Operational risks can be associated with Zurich's people, processes, and systems, and external events such as outsourcing, catastrophes, legislation, or external fraud. Zurich has a comprehensive framework with a common approach to identify, assess, quantify, mitigate, monitor, and report operational risks within the scenario-based assessments, internal controls evaluations, and loss event data.
In the area of information security, Zurich continues to focus on its global improvement program with special emphasis on protecting customer information, improving security with its suppliers, and monitoring that access to information is properly controlled. This helps Zurich better protect information assets and ensure greater alignment with regulation and policies. A key consideration is maintaining and developing the capability of Zurich's business continuity with an emphasis on recovery from possible risk events such as natural catastrophe or pandemic. Zurich continues to develop its existing business continuity capability by further implementing a more globally consistent approach to business continuity and crisis management.
Focusing on the risk of claims fraud and nonclaims fraud continues to be of great importance to Zurich. Zurich continues its global antifraud initiative to further improve Zurich's ability to prevent, detect, and respond to fraud. While claims fraud is calculated as part of insurance risk and nonclaims fraud is calculated as part of operational risk for risk-based capital, both are part of the common framework for assessing and managing operational risks. Zurich considers risk controls to be key instruments for monitoring and managing operational risks. The operational effectiveness of key controls is assessed by self-assessments and independent testing of controls supporting the financial statements.
Reputation risks are risks that might arise from an act or omission by Zurich or any of its employees that could result in damage to the Group's reputation or loss of trust among its stakeholders. Every risk type could have potential consequences for Zurich's reputation, and therefore effectively managing its exposures holistically and systematically helps Zurich reduce threats to its reputation.