2.1. Overview of Relevant PRA, FCA Guidelines and TPR Code of Conduct

The PRA initially established the framework for the operational resilience policy by clarifying how firms should comply with the rules in the “General Organisational Requirements, Skills, Knowledge and Expertise, Compliance and Internal Audit, Risk Control, Outsourcing and Record Keeping” parts of the PRA Rulebook. The initial guidance concerning business continuity in 2015 was subsequently updated in 2017 with a clarification of risk governance policy.

In March 2018, the Bank of England (BoE), PRA and FCA jointly issued a discussion paper concerning undertaking a “dialogue” with the financial services industry concerning expectations of the regulators and the wider public about the operational resilience of UK financial services institutions (BoE, PRA and FCA, 2018). This was subsequently implemented through an “Operational Resilience Policy,” which required UK financial sector firms to be “operationally resilient against multiple forms of disruption (including cyber-related attacks) to minimize the harm caused to consumers and markets (BoE, PRA and FCA, 2021).”Footnote ¹

Simultaneously, in March 2021 the PRA issued an operational resilience “Statement of Policy.” This clarified that all banks and insurers subject to the regulations should be “operationally resilient” through prevention, adaptation and recovery mechanisms (PRA, 2021a). Although not specifically mentioning cyber-risk sources of disruption, the Policy Statement further required that regulated firms to connect their operational resilience with their governance, operational risk policy business continuity planning and outsourcing activities.

The PRA also issued more specific statements of policies concerning impact tolerances for important business services (IBS) (PRA, 2021b), supplemented by an amended supervisory statement (PRA, 2022) and internal management. It also amended its PRA Rulebook concerning operational resilience (PRA, 2021c) and provided more specific policy and supervisory statements regarding outsourcing and third-party management (PRA, 2021d; 2021e).

Additionally, the PRA issued an implementation guide to provide UK-regulated banks and insurers participating in the CBEST intelligence-led penetration testing with an updated framework (PRA, 2021f). The purpose of the framework was to help deal with cyber-risk as an “important element of operational risk.”

Subsequently, speeches were made by three different PRA managers in the period March to May 2022 (Bank of England, 2022a, 2022b, 2022c), which sought to clarify and interpret different policy, supervisory risk and regulatory operations aspects of the operational resilience guidance, respectively. These sought to embellish and provide further clarification of the various definitional and implementation aspects of the original 2021 policy statements.

2.2. Other National Guidelines

In contrast to the PRA/FCA guidance, which is very principles-based and at a relatively high level of granularity, equivalent regulatory supervisors in other jurisdictions require significantly more detail related to the implementation of operational resilience by financial organisations. This section summarises the recent key operational resilience requirements of the European Union (EU), as well as five other OECD countries (Australia, Canada, Hong Kong, New Zealand and Singapore). The EU requirements are more focused on operational resilience that is contextualised to ICT related risks, while the Australian and Hong Kong guidance is at a much more granular level. The New Zealand requirements are based on cyber and systems resilience, while the Singapore guidelines are limited to business continuity planning and are more consumer oriented. By contrast, the Canadian guidance is more principles based but also more comprehensive in scope.

2.3. International Guidelines

There are also some international-level guidelines concerning operational resilience that are specifically focused on financial entities. However, at a higher level, the ISO issued some standards related to both risk management generally and security and resilience specifically, in relation to BCM systems. These are briefly outlined below.

• ISO 22301: Security and Resilience – BCM Systems (ISO, 2019). This standard specifies generic requirements for organisations to implement, maintain and improve a management system to protect against, reduce the likelihood of the occurrence of, prepare for, respond to and recover from disruptions when they arise. The organisation shall determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcome(s) of its BCMS. It also requires business impact assessment to be undertaken, which it defines as comprising: (a) implement and maintain systematic processes for analysing the business impact and assessing the risks of disruption; (b) review the business impact analysis and risk assessment at planned intervals and when there are significant changes within the organisation or the context in which it operates.

• ISO 31000: Risk Management – Guidelines (ISO, 2018a). This standard proposes a generic risk management framework, to assist the organisation in integrating its risk management system into its most significant operational activities and functions. The framework development encompasses integrating, designing, implementing, evaluating and improving risk management across the organisation. It comprises six generic elements:

  1. 1. Leadership and commitment: Top management and oversight bodies, where applicable, should ensure that risk management is integrated into all organisational activities and should demonstrate leadership and commitment.

  2. 2. Integration: Integrating risk management relies on an understanding of organisational structures and context. Structures differ depending on the organisation’s purpose, goals and complexity. Risk is managed in every part of the organisation’s structure. Everyone in an organisation has responsibility for managing risk.

  3. 3. Design: When designing the framework for managing risk, the organisation should examine and understand both its external context (e.g. stakeholders, legal context) and internal context (e.g. organisational culture, strategy and objectives).

  4. 4. Implementation: The organisation should implement the risk management framework by developing an appropriate plan including time and resources, identifying where, when and how different types of decisions are made across the organisation and by whom, modifying the applicable decision-making processes where necessary, and ensuring that the organisation’s arrangements for managing risk are clearly understood and practised.

  5. 5. Evaluation: The organisation should periodically measure risk management framework performance against its purpose, implementation plans, indicators and expected behaviour; and determine whether it remains suitable to support achieving the objectives of the organisation.

  6. 6. Improvement: The organisation should continually monitor and adapt the risk management framework to address external and internal changes. In doing so, the organisation can improve its value. The organisation should continually improve the suitability, adequacy and effectiveness of the risk management framework and the way the risk management process is integrated.

ISO subsequently issued an amendment to ISO 31000 in 2020 that added the generic sentence “The organization shall determine whether climate change is a relevant issue.”

