A Practical Guide to Retiring Insurance Legacy Applications. White Paper

Transcription

1 A Practical Guide to Retiring Insurance Legacy Applications White Paper

2 This document contains Confidential, Proprietary and Trade Secret Information ( Confidential Information ) of Informatica Corporation and may not be copied, distributed, duplicated, or otherwise reproduced in any manner without the prior written consent of Informatica. While every attempt has been made to ensure that the information in this document is accurate and complete, some typographical errors or technical inaccuracies may exist. Informatica does not accept responsibility for any kind of loss resulting from the use of information contained in this document. The information contained in this document is subject to change without notice. The incorporation of the product attributes discussed in these materials into any release or upgrade of any Informatica software product as well as the timing of any such release or upgrade is at the sole discretion of Informatica. Protected by one or more of the following U.S. Patents: 6,032,158; 5,794,246; 6,014,670; 6,339,775; 6,044,374; 6,208,990; 6,208,990; 6,850,947; 6,895,471; or by the following pending U.S. Patents: 09/644,280; 10/966,046; 10/727,700. This edition published August 2013

3 White Paper Table of Contents Executive Summary... 2 Drivers for IT Modernization in Insurance... 2 Determining Insurance Legacy Application Retirement Eligibility... 3 Strategies for Retiring Legacy Insurance Applications... 4 Eight Steps to Successful Application Retirement... 5 Informatica Addresses Insurance Legacy Application Retirement Conclusion A Practical Guide to Insurance Legacy Application Retirement 1

4 Executive Summary The insurance industry faces an urgent need to modernize critical legacy systems in order to improve organizational efficiency and introduce technologies that offer a competitive advantage. Whether they replace core systems with up-to-date packaged solutions, migrate from COBOL-based mainframes to more modern platforms, or both, insurers must also plan to retire the now redundant legacy systems. Otherwise, they face risks and expenses of operating old and new production systems simultaneously. This white paper sets out the necessary steps for an effective data archiving and retention strategy and suggests technology to support it. Drivers for IT Modernization in Insurance A 2013 LOMA industry survey places legacy modernization among the top three areas of technology investment for the insurance industry. Multiple business needs are driving this push for modernization: Mergers and acquisitions (M&A). The insurance industry has seen a significant amount of M&A activity over the last two decades. Post-M&A, the combined companies many times find they have a glut of redundant applications. Application rationalization becomes a key cost cutting initiative that drives retiring and replacing legacy IT systems. Reducing costs. Reducing capital expenses and operational expenses is on all insurance executive s top ten list of priorities. Even though organizations have to invest in maintaining existing applications, in many cases starting anew with modern platforms is lower cost than implementing workarounds. Supplementing limited business capabilities of their existing legacy mainframe-based claims, underwriting, policy administration, and billing systems can result in more costly maintenance over time. Time to market. Beating the competition to market is a critical differentiator. By having the ability to deliver new products and services faster, through new channels including mobile, drives customer loyalty for life and property and casualty (P&C) insurers. However, legacy systems are so complex and so reliant on code modifications for even simple changes to existing products and services that they cannot keep pace with these demands. Improving operational efficiency. Higher combined ratios and lower profit margins are forcing firms to improve their level of operational efficiency. Automating manual processes and minimizing paperwork are critical to this goal, but in a legacy mainframe environment, years of custom coding and limited integration capabilities make it extremely difficult to increase straight-through processing. Additionally one-off programs or lack of standardization can also compete with improving efficiencies. Limited skills and increased system risks. Legacy systems at many life and P&C insurers date back 40 years or more. IT employees skilled in those systems are at or near retirement, with few younger employees with similar skills available to take their place. Moreover, the older a legacy system, the less likely the vendor is to support it, further increasing overall operational risk. 2

5 According to the LOMA survey, modernization initiatives fall into two broad categories: Complete core platform replacement using packaged solutions for claims management, policy administration, underwriting, and billing Migration from COBOL-based mainframe systems to run-time platforms operating on Java, C#, and commodity hardware such as Linux Whichever approach taken, companies modernizing their legacy applications must also retire and decommission older systems to avoid incurring the costs and risks of keeping both old and new in production. To do this, however they require an effective strategy for data archiving and retention, as well as appropriate technology to support that strategy. Determining Insurance Legacy Application Retirement Eligibility Determining whether an application is eligible to be retired is a matter of assessing the business value the application provides against the costs of supporting and maintaining the application. Multiple parameters determine the business value of a legacy application: 1. What is the application being used for? 2. How many employees, partners, or customers use the application? 3. Is the application accessed regularly by many users, or only infrequently by a handful of users? 4. When was the application last used, based on production control or application inventory monitors? 5. How old is the application? 6. Is the application actively creating new content, or is it used only for reporting purposes or needs such as policy servicing? 7. Does the organization have other applications that can serve the same purpose? If so, how many users will have to be trained on the other system? What will be the cost of customizing that system and training? Determining a legacy application s cost also requires a detailed assessment: 1. How much does it cost to license, maintain, and administer the application? 2. How complex is the application? 3. How expensive are customizations to the application? 4. Are resources available to support the application after customization? If so, what will they cost? If not, what is the potential cost of being unable to respond promptly to audit and data access requests? 5. How much does it cost to maintain the software and hardware stack supporting the application? An application is eligible for retirement when the costs of maintaining it exceed the business value it delivers. A Practical Guide to Insurance Legacy Application Retirement 3

