arclogics_fourquickwins

8/9/2019 ARCLogics_FourQuickWins

1/8

FourQuick Wins in Reducing Compliance Risks inInsurance Policies and Procedures Management

Executive SummaryInsurers today face two sets of very high standards when it comes to effectively managing their policiesand procedures:

External standards: Government regulation is imposing a growing number of mandates, includingan increasing trend toward procedural review as a key component of regulatory examinations.Internal standards: High-level executives voluntarily set various standards in order to protect thecompanys brand and ethical standing.

The typical response is to draftad hoc hundreds and even thousands of policies and procedures, just toget it down on paper and cover all the bases. Yet when these documents are not generated andmaintained systematically, critical stresses arise:

Information overloadWeak accountabilityPoorly written and structured contentInconsistency, overlap, and conictHaphazard communication

These stresses drive up costs, severely limit the total overall effectiveness of a companys risk andcompliance efforts, and can place an insurer at greater risk of noncompliance.

The ideal solution would enable the coherent creation of policies and procedures and their coordinatedcommunication across the enterprise. Without such a system, companies cant effectively informemployees about their responsibilitiesleaving them highly vulnerable to regulatory and ethical lapses.

This document begins by outlining in greater detail the real risks created by fragmented policies andprocedures management. It then presents a simple methodology for evaluating your companys currentstate of policy and procedure management maturity. Finally, it offers a four-point plan that quickly andcost-effectively addresses this critical compliance challenge and reduces risk exposure.


2/8

Four Quick Wins in Reducing Compliance Risks in Insurance Policies and Procedures Management

Five common stress points in policies and procedures management

When policies and procedures documents are allowed to originate anywhere in a company, theorganization is placed under several considerable stresses, each carrying considerable risk:

Stress Point #1: Information overload. Employees are often handed a manual that is hundreds of pageslong and contains every company policy and procedure. However,

Many pages of that manual wont apply to them.The size and scope of such a document makes it very hard for employees to pinpoint anyparticular procedure if and when a question arises.Furthermore, employees are usually asked to sign the last page of the book to indicate theirunderstanding of its entire contentsa highly doubtful occurrence.

Stress Point #2: Weak accountability. If everyone is informed about every single policy and procedure, it

can never be clear who is truly accountable for its implementation. In fact, at many companies, no onefeels personally accountable because everyone believes that others are doing the job.

Stress Point #3: Poorly written, poorly structured, inconsistent content. When different teams withdifferent skills compose policy and procedure documents in their own different ways, uniformity andconsistency of content and style will sufferand sometimes vanish. In some cases, content can becomeoverly complex and difcult to understand, with documents written in an overly technical, legalese stylethat the average employee simply cant understand.

Stress Point #4: Overlapping and conicting documents. Without a well-dened means of managingpolicy and procedure documents, multiple versions can become scattered around the organization as hardcopy, on system folders, and on intranet sites. When a change has to be made, there is no guarantee thatall previous copies will be updatedor even that the most recent version is the one being updated.

Stress Point #5: Haphazard communication. Many insurers address compliance issues with a disorganizedbarrage of emails, memos, intranet sites, and verbal instructions. This overloads and confuses employeesand as a result inhibits action on new management directives.

1 Wolters Kluwer Financial Services


3/8Four Quick Wins in Reducing Compliance Risks

Using a maturity model to evaluate policiesand procedures managementThe regulatory burdens on insurers escalate constantly. Therefore, policies and procedures management isa constant, ongoing process whose effectiveness should be assessed and monitored with an eye towardimprovements over time.

A maturity model provides the framework for setting goals and measuring progress towards those goals.One such maturity model is provided byOCEG Illustrated Series: V. Policies, Procedures and Controls . Itdescribes ve key maturity levels:

With an understanding of the maturity level of its policies and procedures management, an insurer canthen embark on an improvement plan. The plan that follows comprises four quick wins that cansubstantially improve a companys risk and compliance posture in relatively short order. At the sametime, the plan lays the foundation for a broader, enterprise-wide risk and compliance strategy. Such astrategy is vital for any insurer seeking to minimize both exposure and costs in the face of relentlessregulatory demands.

Level 2:Ordered Some policies, procedures and controls are known but their design and operating effectiveness is questionable. Documentation is limited.