ISO also issued a specific standard, ISO/IEC 27000, related to information technology and security techniques (ISO, 2018b). Although of direct relevance to DORA implementation, it is not sufficiently generic in nature to cover “operational resilience” and so is not reviewed.

2.4. Industry Specific Guidelines

This section briefly outlines more granular levels of regulatory guidance concerning operational resilience requirements that are directly related to specific types of financial entity. There are relatively greater levels of regulatory guidance concerning operational risk for banks than for insurers.

3.1. Risk Culture

As summarised in Section 2.3, ISO 31000 highlights the importance of organisational risk culture as the relevant internal context to the design of an effective system of operational risk resilience, by reinforcing the need to integrate risk management into the overall culture of the organisation.

A strong risk management culture is therefore essential for building operational resilience and customer focus. It refers to the prevailing attitudes, values and behaviours determining how employees approach risk. A positive risk culture is one where risk is seen as an opportunity for improvement, not something to be hidden or ignored. Employees at all levels are encouraged to identify and report risks, and management is committed to taking appropriate action to mitigate them.

Organisations must take risks to deliver value and for the following reasons:

• Growth and innovation: Playing it safe all the time limits opportunities for growth and innovation. Taking calculated risks allows organisations to explore new markets, develop new products or services and gain a competitive edge.

• Adapting to change: The business landscape is constantly evolving. By taking risks, organisations can adapt to new technologies, customer demands and market conditions. Those who cling to the status-quo may be left behind.

• Seizing opportunities: The best opportunities often lie outside of comfort zones. Taking calculated risks allows organisations to capitalise on new market opportunities, strategic partnerships and technological advancements; and

• Learning and improvement: Taking risks, even if they don’t always pan out, can be a valuable learning experience. Organisations can learn from their successes and failures, improve their decision-making processes and become more resilient.

It is important to remember that risks shouldn’t be taken blindly. Effective risk management involves careful analysis, weighing potential rewards against potential downsides with a customer focus, and taking steps to mitigate risks before acting. Taking calculated risks is essential for organisational growth and achieving objectives. However, the prevailing risk culture within an organisation dramatically impacts its ability to manage these risks effectively.

A strong risk culture also fosters informed risk-taking and enhances performance. Conversely, an inappropriate culture can lead to activities that contradict established policies and procedures. In such cases, individuals or teams may engage in risky behaviour, while others turn a blind eye or fail to recognise the issue. This can significantly hinder the achievement of goals and, in severe cases, lead to reputational and financial ruin.

Risk culture failures are often at the heart of organisational scandals and collapses. For instance, the Walker report on UK banks’ corporate governance post-financial crisis highlighted the importance of behavioural change and cultural transformation over mere compliance exercises (Walker, Reference Walker2009). Similarly, the Baker Report (BP US Refineries Independent Safety Review Panel, 2007) on the BP Texas City explosion pinpointed leadership, competence, communication and cultural deficiencies as contributing factors to the tragedy.

Risk culture is a double-edged sword. While a cautious culture can stifle innovation by overemphasising rigid processes, an overly risk-averse culture can lead to uncontrolled risk-taking due to a disconnect between formal policies and actual behaviour.

National cultures also play a role in shaping organisational risk culture. For example, Hofstede (Reference Hofstede2001) provides a well-known five-dimensional model of national risk culture. Varying interpretations of communication, like “yes” signifying different levels of commitment, and differing cultural attitudes towards risk and shame, can influence both risk management and reporting. African cultures, for instance, emphasise inclusivity and allowing everyone to contribute, while European and North American cultures may move to decisions more quickly. These are cultural differences, not right or wrong approaches, each with their own strengths and weaknesses.

While advances have been made in enhancing the quality of risk management frameworks and processes in recent years, strong risk culture remains the missing link. Effective risk management goes beyond just rules and procedures. Even the most well-defined framework can be misinterpreted or deliberately ignored. Understanding and fostering a strong risk culture is critical for balancing risk and reward in decision-making, ultimately leading to organisational success.

In conclusion, for an organisation to be successful, key characteristics of a strong risk management culture should include the following aspects:

• Customer Focus: Listening to the customer and delivering on the promised service or product.

• Risk awareness: Employees at all levels of the organisation understand the importance of risk management and their role in identifying and mitigating risks.

• Open communication: There are open channels of communication for employees to report risks without fear of reprisal.

• Management commitment: Senior management is visibly committed to risk management and sets the tone for the organisation.

• Continuous improvement: The organisation has a continuous improvement process in place for identifying and addressing risk management weaknesses.

There are many benefits resulting from having a strong risk management culture. A strong risk management culture can provide organisations with the following benefits:

• Enhanced service quality: Higher levels of customer satisfaction and brand loyalty.

• Reduced risk of disruptions: By proactively identifying and mitigating risks, organisations can reduce the likelihood of disruptions to their operations.

• Improved decision-making: A strong risk culture encourages employees to consider the potential risks of any decision.

• Enhanced reputation: Organisations with a strong risk management culture are seen as more reliable and trustworthy by their stakeholders.

• Competitive advantage: A strong risk management culture can give organisations a competitive advantage.

There are several actions that organisations can take to foster a stronger risk management culture, including:

• Leadership commitment: Senior management must visibly demonstrate their commitment to risk management and to delivering for customers.

• Communication and training: Employees need to be trained on risk management principles and procedures.

• Risk assessment: Organisations should conduct regular risk assessments to identify potential risks.

• Incident reporting: Employees should be encouraged to report all incidents, near misses and risk observations.

• Performance measurement: Organisations should track and measure their risk management performance.

