Special Issue of Supervisory Circular - Business Continuity and Disaster Preparedness - May 2018

Disaster Recovery & Business Continuity Plans

The 2017 hurricane season was by all accounts hyperactive and catastrophic, with 17 named storms, 10 became hurricanes including six major hurricanes (Category 3, 4, or 5)1 . The 2017 hurricane season is considered the costliest hurricane season ever with overall losses estimated at US$ 215bn.2 Experts also predict that the 2018 hurricane season will also be an active one. It is therefore important for Class ‘A’ Property and Casualty Insurers (“Insurers”) to ensure that their Disaster Recovery and Business Continuity Plans (“BCPs”) are in place to minimise the potential impact of major operational disruptions by ensuring that they are up to date, and are being continually tested. Such measures will ensure that in the event of a major disruption, such as a hurricane, the measures implemented, and Insurers’ ability to effectively respond post event, will help promote and enhance market confidence, consumer protection and the reputation of the Cayman Islands’ insurance market. Those class ‘A’ insurers who are carrying on insurance business in the Cayman Islands through Insurance Brokers, their BCPs should cover the operation of the insurance brokers who represent them in the Cayman Islands. 

Disaster Recovery & Business Continuity Management

It is the responsibility of the board and senior management of Insurers to ensure that, within their institutions, there is effective and comprehensive approaches to business continuity. The board and senior management also has the responsibility to ensure that appropriate policies and procedures are in place, to safeguard critical functions such as, access to data, the ability to receive and process claims in a timely manner and communication with customers can be effectively implemented post a major event. Considering the important role of insurance companies in the domestic financial market, companies should be able to demonstrate a high degree of resilience in the event of a disruption.

As required by the Statement of Guidance on Business Continuity Management (“SOG BCM”), Insurers should test their BCPs on a regular basis, to ensure that they are working appropriately and effectively. Insurers should conduct simulation exercises and assess the performance of their BCPs and make changes where deficiencies are identified. Post event, Insurers’ BCPs should take into account how they will be able to execute the following critical disaster recovery functions: 

• If the primary building of operation is damaged, the ability to get the alternate site up and running in a timely manner.
• Access to the Insurer’s database, and in the event the main servers are down, the ability to access back-up data sites or some alternate method of accessing critical data.
• The ability to manage large volumes of claims.
• In cases where external loss adjusters are used, consideration should be given whether they will be flown in pre or post event.
• What level of autonomy will loss adjusters have? Will they have claims settlement mandate? 
• How will information be disseminated with potentially limited means of communication? 
• shelter locations are used, where will the equipment, such as satellite phones, laptops underwriting files and claims forms be stored? These items should be readily available for use immediately post event.  

Where deficiencies are identified in the Insurers’ BCPs, the appropriate changes should be implemented to confirm that Insurers are adequately prepared and equipped to continue to operate as efficiently as possible, post a major event. It is also important for Insurers to subject their BCP to independent audit and review, to ensure a level of objectivity and independence is maintained and that the business continuity process works effectively and efficiently if the need arises for it to be utilised. 

Underwriting Management

In accordance with Section 5 of the Statement of Guidance on Market Conduct for Insurers, Agents and Brokers (“SOG Market Conduct”), Insurers are expected to pay due regard to the information needs of their customers and treat them fairly, which includes communicating relevant and meaningful information, in a timely and comprehensive manner, to reasonably enable customers to make balanced and informed decisions. Underinsurance was a major issue in the jurisdiction after Hurricane Ivan in 2004. Where there are cases of underinsurance, it is expected that Insurers would have advised their clients of the risk of underinsuring and provide recommendations for remedying such situations.

Insurers should also verify that information provided to its insureds is accurate in all material respects, easily understandable, not misleading, and available in writing or accessible via electronic means, in accordance with Section 5 of the SOG Market Conduct.  

Claims Management  

Insurers are required to have policies and procedures in place to handle claims in a fair and timely manner in accordance with the SOG Market Conduct and SOG Internal Controls for Insurance (“SOG IC”). The Insurers’ claims handling procedures should be documented and clearly outline all steps from the claim being raised to its settlement. Insurers’ BCPs should also comprehensively identify claims handling procedures in the event of a major disruption.

After hurricane Ivan hit the Cayman Islands, Insurers had to deal with large volumes of claims. There was a case where 90% of the book of business of one Insurer’s claims was reported. Therefore, Insurers’ BCPs should address how the Insurer will provide sufficient staff with the appropriate training and expertise to recover critical operations and services consistent with its disaster recovery objectives. 

A key component to this process will be the review of complaints and dispute resolutions procedures, ensuring that policyholders are aware of the Insurers’ claims handling policies and procedures. It is appropriate for Insurers to have claim contact details, complaints and claims procedures, clearly stated in plain and simple language, within their insurance policy documents.

When using the services of loss adjusters, it is important to ensure that loss adjusters have appropriate understanding of the local market and the relevant experience and expertise to carry out their functions in such an event.