By Stuart Birnie, Operational Risk and Resilience Specialist, whyaye
Today’s customers expect a 24/7 service. It’s a cultural norm in a world where products and services can be accessed via a tap on an app.
But an increased emphasis on digitization across many sectors means that many organizations are relying on third parties to provide this infrastructure and support. In turn, those providers may be reliant on smaller firms. It’s a complex, interconnected world, with major institutions unable to exercise full control of the digital infrastructure that underpins their services.
And in this world, a problem experienced by a firm, or one of their suppliers, can have major ramifications… and lead to a damaging service outage which profoundly affects customers. Think about the implications of a banking app crashing, or customers being unable to withdraw money from cash machines.
Unsurprisingly, a stricter regulatory regime in respect of risk and operational resilience is coming into play across the globe. In the UK for instance, the Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) operational resilience regulations came into force in March 2022 for in-scope financial services providers, with regulations on third party risk management coming into play in a similar timeframe. Other countries are following suit.
So how are organizations facing up to the challenges?
One solution is simply to throw people at the problem – to build up large, in-house teams of operational resilience and risk specialists and cybersecurity experts.
However, without a high level of insight into risk and resilience supporting these teams, this can be a costly – and in the long-term, an ineffective – method of addressing the problem. Without streamlined systems and processes, this approach can keep an organization mired in a reactionary mindset.
Yes, it can be an easy option, but in the long-term, it’s an inefficient way of managing risk, ensuring resilience and delivering the level of service customers deserve.
Technology which provides organizations with a single view of risk and resilience, through one portal, can help to reduce risk across a business. Automated and continuous scenario planning can identify vulnerabilities and real time data on risk position provides confidence when forward planning. That reactionary approach can be replaced by proactivity and agility.
Crucially, an effective integrated risk management platform, can help to connect siloed teams – for example finance, IT, cybersecurity and facilities management – and break down the barriers to effective operational resilience. It can ensure that data from multiple, disparate sources is brought into once accessible, system. And it can help an organization meet regulatory requirements and demonstrate compliance more easily.
Technology in practice – the benefits of an integrated risk management platform
Picture this scenario.
An organization is managing risk and resilience via multiple different processes and systems. This situation has arisen due to a string of business acquisitions and the lack of a unified system across its functions and locations: different departments are approaching risk and resilience in their own ways and via their own processes.
This organization is using an array of different systems for vendor risk management, operational risk management and business continuity – and these systems vary enormously in terms of their functional capabilities. Some departments are reliant on spreadsheets and laborious manual processes.
In this case, the implementation of an integrated risk management platform can have multiple benefits:
- The introduction of one system, which uses the same data model, means that the organization has one consistent and timely view of risk and resilience. For example, the business, risk management and audit functions – the three lines of defence – all have the same view of the organization’s cyber risk position.
- The multiple methods and processes employed by the organization are consolidated and automated via capabilities such as continuous controls monitoring: this has benefits for efficiency and generates better and more timely insights. For example, rather than employees needing to manually check that all key systems are patched, an automated indicator can do this instead. And instead of staff spending hours preparing reports for a risk management committee, or preparing documentation on the organization’s compliance with external regulations or standards (such as ISO 27001), this can be generated by the system.
- The organization’s support models are simplified and the user experience is enhanced, as there is only one system to maintain and use.
What lessons can be learned?
If systems are consolidated and there is a transition to the use of a single data model, all areas of an organization will be impacted. So it’s important to ensure that the project has active support and involvement from senior management, and all areas of the business are involved and bought into the journey.
In addition, an organization will need to undertake a significant amount of work to improve data quality. It will involve all areas of the business – for instance ensuring that risks, controls and policies are consistent and fit for purpose. This needs to be balanced with speed of decision making, so it’s vital to ensure that areas of accountability and delegation are clear, and there is a focus on business outcomes.
Finally, a project of this scale shouldn’t be carried out ‘side of desk’. An organization should ensure that its people have the appropriate capabilities and capacity to carry the project to completion.
Looking to the future…
The rise in geopolitical tensions is disrupting supply chains and changing much of business landscapes. Organizations are becoming more aware, for instance, of the importance of robust cybersecurity functions.
Effectively managing risk and resilience should therefore be a key priority for every organization. However, in recent years, many companies have realised that they can’t carry this out manually, or by relying on an array of disparate, poorly performing systems.
As a result, in coming years we will witness organizations managing risk and resilience far more dynamically. There will be a more widespread integration of highly flexible prediction, prevention, preparedness and response capabilities that are tested, challenged and adapted on a near constant basis. Automation and AI will become more prominent in areas such as scenario testing, risk / threat identification and continuous controls monitoring.
All of this will culminate in a ‘real time’ view of risk and resilience. This will provide those in accountable roles, such as a COO, CIO or CRO, with the intelligence to make the right decisions in a timely manner.
And in turn, this will only improve the customer experience, which, of course, is the ultimate goal of all risk and resilience activities.
For more information on whyaye, visit https://whyayeltd.com/
About whyaye
Founded in 2019 by Maureen Robson Norman, Anna Bisset and Lisa Smith, whyaye brings a fresh, new approach to the UK consultancy landscape. Its clients include multinational financial services, consumer goods and energy companies.
Based in Newcastle upon Tyne, UK, whyaye delivers outcome-led, technology enabled change into organisations, drawing on its extensive industry expertise and employing a collaborative approach to generate real results.
It has created a thriving hub of industry-leading specialists across business change and IT transformation. They apply their expertise and energy to help businesses become more efficient and successful.
whyaye combines innovation in business change and IT transformation with a deep level of expertise and an energetic, positive culture. It breaks down the barriers to change and generates buy-in across organisations by making the transformation process collaborative, fun and exciting.
whyaye’s team have extensive experience of delivering IT transformation, business change and operational resilience through previous roles at major global FS institutions and multinational technology companies. This gives them a comprehensive insight into the challenges of delivering long-term change.
whyaye is a premier ServiceNow partner, with a team of industry-leading ServiceNow specialists who provide guidance, insight and up-to-the-minute intelligence on the application and implementation of this technology. The company has an innate understanding of the ServiceNow environment, thanks to the track record and experience of its industry-leading IT transformation experts. For more information visit https://whyayeltd.com/