Organisations adopting these actions create a stronger risk management culture that will help them build their operational resilience and thereby achieve their strategic organisational objectives.

3.2. Risk Appetite

OSFIC (2024) requires regulated entities to produce an “operational risk appetite statement” which should be “integrated into the FRFI’s enterprise-wide risk appetite framework as described in OSFI’s Corporate Governance Guideline Similarly, the PRA’s 2021 guidelines identify a relationship between risk appetite and impact tolerances. However, the regulations reviewed in Section 2 do not explicitly define what is meant by the term “risk appetite” and its relationship to operational resilience. This section briefly identifies the key relevant issues.

In today’s dynamic business environment, organisations need to balance pursuing the potentially conflicting business objectives of both achieving growth and safeguarding themselves from disruption. This balancing act hinges on two key concepts: risk appetite and operational resilience. Although distinct, they are intricately linked, forming the foundation for a robust and sustainable organisation.

3.3. Building a Solid Information Technology Foundation for Managing IT Risk

A solid IT foundation comprises a well-organised set of technologies and applications that are effectively managed and supported, minimising risks. It possesses the following characteristics:

• Standardised infrastructure with the necessary technology configurations and no more.

• Well-integrated applications that are only as complex as necessary.

• Documented data structures and consistent process definitions throughout the enterprise.

• Controlled access to data and applications, with built-in mechanisms to prevent unauthorised actions and detect anomalies.

• Support staff knowledgeable about each application and its support for business processes.

• Maintenance processes that keep technology up to date with required security patches and upgrades, providing adequate protection in case of a technology failure.

3.3.2. Establish the Base of the IT Pyramid

The IT risk pyramid (Figure 1) further helps organisations to prioritise their IT risk and resilience management efforts. By focusing on the foundation of the pyramid (availability), organisations can reduce the risk of cascading failures that can impact higher levels of the pyramid (access, accuracy and agility).

Figure 1.

IT risk pyramid.

Adapted from Westerman (Reference Westerman and Ross2005).

The IT risk pyramid comprises the following elements:

• Availability sits at the base of the pyramid, representing the foundation. It refers to the risk of IT systems being unavailable or experiencing downtime. This can lead to lost productivity, revenue and customer satisfaction.

• Access refers to the risk of unauthorised users gaining access to IT systems or data. This can lead to data breaches, fraud and other security incidents.

• Accuracy refers to the risk of data being inaccurate or unreliable. This can lead to poor decision-making, operational inefficiencies and reputational damage.

• Agility sits at the top of the pyramid, representing the most complex and impactful risk. It refers to the risk of IT systems not being able to adapt to changing business needs. This can lead to missed opportunities, competitive disadvantage and ultimately, business failure.

Each factor in the pyramid is contagious to another, giving rise to primary and other consequential and interconnected risks. For example, the availability of non-standardised infrastructure can affect all the risk factors in the rest of the pyramid.

Risk factors associated with each of these five elements are summarised in Figure 2.

Figure 2.

IT risk factors in the risk pyramid.

Adapted from Westerman (Reference Westerman and Ross2005).

Addressing the risk factors from bottom to top is the easiest path to reducing IT risks and organisational impact. With this approach, the following organisational issues associated with IT risk management are easier to manage at the base of the pyramid:

• ROI is easier to justify for reducing risks in the lower tiers, where risk can be easily quantified and key risk indicators implemented to monitor risk reduction.

• Risks are less quantifiable on the upper tiers of the pyramid.

• ROI at the top of the pyramid may take years so start with the low-hanging fruit.

• Higher-tier risks cannot be fully solved until the base is under control.

3.4. Risk Model Maturity

Risk models is a framework that helps organisations to identify, assess and prioritise potential risks and opportunities. It is the roadmap for navigating uncertainty. The maturity of a risk model refers to the sophistication and effectiveness of the risk management framework. A mature risk model goes beyond simply listing risks; it is the fundamental basis for risk analysis, scenario planning and continuous improvement processes. Risk models are essential to establishing operational resiliency. Organisations at the initial stage will not have the agility to change or convert to increase their resilience, as represented in Figure 3.

Figure 3.

Risk maturity model.

Adapted from Carnegie Mellon University Software Engineering Institute (1995) and Protiviti (2006).

Figure 3 shows that an organisation’s approach to risk management progresses through five stages:

1. 1. Initial: Risk management is undocumented and relies mostly on individual efforts.

2. 2. Repeatable: Risk is inconsistently defined and managed in separate areas with weak process discipline.

3. 3. Defined: A standardised risk assessment/response framework is established. The organisation provides leadership and the board with an organisation-wide view of risk, often in the form of a list of top risks. Action plans are implemented to address high-priority risks.

4. 4. Managed: Risk management activities are coordinated across business areas. Where appropriate, risk management techniques and tools are used, with enterprise-wide risk monitoring, measuring and reporting. Alternative responses are analysed with scenario planning and techniques like Monte Carlo simulation. Process metrics are in place, but the focus remains on managing a list of risks. Discussions about risk are separate from discussions about strategy and performance.

5. 5. Optimising: The focus shifts to managing risk within the context of enterprise objectives rather than managing a list. Strategic planning, capital allocations and daily strategic and tactical decision-making all consider potential risks. Decision-makers have a reasonable level of assurance that they are taking the right risks at the right level to achieve success, not just to avoid failure. Early-warning systems are established to notify the board and leadership of specific risks that exceed the organisation’s established risk appetite or risk-capacity thresholds and when enterprise objectives are in danger. Discussion of risk at both the top management and board levels is fully integrated with the discussion of strategy and performance.