Policies and procedures are documented using inconsistent language. Terms are not clearly dened or consistently used.. Some roles, responsibilities and accountability are

understood. A methodology to develop, implement and manage policies and procedures is still absent. Technology to reduce the cost and complexity of management iis applied in an ad hoc manner

Level 3:Managed All key policies, procedures and controls are known, and their design and operating effectiveness is

assessed. Documentation is nearly complete.

Terms are consistency used within compliance silos. However, there are still some cross-functional inconsistencies. Key roles, responsibilities and accountability are understood but cross-functional duplication is commonplace. A methodology to develop, implement and manage policies and procedures is in place within silos. Technology to reduce the cost and complexity of management is in place, but is often duplicated in multiple silos leading to excessive costs.

Level 1:Chaos Existing policies, procedures and controls are in a state of chaos and it is unknowable whether they are designed or operating effectively.

Policies and procedures are passed down through an oral tradition and are prone to confusion and inconsistency. Roles, responsibilities and accountability are not clearly dened or absent. A methodology to develop, implement and manage policies and procedures is absent. Technology to reduce the cost and complexity of management is absent.

Level 4:Integrated Silos are broken down using centralized oversight

and coordination and decentralized management. All key policies, procedures and controls are known, and their design and operating effectiveness is assessed. Documentation is complete. Key roles, responsibilities and accountability are dened without gaps or unnecessary overlap. A common methodology to develop, implement and manage policies and procedures is in platforms are consistently used across the enterprise. Common technology to reduce the cost and complexity of management is in place. Training and support are available.

Level 5:Transparent Policies, procedures and controls are embedded within core business processes and technology and are almost invisible to the workforce. Accountability for policies and procedures is built into job descriptions and performance evaluations. Compliance training is embedded within existing job training. Compliance support is embedded within transaction systems. Compliance considerations are built into general business decisions.

XPLANATIONS by XPLANE 207 XPLANE.com and OCEG


4/8



Quick Win #2: Implement a shared system for policies and procedures

document management.With priorities established, the next step towards improving policies and procedures compliance is thecreation of a shared system where policies and procedures documents are housed and updates areimplemented, monitored, and managed.

Before: Without a shared system, policies and procedures take on an unmanageable life of their own.Underwriting, claims, product development, and licensing departments in different business units maymaintain policies and procedures documents in different formats and use different terminology in differentways. Some documents may be written simply and clearly, while others are arcane, evenincomprehensible to the typical employee.

The problem worsens when employees, executives, insurance regulators, or outside auditors havequestions about company policies or procedures. These individuals have to go on time-consuming andcostly hunting expeditions to nd the answers they need. Even so, they still might not nd all theinformation relevant to their search.

After: A Web-based, shared system for policies and procedures management brings uniformity of location,content, revision, and distribution to all policies and procedures. In addition to creating a common lingsystem for these documents, such a system promotes a unied approach to document structure andterminology for all of an insurers disparate compliance teams. It also places all documents under acommon management systemincluding search functions, version control, and metadata structures.With its functionalities fully optimized and leveraged, a shared system ultimately becomes a resource thatis intuitive, easy to use, and embraced organization-wide.

Immediate tangible benets:

The quality of policies and procedures documents improves.Staff can locate relevant documents in far less time.Inconsistencies in language and formatting are eliminated.Redundancies in policies and procedures are also eliminated.Compliance managers can easily pinpoint gaps in policies and procedures coverage.


6/8

Four Quick Wins in Reducing Compliance Risks in Insurance Policies and Procedures Management

Quick win #3: Link policies and procedures to requirements

and roles, and fully document changes to content.With policies and procedures residing exclusively in a Web-based, shared system, compliance managerscan leverage system functionality to associate or link them with:

The specic requirements that drive them (i.e. regulatory mandates or corporate goals)The specic organizational roles to which they apply (i.e. business unit managers)

A shared system will also automatically track revisions as they are assigned and executed.

Before: When compliance managers do not intentionally and clearly document the relationships of regulatory requirements to policies and proceduresas well as assignments in the organization for theirproper implementationmisunderstandings by those involved in each mandate inevitably result. Multiplemanagers can create conicting and/or redundant procedures as they each pursue fulllment of policies.

