Tata AIG General Insurance’s business continuity planning strategies

With more than 13,00,000 customers to service, natural disasters or terrorist attacks are the last things that should hamper your organization’s operations. This realization led Indian BFSI player Tata AIG general insurance company (Tata AIG GIC) limited to revisit its business continuity plan after the Mumbai deluge in 2005. “A customer should be able to lodge his claim — whether he is admitted in the hospital or during an emergency on-board a flight. It’s essential to process claims in time, and ensure employee safety,” says Ashish Dange, the business continuity officer at Tata AIG GIC.

Even though  Tata AIG GIC had a business continuity plan since 2003, its revisit became critical — Tata AIG began a full-scale business continuity planning exercise. This led to a revamp of the existing business continuity and disaster recovery (DR) policy in 2007. As a result, Tata AIG GIC became one of the few Indian insurance players to establish a business continuity management system.

Tata AIG GIC set up an incident management system, headed by its business continuity planning (BCP) team. Today, the company’s BCP team is in charge of incident management. It works in coordination with disaster assessment, executive management, and systems recovery teams. Depending upon an incident’s severity, the company invokes its disaster management team, executive management team, and business continuity plan.

Leveraging stake holder and senior management involvement

For any business continuity planning initiative’s success, involvement of stakeholders and the senior management is vital. At Tata AIG GIC, the annual business continuity plan manual’s review is undertaken by the executive management team.

Key stakeholders in  Tata AIG GIC’s business continuity plan comprises of profit centers (commercial and retail department for different lines of business — marine, accident & health, travel, auto, rural and casualty) and support functions (IT, operations, claims, human resources, pay roll, finance and accounts)

Tata AIG GIC’s business compliance planning (BCP) manual contains the objective, structure and scope of the organization’s BCP. It discusses disaster recovery processes, and explains the turnover of incidents (varying from 30 minutes to two hours). Various command center locations and functions are detailed in the BCP manual. It includes a brief description of the management functions and an impact analysis of  Tata AIG GIC’s business continuity plan. The latest BCP manual was published in June 2010.

As part of the business continuity plan, the nearest branch acts as a backup for every branch. Lost data (timeframe of 24 hours) can be reentered. Tata AIG GIC has outsourced document retention, as it’s critical to the business continuity plan.

Emphasis on communication

Tata AIG GIC believes that communication is the most critical BCP aspect. “During an incident, users can dial a 24x7 toll free number to the call center team — trained to handle any situation. Depending upon incident severity, the disaster management or the executive management team is contacted,” says Dange.

The company provides employees and international visitors with emergency wallet cards. These hold contact information regarding the help center, the managing director, and other important executives. Placing stress on organization-wide communication and its partners,  Tata AIG GIC has set up an Air2Web solution to trigger SMS alerts during disasters. It sends regular alerts to employees, agents and producers, which eliminates call tree system-related issues.

Tata AIG GIC conducts a BCP program during its induction program. This helps employees understand the importance of staff, partner and customer data safety. A basic cross functional system across locations helps customers at all times.

After communication, the BCP plan’s management is critical. Regular table-top exercises, component testing, full-scale annual testing, fire drills and evacuations are carried out. Test reports are published for all the key stake holders.

Exploring the DR setup

Initially, Tata AIG GIC’s DR site was based in Pune.  “During the 26/7 floods, the data center at our Mumbai office faced power issues. It ran for a couple of hours on the UPS, and then on diesel generators,” says Dange. Later, the team invoked its Pune-based DR site.

Due to the realization that climatic or political instability in Mumbai bear a direct impact on Pune, the DR site was relocated to Chennai in 2008. Tata AIG GIC’s current business continuity plan for disaster recovery can be classified into:

• Disaster recovery site (IT) for Mumbai-based Tier 3 certified data center, is an in-house DR facility at Mphasis in Chennai. In case of a failure at the core main frame application (S3) level which integrates with various applications, the Chennai DR site is invoked.

• Central processing (Non-voice) DR site is in Bangalore – In an incident if the processes have to be carried out or policies have to be issued, it will be performed through the Bangalore office.

• Call center backup (Voice) DR site is the Mumbai branch office – Issues faced by the call center hampering customer service can be sorted through the Mumbai branch office.

Backup power systems are available at the primary data center, as well as at the DR site. Two network lines from MTNL and Tata ensure connectivity.

Tata AIG GIC’s DR plan specifies recovery time objectives varying from two hours to five days, depending on process criticality. Since data replication is an EOD activity, the company has a specified recovery point objective (RPO) of 24 hours.  At the end of the day, data gets replicated to the DR systems, which are set up identical to the Mumbai-based data center. Critical applications requiring minimal RPOs use online replication. Non-critical applications (with longer RPO) are replicated offline.

The organization conducts routine DR testing, in which the Mumbai data center’s servers are shut down. All key locations then invoke the Chennai-based DR site.

A successful track record

Tata AIG GIC has skillfully handled incidents. “During the Mumbai terrorist attacks in 2008, a bomb hoax in our company’s Ahura building led to the evacuation of employees to another office. The command center was activated, claims invoked through Delhi, and policies routed through Bangalore,” Dange says.

Dange says that efforts are on to ensure satisfactory business continuity levels among vendors. It’s critical that printing partners, courier companies, IT setup, call centers and third-party administrators have adequate business continuity levels in place to support Tata AIG GIC.