RPO are objectives, not guarantees, unless supported by tested capabilities.

A simple prioritization estimate may express disruption cost as:

where C_total is the estimated total consequence, and the four terms represent direct financial cost, customer impact, regulatory cost and reputational consequence. This is a decision-support model, not an accounting identity. The categories may overlap, so double counting must be avoided. Monetary estimates should be supplemented by qualitative judgements where impacts cannot be reliably priced.

6. Continuity, Disaster Recovery and Crisis Management

Business continuity planning establishes how critical services will continue at an acceptable level during disruption. A continuity plan should specify activation criteria, authority, contact arrangements, workarounds, resource requirements, communications, recovery priorities and return-to-normal procedures.

Common continuity strategies include:

• Do nothing or absorb: appropriate only for low-impact activities.
• Manual workaround: staff use documented alternative procedures.
• Alternate site: operations move to another facility.
• Remote operation: staff work from distributed locations.
• Redundancy: duplicate systems, facilities or personnel provide capacity.
• Reciprocal or mutual aid: another organization provides temporary support, subject to confidentiality and regulatory constraints.
• Degraded service: the organization provides a limited but essential service.
• Diversified outsourcing: dependencies are distributed, although complexity may increase.

Disaster recovery is the technology-focused component concerned with restoring systems, infrastructure and data. It includes backup, replication, recovery sequencing, restoration procedures and technical testing. Crisis management is the senior-level process of making decisions under uncertainty, coordinating stakeholders and protecting the organization’s legitimacy.

Plans should contain concise action cards rather than relying on lengthy narrative documents. They should identify who can declare an incident, who communicates with customers and regulators, how decisions are logged and how staff welfare is protected.

7. Operational Resilience and Scenario Testing

Operational resilience moves from asking “Do we have a plan?” to asking “Can we continue an important service within its tolerance during a severe but plausible disruption?” This approach emphasizes outcomes, dependencies and adaptive capability.

A resilience assessment commonly follows these steps:

1. Identify important business services.
2. Set impact tolerances, including maximum duration and acceptable level of disruption.
3. Map people, processes, technology, facilities, data and third parties supporting each service.
4. Identify vulnerabilities and concentration points.
5. Test severe but plausible scenarios.
6. Record weaknesses, remediation owners and deadlines.
7. Retest and report residual exposure to governing bodies.

Scenario testing should challenge assumptions. Relevant scenarios include a ransomware attack, cloud-provider failure, pandemic-related staff absence, loss of a major office, corruption of claims data, failure of a payment provider and simultaneous disruption of an insurer and a key supplier.

Testing methods include tabletop exercises, call-tree tests, technical recovery tests, failover tests, live simulations and controlled operational exercises. A test is meaningful only when it has defined objectives and evidence. A successful technical failover does not demonstrate resilience if customers cannot authenticate, claims cannot be paid or staff do not know the alternative procedure.

Testing should be proportionate and safe. Live exercises require authorization, safeguards and clear stop conditions. Results should not be manipulated to present a favourable picture. Failed tests are valuable evidence when they lead to credible remediation.

8. Quantitative Assessment and Decision Use

Operational risk measurement can support prioritization, capital assessment and investment decisions, but it should not replace expert judgement. A basic expected-loss estimate is:

where EL is expected loss per defined period, p is the probability of the event during that period, and L is the monetary loss if it occurs. The formula assumes that a meaningful probability and reasonably comparable loss estimate exist. It is weak for rare events, interdependent failures and non-financial impacts.

For multiple mutually exclusive events, expected loss can be represented as:

where p_i is the probability of event i and L_i is its loss. The probabilities should refer to the same time horizon and event definitions. If events can occur together, simple addition may double count or omit dependency effects.

Worked example. An insurer estimates that a payment-processing failure has a 2% annual probability and would cause a direct loss of $300,000. The annual expected direct loss is:

EL = 0.02 × $300,000 = $6,000.

This does not mean that the insurer will lose exactly $6,000. It is a long-run average used for comparison. If a resilience investment costing $20,000 annually reduces the probability to 0.5%, the revised expected loss is 0.005 × $300,000 = $1,500, producing an expected direct-loss reduction of $4,500. The investment cannot be justified on expected direct loss alone because regulatory, customer and reputational effects may be material.

Advanced models may use frequency and severity distributions, scenario analysis or loss-distribution approaches. Their reliability depends on data quality, assumptions about dependence and treatment of extreme events. Senior managers should understand model uncertainty and avoid presenting a precise numerical output as objective truth.

9. Artificial Intelligence and Emerging Issues

Artificial intelligence can support anomaly detection, claims triage, fraud investigation, document classification, cyber monitoring and scenario analysis. It can also create new operational risks: inaccurate outputs, model drift, opaque decisions, biased training data, privacy breaches, prompt injection, unauthorized automation and unclear accountability.

AI governance should include a use-case inventory, materiality classification, approval authority, data controls, validation, human oversight, performance monitoring, explainability appropriate to the decision, security testing and customer-remediation procedures. High-impact decisions such as claim denial or vulnerability assessment should not be delegated blindly to an unvalidated model.