3.5. Benefits of a Risk Mature Model

The benefits of a mature risk model extend beyond just improved operational resilience and can also result in the following:

• Reduced costs: Proactive risk management helps prevent disruptions, which can be far costlier than untimely mitigation efforts.

• Enhanced customer confidence: Customers are more likely to trust organisations that demonstrate a commitment to operational resilience.

• Improved regulatory compliance: Many organisations require robust management practices. A mature risk model therefore helps to ensure improved regulatory compliance.

• Improved organisation’s risk strategy.

• Increased organisational performance: Industry studies suggest that organisations with more mature risk models increase their organisational performance by up to a third.

3.6. Robustness of the Impact Tolerance Setting Process

Where relevant, impact tolerances should clearly align with the firm’s defined risk appetite categories, as both are focussed upon potential disruption and risk-taking beyond what is acceptable. However, operational resilience impact tolerances likely need to be set at a point beyond the risk appetite limit, as the operational resilience limit is probably at a point beyond the often commercially driven desire of the board (which is reflected within risk appetite limits) and will therefore potentially result in intolerable harm and/or clear risks to wider market stability. What is the appropriate level for setting and monitoring impact tolerance levels, and how can these be justified and validated? Impact tolerances should naturally attach to the IBS that a firm has identified. These tolerances should have a clear relationship to specific points or components of the IBS, or to the service. A firm should challenge itself if its impact tolerances are set at an overall IBS level only. It should challenge itself on whether more granular tolerances would add more value in enabling the firm to more effectively identify resilience requirements and status within a particular process/service indicators that may be used to monitor IBSs and their components, thus providing a granular view of resilience status/risk. These should also be clearly linked back to the overall IBS level impact tolerances. Impact tolerances should be set at the point at which firms feel that disruption to an IBS would pose a risk to the safety, soundness, financial stability, or policyholder protection. It is therefore crucial that firms ask themselves “is there a lower level/more granular level of impact whereby significant disruption could be identified and responded to more quickly?” – if the answer is yes, then impact tolerances should be set at a more granular level.

How should data information sources be used to supplement expert judgements? Internal data sources should be used to inform and test expert judgements. This includes incident/loss/near-miss data (including information on resulting impacts) that first-line teams as well as second-line risk teams may hold (e.g. back testing). This should be supplemented by externally sourced information, including the following:

• Periodic research/ongoing scanning of industry and wider news where incidents, research and other content may add evidential value to the firm’s thinking.

• Scanning should include industry news/media, as well as news/media that is focussed on operational resilience topic-specific items such as cyber security and physical asset management.

• Both internal and external sources of data and information can be used to both build and challenge scenarios that help develop a firm’s thinking.

How can firms accommodate the heterogeneity in the end users of IBS?

• Firms should leverage work that they undertake to identify their target market, to help define the characteristics of end users. Disruptive events/scenarios can be placed against these to help the firm work through and identify the potential impacts that these events may have on them.

• If a firm knows that it has a significant proportion of end users that are outside of its target market, it should seek to broadly understand their profile and characteristics to undertake the same exercise.

How can standard duration-based tolerances improve their ORF by specifying tolerances with additional metrics? Duration-based tolerances will be a core part of a firm’s tolerance set in relation to operational resilience. These can be supplemented by relevant SLA-based tolerances and risk-based tolerances or Key Risk Indicators (KRI), to build an overall picture of resilience, which takes account of the following:

• Duration of outages or disruptions.

• Service quality.

• Threat/vulnerability sources (e.g. weaknesses identified via audit, overdue remediations, lack of key people to support the running of a key IBS, external cyber-attacks).

Duration-based tolerances can also therefore be supported by additional metrics that can act as flags for potential vulnerabilities before any duration-based disruption occurs, which can trigger planned responses to investigate or take pre-emptive action.

3.7. Sophistication of Scenario Testing Approaches

This section covers key aspect of scenarios and their importance to operational resilience. It first outlines the key concepts, which then lead to the development of a scenario-based operational resilience system in the next section. Risk practitioners and decision makers are faced with a range of information when conducting risk assessments and planning.

A comprehensive operational risk framework requires an organisation to develop and undertake full scenario analysis to generate forward-looking synthetic data to imagine a plausible range of hypothetical events and the corresponding propagation of consequences, to estimate their corresponding impact. One way to develop those futures is alternative futures analysis (AFS), which is defined as a set of techniques used to explore different future states developed by varying a set of key trends, drivers and/or conditions (US Department of Homeland Security, 2010). AFS is best suited to environments with high uncertainty and too complex to trust a single point prediction. In a complex emerging risk environment, there is a wide range of factors that are likely to influence the crystallisation of the risk. AFS can help analysts, decision-makers and policy makers contemplate multiple futures or scenarios, challenge their assumptions and anticipate surprise developments in various scenario analysis contexts, for example, as applied to wide range of environmental modelling contexts such as modelling bio-complexity associated with multiple alternative uses of landscape environments (Bolte et al., Reference Bolte, Hulse, Gregory and Smith2006).

In general, scenarios refer to a range of detailed, longer-term narratives used to explore how the world might look in the future. Scenario planning is a futures-oriented planning technique used for medium to long-term strategic risk analysis and planning. It is used to explore plausible futures and to develop policies and strategies that are robust, resilient, flexible and innovative. Scenarios are narratives set in the future, which describe how the world might look in, say, ten, twenty, fifty or even a hundred years. They explore how the world would change if certain trends were to strengthen or diminish, or various events were to occur.

