Apr 23, 2009 (Datamonitor via COMTEX) --Insurers across the globe are downsizing in order to remain viable in this difficult market, elevating the risk of employees making critical errors, or engaging in malicious activities to retaliate. Companies looking to protect themselves from such dangers should consider investing in solutions that reduce operational risk.

Credit and market risk are major concerns for insurers. As insurers take stock of this past year, it is clear that, in the simplest terms, poor lending practices (credit risk) coupled with falling home prices (market risk) triggered the economic downturn. As a result, a number of companies collapsed, were sold at fire-sale prices, or are being propped up with government dollars. Insurers holding bonds in these defunct or crippled companies wrote down the value of their investments, which is a credit risk in itself.

Operational risk, which is the third pillar of enterprise risk, has not been front and center in the current crisis. It is a growing concern, however, largely because of increased redundancies. The US finance and insurance industry, for example, witnessed 88 layoff events of 50 or more employees in January 2009, an increase of 76% from the same period the previous year and more than double the number of events in December. Genworth Financial, ING, Allstate and Lincoln National are just a few of the insurers that made headlines by announcing 500 or more redundancies. More recently, Swiss Re announced a plan to lay off 1,200 employees located across the globe. As a result of the increase in job losses, 45% of financial service respondents in a survey by the Global Association of Risk Professionals (GARP) said that operational risk has "greatly increased".


Redundancies elevate operational risk in a number of ways. Employees that are expendable enough to be laid off still possess a certain level of operational knowledge. When these people walk out the door, the information goes with them. By losing that historical knowledge, insurers - or any company, for that matter - are at risk of losing crucial insight into their processes. Additionally, fewer employees means that there are not as many people who can catch errors, which is of particular concern considering that layoffs usually result in increased stress and workloads, and thus higher error rates, for the remaining employees.

Employees that have been or are fearful of being laid off present a risk of fraud or retaliation to the insurer. Along with ingrained knowledge, employees may also possess hard sources of information in the form of documents that they have printed, emailed to personal accounts or saved to USB sticks. This information can be leaked to competitors or customers. The risk-reward calculation of fraud schemes also changes in a downsizing environment. A claims agent that would never have involved him or herself in such a scheme during periods of high job security may begin to think differently when the safety net is removed.

In the short term, insurers can use standard procedures to manage these risks. For example, they can make certain that laid-off employees cannot return to their desks to send that last critical document to their personal email. Additionally, insurers can strive for once-and-done layoffs, as opposed to multiple rounds that can sap productivity and loyalty.

The operational risks posed by laid-off or disgruntled employees are symptomatic of deeper issues that require a longer-term strategy, however. To begin, greater attention to process automation can help reduce the risk of one or a handful of employees becoming too powerful or irreplaceable. Process automation can also reduce instances of fraud. Automating claims functions - such as first notice of loss or settlement - in order to minimize fraud is an area of interest for insurers. In Datamonitor's 2008 survey of 200 global insurers, detecting fraud was the top-ranked reason for investing in claims process automation. In addition to reducing operational risk from fraud or employee error, process automation can cut operational costs, which has become increasingly important as insurers struggle with a soft market and diminished investment income.

Improving data protection is another way to mitigate the risk of a malicious data leak by a disaffected employee. The primary goal of a data protection strategy is first to identify confidential material through the use of keywords or file tracking and second to ensure that such data remain within the enterprise's network. Putting restrictions on what data can be moved to a USB stick, burnt to CD or sent to a printer further strengthens an operational risk strategy. Encrypting critical data provides an additional layer of protection.


Lastly, business intelligence (BI) is evolving to the point where managers may one day be able to know which person had what information at which point in time - and what action they took with that information. This will increase transparency and thus reduce employee-driven operational risk. Perhaps even more interestingly, however, this evolution in BI could lead to a structural shift in management philosophy. By understanding how employees consume data, firms may be able to optimize how each individual employee gets fed information. While this level of BI may be feasible within a few years, adoption (at least early on) may be inhibited by concerns surrounding return on investment at the insurer level. Vendors will have to prove that recalibrating an employee's information consumption leads to productivity gains above the cost of the solution.

In conclusion, the risk of employee error or malicious staff activity resulting from layoffs should be a warning call for insurers to invest in operational risk prevention. By focusing on the third pillar of enterprise risk, insurers will be able to limit costly and reputation-harming incidents, as well as improve operational efficiency.

Jonathan Steiman



http://www.datamonitor.com

Republication or redistribution, including by framing or similar means,is expressly prohibited without prior written consent. Datamonitor shallnot be liable for errors or delays in the content, or for any actionstaken in reliance thereon