CIO Checklist: IT Security Planning

Tom Benton

Late last week the news broke that NSA has been working with US Information giants like Google, Verizon and others to monitor and analyze communications under the Protect America Act. The news set off a wave of responses, from privacy concerns to humorous posts on twitter. The PRISM program can be viewed on the positive side as a big data solution for finding and tracking threats to US security; on the negative side, it could be seen as an invasion of privacy. Whatever one’s view on the issues involved, the news may have people in your organization asking questions about IT security.

CIOs should be prepared to respond to questions from the CEO, Board, and business peers about how data security is handled in their companies. Now is a good time to have a discussion with whoever owns data security – whether that’s a Chief Information Security Officer on your team or someone else in the organization. If you don’t have a single owner for data security, then it’s you. When were your data security policies last reviewed? Does your website give customers information on how their data will be protected? Have you had third party security experts review your data security in the last year? Know the answers, because this could be a time where someone asks them and expects you to know.

With help from my teammate and fellow former CIO Rob McIsaac, I have published a CIO Checklist for IT Security planning. This executive brief provides an overview of IT security areas that CIOs need to consider as part of an overall IT risk management framework in their organization. While not intended to be a comprehensive planning guide or to give specific IT security advice, this guide will help CIOs gain traction on developing and reviewing their organization’s IT security plan.

Data security, privacy and how we communicate them is important in establishing trust. For the insurance CIO, maybe PRISM should stand for “Priority:  Review Information Security Measures”, so that you are better prepared to answer questions and build the trust of those who use our data systems.

Share

On Bad Decisions

Rob McIsaac

Bad decisions are not like fine wine: they don’t get better with time and they very likely carry with them hidden costs or risks that may emerge in the future. Frequently, they will make their presence felt at the most inopportune point, maximizing the “pain” and forcing another decision under less than ideal circumstances. Ultimately, bad decisions can lead to a non-virtuous cycle of suboptimal results, with every future decision becoming a potentially “bigger bet” required to make up for lost ground.

This reality was long ago elucidated for me when I bought my first car after graduating from college. The shiny, sparkly promise of a new ride was intoxicating. The promise of car payments, however, was not! so a car that didn’t leak oil, was unlikely to catch fire, and had a heater that worked seemed to be ideal. In an effort to save a few bucks each month I convinced myself that avoiding expensive options, like air conditioning, was the way to go. What I failed to consider was that driving during a NJ summer while wearing shorts and tee-shirts was a different user experience from driving in rush hour traffic while wearing a suit and tie: I focused on an immediate remediation of current problems, rather than truly considering where I wanted to be in the future. This led to a few years’ worth of very unpleasant commutes. Having our first child gave me an excuse to recast that decision, and I bought a slightly bigger car with air conditioning. That worked well for a short time–I hadn’t considered the impact of a second child’s arrival. I went back to the dealer a third time; that purchase was a charm. Reflecting upon this led me to think about the technology decisions carriers make as they prepare for a potentially uncertain future. How do the requirements get framed for making critical investment decisions for technologies that have a long potential useful life? What criteria are used for making these decisions? Is upfront cost the overarching driver, or is appropriate consideration given to future flexibility and the changing needs produced by an ever-evolving marketplace?

Making good decisions by looking out the windshield to see the future can ultimately be less costly than looking through the rear-view mirror to study the past. It was once famously said that “nothing is more permanent than a temporary solution.”An analog to that may be that bad decisions are simply gifts that keep on giving: they can dig a technical hole that may take years to get out of. Forcing hard dialogue around what the requirements really are, and how they will evolve through an understanding of the future, seems like a no brainer. The magic for CIO’s and IT organizations can be in finding ways to incorporate the flexibility to address the unforeseen. Business and technical changes are rarely linear so this can be an especially exciting–and anxious–prospect. Good hunting!

Share

Leading Capabilities In Claims Drives Loss Ratio Improvements

Karlyn Carnahan

The claims process is not standardized across the industry. A wide variety of processes and new technologies are being used in the claims area, such as predictive analytics, automated straight-through processing of simplex claims, or automated reserving. Whether or not a carrier uses these techniques varies by size of carrier, by industry sector, and by the strategy, culture, and technical capability of the carrier. And there is always the question of whether these techniques actually impact the financial results and outcomes of the claims process.