Usually, a range of scenarios are developed, which represent a range of different possible futures outcomes, associated with different trends and events in a most likely, optimistic and pessimistic future states. These scenarios are then used to review or test the operational resilience profile of a firm under a range of disruptive events. Scenarios can be used to identify critical dependencies and guide measures designed to increase resilience. They are also a useful means of identifying early warning indicators that signal alternative future outcome possibilities.’

A scenario planning tool describes a particular set of conditions that might impact a firms operational resilience risk profile over a specified horizon. The task of a firm undertaking scenario analysis is to determine the following:

1. 1. The impact of an external disruptive risk event on a firm’s critical business operations.

2. 2. The actions of management.

3. 3. How firms may respond to the unfolding events described by the scenario.

It should be noted that these scenarios are not limited to purely quantitative econometric forecasts but can also be used to model a series of events that might impact a firm or the economy. They also do not necessarily represent a firm wide consensus view on how to address an operational resilience issue, but rather they are intended to provide a basis on which different strategic issues can be analysed.

3.7. Customer-Centric Operational Resilience

Consumer duty and conduct risk are critical foundations for operational resilience not only for financial services but for all customer-facing businesses. A customer-centric foundation ensures that firms not only withstand and recover from disruptions but also maintain their obligations to customers and uphold fair market practices. As noted in Section 2, legislation in the UK (Financial Conduct Authority, Conduct Risk and Consumer Duty) and Singapore (MAS) safeguard consumers’ interests and promote fair dealing. These elements interconnect in several ways.

Moreover, consumer duty and conduct risk are crucial for operational resilience in all customer-facing businesses, not just financial services. Recent legislation in the UK and Singapore aims to safeguard consumers’ interests and promote fair dealing. Fair dealing has also been a focus from insurers in France, where customer loyalty has made insurers move away from the traditional business model to more customer-centric models (Clements et al., Reference Clements, Rath and Chanon2021). The following section highlights some of the key aspects.

3.7.4. Integration into Operational Resilience

Effective consumer duty and conduct risk management also drive the development of robust IT systems and systems supporting customer delivery, which can withstand disruptions while continuing to serve customers effectively. Feedback loops from monitoring consumer outcomes and incidents help to continuously improve ORFs. Firms that prioritise consumer duty and conduct risk are therefore better prepared to communicate clearly and transparently with customers during a crisis. An emphasis on ethics and compliance furthermore ensures that the firm’s response to operational disruptions is fair and just, thereby protecting the firm’s reputation and legal standing.

In conclusion, consumer duty and conduct risk management are essential for operational resilience, by enabling firms to be more focused on the importance of upholding high standards of ethical behaviour, regulatory compliance and customer-centric practices, ensuring long-term stability and success of a business as it encourages the right ethics and behaviours within an organisation, driving brand-loyalty.

Figure 4 summarises the inter-relationship between a consumer-centric operational resilience system; conduct risk and consumer duty as the main beam; and the three pillars of identify and prepare, respond and react and recover and learn. It then identifies the integral physical, IT and cyber security as the foundation.

Figure 4.

Consumer-centric operational resilience.

In summary, the analysis in this section and in Figure 4 suggests that operational resilience should be fully integrated into the firm’s risk management strategy as part of its response to the demands of meeting regulatory requirements for consumer duty and conduct risk. The following aspects are highlighted:

The main beam comprises three “pillars”:

1. 1. Pillar 1 – identify and prepare: Categorise key information systems; map IBS; identify and assess risk threats and vulnerabilities of mapped areas; determine likelihood of occurrence; assess controls to determine residual risks; scope and scale threats and vulnerabilities; undertake impact assessments; identify tolerance to impacts; prioritise based on risk appetite; communicate results; and identify third-party dependencies.

2. 2. Pillar 2 – respond and react: Fully integrate both business continuity and incident management strategy into the ERM system and link to firm’s risk capacity and appetite; develop crisis management communication plans to both internal and external parties (e.g. media); and manage physical security and facilities and cybersecurity risk threats.

3. 3. Pillar 3 – recover and learn: Board to review report of incidents and review lessons learned; monitor issues and review controls effectiveness; and promote learning and continuous improvement via war games and business continuity exercises.

4.1. Emerging Risks

The coronavirus pandemic, geopolitical polarisation, the ongoing wars in Ukraine and the Middle East and threats of nuclear events have all become daily news. At the same time, recent bank runs in the U.S. and ripple effects through the financial markets bring back memories of the global financial crisis of 2008–2009. These turbulent times have led financial sector organisations to a renewed focus on emerging risk planning and preparedness and an enhanced focus on assessing the effectiveness of their ERM frameworks in categorising, planning and mitigating the effects of a wide range of emerging, systemic events. Against this backdrop and in their business-as-usual environment, organisations are faced with four risk types, as summarised in Table 1:

1. 1. Known risks: These are easily identified, and organisations have plans and strategies to avoid and mitigate their consequences.

2. 2. Emerging (unknown known affecting both model and/or data) risks: These are also known, but the full extent of their immediate, short- and long-term ramifications and their interactions with other types of risks are yet not fully clear.

3. 3. Unknown risks: Black swans, these are unprecedented and unimagined, extremely rare events, with massive impact. They are “intrinsically unpredictable” due to lack of or non-existent reliable historical data on these events (Taleb, Reference Taleb2007; Taleb and Blyth, Reference Taleb and Blyth2011).

Table 1.

