Operating in a state of “business as usual” is no longer synonymous with an absence of disruption or crises occurring. The challenges institutions face have become predictably unpredictable. From geopolitical events to natural disasters to mismanagement of risks, there are global business disruptions which are being dealt with daily. The “new normal” is a state of near constant management and mitigation of disruption to services.
The chance of compounding crises occurring is a major concern for risk, resilience, security, and operations teams. There is mounting pressure (from regulators as well as consumers) for organizations to take a proactive approach to ensure their future resilience, assuming regular controls might fail and scenarios will be more severe than anticipated. With that being said, there are three key considerations to remember when implementing a more resilient state.
Break Down Silos
At the simplest level, a firm’s leadership needs to know where their organization might have vulnerabilities, what must be done to prevent impacts being felt, and how to implement resilience measures in order to be better prepared for future disruptions. In some organizations, their operational risk, cybersecurity, IT disaster recovery, supply chain, compliance, and business continuity programs operate in isolation from one another. They work off of different data sets and have differing priorities which leads to different processes and tools. This results in departmental silos producing inconsistent reporting and decision-making.
To solve this, organizations are establishing cross-functional steering committees, bringing together leaders from operational resilience, business continuity and disaster recovery, cybersecurity, and third-party risk management to align complementary programs, teams, data, and metrics. In addition to ensuring consistency and streamlining processes, breaking down these silos also increases transparency, knowledge, and alignment across the firm.
Of course, these collaboration programs require strong leadership (with some bringing in a chief resilience officer) as well as a significant change in the company's culture and approach to risk and resilience. These leaders are best situated to provide key insights and analysis for executive teams to consider when making critical company decisions around matters which involve digital transformation, geographic expansion, or third-party initiatives.
Increase Focus on Third-Party Risk Management
Organizations must also sharpen their focus on their third-party risk exposures as they pertain to important or critical business services. Resilience teams are working with third-party management teams to better assess potential supply chain vulnerabilities and understand the risk profiles of their critical third parties.
There has been a recent plethora of regulation around critical third-party providers to the financial services sector, such as the EU's Digital Operational Resilience Act (DORA), the UK’s “PS7/21 outsourcing and third-party risk management” as well as “DP3/22 Operational resilience: Critical third parties to the UK financial sector,” and Australia’s “CPS 230 Operational Risk Management” (including third-party risk management). This is setting in motion a change to best practice methodologies around supply chain resilience, with even those unaffected by the regulations looking to align with requirements.
Supply chain disruptions and consequent impacts are particularly hard to manage due to the amount of time that it can take to onboard and offboard firms and then rebuild the resources to satisfy the requirements of all process and service owners. This is exacerbated when battling vendor-based cybersecurity breaches, which are only on the rise as attackers recognize the value that they bring in access points to a wide range of firms. To combat this effectively, it has never been more necessary for cyber, resilience, and third-party teams to work in conjunction.
Think Globally, Act Locally
With the rise in regulatory scrutiny, firms are being challenged with a new obstacle: the increasing complexity of running one holistic program that complies with all global regulations. The stakes can be high in terms of fines; the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) issued their first fine (of £48 million/$58 million) against the lack of operational resilience measures to TSB Bank in December 2022. The operational, legal, and reputational stakes can be even higher to remediate, costing millions to even billions.
Most of these regulations have a common requirement: firms must be able to map their critical business services and interrogate all processes, assets, and resources that support those services, both within the company and throughout its supply chain. This holistic approach demands a comprehensive, integrated platform that allows organizations to view their data and analyses through a single lens.
The Time is Now for Operational Resilience
Updating or overhauling a company's operational resilience program can seem daunting – but it's been proven time and again that a well-functioning resilience program is the best insurance against financial and reputational loss. Events, like the recent Silicon Valley Bank collapse, may suggest many risks are unpredictable, but the root causes and lack of adequate risk management are there if we look. Firms can be proactive and must focus on what they areempowered to do now. By streamlining teams and processes, reprioritizing investments based on vulnerabilities, and finding properly tailored technology, firms will be better prepared to weather the disruptions of the future.
