
Ecclesiastical Insurance Office plc
Strategic Report
• A number of security measures are deployed to
Cyber risk remains a constantly evolving threat, with
The risk of criminal or unauthorised use
ensure protected system access
malicious threat attackers continuing to seek to
of electronic information, either
• Security reviews and assessments are
exploit businesses. Employee awareness and
belonging to the Group or its
performed on an ongoing basis
vigilance is therefore highly important at this time,
stakeholders for example customers,
• There is ongoing maintenance and monitoring
which is continuing to be proactively managed.
employees etc. cyber security threats
of our systems and infrastructure in order to
from malicious parties continue to
prevent and detect cyber security attacks
increase in both number and
• There is an ongoing information security
sophistication across all industries.
training and awareness programme
• The Group has a clearly articulated strategic
The level of this risk has not materially changed.
The risk of failing to manage the change
programme, identifying areas of priority across
There continues to be a significant volume of change
needed to transform the business.
the Group
within the business, which is monitored closely,
A number of strategic initiatives are
• Ensures that there is adequate resourcing for
relating to both IT systems and to meet the ever-
underway under three themes, support
change projects using internal and external skills
changing regulatory landscape.
and protect, innovate and grow and
where appropriate
transform and thrive. These include a
• A Change Board and change governance
Appr
opriate strengthening of expertise has
transformation of our core system and
processes are in place and operate on an
continued in the year to reflect and meet this volume
key processes, which will deliver
ongoing basis
of change.
significant change for the company
• The Group Management Board undertakes
over the next few years. There are a
close monitoring and oversight of the delivery of
number of material risks associated
the strategic initiatives and key Group change
with major transformation, not only on
programmes
the risks to project delivery itself, but
the potential disruption to business as
usual, or delays to planned benefits.
• A recovery and resilience framework is in place
Operational resilience continues to have been
The risk that the Group does not
aligned to the delivery of customer services
successfully tested during the year, with the
prevent, respond to, recover and learn
• Recovery exercises including IT systems are
continued need to meet the needs of our customers.
from operational disruptions.
regularly performed across the company with
Focus continues from the prior year on meeting the
The Group provides a wide range of
actions identified addressed within an agreed
enhanced regulatory requirements around
services to a diverse customer base and
timescale
resilience.
has a reputation for delivering excellent
• All suppliers are subject to ongoing due
service. Therefore, we seek to minimise
diligence
the potential for any such disruption
• There is ongoing maintenance and monitoring
that would impact on the service
of our systems and infrastructure in order to
provided to our customers.
prevent and detect issues
Data management and governance
• A Group Data Governance Committee is in place
Enhancements continue to be made to the
The risk that the confidentiality,
• Group data governance and Group data
governance, management, use and control of data, in
integrity and/or availability of data held
management and information security policies
order to meet the evolving requirements. It continues
across the Group is compromised, or
are in place
to be monitored and managed within the context of
data is misused. The Group holds
major change programmes.
• A Group data optimisation programme is in
significant amounts of customer and
place which is responsible for ensuring the
financial data and there could be
delivery of the data strategy and all aspects
significant implications if this is
relating to the governance, management, use
compromised or is found to be
and control of the Group’s data in line with
inaccurate.
regulatory requirements
Regulatory and conduct risk
The risk of regulatory sanction, operational disruption or reputational damage from non-compliance with legal and regulatory requirements or the
risk that Ecclesiastical’s behaviour may result in poor outcomes for the customer.
• Undertakes close monitoring of regulatory
There continues to be a significant volume of
The risk of regulatory sanction,
developments and use dedicated project teams
regulatory change. We remain focused on the
operational disruption or reputational
supported by in-house and external legal
management of regulatory change and therefore the
damage from non-compliance with
experts to ensure appropriate actions to achieve
overall risk level is unchanged.
legal and regulatory requirements. We
compliance
operate in a highly regulated
• An ongoing compliance monitoring programme
environment which is experiencing a
is in place across all our SBUs. Regular reporting
period of significant change.
to the Board of regulatory compliance issues and
key developments is undertaken