The five hidden transmission channels between climate stress and operational-resilience failures. A framework for insurers modelling the intersection.
ClimateOperationalDORASS5/25SS5/25 (PRA) asks the firm to embed climate risk in its risk-management framework and evidence its capability to model physical and transition stress. DORA Article 25 (EU) asks the firm to demonstrate operational resilience against severe-but-plausible scenarios with explicit attention to ICT third-party risk. Read narrowly, these are two different tasks. Read for substance, they ask the firm to show the same thing — that under stress, the operations continue. Insurers staff these demands separately. That's where transmission channels live.
The supplier the firm depends on for claims handling, policy administration, document storage or specialist underwriting support sits somewhere geographically. So does that supplier's own supplier. A flood in a third-party operations hub is climate stress at the supplier and operational-resilience failure at the insurer in the same instant.
The cloud and colocation infrastructure on which the modern insurer's policy systems, claims platforms and broker portals depend has thermal limits. UK and continental-European heatwaves of 2022/2023 magnitude caused thermal events in named hyperscale providers; insurance industry exposure to those providers grew through the same period. Climate physical risk transmits to ICT availability, which transmits to claim-settlement capacity in the same week as the event that generated the claims.
The pandemic taught that workforce continuity isn't headcount. Climate stress raises the same problem in a different form. A flood that closes a major operating centre, a heatwave that constrains attendance at non-air-conditioned sites, an air-quality event that limits specialist underwriting hubs — each transmits climate physical exposure into operational continuity. Pandemic-era continuity infrastructure addressed network access; it generally didn't address coincident loss of housing or transport.
The shift to specialist outsourced services — claims TPAs, actuarial platforms, broker portal providers, KYC providers — has concentrated significant industry-wide operational dependency in a small number of vendor sites. The firm's individual concentration on a single TPA may be modest; the industry's concentration on the underlying provider may be large. When climate stress strikes the underlying site, the insurer experiences operational stress its own concentration framework didn't see.
The most often missed. A material climate event triggers parallel supervisory action across multiple regimes — SS5/25 capability follow-up, DORA scenario test review, ISSB disclosure verification, and for cross-border firms a similar set from EU or US supervisors. The firm receives them in the same quarter. Each demands evidence; each requires the same scarce risk-team capacity. The aggregate burden is operational, even though no individual letter is.
Ask the CRO and the COO, separately, to identify the firm's three largest climate-driven operational-resilience exposures. If the lists do not substantially overlap, the firm has the visibility problem this paper describes.
Full paper covers each channel in depth with practical tests insurers can run this quarter, and three engagement routes for the climate-to-operational intersection.