The ACPR has carried out a survey on the outsourcing of insurance activities by insurers. The survey was carried out in preparation for the entry into force of the Digital Operational Resilience Act (DORA) regulation 2022/2554, scheduled for 17 January 2025. This regulation comprises four pillars: governance and management of IT risks, reporting of major technology-related incidents, IT operational resilience testing and third-party risk management. Insurers (companies, mutuals, provident institutions) mainly outsource management (contracts or claims), part of their information systems and asset management. The less outsourced functions are logically the core business of risk carriers, actuarial services, audit and compliance. The ACPR emphasises the regulatory compliance of its operations (agreements, documentation of risk studies, regulatory reporting on outsourcing, comitology, etc.). However, beyond compliance, the real challenge is to make it work, and work well. The first difficulty is that the relationship between risk owners and their external service providers is a contractual one, with “black box” obligations. This type of relationship makes it impossible to go into detail. However, as soon as there are discrepancies or difficulties, in-depth investigation is necessary and it is much more difficult to do this with external service providers. Secondly, outsourcing is by definition carried out with external service providers who do not have the same way of thinking as risk managers, nor the same objectives. It will be more difficult for the risk carrier to make the necessary adjustments to changes in the business with a service provider who is more interested in maintaining the status quo in order to minimise costs. That’s why Smalltox, as an outsourcing specialist, prefers the partnership approach to a simple service relationship. Our principle is: ‘Your problem is my problem and my problem is your problem’. So the common objective is for everything to go well for everyone, and everyone makes every effort to achieve this, ‘whatever it takes’. Another extremely important aspect of what we do is that we guarantee :
- To the actuaries of our insurance partners :
- That their rate algorithms will always be respected for the millions of rates made every day for quotes, contracts, amendments, renewals.
- Full transparency in distribution and management reports.
- To the accountants of our management partners, that it will be just to the nearest cent and easily and quickly reconcilable every month with the bank.
We are therefore trying to solve the ‘black box’ problem by giving all the necessary details beforehand so that the program becomes a ‘white box’.
