Picture a severe storm sweeping across a province. Claims volumes climb within hours. The outsourced claims administrator cannot reach its operating location. Its technology provider then suffers an outage, and the claims records become unavailable. Each of these risks sits in a register somewhere. On the day of the storm they converge on a single service: paying customers when they need help most.

An insurer can have sound cybersecurity controls, documented policies and regular risk assessments, and still face serious disruption when a critical supplier fails. The consequences reach well beyond IT. Claims are delayed, premium collections stop and customer information may be exposed. A supplier incident quickly becomes the insurer’s own operational, financial and reputational problem.

KPMG’s "South African Insurance Industry Survey 2026" offers a useful backdrop. It examines how technological progress, risk management and accountability relate to one another. Its introduction asks insurers what they are trying to achieve, what risks they create along the way and where human judgement must remain present. The lesson from its cybersecurity and risk observations is that controls are essential, but resilience depends on continuous adaptation.

Joint Standard 2 of 2024, issued by the Financial Sector Conduct Authority and the Prudential Authority, sets out cybersecurity and cyber resilience requirements. Meeting them gives insurers a strong foundation. It does not remove the need to respond to changing threats and vulnerabilities.

The strategic point is broader. AI, cyber threats, climate change, geopolitical uncertainty and third-party dependencies can interact and amplify one another. Understanding those connections can change decisions about outsourcing, investment, supplier selection and business continuity. The seven practices below offer practical guidance for applying these insights to third-party risk management.

1. Start with the business services you need to protect

Begin with services such as claims settlement, premium collection, policy administration and customer support. For each one, identify the suppliers, systems, data and people it depends on. Include important subcontractors where you have visibility.

Then ask a simple question. If this supplier became unavailable, what would stop, who would be affected and how quickly would the impact become unacceptable? This moves the conversation away from maintaining a supplier list and towards understanding business exposure. It also reveals suppliers whose importance is far greater than their contract value suggests.

2. Translate supplier risk into business consequences

A risk rating means more once decision-makers understand what it implies for the insurer. For each critical dependency, assess what disruption would cause. Think about delayed claims, missed collections, extra operating costs, customer harm and recovery backlogs. Consider how long the service can be interrupted, how much data loss is tolerable and whether a practical workaround exists.

Where precise estimates are not available, use ranges and document your assumptions. The result helps management see where stronger controls, alternative arrangements or additional investment would make the greatest difference.

3. Make dependency risk part of business approvals

Bring third-party risk into the decision before the insurer commits to a new supplier, product, outsourcing arrangement or technology platform. Revisit it when contracts renew or when a supplier’s role expands. A proposal should set out the commercial benefit alongside the dependency it creates, the exposure that remains after mitigation and the cost of maintaining continuity.

Consolidating services with one provider is a good example. It may reduce cost and simplify administration. It also changes the impact of a single supplier failure, and management should understand by how much. Risk information should shape the decision itself, including any conditions attached to approval.

4. Look for risks shared across suppliers

Assessing suppliers one at a time can hide common points of failure. Two providers that look independent may rely on the same cloud platform, telecommunications network, subcontractor or geographic location. Review these shared dependencies across each critical business service. Where information is missing, record the uncertainty and factor it into contingency planning.

This tells management whether supplier diversification delivers real resilience. It also shows whether a proposed alternative could fail for the same reason as the original.

5. Test the response with the people who would deliver it

Run focused tabletop exercises built on realistic scenarios. A claims administrator becoming unavailable is one. A supplier breach affecting customer records is another. Involve the relevant business owners along with IT, risk, compliance and customer communications teams. Include suppliers where practical.

Use the exercise to test who makes decisions, how incidents are escalated, whether essential data stays accessible and whether manual workarounds can handle expected volumes. Look at both the initial interruption and the backlog once service resumes. If a supplier cannot take part, test the insurer’s own response and record your assumptions about the supplier’s recovery. Then turn the findings into actions with owners, deadlines and evidence of completion.

6. Monitor changes that could alter a decision

Periodic assessments give a point-in-time view. Strategic oversight also needs signals that a dependency is becoming more fragile. These include recurring service failures, deteriorating financial health, overdue remediation, changes in subcontractors, unsuccessful continuity tests and incidents affecting shared infrastructure.

Agree in advance which changes require escalation, additional safeguards or a fresh look at the relationship. Monitoring then becomes a trigger for timely action. It stops being another report that no one acts on.

7. Give executives decisions to make

Executive reporting should connect supplier exposure to business priorities and show where intervention is needed. A useful report explains which services are most exposed, what has changed, whether recovery arrangements have been tested and which decisions need approval.

Compare two statements. “Three supplier assessments remain outstanding” describes an activity. “Our claims service depends on a provider whose recovery capability remains unverified, and management must decide whether to fund an alternative processing arrangement” describes a business decision. An accountable business owner should hold responsibility for each critical dependency, supported by risk, IT, procurement and compliance.

Where to begin

Insurers do not need to tackle everything at once. Choose one important service and its most critical suppliers. Map the dependencies, assess the consequences of failure, test the response and take the resulting decisions to management.

That creates a practical foundation for building third-party risk into strategy. Over time, the measure of success is whether the insurer makes better-informed commitments, directs investment where it matters and remains able to serve customers when a supplier fails.