Obsolescence Risk Management for a major Insurance Firm

Obsolescence is increasingly becoming a concern for organisations across all sectors, representing a risk across multiple spheres within the Operational Resilience Framework (i.e., Information Security, Business Disruption and Regulatory).

Our client, an insurance and reinsurance provider, turned its focus to this issue in 2020 but lacked visibility and understanding of obsolescence in terms of the threat it posed to the business.

Since May 2021, Wavestone has provided support to our client in managing obsolescence risk; initially with the production of an industrialised reporting tool that facilitated the prioritisation of mitigation activity to address obsolescence followed by a discovery exercise and a maturity assessment which highlighted that they did not have a ‘holistic’ approach for managing obsolescence risk.

The report findings provided a view of their level of maturity against best-practice risk management processes and laid the foundations to invest in addressing risk and managing all risk themes – not only risk filtered through the Information Security lens.

Wavestone is continuing our support by developing a strategy for managing obsolescence risk and anchoring it to within the current operational risk framework, improving data quality, tooling capability, embedding KRIs and establishing an obsolescence risk culture.

The client thus took the strategic decision to fully insource the SOC whilst improve its effectiveness by implementing a follow-the-sun model, virtual one-team mentality, improving the accuracy of use cases and leveraging automation to enable the teams to focus on value-adding tasks.  

Wavestone gained strong credibility early on through the development of the dashboard, and through subsequent engagements have built strong relationships with the diverse, global client team (UK and US stakeholders) at all levels, including the CIO and COO. This resulted in fantastic feedback and a desire for longer-term collaboration in addressing obsolescence risk (and beyond).

The obsolescence risk dashboard has been used internally by the senior client management teams to help them understand where they need to target management focus and remediation budgeting. The direct outputs of which have helped our client to prioritise – across multiple departments – their remediation works and allocate their multi-million-dollar budget for 2022.

Wavestone’s practical recommendations on improving the client’s tool for identifying and mitigating risks through easy categorisation of Obsolescence incidents was proven beneficial in establishing appropriate governance around Obsolescence management. Moreover, Wavestone’s recommendations on a common alignment of all the divisions within the organisation around application criticality facilitated a centralised view of Obsolescence.

The project has generated a sharp uptake in awareness of obsolescence risk across the organisation. At both operational and leadership levels, there is a high level of buy-in and willingness to take collective action. This strong obsolescence risk culture is crucial to ensure changes are made in the way obsolescence is defined, monitored, protected against and governed by, which will yield maximum long-term benefits for our client.

Our client has also benefitted from greater fluency in the structure of their IT estate, as well as understanding the challenges relating to the maintenance and integrity of data. More specifically, Wavestone provided the client with a full end-to-end mapping of data to correlate applications and infrastructure to Obsolescence risk and its impact across the organisation. This action resulted in improved visibility and understanding of the true risk and impact associated with Obsolescence across the technology environment.

Moreover, the successful work carried out to address obsolescence risk represents a model for managing all types of technology risk, which is crucial to the competitiveness of the firm.