Building operational resilience

So said the G20 Leaders’ Summit statement of 26 March 2020, days before the publication of the Policy Statements on operational resilience from the UK regulators. The pandemic has clearly illustrated the importance of operational resilience and, while in many cases organisations responded well, many found they were less well prepared. This has reinforced the importance of building enhanced operational resilience. 

Following initial implementation, companies have a transition period to ensure they can operate their important business services within the impact tolerances set, as soon as is reasonably practicable. This period will end no later than 31 March 2025.

A consistent direction of travel

The requirements set out in final Policy Statements remain largely consistent with the consultation phase. For the most part, changes provide additional clarity to support firms to effectively implement their operational resilience approaches, while not over-specifying what is required.

This approach means that firms that have made significant progress on operational resilience over the last few years will be well-placed to continue to develop, refine and embed their approaches, without having to make wholesale changes.

For those organisations which still have work to do, the publication of Policy Statements marks the point where it is now necessary to move quickly to accelerate efforts and put a practical approach in place. This will be helped by the regulators explicitly expecting firms to take a proportionate approach, only considering extra layers of complexity where there are significant benefits in building operational resilience.

Taking a practical approach

Based on our practical experience of working with clients in this area, we recommend firms concentrate their efforts on seven key areas.

• Focus on what’s important to you as a business: having a deadline just under 12 months away may encourage firms to approach this work as if it were a ‘tick box’, regulatory compliance exercise. However, the regulators don’t want a one size fits all approach. While it can be useful to understand the approaches of other firms, operational resilience needs to work in the context of your organisation and its operating model.
• Understand your current position: to focus on what’s important, there is a requirement to understand your current position. In our experience we find that spending some time completing a gap analysis, to understand how existing capabilities can be leveraged to support the operational resilience approach, leads to a more efficient, cost-effective approach.
• Engage the Board: the approach firms develop to operational resilience should help Boards to engage with strategic decisions about significant operational changes and investments. Board members have in the past struggled to engage in operational risk and resilience areas in the right way; they often see operational resilience as a positive initiative, and engaging them early can help to shape approaches to meet their needs.
• Iteration and evolution are key to embedding: where firms have approached projects iteratively — for example, developing an initial approach, doing a pilot exercise to test it, and then applying these learnings to refine their approaches further — they have tended to have the most impact on their businesses.
• Engage the wider business: approaching projects iteratively helps build understanding and engagement, and ultimately helps to embed approaches in the business. Project teams have found it is very difficult to make good progress and add value unless they have the active engagement and input from the wider business. If done well, operational resilience can help to break down business silos.
• Don’t get bogged down in the detail: we have seen organisations struggle and get lost in the detail of mapping. Regulators have now clarified that mapping and testing of impact tolerances to a full level of sophistication are not seen as crucial within the first year. Firms should concentrate on the identification and testing of key resource constraints and service vulnerabilities which impact the ability to service customers, and not fall in to the trap of getting lost in the detail during this initial phase.
• Consider the extended enterprise: effective operational resilience includes engaging beyond the boundary of a business, and the management of third parties is central to many firms’ ability to remain resilient to disruption and external change. Operational resilience provides an effective lens for firms to assess and manage their exposure to third parties and material sub-outsourcing. Regulators have recognised that rules in this area have not kept pace with technological change, suggesting that outsourcing and third party risk management will be an increasing focus of regulatory activity.

Do not miss the opportunity to add value

This next year provides a good opportunity to build strong foundations in operational resilience. By taking a practical approach, and engaging the business to understand what works in your firm, you can enhance operational risk management and decision making, and increase your organisation’s ability to react faster and more effectively to disruption.

In doing this, it’s important not to lose sight of the business value that can be gained if operational resilience activity is done well. Building operational resilience in an organisation should result in the outcome that customers can trust the business to adapt to changing circumstances; that it can deal with stresses and disruptions whilst delivering on promises, achieving business objectives and operating within agreed tolerances. Operational resilience is important to customers, and they are more likely to select and be loyal to firms that are more resilient and respond well to operational disruption.

From what we’ve seen to date, our view is — done well — operational resilience can be an area where the cost of compliance is significantly exceeded by the organisational benefits gained and value realised.

Next steps

Where firms have already made significant progress, we anticipate changes will be easily integrated into existing approaches, as core policy elements remain largely unchanged. For companies just beginning to mobilise, final Policy Statements provide additional clarity to help them to move forward.

Irrespective of their stage of development, all firms must now focus on overcoming the practical challenges of implementation, learning lessons from their activity to date, and collaborating with external experts and their partners to develop an effective operational resilience approach.