I’ve just published a new report that introduces the Novarica Claims Capability Maturity Model (NCCMM). I asked 92 property/casualty insurers complete a self-diagnosis using the NCCMM. The report details what property/casualty insurers are really doing in claims today, and what effect it is having on loss ratio.

In general, personal lines companies are more likely to use sophisticated techniques to manage the claims process, with Workers Compensation carriers a close follower. Personal lines carrier results are also highly correlated with improved loss ratios – likely due to the high level of homogeneity across claims. Commercial lines and specialty carriers lag behind the leaders in terms of the technical capabilities they provide.

Correlating capability levels to loss ratio is an inexact science. Loss ratios are affected by underwriting decisions and cat losses as well as claims capabilities. But it is clear is that regardless of the sector, size of carrier, or age of claims admin system, leading capabilities in areas such as workflow, document creation, utilization of software to support investigations, and multiple channels for FNOL all are associated with lower loss ratios – and significantly so for some sectors.

Read a free preview of the report at www.novarica.com/novarica-claims-capability-maturity-model-benchmark-finds-wide-variations-in-claims-processes/

Share

Think Big, Act Small

Martina Conlon

I was speaking with a client yesterday about the technology they have rolled out in the past 2 years. It is a small insurance organization that has delivered a great deal of functionality in a very short time – a new policy system for several lines of business, agent portal with new business, policy change, online document delivery and mobile support, and coming soon, a new data warehouse environment. All of this on a low 7-figure IT budget and a handful of IT resources – and they now supporting and enhancing their technology themselves. Impressive, but not completely unique for small companies.

There’s also the small multiline regional insurer that has delivered better technology in 5 years than many mid-size companies, with modern core systems, agent and consumer portals – and the small workers comp insurer with a trove of robust and widely adopted mobile apps and ongoing R&D efforts around new hardware appliances. What these organizations lack in funding, they make up for in agility. All of these companies have smart CIOs with vision. But the small company edge seems to be the intimacy of the executive teams and the resulting transparency and trust. These organizations make decisions rapidly, are pragmatic in their approach, recognize their financial limitations without making them obstacles and just do it. Certainly bigger companies may inherently have more complexity, but we can all take some lessons from these small but highly agile companies – think big, but act small.

Share

New Report: Email Archiving and Compliance

Tom Benton

On the list of important IT projects for insurance CIOs and their IT organizations, you would expect to find Policy Administration Systems, Billing, Claims, Illustrations… but maybe not e-mail.  As Rob and I found out recently, however, e-mail issues are a significant pain point for many life/annuity carriers.

While email has become a necessary mission-critical IT service that may be taken for granted by business stakeholders, few systems are more visible if there is an outage or a need for support during a regulatory or legal inquiry.   With changing regulations and interpretations, as well as new communication channels and technologies such as mobile and social media, CIOs and their organizations must ensure that email is not only reliable and efficient, but also properly archived and effectively managed to meet wide-ranging retention and compliance requirements.

In our new report, Email Archiving and Compliance:  A Checklist for Insurer CIOs, Rob and I present information about issues, best practices and a checklist to consider when evaluating current systems and potential solutions.  The report also includes insights from a survey of seven leading Life/Annuity insurers at various phases of researching and implementing systems.  Among the survey results, over half of the respondents reported moving to or being willing to move to cloud-based components for their next generation solutions.

The report will help IT leaders start the conversation about their email systems situation and begin planning for any necessary changes.  Contact us if you would like to discuss how these issues are affecting your organization.

Share

CIOs Discuss Industry and Operational Issues at Novarica Council Meeting

Matthew Josefowicz

More than 30 insurer CIO members of the Novarica Insurance Technology Research Council gathered at the Omni Providence yesterday to discuss industry and organizational strategic issues.

