Risk Consulting

Since the publication in July 2018 of a joint Discussion Paper between the Bank of England and the FCA, there has been much discussion and debate between risk and compliance professionals, information security specialists and regulators, on operational resilience. As the resulting Consultation Paper is expected imminently, now is a good time to broaden this discussion to include Non-Executive Directors, given the importance of Board engagement.

At its heart, the outcome of effective operational resilience is simple: a business that can, and is confident it can, withstand, absorb and recover from stresses and disruption whilst delivering promises to customers. As ever with regulatory initiatives, this comes with new things to think about, including:

• Consideration of operational resilience focused on critical business services; the most important products or services a company provides to its customers.
• Having defined critical business services, companies should set impact tolerances — the amount of disruption that can be tolerated in the event of an incident — then test whether this condition can be met.
• Operational resilience embodies a shift in mindset: assume systems will be disrupted, and focus on back-up plans, responses and recovery options to deal with this disruption.

Boards are expected to play a critical role in operational resilience as part of their responsibility to ensure a sound and well run business.

This includes setting clear standards, prioritising critical business services, defining impact tolerances, roles Audit / Tax / Advisory / Risk / Performance Smart decisions. Lasting value. Operational resilience – what is it, and what does it mean to NEDs? oversight, identifying critical dependencies on third parties and critical providers, and being actively engaged in a company’s plans. This is an extension of current regulatory thinking where, for example, Boards are already being asked to take responsibility for cyber resilience.

Well-intentioned, regulatory-sponsored change has often been a two edged sword in developing effective, cost efficient management approaches. For example, the recent focus on conduct has in many firms led to its own separate, siloed framework rather than an integrated part of business decision making. Increasingly Boards are seeking to engage with operational risks, including cyber, which are more important, more dynamic and more likely to crystallise than before; however, operational risk approaches are often seen as requiring significant business time but not focusing on the big issues, offering little in the way of strategic value.

As NEDs start to engage with their management teams on this, there is value in considering how their organisations can maximise their return on investment in operational resilience, seeking to avoid the issues previously experienced with regulatory-driven change. Whilst operational resilience could be seen as another regulatory fad, there is value and significant benefits for stakeholders if approached in the right way. In particular, operational resilience can bring insights into how operational delivery and a company’s business model is supporting the delivery of business strategy, and how changes can help to optimise the business model, improve performance and build resilience.

Thought of this way, operational resilience isn’t just about downside risk; it’s also about a business’s ability to capture and manage opportunities.

We see value in Non-Executive Directors asking themselves the following questions in respect of operational resilience:

• What strategic benefits can be gained from investing in the development of operational resilience?
• Where are the largest vulnerabilities, or areas for improvement? Are our company’s areas of concern the same as those of their regulators?
• How can operational resilience drive strategic value, helping us to engage more effectively with operational risk and resilience in a business focused way that aids decision making?
• How can we avoid operational resilience becoming a separate, siloed framework and approach?
• Who should lead operational resilience? Should operational resilience activity be primarily the responsibility of first or second line functions?

There has never been more interest and enthusiasm from companies to use data and technology to drive forward the effective delivery of strategy. It is widely recognised that innovation is required in ordered to remain relevant and competitive. 

Although using data and technology creates fantastic opportunities, generating real business benefits from a technical and operational platform can be difficult to do, especially whilst also avoiding unintended and adverse consequences. 

Introducing and encouraging innovation within a company by ustilising advanced technology (such as machine learning) brings with it a wide range of challenges which may not have arisen before with more traditional projects.

The most successful, and least damaging, initiatives are always those where the vast majority of the likely issues are highlighted right from the outset; and innovation projects are no different. The key to success is being well equipped to collectively identify, and rapidly expand knowledge and expertise in, these new areas. 

At the core, there are many questions that a business needs to explore before embarking on an innovation based project or transformation. These need to span traditional topics, such as cost and delivery, but must also branch out to potentially more unfamiliar areas.

To be effective companies, with the help of their boards, must have a shared, realistic understanding of their current maturity in relation to implementing and executing innovation, with an appropriate and tailored road-map for the future. 

An important part of maturity is understanding the company's definition of success relating to innovation and the genuine appetite for failure. This needs to involve more than paying lip service; there needs to be confidence that it will be demonstrated in practice. 

