Good risk management relies on having the right data, at the right time. Without this, senior leadership will struggle to make informed decisions about the direction the business will take, and regulators may not be able to offer effective supervision. Both parties (and other stakeholders) need assurance that the firm’s risks are appropriately managed, with controls that are well-designed and operating as intended. But modern risk management is more than that and presents an opportunity to identify areas for innovation and organisational growth.
Meeting this challenge isn’t easy, especially with economic uncertainty, a heavy regulatory change programme, and new requirements for ESG (among others). Staying on top of an ever-changing risk profile can be all-encompassing, and many insurance firms struggle to meet business demands with the resources available to them. Wishlist items to improve horizon scanning, make connections between different risk types or inter-departmental collaborations often fall by the wayside. Simply put, risk management teams are feeling the pressure to do more with less.
To meet this brief, more firms are moving away from manual processes and embracing automated risk management approaches. But this can be daunting and many risk functions aren’t clear on the benefits, barriers to adoption or who to speak to. Understanding key stumbling blocks can help you decide where to start.
Many firms still rely on manual processes to enforce, monitor and assess the effectiveness of their controls. This includes how the risk function is able to monitor risk appetite and risk indicator thresholds. This is inherently limited by the size of the team available and isn’t easily scalable during peak times. It’s also error-prone and only allows for a sample of controls to be tested when checking the effectiveness of controls performance, and depends on the business to provide data when collating information for business-as-usual risk management activities. Automation in these areas helps to alleviate these problems, offering accurate and scalable monitoring of the entire population of data. This reduces the pressure on resources, freeing up specialist skill sets to focus on wishlist areas to drive innovation and value across the business. More challenging and rewarding work also encourages individuals to stay in the organisation, retaining talent in the long term.
Another key benefit is speed. With manual processes, there's often a delay of days, weeks, or even months between exceptions occurring, and second or third-line team identification. In the meantime, data flows and reporting processes could carry the error, affecting stakeholders’ understanding of the firm’s current risk profile and influencing management decisions. Automated solutions reduce that lag and support continuous monitoring, flagging exemptions in near real-time. Not only does this improve MI, but it supports a system that is fundamentally more sensitive and responsive to risk.
Drawing on multiple data feeds allows firms to create a real-time dashboard and monitor risks and controls across a range of risk areas. This gives more comprehensive oversight than ever before, supporting data visualisation and helping assurance teams to identify interconnected risks. It also simplifies the reporting process, as much of the data has already been collated and analysed, with qualitative data and expert views to be added and dropped into the preferred format. It’s important to note that not all risk data will be quantitative in nature, so separate appropriate controls and reporting processes for qualitative data are still needed.
Automating reporting feels like a no-brainer, but it’s easier said than done. Changes on this scale need significant investment in terms of time, and many insurance firms don’t have the resources to spare. Many firms are also lumbered with legacy data and reporting systems, which can be slow and duplicative, resulting in inaccurate and incomplete information stored across multiple data repositories. There’s also the question of skillsets, as a significant chunk of the work needs to be done by data specialists.
But the good news is, it doesn’t have to be expensive, and most insurance firms already have software they can use to get started. The standard Microsoft Suite includes Power Automate and Power BI, which can help structure data outputs, analyse them and create a real-time monitoring dashboard. Other programmes are available, but a proof of concept using existing software could be a good starting point.
The risk and data team must work together closely to identify opportunities for risk and control automation. This includes assessing the current data available, where it's stored and verifying the sources. Where there are gaps, firms will need to secure additional data from internal or external sources, as needed.
The risk team will need to review their existing processes to ensure repeatable actions, with structured data outputs to feed into the algorithm. Next, the data team will set up, test and validate the automated processes and ensure the dashboard works as intended. There will also be some unstructured and qualitative that won’t feed into the algorithm, so the risk team will need to review these data feeds and establish a process to capture that information.
Automated risk and control processes and reporting will help insurers stay on top of their risks and improve their control environment. Freeing up resources in the short term will improve the quality of assurance in the long term, increasing responsiveness to risk and business resilience. Moving simple and repetitive assurance work to an automated platform will also make better use of specialist resources, helping to drive innovation and supporting business growth in the long term.
For more insight and guidance, get in touch with Nousheen Hassan.