Risk classification

4.2. Threats to Operational Resilience

The operational resilience of firms is at risk from a variety of discrete, linked and compound events (Cutter, Reference Cutter2018). Emerging risks such as control failures, third-party disruptions, infrastructure outages, technology failures, cyber incidents, geopolitical incidents, pandemics and natural disasters tied to extreme weather events and biodiversity loss are significantly more complex and different than traditional risks. These types of risks act as amplifiers to existing risks. They are characterised as “systemic” in nature because they are concurrent and diversified; they happen to everyone at the same time, and they have the potential to cause a system-wide breakdown or significant disruption to human-caused economic, financial and security systems supporting our way of life. Furthermore, emerging risks create common consequences that can cluster and cascade, because of the multiple consequences triggered by the risks. These consequences combine and accelerate within a certain risk context, and they generate unforeseen effects.

Cascading and clustering of consequences further increases the magnitude of the total systemic risk. Examples of emerging risks to financial firms include attacks on AI-enabled financial trading models, bond dumping by foreign holders of equity and debt securities, deep-fakes used to spread misinformation used to manipulate beliefs and behaviours of investors. Thus, they pose increasing threats to firms operating systems and to the supply of products and services to customers.

Linked risks are risks that have the same cause; for example, in 2010, the same meteorological weather anomaly over Russia sparked extreme heat and persistent wildfires in Russia as well as heavy rainfall fuelling heavy flooding in Pakistan. Compound risks are risks that have independent causes, but their effects join in a certain risk context and amplify the consequence(s). For example, the ongoing wars in Ukraine and between Israel and Hamas, amplified by the continuous attacks on ships in the Red Sea amplifying the risks to global supply chains and raising the cost of war risk insurance and transportation costs.

In general, emerging risk is defined as the product of the likelihood and consequence of an outcome. Systemic, disruptive operational events are high-impact, low-probability events and they are considered unlikely. Therefore, risk managers often omit to assess the impact associated with these types of risk because they do not realise that such very unlikely risks have an impact that is so large that they dominate the calculation of total risk and thus they are worthy of special attention.

Consequently, the identification and assessment of threats posed to the operational resilience of firms requires fresh thinking; by considering unlikely risks and moving beyond an assessment of the risks of individual events such as cyber-attacks, wars and power grid failures, based on historical data alone; and assess scenarios of these events and their associated 1^st, 2^nd, 3^rd, 4^th … order societal and economic consequences over the immediate, short, medium and possibly long term. Therefore, by identifying these types of systemic, disruptive scenarios, firms can minimise service disruptions associated with emergencies that arise from these types of risks.

Therefore, an effective ERM system should incorporate a robust ORF to enhance the ability of the firms to withstand, adapt to, and recover from such events while continuing to deliver their critical operations by undertaking the following three steps:

1. 1. Identify the firms’ critical operations and mapping the internal and external dependencies (e.g. people, systems, processes, third parties, facilities and so on) required to support critical operations.

2. 2. Establish tolerances for disruption in respect of a firm’s critical operations.

3. 3. Conduct scenario testing to gauge the ability of the firm to operate within its tolerances for disruption across a range of severe but plausible scenarios; including high impact, low probability events and considering the normal and radical uncertainty associated with scenario design and evolution across single and multiple time horizons (Georgescu, Reference Georgescu2020).

Figure 5 illustrates the trade-off between the relationship between the relative impact and relative likelihood of several types of events that may cause business disruption.

Figure 5.

Trade-off between relative impact and likelihood of low probability, high consequence risks (HM Government, 2023).

© Crown copyright.

4.3. Operational Resilience Risk Assessment

The UK financial sector regulatory authorities defined the concept of impact tolerances as “the types of failure which would be intolerable for both their customers and financial services market providers” (BoE, PRA and FCA, 2018). Operational resilience requires a dynamic method to risk assessment rather than the static approach of looking for longer term reviews on an annual basis. The goal of an ORF is to enable management to model what may lie beyond the horizon by thinking the unthinkable in identifying and handling unexpected events that disrupts their critical operations and to offer management an array of possible futures. Extreme risks generate downstream, knock-on consequences and a range of triggered, linked and compound risks. These risks tend to cause similar cascading consequences such as a failure of a nation’s electric power distribution systems, with knock-on effects on food, energy, transportation and supply chains.

For example, the geopolitical threat posed by emerging technologies such as an electromagnetic pulse weapons (EMPs) developed by an adversarial non-state actor pose a systemic threat that can hold a society at risk with catastrophic consequences (Congressional Research Service, 2008). A discrete EMP attack on a single nation, or an EMP attack on a group of nations simultaneously, has the capability to produce significant damage to a nation’s critical infrastructures including a nation’s electric power grid, telecommunications, banking and financial services, fuel, energy, food and water and transportation infrastructures. For example, in the highly networked and inter-dependent banking and financial services industry, millions of transactions happen electronically on an hourly basis. All transactions are recorded and stored electronically, and they depend on the speed, processing and storage capabilities of electronic information technology. A large-scale terrorist attack on a developed nation’s electricity infrastructure using an EMP weapon can disrupt all critical infrastructure, including power, transportation and telecommunications systems. Consequently, essential operations in key financial markets may be severely disrupted, thereby in turn increasing the systemic risks of the global financial system (McAndrews and Potter, Reference McAndrews and Potter2002). A potential EMP attack can cause widespread functional collapse of the electric power system in the area(s) affected, and consequently disrupt the infrastructure, utilities, global supply chains and resource networks that service financial sectors of nations around the world.

Moreover, the risk of disinformation is increasing. Recent news reports and analysis have highlighted the risks of the use of artificial intelligence methods in enabling increasingly realistic photos, audio and video digital forgeries, known as “deepfakes.” According to a recent report on CNN, a finance worker at a multinational firm was tricked into paying out $25 million to fraudsters using deepfake technology to pose as the company’s chief financial officer (Chen and Magramo, Reference Chen and Magramo2024).

