While the final sector-wide conclusions of DyGIST are still to come, insurers can already begin reviewing what the exercise may have revealed about their internal readiness. DyGIST tested the ability of firms to mobilise data, make decisions, and communicate under pressure - areas that are likely to remain central to future stress testing and the real-world crisis response.
The exercise can highlight where data was difficult to access, modelling assumptions needed stronger challenge, and where governance slowed decisions, and how communication between technical teams and senior leaders can improve.
Traditional stress testing often focuses on financial resilience under severe, but plausible scenarios. However, DyGIST required firms to respond to a sequence of adverse events in real time as they would in a real crisis, with scenario information released progressively and the PRA observing how they mobilised data, made decisions and communicated.
As such, the exercise creates a broader view of resilience; strong capital is still important, but interpreting information, co-ordinating teams and making timely decisions is also tested. If a firm cannot quickly identify exposures, understand operational dependencies or explain the basis for decisions, its financial position may not tell the full story.
Stress testing therefore provides insurers with a practical opportunity to assess how well internal processes work under pressure. The most useful lessons are likely to come from reviewing how the firm responded during the exercise, where delays occurred, and which parts of the response were too manual, depending on individual knowledge or late-stage escalation.
During a live stress test, firms need to understand their exposures, assess the financial impact of each event and update their view as new information becomes available. Doing so becomes difficult when data is fragmented across systems, held in inconsistent formats or dependent on manual intervention.
Here, the lesson is to review whether the data used during the exercise was available quickly enough and in a format that supported decision-making. This should include exposure data, claims information, reinsurance data, asset information, liquidity information and the assumptions used across modelling outputs.
Data quality should also be assessed across the full response process. If teams had to make late adjustments, rely on individual knowledge or reconcile multiple versions of the same information, the firm may need to strengthen data ownership, definitions and controls before the next exercise. Poor data quality does not only affect the accuracy of a submission; it can also slow the response at the point when speed and confidence are most needed.
DyGIST required firms to assess the impact of evolving scenarios, with each new development creating further pressure on assumptions, exposure analysis, and decision-making.
Models are essential in this process, but need to be understood clearly; a model output may provide estimates on losses, capital impact or liquidity position, but senior leaders need to understand the assumptions behind it, the level of uncertainty, and how sensitive the result is to change.
This is particularly important where firms are dealing with more uncommon events, limited data or multiple risks occurring at once. Insurers should therefore review whether modelling assumptions were documented clearly, challenged at the right level, and communicated in a way that supported decision-making. If outputs require repeated explanation, or if senior teams find it difficult to understand the confidence level behind the numbers, the firm may need to improve how technical analysis is translated into decision-ready information.
DyGIST requires firms to make decisions as scenario information changes. The PRA’s 2026/27 Business Plan states that the exercise was designed to assess firms’ management of event risk and the credibility of their responses, with scenario information released progressively during the exercise.
As such, insurers should consider whether decisions were made at the right level, if escalation routes were clear and whether senior leaders received the information quickly enough. Where decisions were delayed because accountability was unclear, or because further review was needed before action could be taken, the firm may need to strengthen its crisis governance arrangements.
Further, firms need to show what was decided, who gave approval and what information and assumptions were used. After DyGIST, insurers should review whether their governance arrangements were suitable for a live, uncertain exercise. The most useful questions are likely to be practical in nature:
Stress testing also gives insurers a view of how operational resilience affects financial response. A severe event may create capital, liquidity or claims pressures, but the firm’s ability to respond also depends on people, systems, third parties and established processes working as expected.
During DyGIST, firms had to respond within the timeframes of the exercise, making operational dependencies an important part of the post-exercise review. Insurers should consider whether key systems provided the right information, whether teams could access data quickly enough, and if third-party arrangements created any delays or uncertainty.
Operational resilience should be assessed alongside the financial outputs of the exercise; a firm may be able to model the impact of an event, but still face difficulty if the processes behind the response are slow, fragmented or too dependent on individual knowledge.
During a live stress event, actuarial, risk, finance, claims and operational teams may all be working with different parts of the same scenario. If communication is unclear, delayed or too technical, decisions can become slower and harder to evidence.
Insurers should review how information moved through the organisation during the exercise, including whether senior leaders received updates in a consistent format, whether assumptions and limitations were explained clearly, and how teams understood what information was needed at each stage of the response.
Firms also need to effectively explain the basis of their response to regulators, including the assumptions used and the actions being considered. Where information is still developing, the firm should be able to show how it reached its view at the time and what further work may be needed.
After DyGIST, insurers should consider whether their internal reporting packs, crisis updates and decision papers were suitable for a fast-moving scenario.
The period after DyGIST is an opportunity for insurers to review the response in detail, and to consider how the response was produced, where pressure was felt and which parts of the process would need improvement before the next regulatory exercise or real-world stress event.
The most useful reviews look at the full response chain, including the quality of the data used, the assumptions behind modelling outputs, the speed of governance decisions, the role of third parties and the way information was communicated to senior leaders. If any part of the process relied heavily on manual work, individual knowledge or late-stage reconciliation, that should be treated as a resilience issue rather than an administrative inconvenience.
Insurers should also consider whether the response was repeatable. A process that worked because a small number of experienced people knew where to find information may not be reliable under greater pressure, staff absence or a more complex scenario.
Essentially, after a stress test, firms should have a clearer view of which capabilities are properly embedded and which depend too heavily on workarounds.
The true value of DyGIST will be felt in the improvements firms make after the exercise: better data controls, clearer governance, stronger modelling documentation, more reliable third-party information and better communication between technical and senior teams can all improve readiness for future stress events.