Putting operational resilience to the test
As a claim handler, what would you do during a peak claim event if your core Claim Management Solution was unavailable and ECF suddenly went down? How would you ensure that claims were paid in a timely fashion with auditable proof that the built-in system controls (such as sanctions) have been adhered to?
A recent London Market operational resilience exercise facilitated by the Lloyd’s Market Association (LMA) and consultancy firm Crowe addressed precisely this scenario by testing the processes organisations have in place to overcome the challenges they would face.
To maximise the impact of the scenario tested, the LMA needed to select a technology vendor with a sufficient number of carrier clients in the London Market. On the strength of our substantial market share, our well-established reputation as a professional and collaborative business, and our willingness to commit our time and expertise, the LMA turned to DOCOsoft. Around 50% of London Market claims messages pass through a DOCOsoft CMS, while more than a third of LMA members use our systems. Our involvement makes DOCOsoft the first CMS provider to assist with a market testing exercise of this kind.
The art of the plausible
The first task was to construct a scenario that was severe enough to test participants robustly – but not so far-fetched as to stretch the boundaries of plausibility. This proved to be an unexpectedly tough challenge. Each DOCOsoft client uses their own unique instance of the CMS – either hosted by DOCOsoft or deployed on-premise. This architecture made it surprisingly hard to identify a realistic scenario event that would be capable of taking out the DOCOsoft CMS for every participating carrier at the same time.
Crowe and DOCOsoft looked at seven potential scenarios before settling on an insider-malware event for the simulation, acknowledging that even this scenario was extremely unlikely in practice. That improbability should be reassuring from a DOCOsoft customer’s perspective, but it also illustrates an important principle of resilience testing. Extreme scenarios don’t need to be likely to be useful. But they do need to be credible enough to expose dependencies, assumptions, and potential points of weakness before a real incident arises.
Workarounds need to work
The exercise concentrated primarily on a simple question: if the CMS became unavailable, could claims teams continue operating?
The results provided some cautious encouragement. Claims handlers were able to access ECF directly, with only a limited number requiring accounts to be re-enabled, and one reporting zero delays in responding to claims through ECF throughout the two-day exercise.
There’s a useful lesson here. A workaround set out in a business continuity document won’t necessarily function under pressure. Access credentials expire. People change roles. Knowledge disappears. Rarely used alternative processes become unfamiliar.
One particularly effective practice identified during the exercise was periodically prompting claims handlers to log into ECF, to make sure their accounts remained active. That might seem a small exercise in operational discipline, but it’s exactly the kind of attention to detail that can determine whether or not a contingency plan works when it’s actually needed.
To further test organisations’ processes, an additional stress factor was added to the scenario, with ECF becoming unavailable. This forced organisations to revert to older methods of communication (e.g. email) while tracking and ensuring that claims payments were processed and tracked correctly. The key question here was how long organisations could operate without ECF or the DOCOsoft CMS. Without any access to online claims systems claim handlers had to ensure that claim payments were made and were required to follow Lloyd’s Urgent Settlement Guidance.
Since the exercise was carried out, there has been a request from Lloyd’s to review and update the Lloyd’s Urgent Settlement Guidance.
Resilience is also about communication
As well as interrogating the technological implications of disruption, the exercise also highlighted the importance of clearly defined communications spanning account management, support, IT and BCP teams, senior leadership, market bodies, and incident-management contacts, with appropriate processes for escalation, de-escalation, and the return to business as usual.
Participant feedback underlined the need for central market communications and for having recognised contacts and channels agreed in advance. It also highlighted teams’ high level of reliance on CMS functionality. Participants commented that other suppliers could benefit from undertaking similar testing exercises.
Ultimately, operational resilience isn’t something that can be achieved by individual firms testing themselves in isolation. London is an interconnected ecosystem of carriers, brokers, technology providers and central market services. So, resilience depends on understanding, not simply whether each component can recover, and how quickly, but also how the market continues operating while one component is unavailable.
For DOCOsoft, the exercise provided welcome validation of the resilience inherent in a distributed client estate and an opportunity to share our experience of BCP, escalation, recovery and communications. For the wider market, the real value will come from continued testing in future: verifying assumptions, keeping fallback routes usable, clarifying responsibilities, and extending realistic resilience testing across other key suppliers and dependencies.
Because, if you do find yourself experiencing a genuine systems outage, that’s the wrong time to find out that your workaround only worked on paper.