Furthermore, deepfakes can potentially be used as character assassination tools for people working in various organisations. Further, some even suggested that AI tools such as ChatGPT could be used to create full digital “patterns of life” in which an individual digital footprint is mapped against malicious and fake personal information, such as spending habits and job history, to create comprehensive digital personal profiles that can be used potentially to generate false news. This can influence public discourse, manipulate beliefs and behaviours and erode public trust in publicly listed companies across the world, with far-reaching financial implications.

4.4. Mapping the Consequences of Operational Disruptions

A robust ORF therefore requires fresh thinking by considering unlikely risks and moving beyond an assessment of the risks of individual events causing disruption to critical business services based on historical data alone; and placing more focus on the multiple pathways of cascading consequences that these events may trigger. Moreover, a robust ORF assesses reasonable worst case scenarios of these events and their associated 1st, 2^nd, 3^rd, 4^th, etc quantifiable direct impacts (e.g. financial losses, deaths, injury), as well as their non-quantifiable indirect impacts (e.g. psychological damage), over the immediate, short, medium, and possibly longer term. A top-down (feed forward) and bottom-up (feed backward) cause/consequence analysis framework can be used to provide a holistic view of “what might happen?” It can thereby provide the risk owner/decision maker with an enhanced understanding of the multiple pathways of linked and compound secondary and higher risks and pathways of cascading impacts triggered by these events (see Figure 6).

Figure 6.

Propagation of risk through socio-economic systems.

This framework provides an enhanced method of how to assess the likelihood of these events. It also removes some of the biases associated with low probability events, by thinking in terms of the higher likelihood of the cascading consequences triggered by these events, impacting firms’ critical operations; instead of the likelihood of the events themselves. The discussion in Section 4.4.1 highlights the interrelationship and interdependencies between different types of events and their implications for analysis.

4.4.2. Feed Backward Emerging Risk analysis (FFA)

Financial organisations may not be aware of which scenarios lead to the risk of organisational failure. This requires the identification and assessment of the circumstances that may cause the firm’s business model to become unviable or result in its counterparties losing confidence to a critical extent. For example, it requires assessment of the impact of how many configurations of triggered primary and secondary risks leads to multiple, simultaneous financial services failures, where customers withdraw cash from multiple banks leading to multiple, simultaneous bank runs. Figure 7 illustrates the issue in the context of emerging risks and their common consequences.

Figure 7.

Emerging risks and common consequences.

4.4. Key Considerations When Building an ORF

This section suggests that the following issues are relevant to evaluating and implementing an OR:

1. 1. Recognise at board level that firms’ operational resilience profiles need explicit management, and they need to be considered from a holistic system based multidisciplinary approach and view.

2. 2. The design of scenario-testing should be proportional to the size, complexity, business and risk profile of the firm, as well as its level of interconnectedness to the financial system.

3. 3. To build a robust scenario framework that considers a range of risks, hazards and shocks, engage with external experts to identify, evaluate and monitor these risks and the different approaches to cope with these risks properly.

4. 4. Develop an operational resilience analysis framework for the systematic identification of emerging threats to IBS that are considered improbable, or unlikely, and develop a framework for understanding, assessing, modelling and mitigating emerging, systemic risks and anchoring the framework in the latest theories and reliable data.

5. 5. The framework should also include the following considerations:

   • Horizon scanning to identify the most significant extreme risks to firms’ critical operations.

   • Categorisation of risks into three classes, namely discrete, concurrent, or cascades, and identifying the underlying causes (drivers); do they have the same underlying cause or independent causes and are the consequences(s) discrete, compound and cascading?

   • How likely are they to happen?

   • The range of plausible worst-case outcomes?

   • What is the likelihood of consequences if the risk happens, and how will the risk(s) affect the firm’s IBS?

   • What is the timing of the consequences: are they immediate, short term, medium term, or long term?

   • Assess to a reasonable degree the multiple cause-and-effect relationship driving emerging risks and the complex, cascading consequences the set-in motion.

   • Understand the correlations between risks focus on higher-order cascading effects of the risk

   • Develop reporting strategies to communicate judgement about risks to senior management in a timely manner considering the importance of using the correct vocabulary when explaining risk. Further, when reaching a judgement about a risk the following factors need to be accounted for:

     1. (a) Quantify the certainty level of all key judgements about the risks.

     2. (b) Identify explicitly the critical assumptions.

6. 6. Define the 3rd party service providers

7. 7. Define level of disruption potentially caused to customers

   • Level one : Disruptive event does not significantly impair the ability of banks or insurance companies’ senior management to run the firm but causes a minor inconvenience to customers.

   • Level two : Disruptive event impacts the financial and/or operations safety and soundness of a firm and causes significant stress to customers.

   • Level three : Disruptive event results in a significant increase in systemic risks, which threatens the operational resilience of the firm, with the potential to cause financial instability. Consequently, it may cause significant disruption to the reliability and/or integrity of the quality of services provided to customers. Figure 8 summarises the different levels of disruption.

     Figure 8.

     Levels of disruption.

     

8. 8. Identify essential resources (people, technology, facilities) that support critical business services.

9. 9. Identify impacts.

   • Quantifiable impacts such as financial losses, loss of life and injury.

   • Non-quantifiable psychological impacts such as the dread factor.

10. 10. Undertake scenario testing techniques and learning outcomes:

    • ➢ Run simulations or workshop exercises based on the designed scenarios.

    • ➢ Learn from the outcomes, identify weaknesses and refine your operational resilience strategies.

    • ➢ Ensure that senior management and relevant stakeholders understand the scenario methodology.

    • ➢ Clearly define roles and responsibilities during disruptions.

    • ➢ Establish effective communication channels to coordinate responses.

