Insutec Helps You Meet FSCA Prudential Standards

About the FSCA's Governance and Operational Standards for Insurers

The Prudential Authority, working alongside the FSCA under the Insurance Act and the Financial Sector Regulation Act, sets Governance and Operational Standards for Insurers (GOI standards) covering governance, risk management, and operational resilience. Insurers are required to maintain operational risk and information security capability proportional to their threats and exposures, to test the effectiveness of their controls, and to notify the Prudential Authority of material incidents in a timely manner.

These standards apply to all licensed insurers and reinsurers operating in South Africa, and extend to the third parties and outsourced service providers that manage information or operational functions on their behalf.

Why insurers take this seriously

• Risk-based and outcomes-focused
  Controls should be proportional to the criticality and sensitivity of the data and systems involved, and to the evolving threat landscape.
• Clear accountability and governance
  Defined roles and responsibilities are expected at board, senior management, and outsourced-provider level, improving oversight of operational risk.
• Assurance through testing
  Regular testing of controls and prompt remediation of gaps is expected, strengthening resilience over time.
• Third-party and outsourcing visibility
  Oversight of service providers who hold or access policyholder and claims data is required, extending accountability across your whole operating model.

How Insutec helps you meet these standards

Insutec helps you establish and evidence the controls these standards expect: visibility into where sensitive data lives, who can access it, how it is used, and whether your controls are actually working. It also supports timely incident detection and response, and simplifies putting together the evidence pack for an FSCA or Prudential Authority review.

Insutec supports:

• Discovery and classification of policyholder and claims data for proportional controls
• Access governance and least privilege across claims, policy, and reserving data
• Full auditability of administrator and privileged user activity
• Continuous monitoring, alerting, and incident investigation
• Configuration integrity and change control for critical systems
• Evidence and reporting for internal assurance and regulatory engagement