Organization Name Itrustu Insurance

Company Description of Business Itrustu is one of Ontarios largest insurer with a market share of around 70 percent. With a focus on insurance for individuals and small businesses, Itrustu insures:

- One in three households

- One in five motor vehicles

- More than 100 small businesses

Itrustu products are available through a variety of distribution channels including brokers, corporate partners such as banks and building societies, and Itrustu Direct. Itrustu is part of Tiva which is the worlds sixth-largest insurance group. It is one of the leading providers of life and pensions products in Canada and has substantial businesses elsewhere around the world. The main activities are long-term savings, fund management and general insurance. Tiva has over 6,000 employees in Canada. As a result of the regulated environment that Itrustu operates in and the sound business practice of protecting its staff, customers, shareholders and key stakeholders, Itrustu takes business continuity management very seriously.

Risk Management Following are the main risks that Itrustu Insurance plans for mitigating against:

- Cyber threats (hacking, spam or fraud, malware, ransomware, phishing, confidentiality, data or Identity theft and others) - Loss of IT, telephony and/or network communications for longer than one day -Flood that causes denial of access to a building - Loss of power - Snow storm The risk UT has not been anticipating in their Risk Management plan is pandemic Risk Management plan In Pandemic COVID-19 has changed the world and organizations need to upscale with the changing face of the world. Organizations not only needed to provide quick response and increase the availability of resources but should be able to incorporate the new NORMAL into their operations resiliently. The Pandemic has shifted all eyes to RM professionals and all the executives are looking for answers. This the real test of your Risk Management plan and response, do you have your processes automated, integrated work plans, communications and reporting that scale globally? On top of the current COVID-19 pandemic, the threat of a cyber-attack, natural disasters and breaches caused by third-party vendors are still growing. Its not enough to demonstrate you have a plan but to proof that it will work. The role of the Risk Management plan has evolved, and you must evolve with it. As you know , COVID-19 has been reported almost every single country across the globe. Itrustu is trying its best to come up with a comprehensive Risk Management plan and are working hard to develop a crisis leadership team responsible for pandemic plan implementation. The team should have representatives from the executive leadership and from each functional area in the organization including account management, business operations, communications, sales, human resources, marketing and last but not least the IT department.

Template 4: Risk Consequences

Completing the risk record in Template 3 on a risk by risk basis will provide the organization with an overview of the specific events that could have a significant impact on its finances, infrastructure, reputation and marketplace. Completion of this risk consequences template will enable the organization to decide the management actions it intends to take in response to the significant risk events. Template 4 is designed to enable the organization to evaluate the potential consequences for strategy, tactics, operations and compliance for each of the risk events. The table below should be completed on a risk by risk basis to record the results of the risk evaluation for each of the potentially significant risk events. Undertaking the risk evaluation and recording the results in the table below will enable the management of the organization to decide what actions need to be taken in order to make the anticipated consequences of each of the identified risk events tolerable.

Question:

Monitoring of the risk

Details of how the level of risk is monitored, including details of measurements taken of risk performance and/or the leading and following indicators that would result in a change in the level of risk.

Governance of the risk

Confirmation of specific governance arrangements related to the risk and any statutory or mandatory reporting obligations, including consideration of the risk attitude / appetite of the organization and the ability to improve risk control standards.