A robust ORF requires a firm to implement a system level view of multiple risks. It also requires the firm to invest effort into undertaking discussions of reasonable and plausible scenarios impacting a firm’s critical operations in a variety of situations for each plausible risk event; based on the best available historical, statistical and scientific evidence and analysis of the key trends and uncertainties that will shape the strategic emerging risk landscape. This is to allow firms to minimise the strategic shocks associated with emergencies that arise from these types of operational risks.

5.1. Implementing ORFs

Like many frameworks, to effectively implement an ORF, the following things need to be considered/ achieved:

• There needs to be clear, consistent and strong commitment from senior management (Board and below) to emphasising the importance of the ORF and its effective operation. They need to ensure that they maintain oversight of its implementation and ongoing effectiveness. This includes ensuring the adequate provision and direction/allocation of resources.

• Wherever possible avoid developing and implementing a framework that introduces siloed and parallel processes to existing frameworks/ways of working that unnecessarily add to people’s workloads. This will result in a lack of buy-in and commitment to operating them effectively.

• The requirements of an ORF should be stitched into first line firm-wide and functional objectives, roles and responsibilities and resource plans.

• These should be integrated with existing roles and responsibilities that relate to issues such as service design and delivery, IT infrastructure, physical asset management, risk management and control, customer service and outcomes, business continuity and disaster recovery.

• This points to the need to avoid, where possible, adding new policies and procedures, instead focussing on augmenting and updating existing policies to help make OR a part of a “business as usual” in terms of working and thinking (and not a separate exercise).

• Likewise, new MI and reporting will need to be developed, but this should be incorporated where possible and appropriate into existing governance bodies and committees (changing the terms of reference of relevant committees to incorporate). Again, this reinforces the fact that an effective ORF should be part of a firm’s usual thought processes, oversight and decision-making.

• Like any new framework or change in ways of working, close attention should be paid to user experience and feedback in operating that framework. It is likely that areas of improvement will be identified, including in relation to the adequacy of impact tolerances, the nature of scenarios and response plans. Feedback should be consistently sought to help iron out any design and operational challenges or opportunities to build further enhancements.

• As would be the case with business continuity and disaster recovery relevant events, lessons learnt following any OR event should consider the adequacy of the ORF in enabling the effective management of that event.

• From a second line perspective, firms should seek to enable an appropriate level of integration between their ORF, as both will leverage each other, for example, risk appetites and KRIs helping to provide key contextual guidance and understanding around exposures, and insights from operational resilience monitoring helping to inform the firm’s understanding and assessment of its risk profile. It is crucial that insights generated by both frameworks inform the other and do so in efficient, non-duplicative ways, for example, use a single approach/process to identify, record and assess incidents and near-misses. Risk universes, risk policies and procedures, assessment methods, monitoring tools and metrics should take account of OR and build related requirements, responses and thinking around threats and mitigation/control into them. This will also help enable the provision of effective second line oversight of OR and ORFs.

5.2. Operational Resilience Maturity Dashboard

This section briefly outlines the most recent developments in the level of operational resilience maturity by a small number of large, regulated UK entities. The analysis is based on the OECD ERM maturity risk dashboard (OECD, 2021), which was developed initially for implementation by taxation authorities. However, the framework, being consistent with the ISO 31000 generical guidance on the implementation of best practices in ERM systems, is therefore also compatible with the analysis of the maturity of operational resilience.

5.2.3. Implementing the Maturity Dashboard in practice

Data and Sample

The operational resilience maturity of the six largest UK listed FIs which are subject to the BoE, FCA and PRA (2021) guidelines in the were chosen for initial analysis, comprising the two largest banks, insurers and asset managers by total assets.Footnote ⁴ The annual reports related to each of the three latest years after the issue of the guidelines (2021–2023) were then analysed.

Findings

Table 2 summarises the average maturity scores (ranging from 1 to 5) for the six UK FIs in each of the 10 categories, as well as their total average operational resilience maturity (as a percentage).

Table 2.

Sample of large UK financial institutions’ average operational resilience maturity disclosure scores 2021–2023

The average operational resilience maturity score ranges vary considerably across the 10 major categories, with the highest average level for ERM policy and operational risk management framework, and the lowest for risk treatment, risk analysis and evaluation and risk information communication and reporting. Moreover, there have been significant improvements over time for only the first five categories of operational risk management, as well as the five operational risk management subject areas. The overall operational resilience maturity of the sample increased only slightly from 2021 to 2022 but increased to 50% in 2023. Overall, the results suggest that, at least for the sample of six largest UK FIs, there is only a progression to an established level of average operational resilience maturity. Figure 9 summarises the major trends across each of the three categories of UK financial institution over the period 2021 to 2023.

Figure 9.

Average total operational resilience maturity for UK financial institutions by sector type.

Figure 9 shows that banks have a significantly higher level of total average operational resilience maturity than either insurers or asset management institutions. Banks and asset management institutions have gradually increased over the last three years, but the insurance industry failed to increase from 2021 to 2023.

The results of the analysis suggest that, while the total overall operational resilience of the six largest UK FIs has gradually increased over time, there are significant variations across the dashboard, with implementation of overall ERM and operational risk management frameworks not being fully integrated with processes of monitoring, review and risk communication. Furthermore, there are considerable variations between types of FIs, with the two banks averaging established levels of operational resilience maturity while the two asset managers are still emerging and progressing stages of maturity. By contrast, insurance companies are lagging the banks in terms of maturity but are considerably more advanced than the asset managers. These results are of concern given the importance of these “too big to fail” FIs to both the overall UK economy and to the confidence that these institutions are robust to operational resilience threats.