The carrier had invested in operational resilience before CPS 230 required it. The budget case was difficult: resilience spend is hard to attribute to revenue, and the board approved it on compliance grounds. Then a competitor experienced a material operational disruption. The prepared carrier did not just survive the period without incident. New policyholders arrived. The CFO asked whether the resilience investment should be restated as a growth line.
CPS 230 came into force on 1 July 2025. Operational resilience moved from best-practice to regulatory requirement. For most carriers, this changed the compliance conversation but not the board framing: resilience is still approved as overhead, justified by the regulatory obligation rather than the commercial return.
That framing determines the budget. A compliance overhead is funded at the level needed to satisfy the requirement. An investment with measurable commercial return is funded differently. The carriers who invest in ahead-of-expectation resilience posture are working with a different budget logic - and getting a different result.
Three returns are not captured when resilience is framed as overhead.
The first is customer trust. Insurance is a long-term, trust-dependent relationship. Policyholders who experience uninterrupted service through periods of industry turbulence stay. The carrier who frames resilience as overhead gets the budget that framing implies. The carrier who treats continuity as a customer experience investment gets the retention that continuity delivers.
The second is regulatory goodwill. APRA and RBNZ engage more constructively with carriers who demonstrate ahead-of-expectation posture. The 2022 operational incident at Medibank became a reference point for regulators across the industry - a demonstration of what resilience failure costs and what it prompts. Carriers who have invested before being asked occupy a categorically different regulatory relationship.
The third is switching behaviour. When a competitor experiences operational disruption, the carriers with visible continuity records see inbound enquiry. The resilience investment does not just protect against the carrier's own disruption. It creates a position when disruption happens elsewhere.
The spend does not change. The frame changes. And the frame determines the return.
Resilience communicated to customers is a trust signal. In life and health insurance, where the policyholder relationship spans decades, continuity of service is not a technical detail. It is the product. The carrier who can point to an uninterrupted service record - and to the operational architecture that produces it - is communicating something competitors without that record cannot.
Resilience communicated to regulators is a goodwill asset. APRA's examination process is more constructive for carriers who arrive with documented, tested continuity arrangements. NZ regulatory governance requirements are moving in the same direction. A posture built before being required earns a qualitatively different supervisory relationship.
Resilience communicated to the board as an investment case - with three return dimensions rather than a single compliance obligation - gets funded at a different level.
Each audience requires a different frame.
For customers: service continuity, stated simply. Not system architecture or certification lists. A record of uninterrupted service, communicated through the channels policyholders use. This builds the trust signal that generates retention advantage.
For regulators: operational continuity evidence. Not a policy document. Tested alternative arrangements, documented governance, and a second source who can carry load if the primary arrangement fails. This is the language APRA and RBNZ respond to under the current standard.
For the board: investment return across three dimensions - avoided incident cost (the downside case), regulatory relationship quality (reduced supervisory burden), and switching behaviour advantage (the upside when competitors are disrupted). Framed this way, resilience is a position, not overhead.
ISSI operates as a warm second source on the platforms ANZ carriers already run. Because platform fluency already exists, there is no ramp period before load can be carried. ISO 22301-class business continuity credentials and audit-passed operations provide the architecture that makes a resilience narrative credible to customers, to regulators, and to a board that needs to see the return. If the resilience investment framing is the active conversation, it is worth thirty minutes.
Sources: APRA Quarterly Life Insurance Performance Statistics (2025); APRA Quarterly Insurance Performance Statistics (September 2025); IMARC Group Australia BPO Market Report (2025); APRA CPS 230 Operational Risk Management (effective 1 July 2025)
