Three sides of the same insurance systems

The first program I changed in production, in the spring of 1997, calculated the annual revaluation of savings policies for a small insurer in Piedmont. My supervisor at Gemmaldi Informatica, a Turin service bureau that ran policy systems for several insurers on a shared mainframe, made me read the policy conditions before touching the code. The rule I had been asked to adjust matched a clause that a later product had altered. Nobody had noticed, because the two products were rarely held by the same customer. Since then I have treated policy wording and program logic as two records of one promise, and I distrust either when it stands alone.

I graduated in computer engineering from Morvaldi Polytechnic in July 1996 and joined Gemmaldi that October as an analyst-programmer. Over nearly ten years I worked in COBOL, CICS and DB2, then as a systems analyst and project lead on the life-insurance accounts. Corvelline Vita was one of those clients. I learnt what a service bureau sees and what it misses: we knew exactly how the batch ran, while the insurer's actuaries and product managers held the reasons behind it. When each side assumed the other understood a rule, errors could stay hidden for years.

In 2006 I moved to Brescolani Brokers, a Milan broker group, as head of broker systems. For the first time I was a customer of insurers' technology rather than its supplier. Our account executives retyped client data into fourteen insurer extranets, each with its own login and its own idea of a quotation. I led a placement system that recorded what we had offered a client and why, and negotiated data exchanges with the insurers willing to accept them. I also saw how intermediaries really use a portal: shared desks, late evenings before a deadline and passwords written on paper because there were too many to remember. That memory shaped a decision I made nineteen years later.

Corvelline recruited me in February 2012 as head of applications for life and pensions. By then the company had outsourced the operation of its policy ledger to Gemmaldi, so I returned to that relationship from the other side. Solvency II was approaching, and the actuarial and risk teams needed policy data at a level of detail the ledger had never been asked to produce. We built extraction and reconciliation routines rather than altering core programs, and I learnt to agree definitions with actuaries before anyone wrote code.

From 2017 I ran IT operations and resilience, which made me responsible for incidents, disaster recovery and our oversight of outsourcing partners. I rewrote recovery tests so that they ended with a business user completing a real transaction, not with a technician confirming that a server had started. I also discovered how little of our supplier oversight could be evidenced. We had monthly service reports, but not the audit and exit rights we would have needed if a supplier failed.

I became CIO in April 2021. The board held two expectations that pulled against each other: modernise, and do not put old promises at risk. My answer has been to separate them. New business has run on a cloud platform since 2024, notified to IVASS as an outsourcing of an important function and managed under EIOPA's guidelines on cloud outsourcing. The closed books remain on the mainframe, where they are stable, while we make sure we understand them well enough to move them. The three decisions on this site sit inside that plan: a renewal that bought exit rights, an investment in people who can read the old code, and a security change brokers did not want.

I lead through a small number of heads who own their budgets, and I ask them to bring problems early rather than solutions late. I prefer written decision papers to slide presentations, because a paper can be checked by the actuarial function, the risk function and internal audit before it reaches the executive committee. With directors, I try to say what we depend on, what would happen if it failed and what it would cost to depend on it less. They do not need the architecture diagram; they need the exposure and the choice.

I have not served on a board. I have presented to our risk committee for five years and answered its questions on DORA, cyber incidents and outsourcing. I would like to bring that oversight experience to another board, in financial services but outside life insurance, where I can learn as well as contribute and where my employer's interests would not be in question.

Open to Board appointments

Languages / Italian · English