Consideration of the new and wider issues that innovation brings, such as culture, potential unintended biases and explainability of complex models, prior to presentation of live opportunities, will place companies in the best position to proceed and be successful.

Ensuring success and protecting the business when dealing with innovation requires up front broad and careful consideration of key questions, including:

• What are the non-traditional topics or areas that need to be considered but have a tendency to be forgotten?
• What adverse scenarios do we need to consider and how do we generate the range of possibilities? 
• What new skill-sets might be required at senior levels and what are the options that are available to secure them?
• How do we assess the company's readiness for, and maturity to manage, innovation and what steps can we put in place to make appropriate changes?
• How do we balance the need to communicate with and get buy-in from, a vast number of stakeholders with the need for pace and delivery?
• How do we manage and maintain enthusiasm alongside the reality of dealing with day to day issues and challenges?

We put Environmental, Social & Governance considerations (ESG) on our May 2020 Crowe NED club agenda, as we felt the topics were shifting into the political, regulatory and corporate mainstream. Discussions at that meeting were, quite naturally, dominated by the board leadership challenges of COVID-19; but when we touched on ESG and sustainability there were some significant differences of view. Some attendees strongly felt that work in this area would need to be deferred to enable economic recovery from the pandemic, while others believed that firms should embed ESG consideration more proactively now.

The pandemic has illustrated that companies are capable of changing entrenched ways of working to a degree perhaps not realised; in some cases it has also shown that these adjustments, made at a time of crisis, can bring significant costs and risks. The pandemic, like many crises, has resulted in a re-appraisal of individual and corporate purpose, with a notable shift towards expectations that companies not only deliver financial performance, but also make a positive contribution to society.

Whatever your viewpoint it is clear that the subject of ESG in general, and climate change in particular, will be a significant focus for 2021. In July 2020, the PRA set the expectation that firms should have fully embedded their approaches to managing climate-related financial risks by the end of 2021. The Climate Financial Risk Forum (chaired by PRA and FCA) produced a guide for industry on how to approach climate disclosure, risk management, scenario analysis and innovation.

The PRA also provided feedback that firms’ strategic responses need to be clearer and climate-related financial risks better considered. In November, the Governor of the Bank of England highlighted the challenges of transitioning to net zero emissions, and the key role the Bank sees the UK financial system having – to be resilient to risks from climate change and to play a key role in facilitating relevant investment in the economy. To encourage this, a climate stress test exercise  will be launched in June 2021, and firms are being given the clear hint to think about whether additional capital needs to be held against these risks. 

The FCA is requiring premium listed companies to improve climate disclosures for reporting periods beginning 1st January 2021 – the start of a longer-term trend. The FCA is consulting in the first half of the year on widening the scope further, introducing Taskforce on Climate-related Financial Disclosure (TCFD) obligations on asset managers, life insurers and pension providers and shifting from “comply or explain” to mandatory disclosure. The FCA is aiming to bring in disclosure rules for the largest firms by 2022, and the Chancellor will require all large companies and financial institutions to disclose climate risk information by 2025.

Whether or not firms want to focus on climate change, it looks like they are going to have to. While regulatory focus can help to create impetus, it does raise the risk that firms don’t address ESG and climate considerations in a sincere way and we see “greenwashing”. 

Crowe’s viewpoint is that for ESG to really be a success, not only do each of the E, S and G elements need to develop and progress to support the organisation’s strategy and purpose; there also needs to be a greater degree of linkage and integration between them. This integration is difficult to achieve through regulation alone, and requires organisations to see the benefits that can be realised through a joined-up approach. Activity needs to be focused, prioritised, and explicitly linked to an organisation’s purpose and strategy.

Our January 2021 meeting provides a great opportunity to consider the following important questions:

• What is the business case for investing in ESG and climate for your organisations? What costs and benefits do you see? Will capital increase? How will you measure the benefits?
• Should the focus be meeting regulatory expectations and managing risks; or on capturing value, for example through new products, investments and financing methods?
• Should the focus be purely on climate change, or should there be a more integrated approach to ESG?
• What are the key risks and challenges to overcome, and what role can the board play? How do you balance the short and long-term? Does board governance need to be refined?
• How do you bring your people and other stakeholders, including third parties, with you on the journey?
• How will financial services companies be expected to influence their investees in respect of ESG and climate? What challenges does this bring, for example to outsourced asset management?