3-Step Framework to Manage COVID Risk

Insurers need a comprehensive yet customizable approach to assess operational risk quickly and dynamically and chart responses to COVID-19.

For insurance leaders, the full impacts of the COVID-19 pandemic will unfold over the coming months, but the rapid evolution of the crisis is forcing organizations to constantly evaluate how they are responding today.

Realistically, most business continuity procedures will prove inadequate. Very few would have planned and provided for a global crisis that kept virtually all of their workforce sequestered at home for weeks or months. Because there is no proven methodology for what we’re navigating today, organizations are having to collaborate virtually, sometimes on a global scale, to rapidly adapt business operations, frequently and simultaneously across several businesses on very short time cycles. Some solutions will succeed, and some will not. Others might not work until conditions change. Also, business decisions driven by the current situation will create unexpected demands on operation risk management. For example, several insurance carriers announced premium credits to their auto policyholders due to a significant drop in usage. Such decisions will require an ability to process large volume of one-time transactions, in a controlled yet customer-friendly manner.

In these conditions, insurers need a more comprehensive yet customizable approach to assess operational risk quickly and dynamicly and chart responses to COVID-19. 

Organizations should undertake a three-step approach to better understand the impact of the coronavirus on their operations, identify high-impact and high-priority areas, assess new and increased risks and develop actions to address business critical priorities.


Companies should use an integrated process-health check that brings together business continuity process and crisis management teams to define and implement targeted response decisions. A thorough assessment will identify gaps specific to the current pandemic, as well as heightened or new risks.

Some of the factors that have increased risks under COVID-19 and affect processes include:

  • Dependency on technology that is less effective when working from home 
  • Activities that require physical interaction, such as check printing and mail rooms 
  • Activities that rely on in-person interactions and meetings
  • Numerous process handoffs, particularly across functions 
  • Regulatory constraints such as time-sensitive and mandatory requirements

Insurers must quickly document processes severely affected by the current crisis and identify areas with a high number of manual touch points and mandatory in-person interactions. Companies need a framework agile enough to provide leaders with increased visibility into their processes, including changes to daily tasks, implications for working remotely and identifying tasks that cannot be handled without manual intervention. The right framework should also highlight regulatory risks for non-compliance and potential impact on quality assurance procedures.

Using strategies such as a lightweight, questionnaire-based approach, leaders can gather insights into their processes that account for the impact of COVID-19 in two to three business days and require minimal time from process owners. Responses to a well-designed questionnaire will not only identify process gaps specific to the current crisis but will also find candidates for future improvements and innovations. 

See also: Rethinking Risk Management in a COVID-19 World


A centralized and purpose-based response structure works best to solve company-wide issues for many carriers. Key decisions related to organizational priorities, customers, employees and costs must be made in the face of uncertainty and incomplete information. Central ownership and accountability in the form of a dedicated response team will ensure a consistent, iterative approach and effective risk management.

The right framework captures this information and ranks it from both business criticality and risk perspectives. Once risks have been identified and prioritized, operation leaders should align on potential scenarios and recommended solutions. While recommendations will vary across organizations and functions, they will typically include:

  • Identify processes that have changed during COVID-19 and implement new process steps on an interim basis. Rapidly create or update existing process map documentation and communicate this information to relevant stakeholders
  • Identify new risks, controls and testing procedures. Develop plans to reinforce controls that have been relaxed in any transitions to work-at-home
  • Identify and recommend changes to employee responsibilities including deprioritizing non-business critical activities, and the strategic navigation of key business continuity process resources
  • Supplement processes with additional collaboration tools to enhance remote work output, such as digital check printing solutions, document sharing tools and other interventions.

Business leaders know they need to act now instead of waiting to design the perfect solution. Senior executives should communicate to business units and function leaders a broad outline within which solutions should be developed. Such guardrails are usually based on the organization’s vision, culture, business critical requirements and other non-negotiables. Then, the focus of operations leaders must turn to segmenting the overall organization response strategy into actionable plans for their responsibility areas. Clearly, action plans should be detailed enough to include ownership, timelines and measurable, expected outcomes.


Response managers must also establish feedback loops to monitor the efficacy of their response strategy and tweak it as required. New challenges will emerge. Unanticipated situations will develop, and a significant percentage of responses will at least partially fail to meet their objective. In these scenarios, an agile, test-and-learn approach allows leaders to adapt to changing requirements as quickly as possible. Following are a few agile principles that would allow leaders to strike a balance between business support and risk management, and move forward with speed:

  • Build and deliver working solutions, with a preference to short time cycles 
  • Learn and change. Be creative and promote non-standard solutions 
  • Set up cross-functional and diverse response teams 
  • Clearly define ownership and outcome expectations 
  • Hyper-track progress, using frequent touch points

Every crisis presents opportunities, and some companies will come out of this crisis stronger. Post-crisis, speed and agility to adapt will differentiate the leaders from laggards in this new normal. According to a McKinsey study, companies that managed the 2008 financial crisis with speed, discipline and resiliency saw 30% increases in revenue and big reductions in operating costs during the recovery. 

See also: 7 Biases Customers Have About Risks  

There is an opportunity to accelerate an agenda advancing the future of work as companies consider an environment that promotes virtual teams, provides online collaboration tools to employees and uses digital operational capabilities to supplement human workers. As operations stabilize and the new normal takes hold, the response team should pivot and identify opportunities to continue to transform. This will allow companies to leverage learnings from the current crisis and build stronger crisis response capabilities.

An adaptive risk assessment framework approach requires a strong alignment among functional and operations leaders. It also requires a status cadence that allows a quick rollout of actionable recommendations, rapid reviews of their impact with process owners and the ability to course correct frequently. 

Read More