6 Strategies for Retiring Legacy Insurance Applications Organizations reviewing their application portfolio for the first time often find hundreds of applications that are candidates for retirement. Because it is impossible to retire hundreds of applications at once, companies must develop an application retirement strategy that prioritizes the most critical applications and data. Prioritizing Applications Eligible for Retirement For organizations with hundreds of legacy applications, it is best to create a plan that prioritizes based on realizing the biggest savings with the least amount of effort. This might seem obvious, but many times projects can go awry by focusing on a high profile application that may not be the best with which to start. Cost savings. Starting with applications that generate the greatest cost savings showcases the value of the application retirement project by freeing up budget and resources. Tying the savings to hardware with maintenance contracts about to expire is optimal because a large portion of the costs savings can be realized immediately. Knowledge of the application and the reporting requirements of the retired data. Lack of functional application knowledge is a primary challenge of application retirement projects. The older a legacy application is, the more likely it is that employees who have the knowledge necessary to mothball the application have left the company and the harder it is to find new employees with the appropriate skills. By starting an application retirement initiative with legacy applications where resources have an institutional understanding of the application s functionality and reporting requirements, an organization is more likely to complete the retirement successfully and build the business case for more complex retirements. Avoid Controversial Applications In The Beginning. It is better to start with an application that has the fewest objections for retirement. Once business users are comfortable with the way they access data going forward, it increases the adoption and approval for future retirements. Complete and Selective Data Retention. Application retirement best practices suggest archiving all of the data at once while maintaining online access to the data via a preferred reporting tool. By keeping all the data accessible from an online archive, the organization can avoid lengthy up-front analysis. This is the simplest process and can be deployed quickly delivering the quickest time to savings. For those that have a clear understanding and knowledge of the application data model with detailed retention requirements, selective data retention can be implemented up front or applied after the application has been retired as a whole. In either case, using a best-in-class application retirement solution will enable the organization to do both. 4

7 Eight Steps to Successful Application Retirement To successfully retire an application, follow these eight steps: 1. Create a cross-functional team 2. Understand the insurance legacy applications and the data that needs to be retired 3. Preserve the original business context of the legacy insurance application data 4. Validate retired data 5. Ensure access to archived data 6. Secure retired data 7. Set retention policies on retired data 8. Select the right technology for application retirement 1. Create a Cross-Functional Team Successful application retirement projects are typically staffed by cross-functional teams with representation from compliance, the line-of-business function, and IT. Team members usually have the following roles: DEPARTMENT/FUNCTION TEAM MEMBERS ROLES Compliance/Audit Line-of-business managers (Underwriting, Claims, Risk Management, Policy Administration, Finance, Operations) Information technology professionals Compliance managers, internal auditors, general counsel staff Business analysts, line-ofbusiness managers Core insurance application owners, IT managers, database administrators, application developers, architects Determine what data should be retired for compliance purposes, the retention period, and the security access controls that should be associated with the retired data. Describe how the legacy application is being used; define the data that needs to be retained for regular business needs and the type of access and reports that need to run against the retired data. The line of business may also provide further refinements to the retention requirements for different data within the application. Develop the application retirement strategy, evaluate software products for application retirement, retire the application, and shut down the legacy application. A Practical Guide to Insurance Legacy Application Retirement 5

