Insurers monitoring compliance with new operational risk management rules should ensure artificial intelligence and climate change exposures are not overlooked, Clyde & Co consultant Dean Carrigan says.

The Australian Prudential Regulation Authority standard CPS 230, which started on July 1, covers areas including technology and third-party service providers.

Mr Carrigan says although there is no express reference to AI, the document implies any material third-party AI service provider arrangements, particularly when used in underwriting and claims processes, should be considered.  

“There’s been a lot said and written about the rise of AI and one of the interesting and challenging issues is how the expansion of operations by insurers using and dependent on AI fits into the piece,” he told insuranceNEWS.com.au. “I think that’s an important consideration that must not be overlooked.”

Mr Carrigan says change management and climate responses in underwriting, resilience, targets and reporting, also not explicitly referenced, need to be considered too.

The detailed standard is the culmination of an escalating APRA focus on operational risk management oversight and resilience, he says.  

“It’s a bit of a departure from what was historically APRA’s stated position in relation to principles-based regulation – it’s a series of declarations about what regulated entities must do.

“I think that’s understandable and also necessary, given the increased complexity of the financial services sector and the development of intermediation and the rise of digital platforms over the course of that period.”

Mr Carrigan says challenges include “how far and how wide” boards must look to be satisfied outsourced arrangements meet service provider requirements.  

“It’s really for the first time a holistic universal statement by APRA of its expectations in relation to how the business is run from go to whoa,” he said. “It goes beyond the customer, broker, underwriting agent and then insurer interface and looks out the other side to the reinsurance piece as well. It is every link in the ecosystem.”

Companies should keep engaging with the process following implementation, he says.

“Boards should be asking questions of senior management and satisfying themselves that the work that needs to be done post introduction of the new standard is actually, as a matter of fact, being done.”