7.5.5. Operational risk

Operational risk is the possibility of suffering loss resulting from improper or erroneous internal processes, human activities, system failures or external events.

Operational risk management has the purpose of optimizing the level of operational risk and operating efficiency in the PZU Group’s operations, leading to a reduction of losses and costs arising from such risks and ensuring adequate and effective control mechanisms. Information on operational risk levels is regularly reported to relevant internal authorities.

Operational risk is identified in particular by:

• accumulation and analysis of information on operational risk incidents and the reasons for their occurrence;
• self-assessment of operational risk;
• scenario analysis.

Operational risk is assessed and measured by:

• calculating the effects of the occurrence of operational risk incidents;
• estimating the effects of possible occurrence of operational risk incidents.

Monitoring and control of operational risk is performed mainly through an established system of operational risk indicators and limits enabling assessment of changes in the level of operational risk over time and assessment of factors that affect the level of this risk in the business.

Reporting involves communicating the level of operational risk, the effects of monitoring and control to various decision-making levels. The frequency of each report and the scope of information provided therein are tailored to the information needs at each decision-making level.

Management actions involving reactions to any identified and assessed operational risks involve, in particular:

• taking actions aimed at minimizing risks, for instance by strengthening the internal control system;
• risk transfer – in particular, by entering into insurance agreements;
• risk avoidance by refraining from undertaking or withdrawing from a particular type of business in cases where too high a level of operational risk is ascertained and where the costs involved in risk mitigation are unreasonable;
• risk acceptance – approval of consequences of a possible realization of operational risk unless they threaten to exceed the operational risk tolerance level.

Business continuity plans were implemented by PZU. Actions securing correct operation of the processes included in the Plan in the event of emergency have been tested.

The activities undertaken by the PZU Group in response to the COVID-19 pandemic are coordinated by the Crisis Management Team comprised of representatives of the Management Boards of PZU and PZU Życie since 25 February 2020. Its main assignment is to ensure business continuity while applying the strictest security measures and regulatory restrictions. Some of the decisions made by the Crisis Management Team are communicated in the form of recommendations to the PZU Group subsidiaries. As a result, despite the challenging situation, there were no disruptions in any PZU Group companies associated with the continuity of operations or the provision of services.

The Crisis Management Team has decision-making powers in two key aspects: organizational/legal and technical. In the exercise of its powers in the former area, procedures were adopted to enable remote work, necessary amendments were also made to the business continuity procedures. In parallel, new regulations were devised to manage the risk of infection. The sales, contract administration and claims handling processes were adapted to ensure business continuity and, at the same time, safe customer service. Actions taken in the technological area involved the expansion of IT devices to increase the capacity of VPN connections and the purchase of tools enabling remote work and ensure the taking of proper disinfecting and protective measures.

In 2021, the Crisis Management Team continued the adopted strategy, adapting it to the changing circumstances of the pandemic while delegating some of the processes forming part of ongoing operations