Overcoming the obstacles to effective scenario testing

Keegan Gwendu, Senior Manager, Risk Consulting and Daniel Spreckley, Senior Manager, Risk Consulting

Scenario testing is an invaluable tool for organisations to gauge their preparedness in the face of unforeseen disruptions. Over the years, organisations have carried out scenario testing across several interrelated disciplines such as operational risk, cyber, business continuity (BC), disaster recovery (DR) and more recently, operational resilience. Operational resilience regulations have increased the focus and the amount of scenario testing, as this is the primary method for organisations to:

assess their preparedness to deal with disruption
proactively identify and address vulnerabilities
test their ability to stay within impact tolerances and not cause intolerable harm.

While all organisations acknowledge the benefits of a robust scenario testing programme, we have observed through our extensive operational resilience work within financial services and insurance, that many firms have yet to overcome the four common challenges that hinder efficient and effective scenario testing.

Inefficient approaches to scenario testing

Testing is often being conducted in silos by different teams across interrelated disciplines. These teams can spend duplicated time developing similar scenarios and engaging the same stakeholder groups to conduct similar tests, and all frequently do not share the output. Over time, a siloed approach can increase stakeholder testing fatigue. This can lead to senior stakeholders reducing the amount of testing due to cost and resource implications.

Lack of diversity in testing methods

Testing helps build confidence in handling crises or disruptions when they arise. The more diverse or sophisticated the testing methods are, the more they can simulate real-life situations and provide valuable insights into a firm's readiness. Some firms have struggled to progress beyond table top testing without a structured approach that clearly defines what sophistication means for them, the diverse methods they will use and the rationale for their use.

Limited forward planning

As the adage goes, "fail to plan, plan to fail". Some firms have yet to take the time required to plan their scenario testing programmes adequately and engage stakeholders to maximise the value of the testing exercises. Planning and ensuring testing is scheduled between the peaks and troughs helps to increase stakeholder engagement. Sometimes, intentionally testing when capacity is tight can be beneficial; however, it's essential to be deliberate and plan.

Limited rigour and focus on remediation

In some cases, we have noticed that organisations that have successfully planned and executed scenario tests have yet to apply the required level of rigour and post-testing focus needed to ensure:

vulnerabilities are assessed, prioritised, and addressed in a timely manner
required actions to enhance preparedness and resilience are undertaken
scenario testing approaches are reviewed and improved based on the insights gained from executed tests.

Overcoming the common challenges

By adopting the following strategies, organisations can move past these common challenges and shift their focus - from the identification and assessment of vulnerability to taking action to enhance resilience.

Strategy one: Use an integrated approach to enhance efficiency and effectiveness

Organisations should develop and deploy a joined-up approach that removes siloes and ensures that there is a consistent way to assess scenario testing requirements, develop scenarios, and conduct testing efficiently across multiple disciplines.

Strategy two: Use diverse methods to increase testing sophistication

Organisations should understand and agree on the testing methods they plan to use to increase their testing sophistication. Agreed methods should be aligned with the organisation's testing maturity level to derive maximum value from a diversified testing approach. For instance, jumping from a tabletop exercise to a no-notice live simulation may not yield the benefits of sophisticated testing if the organisation is not ready.

Strategy three: Proactive planning to increase scenario testing efficiency

Organisations should develop credible testing plans that allow for efficient delivery of testing methods. As scenario testing can be resource-intensive, advanced planning is necessary to ensure stakeholder buy-in and timely execution.

Strategy four: Enhance resilience through consistent rigor in all testing stages

Organisations should increase their focus on remediation and post-testing activities to ensure that the most important and cost-effective actions are taken to enhance resilience. There should be mechanisms in place to prioritise remediation activities, secure necessary funding and aid planning and tracking of post-testing actions.

If implemented correctly, these strategies can help firms execute efficient and cost-effective scenario testing that breaks down silos, enables them to identify tangible enhancements to improve resilience, and adequately prepares them to respond and recover from operational disruptions without causing intolerable harm.

We continue to support firms in enhancing approaches, and unlocking efficiencies and collaboration, through integrated scenario testing, so they continue to build resilience.

For more information on how we can help you improve your resilience posture, please contact Justin Elks, Keegan Gwendu or your usual Crowe contact.

News and Insights

Five Golden Rules for value-building operational resilience

Golden rules to help firms maximise the value of operational resilience during the remaining two years of the transition period.

Operational resilience: what is it and why is it important

Do you know what’s operational resilience and the importance of it. Read our latest insight to understand the values it brings to businesses.

Crowe UK celebrates year of growth

IAB survey reinforces our position as a recognised leader in the UK for audit, tax advisory and risk services.

Crowe UK named Risk Consultancy for five consecutive years

For the fifth year in succession, Crowe has been named Risk Consultancy Firm of the Year by InsuranceERM at their 2024 Awards.

Five Golden Rules for value-building operational resilience

Golden rules to help firms maximise the value of operational resilience during the remaining two years of the transition period.

Operational resilience: what is it and why is it important

Do you know what’s operational resilience and the importance of it. Read our latest insight to understand the values it brings to businesses.

Crowe UK celebrates year of growth

IAB survey reinforces our position as a recognised leader in the UK for audit, tax advisory and risk services.

Crowe UK named Risk Consultancy for five consecutive years

For the fifth year in succession, Crowe has been named Risk Consultancy Firm of the Year by InsuranceERM at their 2024 Awards.

Justin Elks

Partner, Head of Risk Consulting

London

+44 (0)203 457 6660

Read full CV

mail 

Related services

Risk Consulting - Financial Services