7.5.5. Operational risk

Operational risk is the possibility of suffering loss resulting from improper or erroneous internal processes, human activities, system failures or external events. 

Operational risk management has the purpose of optimizing the level of operational risk and operating efficiency in the PZU Group’s operations, leading to a reduction of losses and costs arising from such risks and ensuring adequate and effective control mechanisms. Information on operational risk levels is regularly reported to relevant internal authorities.

Operational risk is identified in particular by:

• accumulation and analysis of information on operational risk incidents and the reasons for their occurrence;
• self-assessment of operational risk;
• scenario analysis.

Operational risk is assessed and measured by:

• calculating the effects of the occurrence of operational risk incidents;
• estimating the effects of possible occurrence of operational risk incidents.

Monitoring and control of operational risk is performed mainly through an established system of operational risk indicators and limits enabling assessment of changes in the level of operational risk over time and assessment of factors that affect the level of this risk in the business.

Reporting involves communicating the level of operational risk, the effects of monitoring and control to various decision-making levels. The frequency of each report and the scope of information provided therein are tailored to the information needs at each decision-making level.

Management actions involving reactions to any identified and assessed operational risks involve, in particular:

• taking actions aimed at minimizing risks, for instance by strengthening the internal control system;
• risk transfer – in particular, by entering into insurance agreements;
• risk avoidance by refraining from undertaking or withdrawing from a particular type of business in cases where too high a level of operational risk is ascertained and where the costs involved in risk mitigation are unreasonable;
• risk acceptance – approval of consequences of a possible realization of operational risk unless they threaten to exceed the operational risk tolerance level.

The Business Continuity Plans that PZU had in place did not provide for an epidemic scenario of the COVID-19 type. After the announcement of a crisis situation in PZU on 25 February 2020, the Crisis Management Team has taken action to supplement the contingency plans, including in respect of transition to and performance of remote work and levels of response in the event of an epidemiological threat at PZU. At the same time, action has been taken to expand, reconfigure and scale up the capacity of the VPN environment as well as make developmental changes in the IT systems while maintaining business continuity and securing the interests of insurance clients.

The sales, contract administration and claims handling processes were adapted to ensure business continuity and, at the same time, safe customer service. 

Despite the crisis situation, there were no major disruptions in any PZU Group companies associated with continuity of operation or client service.