Other contemporary developments include concentration in major cloud providers, systemic dependence on common software, digital identity fraud, climate-related disruption of facilities and increasing regulatory expectations for third-party and cyber resilience. Resilience planning must therefore consider correlated failures rather than treating each dependency as independent.

10. Illustrative Case: The Meridian Mutual Claims Outage

Background. Meridian Mutual, a fictional regional insurer, migrated its claims platform to a cloud service. The migration reduced infrastructure costs but left claims payments dependent on the cloud platform, a payment gateway and a specialist claims administrator.

Problem. A software update introduced a defect that corrupted claim-status records. The system remained accessible, but adjusters could not determine which claims had been approved. Payments were delayed for three days. The incident affected vulnerable customers and generated a high volume of complaints.

Analysis. The immediate cause was a defective release. Root-cause analysis identified deeper weaknesses: insufficient testing with realistic data, inadequate segregation of release approval, no independent reconciliation between claims and payments, unclear supplier notification duties and a continuity plan focused on system unavailability rather than data integrity. The BIA had identified a two-day RTO for claims payments but had not established an acceptable tolerance for inaccurate status information.

Approach and solution. Meridian activated its crisis team, froze questionable payments, established a verified manual register and contacted affected customers. It required the supplier to restore an uncontaminated version, reconciled claims against payment records and prioritized urgent medical and hardship claims. After the incident, Meridian revised its important-service mapping, introduced pre-release testing, established independent reconciliation, required stronger supplier change notification and conducted a joint recovery exercise. It also revised customer communication and remediation procedures.

Outcome. Claims payments resumed after three days, but the organization recognized that technical availability had masked a serious integrity failure. The board required quarterly reporting on recovery tests, data-quality incidents, supplier concentration and customer outcomes.

Learning points. First, resilience concerns the delivery of a reliable service, not merely system uptime. Second, outsourced execution does not transfer accountability. Third, impact tolerances must include customer harm and data integrity. Fourth, near misses and failed exercises should drive investment before a major loss occurs.

11. Challenges, Ethics and Regulatory Considerations

Operational risk frameworks face several limitations. Risk registers may become administrative inventories rather than decision tools. Heat maps may conceal uncertainty. Incident data may be biased toward events that are easy to detect. Rare-event estimates may be unstable. Plans may become obsolete as products, suppliers and technology change.

Ethically, insurers must balance resilience investment with affordability and inclusion. A control that reduces fraud but unfairly excludes legitimate customers is unacceptable. Emergency prioritization should be transparent and should protect vulnerable policyholders. Personal data used for fraud or cyber analytics must be collected and processed lawfully, proportionately and securely.

Regulatory expectations vary by jurisdiction, but common themes include board accountability, risk-based governance, outsourcing oversight, data protection, incident notification, business continuity and fair treatment of customers. Compliance should not be treated as the complete objective. A plan designed only to satisfy documentation requirements may fail under actual stress.

Best-Practice Implementation Roadmap

An insurer seeking to strengthen operational resilience can proceed as follows:

1. Obtain board sponsorship and define accountability.
2. Establish a common operational-risk taxonomy.
3. Identify important business services and customer outcomes.
4. Perform RCSAs and map critical dependencies.
5. Set measurable risk appetites and impact tolerances.
6. Strengthen preventive, detective and corrective controls.
7. Integrate cyber, fraud, conduct and third-party risk processes.
8. Build practical continuity and disaster-recovery arrangements.
9. Test severe but plausible scenarios, including data-integrity events.
10. Track remediation to closure and independently assure results.
11. Use incidents, near misses and changing technology to update assessments.
12. Report clearly to management, the board, regulators and affected customers.

Chapter Summary

Operational risk arises from failures of processes, people and systems and from external events. In insurance, it affects underwriting, policy administration, claims, payments, customer treatment, compliance and trust. Effective management requires clear governance, accountable process ownership, RCSAs, incident and near-miss learning, KRIs and independent assurance.

Major exposures include process error, people risk, technology failure, outsourcing, fraud, cyber threats and conduct risk. Controls should be preventive, detective and corrective, and should be tested rather than assumed to work. Business impact analysis identifies important services, dependencies, recovery objectives and consequences of disruption. Business continuity provides operational workarounds; disaster recovery restores technology; crisis management coordinates strategic decisions; and operational resilience tests whether important services can continue within defined tolerances.

Quantitative tools such as expected loss can support prioritization, but uncertainty, dependence and non-financial impacts require judgement. AI and digital ecosystems create both control opportunities and new risks. Ethical governance requires fair customer outcomes, privacy protection, transparency and accountability. Resilience is ultimately a management capability demonstrated through evidence, learning and adaptation.

Key Terms

Operational risk: Risk of loss from failed or inadequate processes, people, systems or external events.

Residual risk: Risk remaining after controls are applied.

Inherent risk: Exposure before considering controls.

Risk and control self-assessment: Structured management assessment of risks and controls.

