The term ‘operational resilience’ encompasses what used to be called ‘business continuity’ or ‘operational risk management’. This initiative comes from the UK regulators, keen to bring various strands of similar work together. An initiative that has the end consumer of business services in mind, and assumes that disruption will happen.
This was the first time that all three regulators (Bank of England (BoE), Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA)) had published a joint discussion paper. The paper highlighted how important they felt the issue was, both to the financial system and the UK economy as a whole.
The paper sets out the regulators' view that continuity of business services is essential to operational resilience. The paper also introduced the concept of 'impact tolerance statements' and asked for views on how best they could build on existing requirements to ensure statements continue to be effective, as the market and technology develops.
Naturally, firms will need to make large cost and time investments to take this work forward, but ultimately, there will be significant benefits. If firms embrace, rather than simply see it as a regulatory obligation, there should be many long-term advantages - for example, more stable and reliable operating platforms, clearly defined and tested workarounds when disruption occurs, and better consumer outcomes.
Firms operating in other jurisdictions as well as the UK, or globally, could replicate the principles outlined by the UK regulators, or apply them elsewhere. Therefore, there is an opportunity for UK firms to take the lead in developing internal frameworks.
Cyber resilience is an important, and currently more developed, aspect of operational resilience as a whole, and you can find out more on the IA's work on this subject in the member area.
LATEST DEVELOPMENTS (most recent first)
Consultation Paper
We expect the regulators to issue individual consultation papers, and some supplementary documents, in October 2019. From there it's likely that we could have a policy statement in mid-2020 and implementation during 2021.
The IA response to the Discussion Paper
We submitted a response to the discussion paper in October 2018. As well as responding to the specific questions raised in the paper, we emphasised five points:
1. Regulators should recognise the work already being done in this area by investment management firms, under the guise of operational risk management, contingency assessments, business continuity planning, and ICAAP scenario testing and reporting;
2. Regulators should apply proportionality to this issue and focus on where the real risks to customers and markets lie - on financial market infrastructures and systemically-important firms;
3. This work should note that the importance of third-party suppliers, cloud outsourcing and therefore market concentration in the risks that firms face;
4. The proposed services-based approach should be considered alongside the ongoing systems and processes-based approach. It should not be implemented as a replacement;
5. To improve the clarity of regulatory expectations, more guidance would be useful. For example, to help firms understand what the regulator defines as a 'vital service' or a firm's 'most important business service'.
Discussion Paper
The joint regulators issued a discussion paper in July 2018. In summary, the regulators believe that firms can achieve better operational resilience by focusing more on setting, monitoring and testing specific impact tolerances for key business services. These define how much disruption can be tolerated. Important concepts in the paper include:
- focusing on the continuity of the most important business services as an essential component of managing operational resilience;
- setting board-approved impact tolerances, which quantify the level of disruption that can be tolerated;
- planning that assumes disruption will occur, as well as seeking to prevent it.
EVENT
We will be discussing recent developments and how the IA is supporting its members at an event later in 2019.
MORE INFORMATION & CONTACT
See full details of how the IA is supporting its members on operational resilience in the member area.
Contact John Allan for more information.
Last reviewed 30-Sep-19