 

The morning opened with a general discussion of technology trends shaping the industry and how insurer CIOs are helping to position their companies to compete in this new environment. Major topics of discussion include evolving channel preferences and customer expectations, as well as the increased use of third-party data in underwriting, and the “shift to the left” of risk selection from underwriting to marketing. Members also discussed the importance of aligning market segment, product offering, and channel strategy, and the necessity of flexible and agile systems to support new developments.

Despite these challenges, IT spending and staffing levels continue to fall within historical norms. Members discussed the findings of recent Council studies on Budgets and Projects for 2013 and Quick IT Benchmarks.

In this challenging environment, optimizing business/IT partnership is more important than ever, and was the next focus of discussion. Members talked about the challenges of driving organizational innovation from within IT, especially in the face of complacency from some business leaders. Some members pointed out the high general correlation of senior business leaders’ age and interest in driving change through IT.

Another key topic of discussion was big data and analytics. Most of the participants agreed that while true “big data” (unprecedented volume, velocity, and variety of data) has yet to impact most insurers, the “big data” hype has re-focused attention on the value of data and analytics in general.

Members are increasing their use of third-party data for pre-fill and speeding the underwriting process by reducing manual data collection.

Members also noted that vended core systems are starting to include more analytical capabilities in traditional transactional and record keeping systems like policy administration systems and claims.

Core systems replacements were another hot topic of conversation, as nearly every member attending had recent completed, was currently planning, or was in the middle of a major core systems replacement project. Members noted the increased need for speed in phasing component-by-component replacement projects and the more limited life-expectancy of modern systems given the accelerated rate of change in both IT and insurance. Members also discussed best practices in managing vendors, and the importance of monitoring configurable systems with the same discipline traditionally applied to code-and-test systems.

Afternoon breakout sections included active discussion of cat-modeling and impact of changing weather patterns on underwriting, as well as discussions of the impact of changing financial and health care regulations.

Our next Council event is the presentation of the 2013 Impact Awards in NYC on August 21. We look forward to seeing our members there as well!

Share

Importance of Communication on Core System Replacement Projects

Tom Benton

In my recent discussions with various insurance IT leaders, communication issues are becoming a common thread in lessons learned during core system replacement projects.  This reminded me of a Harvard Business Review blog post I read recently.  The post suggests that communication is an issue that has been of concern for a long time.

The author (Scott Edinger, founder of Edinger Consulting Group) presents three critical elements of communication first proposed by Aristotle, the Greek philosopher who studied under Plato and was teacher to Alexander the Great, a leader who undoubtedly dealt with communication issues on his projects.  The three elements of ethos (credibility), pathos (emotional connection) and logos (reason, or logic) are all important to communicating your message effectively as a leader.  Your team needs to believe what you are saying, connect with it and understand how you came to your conclusions.  The post notes that while all three elements are needed to communicate  effectively, leaders can become better communicators by improving in any of the three.

From my discussions on core system replacement projects, IT leaders believe that improvement in communication will increase the likelihood of success on these projects.  As one Novarica IT Research Council member noted, project leaders need to communicate “early and often” for project teams to successfully meet the challenges of these large, high risk projects.

Share

New Briefs: Avoiding Over-Customization, Negotiating Software, and Guide for Business Execs

Matthew Josefowicz

We’ve published two new briefs on best practices for insurer CIOs and their teams, and one for CIOs to share with their business peers:

Rob McIsaac and Sarah Bogan have provided a checklist for avoiding the perils of over-customization in policy administration systems projects by focusing on driving adoption of new practices rather than adapting new systems to old practices.

Karlyn Carnahan outlines best practices in negotiating enterprise software terms and conditions with detailed guidelines on things to watch out for.

I’ve written a guide for business executives on maximizing the value of their IT investments, highlighting 9 key steps to take to run, grow, and transform your organization more effectively.

Maximum IT Value

Several of our CIO clients have already shared this one from their seats at the top table and found it to be effective.

