While a disruption at a large insurer has the  potential to affect a large number of consumers and businesses, the effects  would likely be limited to that insurer’s policyholders and would not spread  to other insurers or the larger insurance sector. For most health insurers, such goals for customer service functions,  including telephone information lines and authorizations necessary to  receive medical services, was 1 day or less. And while a disruption to a  regulator’s operations could delay the provision of these services, almost  all of the insurers we spoke with said that a delay of even 1 or 2 weeks  would likely not have a significant negative effect on insurers or  consumers. Insurers, Most State Regulators, and NAIC Have Taken Actions Designed to Protect and Recover Their Critical Operations

Each of the insurers we spoke with, most of the state insurance regulators  we met with, and NAIC all indicated that they had taken actions designed  to protect their critical operations from disruption and recover them  should a disruption occur. As discussed earlier, most insurers told us they  could recover their most critical operations within a day and most other  operations within 3 days. Insurers Have Implemented Security and Business Continuity Capabilities Designed to Meet Their Own and Their Customers’ Needs

As discussed more fully later in this report, while NAIC examination  guidelines provide some criteria for insurers to use in developing their  information and business continuity capabilities, they do not establish  specific recovery time objectives for insurers’ critical operations. For example, 10 of the 18 insurers we spoke with felt that  their individual company’s need to recover quickly was less than it was for  other financial market organizations. 2). All of the  property/casualty and life insurers we spoke with considered their  investment management functions one of their highest priorities, with all 6  of the life insurers and 6 of the 7 property/casualty insurers telling us they  could restore such operations within 24 hours. Four of the insurers had outsourced part or all of their data  centers’ backup functions, and three had outsourced some portion of their  claims-processing operations. Specifically, all of the state regulators had procedures  in place to back up critical data, most had plans for how they would  operate if their primary facilities were inaccessible, and most had backup  computer systems. Similarly, while state insurance examiners also review  insurers’ business continuity programs, they do so as part of the larger  objective of reviewing internal controls over information systems and do  not require that insurers have minimum capabilities or meet minimum  recovery times. In addition,  while regulators have informal expectations for how soon after a  disruption insurers should be able to recover certain critical operations,  such as claims processing, the examination process does not require  examiners to determine whether insurers can meet these informal  expectations. Finally, although we visited a limited number of state insurance regulators,  and did not observe any specific problems as a result of current  examination guidelines and practices, we recommend that state regulators,  working through NAIC, use their regular review of the adequacy of state  examination guidelines and practices as an opportunity to consider  whether any changes to the following are warranted:  the manner and extent to which current examinations review insurers’  business continuity capabilities, including the placement of business  continuity within the examination guidelines and the minimum recovery  time objectives for certain insurer services; and  current examination guidelines and practices related to the review of  insurers’ outsourcing of critical functions. Specifically, we (1) described the potential  effects of disruptions to the operations of insurers, state regulators, and  National Association of Insurance Commissioners (NAIC); (2) determined  what actions insurers, state regulators, and NAIC have taken to prepare for,  protect against, and recover from business disruptions; and (3) assessed  the extent to which certain current laws and regulations require reviews of  insurers’ efforts in these areas and the extent to which state examinations  include such reviews.
Why GAO Did This Study

The insurance sector is a key part of the U.S. financial sector, particularly following a terrorist attack or other disaster where there has been loss of life and damage to property. To determine the insurance sector's preparedness to protect and recover critical insurance operations, GAO was asked to (1) describe the potential effects of disruptions to the operations of insurers, state insurance regulators, and the National Association of Insurance Commissioners (NAIC); (2) identify actions taken by those organizations to protect and restore their operations; and (3) assess the extent to which regulations require reviews of insurer efforts in these areas.

What GAO Found

Adequate business continuity capabilities are necessary to prevent terrorist attacks or natural disasters from severely disrupting the operations of large insurers and leaving the companies unable to provide important services to policyholders when needed. And while a disruption to a large insurer could potentially affect millions of policyholders, any effects would likely not spread throughout the insurance sector because of limited interdependencies among insurers and, unlike the securities markets, the lack of a single point through which insurance transactions must pass. Further, while state insurance regulators and NAIC provide important services to consumers and insurers, such services are generally not time sensitive and a disruption of 1 or 2 weeks would not have a significant effect. All of the 18 insurers and most of the five state regulators GAO spoke with, as well as NAIC, indicated that they had taken actions designed to protect their operations from disruption and recover critical operations should a disruption occur. For insurers, these actions typically included establishing geographically dispersed backup sites and conducting critical operations at multiple geographically dispersed facilities. Among property/casualty and life insurers, the highest priority was generally to recover investment and cash management functions, while among health insurers it was customer service and claims processing. Most insurers said they could recover their highest priority operations within 1 day, and most other operations within 3 days. While all of the state regulators GAO spoke with had processes in place to back up critical data, one had no backup computer systems, one had no business continuity plans, and one had neither. NAIC has also taken steps to protect critical data and has implemented business continuity capabilities designed to recover critical operations within 24 hours. Current federal and state regulations, as well as NAIC examination guidelines, require insurers to have information security programs and business continuity plans, but do not require minimum recovery times. For example, state insurance examinations review information security and business continuity as part of the larger objective of reviewing insurers' internal controls and insurer solvency, and do not require insurers to meet specific recovery objectives. However, while state regulators stated they had informal expectations that insurers would recover certain critical operations, such as claims processing, within 2 days after a disruption, half of the insurers GAO spoke with had set recovery goals for their claims processing operations that would appear not to meet these expectations. Further, it is not clear whether current examination guidelines and practices adequately address the trend among insurers to outsource certain functions, especially information technology functions. For example, some of the insurers GAO spoke with were outsourcing their computer system backup functions or portions of their claims-processing operations, but only one of the regulators said they had ever conducted audit work at such a service provider.