8 2. Understand the Legacy Insurance Applications and the Data That Needs to Be Retired Without understanding legacy applications and their underlying data model, it s difficult to determine which data to archive and selectively retain for normal business needs and regulatory compliance. To achieve this understanding, interview employees, partners, customers, and auditors who use the legacy application and ask them these critical questions: What purpose does the application serve today, as opposed to when the application was originally deployed? What application modules or functions are no longer in use? What reports are run against the application? If several reports are being run, can any of them be consolidated? Does the organization have other applications that serve the same purpose as the legacy application? Should data be migrated to another application? What data needs to be retained for compliance purposes? How long must the data be retained to satisfy state and federal regulations, such as Solvency II or National Association of Insurance Commissioners (NAIC) equivalent requirements? 3. Preserve the Original Business Context of the Legacy Insurance Application Data Preserving the original business context of the data object is vital to ensuring that necessary data is retained for the right reasons. For example, if you are retiring policy servicing data for policyholders who are no longer customers, you must capture all the transactional, referential, fee code tables, and audit information associated with the policy. Transactional information includes premium amounts, payments received, rate tables, customer billing information, and other information associated with the servicing of past policies. Referential information includes agent/broker names, address, and contact information. The audit trail includes details about past rate changes, the reasons for those changes, and the approvers for the rate changes. This data is typically stored in several tables in the database, with complex relationships between table data and business rules defining additional semantics. To make matters more complex, many of these relationships and business rules are defined at the application layer and cannot be mined directly from the database. Preserving the original business context of the application data requires application knowledge and sophisticated data modeling techniques that prevent the relationships between the data and the business rules from being compromised. 4. Validate Retired Data Legacy applications should be decommissioned promptly after the data within them is archived to avoid the risks and costs of running legacy and new systems simultaneously. Before retiring the application, it s important to verify that the archived data is complete and correct. Legacy data is often stored in an application-specific manner for example, dates stored in DB2 mainframes as integers, dates stored in Julian rather than Gregorian format, or encrypted data that must be decrypted to ensure accessibility after archiving. This data must undergo transformations to convert it into a common format so it can be validated. However, as a result, the archived data may be in a slightly different datatype or format than it was in the original application. It is important to identify the transformations performed on the original data during archiving, then review and validate the transformations after archiving to ensure that the differences and exceptions are acceptable. 6

9 The end result is a report verifying that all the data to be retained is in the archive and indicating whether or not the data is identical. If the archived data differs from the original, the report should note and approve any exceptions. This report is an important part of establishing a chain of custody during an audit. 5. Ensure Access to Archived Data Providing quick and efficient access to retired data is key to the success of your application retirement project. Organizations must be able to query, browse, and report on historical data on demand to respond to audits and discovery requests. The application retirement solution used to shut down a legacy application must also provide robust application-independent access via open industry standards such as ODBC/JDBC, XML, and SQL and reporting tools such as Crystal Reports, MicroStrategy, and Business Objects, in addition to keyword search capability. Consider the following when developing a plan that defines how retired data will be accessed: How will business users and administrators access data? What format do they need to see retired data in? How will auditors access the data? What reports do auditors typically access? What reporting tools are users and administrators familiar with? How will users search for retired data? End users should be able to access retired data in a way that does not compromise user experience for example, the contents of a legacy insurance policy administration system should be available in their original format. 6. Secure Retired Data It is not uncommon for a legacy application to contain privileged information. For example, a policy administration application in an insurance company may contain sensitive personal information, while other applications may contain intellectual property that must be protected. This privileged information must be secured during application retirement and data archiving. Consider the following when developing a plan to secure retired data: Should only administrators and privileged users be entitled to access retired data, or should a broader group be allowed to access the retired data? Should the same security policy that controlled access in the legacy application apply, or should the security policy be further restricted or relaxed? A Practical Guide to Insurance Legacy Application Retirement 7

10 7. Set Retention Policies on Retired Data More and more organizations are recognizing the costs and the risks associated with retaining data indefinitely. As with other information in the organization, retired data should be managed according to the enterprise-wide information management policy. Data retention requirements are driven from industry regulations including Solvency II and NAIC s equivalent requirements for capital adequacy. Some insurance companies specify a retention policy per application, whereas others may need it at a business entity level, such as customer or employee records. Other organizations may have even more complex requirements where multiple retention policies may need to be assigned to the same record, and conflicts among the rules need to be resolved by the retention management system. It s important to understand your organization s retention requirements early in the process so you can select an application retirement solution able to meet those requirements. The right solution provides comprehensive policy management features as well as integration with storage platforms that manage retention. 8. Select the Right Technology for Application Retirement Because application retirement requires sophisticated data modeling, extraction, retrieval, validation, and retention capabilities, organizations are best served by seeking out a vendor with a proven solution for application retirement. An application retirement solution should furnish the following capabilities: Modeling the data in the legacy application Discovering unknown data relationships Creating retention policies that define what data should be retired Extracting the data with its full application context Indexing the data for efficient searching Validating completeness and correctness of retired data Providing application-independent access and reporting Ensuring immutability of the retired data and securing it for access by only privileged users Enforcing retention and disposal policies at the application, entity, or groups of records level, based on regulatory and organizational requirements Auditing all access and any actions against the retired data (changes in retention policies or disposal and legal hold) Because every organization has unique requirements with application retirement projects, choosing a software solution often includes a substantial services component. It s advisable to give the highest consideration to vendors who have extensive experience with archiving large volumes of data from structured applications, proven project management capabilities, and implementation best practices. 8