Beyond conict and redundancy, this reliance on individual managers personal knowledge over detaileddocumentation costs an insurer critical insight if and when those managers leave. As a further risk, suchdependence makes any sort of policies and procedures auditing activities virtually impossible toaccomplish.

After: Appropriate assignment of policies by business unit, line of business, or other organizationalhierarchy methods enables managers to:

Logically link procedures to the policies they supportLink regulatory requirements to the contentLink policies and procedures to organizational units

Effectively distribute targeted, relevant content to the exact audience responsible for and in needof compliance guidance.Additionally, implementation of automatic tracking of changes keeps an ongoing record of who editedwhich policy when, and provides an on-demand audit trail.


Staff requires far less time to nd relevant documents.Procedures become more understandable to those who have to follow them.Compliance success is not compromised by the loss of key personnel.Insurers can readily provide evidence of updates to policies and procedures tokey stakeholders, including regulators.

5 Wolters Kluwer Financial Services



Quick Win #4: Improve attestation

When an insurer manages policies and procedures through a shared system, that organization is well-positioned to request that employees conrm or attest that they have received the necessary documents,understand the policies, and will follow the procedures.

Before: Most insurers perform attestation manually. They rst distribute hard copy and/or electronicdocuments on an ad hoc basis. They then try to keep track of sign-offs in a variety of spreadsheetsscattered across the company.

The attestation challenge multiplies if multiple policies and procedures are lumped into a single largedocument. In such cases, employees must sign to indicate their understanding of theentire documentrather than the specic area thats actually relevant to them.

Complicating the matter further still are third parties, such as suppliers and contractors, who may beaffected by certain policies. It can be particularly difcult to get documents to and receive attestationsfrom these entities. Recipients may also get confused by the inconsistent formats that differentcompliance teams usetoo confused to attest to their understanding of relevant procedures.

After: Leveraging attestation tracking through a shared system will streamline compliance-related tasksconsiderably. Such a system gives compliance managers a window to easily see who has not provided aresponse, and follow up with those individuals. An ideal shared system would provide employees and thirdparties with only those policies and procedures that affect them.


It takes far less time to distribute materials and collect attestations.Confusion arising from inconsistent formats and irrelevant content is eliminated.Third parties are more seamlessly integrated into compliance processes.Compliance staff and upper management gain greater visibility on compliance activities thanks toimproved reporting.

An insurers top policies and procedures challenge may be achieving a consistent model for compliantclaims practices, protecting the privacy of customer data, or any other concern. The four quick winprinciples we have outlined will enable compliance managers to meet pressing project deadlines and staywithin budget, while leading their organizations forward along the policies and procedures maturity scale.


8/8

To learn more visitInsurance.WoltersKluwerFS.com/ARCLogi

ARC Logics for Financial Services fromWolters Kluwer Financial ServicesThis revolutionary solution combines the proven technology of ARC Logics, a Wolters Kluwer business, with industry content,regulatory content, and the expertise of Wolters Kluwer Financial Services. ARC Logics for Financial Services enables organizations

to efciently manage compliance risk, operational risk, and audit. ARC Logics is a modular integration of four key risk management components: Policies and Procedures, Risks and Controls,Program Management and Audit. Together, the modules provide a common collaborative platform to monitor, measure, andmanage compliance and operational risk across all business lines and legal entities. With ARC Logics, organizations are able tofulll immediate enterprise risk management objectives in a targeted, cost-effective manner while concurrently building a holistienterprise wide program.

Wolters Kluwer Financial Services provides best-in-class compliance, content, and technology solutionsand services that help nancial organizations manage risk and improve efciency and effectiveness acrosstheir enterprise. The organizations prominent brands include ARC Logics, Bankers Systems, VMPMortgage Solutions, PCi, AppOne, GainsKeeper, Capital Changes, NILS, AuthenticWeb and UniformForms. Wolters Kluwer Financial Services is part of Wolters Kluwer, a market-leading global informationservices company focused on professionals with annual revenues (2009) of 3.4 billion ($4.8 billion),approximately 19,300 employees worldwide and operations in over 40 countries across Europe, NorthAmerica, Asia Pacic, and Latin America.

Wolters Kluwer Financial Services130 Turner Street, Building 3, 4th FloorWaltham, MA 02453Toll-free: 800.481.1522Email: [email protected]

W lt Kl Fi i l S i

arclogics_fourquickwins

Documents