Share

ACORD/LOMA Forum 2013: Novarica on Growth, Modernization, and IT Impact

Matthew Josefowicz

Chad, Karlyn, and I will be speaking at a number of this year’s ACORD/LOMA Forum, on topics ranging from modernizing your distribution channels to preparing insurers for new technologies and business strategies in 2014. If you’re planning to attend ACORD/LOMA this year, please let us know.

Our sessions are:


Tuesday, May 7

  • 2:15-3:30 PM. Creating Market Expansion Capabilities: Capitalizing on New Growth Opportunities (Karlyn Carnahan)

There has never been a better time for insurers to develop a strategy for capitalizing on new growth opportunities. The marketplace abounds with opportunities for carriers to offer critical products and services to commercial and private businesses. This panel discussion will cover how to get started on setting up your business for successful expansion, outline the benefits of industry partnerships and provide a comprehensive overview of the technology available to successfully expand your business to serve the markets you want to serve.

  • 2:15 PM – 3:30 PM e-Signatures: Implementers Discuss Their Experiences and the Benefits of Adoption (Rob McIsaac)
Rob McIsaac participates in a panel with Genworth, ESRA, and Warwick on e-Signatures benefits and challenges.

 

Wednesday, May 8

  • 8:30-9:30 AM. Evolving Your Distribution Channels: Modernization That Matters (Karlyn Carnahan)

Insurance isn’t purchased the way it was a decade ago. Unfortunately, insurers have maintained static distribution channels with little potential for significant growth. So, how can insurance distribution channels change with the times? For insurers, the evolution of distribution channels is modernization that matters. Attend this session to learn how automation can help distribution channels roll with the punches and improve producer management at the same time.


  • 10:00-11:15 AM. Analyst Panel: What is New in 2013 and What Should We Expect in 2014? (Matthew Josefowicz)

While many new technologies and business strategies are discussed during the event, is anything really new that is changing the industry? This panel will present point of views from the analysts on what is new this year and how much change is really happening within the industry. Panelists will discuss the major industry changes of 2013, whether insurers are really innovating, and what we can expect in 2014.

  • 1:15-2:15 PM. Core Policy Transformation: Real-World Insurer Stories (Chad Hersh)

This interactive session brings together technology, consulting and data conversion industry experts to discuss the different strategies insurers are taking to fundamentally improve their business. Hear real-world stories of insurance transformation from the teams that are executing on these projects. Topics will include understanding the compelling business reasons to transform, including product agility, excellent customer service, and reduced cost; and how business context impacts transformation strategy and business value of modern application architecture in a changing insurance value chain.

  • 2:30-3:30 PM. IT Initiatives That Deliver Business Impact (Matthew Josefowicz)

This panel of insurers presents case studies of real-life IT projects that delivered business impact by adopting new practices, delivering quick hit new capabilities, expanding the capabilities of existing systems, or transforming entire platforms. Learn how these insurance IT leaders worked with their business partners, overcame challenges, and delivered real business impact.

Share

February New Research Round-Up: Mobile, CIO Best Practices, ACE Rankings

  • Mobile in Insurance Beyond Personal Lines: Current Trend and Expectations. Mobile has spread far beyond personal lines, with significant growth projected for this year and beyond for policyholder and agent/broker capabilities across the industry. Based on a survey of 75+ CIOs.
  • Bring Your Own Device (BYOD) in Insurance. BYOD is growing in insurance, but large and midsize insurers are taking different approaches. Based on a survey of 75+ CIOs.
  • Moving Into Mobile. 3-page interview with Novarica partner Chad Hersh from this month’s Best’s Review on mobile trends in insurance. Clients and non-clients may download the full article for free.
  • Contract Development Planning Checklist. The latest in our CIO best practices checklist series.
  • Novarica ACE (Average Customer Experience) Rankings of 37 insurance software solutions, including solutions from Agencyport, Cincom, ECCA, FirstBest, Guidwire, Hyland Software, Innovation Group, Insuresoft, Intuitive Web Solutions, iPartners, Maximum Processing, MULTICO, Napersoft, NxTech, Oceanwide, OneShield, Optical Image Tech, Perceptive Software, Silanis, StoneRiver, SunGard, Thunderhead, Vertex, and Vertafore.
Share