11 Informatica Addresses Insurance Legacy Application Retirement The Informatica Application Retirement Solution manages the full lifecycle of content in database applications. It is designed especially to manage the application retirement challenge by supplying five capabilities (see Figure 1): 1. Discovering, classifying, and extracting business records 2. Validating archived data 3. Providing easy, secure access to retired data 4. Complying with data retention and privacy regulations 5. Storing data efficiently and implementing tiered storage strategies Discover Archive Retain Legacy Insurance Applications Data Archive Data Validation Data Visualization Compliance Manager Policy Admin Claims Underwriting Metadata Discovery Create open, query-able archive Validate archive data Built-in, secure access Store with 95% compression Assign Retention Policies Capture Audit Logs Generate Compliance Reports ediscovery and Legal Holds Figure 1: Informatica Application Retirement Solution Discover, Classify and Extract Business Records The Informatica Application ILM product family provides data modeling techniques that allow you to classify and extract related subsets of data that represent the business object. The original context of the business object is preserved in an audit-ready format that is readily accessible for compliance and regular business needs. It also allows the later creation of additional relationships between data for future analysis. If information on the relationship between tables and records is neither stored in the source system nor known by functional experts, the Informatica Application ILM product family offers a Discovery Option to infer table relationships and business entities based on the discovered relationships. Knowledge about data relationships is important for establishing retention policies for related records as well as determining how data will be accessed. A Practical Guide to Insurance Legacy Application Retirement 9

12 Validate Archived Data The Informatica Application ILM product family s Data Validation Option lets you easily validate that the data archive process is complete and correct by defining business rules to compare archived data against the data in the original application. The ability to define validation rules eliminates the need to write SQL scripts to perform the comparison, ultimately increasing productivity. Any discrepancies between the archive and source system are noted in the report output, which can be used later for review and audit purposes. Provide Easy, Secure Access to Retired Data As part of the Informatica Application ILM product family, Informatica Data Archive offers several ways to ensure that retired data is appropriately secured and can be accessed on demand during the regular course of business as well as for audits and e-discovery. Informatica technology furnishes several options for accessing and securing retired data: Retired application data can be searched based on keyword search and business entities, with full application context, from Informatica Data Archive s data discovery portal. Reports can be created using an integrated Data Visualization Feature Retired data is accessible via standard interfaces such as ODBC/JDBC and SQL and through reporting tools such as Crystal Reports, MicroStrategy, and others. Comply with Data Retention and Privacy Regulations Informatica Data Archive offers a comprehensive feature set to ensure that retired data is secured and retained for the period specified by relevant regulations. A policy engine enforces retention policies assigned to retired data, from the application level to a granular group of records. It then purges the data when the retention period expires so that it s not retained beyond a period of time that would pose a legal risk. Legal hold capabilities are also available to ensure that data relevant to a legal case is retained even if the retention period has expired. Integration with best-in-class storage platforms, such as EMC and Hitachi Data Systems, guarantees that retired data is locked down until the retention period expires. At the same time, reporting and e-discovery ensure that retired data remains accessible in the event of an audit or litigation. Store Data Efficiently and Implement Tiered Storage Strategies Informatica Data Archive converts the retired data to an optimal, highly compressed archive format, yielding up to 98 percent compression. The data is fully indexed to support SQL query and keyword search, while reducing storage capacity requirements. Additionally, because retired data is infrequently accessed and typically never modified, it can be stored on an inexpensive storage tier. As a result, organizations can save costs and free up high-speed storage for critical business needs. 10

13 Conclusion The market conditions driving the insurance industry to modernize its legacy systems are unlikely to reverse themselves any time soon. Therefore, the industry must pursue modernization with carefully thought-out strategies and technology solutions to support them. Informatica offers an entire family of solutions to manage the retirement of legacy applications and the data they contain, easing the insurance industry s transition to more modern systems. For more information on our industry-specific solutions for insurance, please visit us at About Informatica Informatica Corporation (Nasdaq:INFA) is the world s number one independent provider of data integration software. Organizations around the world rely on Informatica for maximizing return on data to drive their top business imperatives. Worldwide, over 5,000 enterprises depend on Informatica to fully leverage their information assets residing on-premise, in the Cloud and across social networks. For more information, call ( in the U.S.), or visit A Practical Guide to Insurance Legacy Application Retirement 11

14 12

15 A Practical Guide to Insurance Legacy Application Retirement 13

16 Worldwide Headquarters, 100 Cardinal Way, Redwood City, CA 94063, USA Phone: Fax: Toll-free in the US: informatica.com linkedin.com/company/informatica twitter.com/informaticacorp 2013 Informatica Corporation. All rights reserved. Informatica and Put potential to work are trademarks or registered trademarks of Informatica Corporation in the United States and in jurisdictions throughout the world. All other company and product names may be trade names or trademarks. IN09_0813_02495