Key risk indicator: Metric providing warning of changing risk exposure.

Operational risk event: Incident or near miss that causes or could cause operational loss.

Three lines model: Framework distinguishing operational management, risk oversight and independent assurance.

Business impact analysis: Assessment of disruption consequences and recovery requirements.

Important business service: Service whose disruption could cause intolerable harm to customers or the organization.

MTPD: Maximum tolerable period of disruption.

RTO: Target time for restoring a service or system.

RPO: Maximum acceptable age of data that may need to be recreated.

Business continuity: Capability to continue important activities during disruption.

Disaster recovery: Restoration of technology, infrastructure and data after disruption.

Operational resilience: Ability to continue important services within acceptable tolerances during severe disruption.

Third-party risk: Risk arising from dependence on suppliers or external service providers.

Conduct risk: Risk of customer or market harm caused by inappropriate organizational behaviour.

Root-cause analysis: Investigation of underlying conditions causing an incident.

Impact tolerance: Maximum acceptable level of disruption to an important service.

Near miss: Event that could have caused loss but did not.

Review Questions

Short Answer Questions

1. Define operational risk and distinguish it from underwriting risk.
2. What are the responsibilities of the first, second and third lines?
3. Explain the difference between RTO, RPO and MTPD.
4. Why are near misses useful in operational risk management?
5. Identify four controls relevant to cyber risk in an insurer.

Long Answer Questions

1. Explain how an insurer can establish an effective operational risk governance framework.
2. Discuss the relationship between business continuity, disaster recovery, crisis management and operational resilience.
3. Analyse the principal operational risks associated with outsourcing claims administration.
4. Evaluate the strengths and limitations of risk matrices, KRIs and expected-loss calculations.
5. Explain how conduct risk should be incorporated into product design, distribution and claims management.

Analytical / Application Questions

1. An insurer’s claims platform is unavailable for 18 hours, but its backup data are six hours old. Identify the relevant recovery objectives, customer risks, immediate actions and longer-term control improvements.
2. A fraud-detection model rejects applications from one demographic group at twice the rate of other groups. Design an investigation and governance response that addresses operational, ethical and regulatory concerns.
3. Map the dependencies of a hypothetical online claims-payment service and propose a severe-but-plausible scenario test that would assess both availability and data integrity.

Multiple Choice Questions with Answers

Question 1

Which statement best describes operational risk?

A. Risk that insured losses exceed actuarial expectations

B. Risk of loss from inadequate or failed processes, people, systems or external events

C. Risk that investment markets decline

D. Risk that a competitor launches a cheaper product

Correct Answer: B. Risk of loss from inadequate or failed processes, people, systems or external events

Question 2

Which line primarily owns risks created by day-to-day business activities?

A. First line

B. Second line

C. Third line

D. External audit line

Correct Answer: A. First line

Question 3

What does an RPO measure?

A. The maximum tolerable duration of service disruption

B. The target time to restore a service

C. The maximum acceptable age of data that may need to be recreated

D. The number of recovery staff required

Correct Answer: C. The maximum acceptable age of data that may need to be recreated

Question 4

A control that prevents one employee from creating and approving the same payment is an example of:

A. Segregation of duties

B. Scenario analysis

C. Impact tolerance

D. Crisis communication

Correct Answer: A. Segregation of duties

Question 5

Why should operational resilience testing include data-integrity scenarios?

A. Systems can be available while producing inaccurate or corrupted information

B. Data integrity is unrelated to customer outcomes

C. Availability testing always measures data accuracy

D. Integrity failures occur only in paper-based processes

Correct Answer: A. Systems can be available while producing inaccurate or corrupted information

Question 6

An event has a probability of 0.02 and a loss of $300,000. Using EL = p × L, what is the expected loss?

A. $600

B. $6,000

C. $60,000

D. $600,000

Correct Answer: B. $6,000

Question 7

Which activity is most directly associated with a business impact analysis?

A. Setting advertising prices

B. Identifying disruption consequences and recovery requirements

C. Calculating insurance reserves only

D. Selecting investment securities

Correct Answer: B. Identifying disruption consequences and recovery requirements

Question 8

Which statement about outsourcing is correct?

A. Outsourcing transfers accountability for the process to the supplier

B. A service-level agreement eliminates the need for continuity planning

C. The insurer remains accountable for outsourced activities

D. Supplier risk exists only when the supplier is overseas

Correct Answer: C. The insurer remains accountable for outsourced activities

Question 9

What is a near miss?

A. A confirmed financial loss above the risk appetite

B. An event that could have caused loss but did not

C. A planned disaster-recovery exercise only

D. A completed internal-audit report

Correct Answer: B. An event that could have caused loss but did not

Question 10

Which is the most appropriate governance response to a high-impact AI claims model?

A. Allow fully automated decisions without monitoring

B. Use it without documenting its data sources

C. Apply validation, human oversight, monitoring and accountability

D. Exclude all technology staff from its governance

Correct Answer: C. Apply validation, human oversight, monitoring and accountability