Operational resilience & coronavirus: A UK perspective
- 7 August 2020
As part of our operational resilience discussion groups, we hosted a call for our members who are active in the UK on 25 March 2020.
The discussion was originally going to be about the Operational Resilience Consultation Paper. However, given the current situation, our primary focus was on the coronavirus (Covid-19) pandemic and its impact on operational resilience.
The discussion was open to organisations in the ORX membership who are active in the UK. It offered a platform for our members to share perspectives, challenges and ideas with each other. Here's some of the main points from the discussion.
Key discussion points:
- Coronavirus is the biggest operational resilience challenge participants have encountered. Firms are having to consider how to capture and understand the impact and the implications for resilience.
- Current pandemic scenarios are being stress-tested live and amended as necessary. Most existing pandemic scenarios are missing the components needed given the current outbreak.
- In recent years, planning for pandemics had been put on the back burner, with the focus being on ‘hot topics’ such as cloud computing and cyber. Going forward, the industry will need to reconsider the extreme, yet plausible scenarios it plans for.
- Firms are starting to focus coronavirus planning beyond the next week or two, prioritising resilience preparations for key services to support the wider economy and their own operations (e.g. considering how the payments control environment can be adapted so services can continue).
- Firms are trying to be more agile in their approach to internal communications, with tools being used to support the virtual environment. Questions were raised regarding whether the maintenance of additional communication tools is sustainable long-term (post coronavirus).
- Most reported work from home (WFH) capabilities were holding up under stressed circumstances and operations were able to continue, albeit this is accompanied by increases in the operational risk profile (e.g. increased process errors).
- Gaps in business continuity frameworks have been highlighted by the current situation. Resiliency planning will need to be enhanced to allow for the complex interdependencies between different areas of an organisation when there is widescale disruption.
- This was particularly noted with regards to third-party suppliers/vendors, with a number not equipped to deal with the current situation. There is also a need to have a better understanding of supply chains and of supplier concentration risk.
- There has been an increase in the frequency of communications between firms and their third-party suppliers (particularly with FMIs).
- Concerns were raised regarding the sustainability of having back-up suppliers for the same service to increase operational resilience, as well as over the resiliency of cloud service providers.
- Firms reported having open communication lines with regulators on the topic of resilience.
Next steps on operational resilience
Since June, we've been working with our UK active members to support their response to the Bank of England/FCA Operational Risk Consultation Paper. The first phase of this work is looking at how they are approaching the definition and identification of 'Important Business Services', as well as their operational and organisational response to resilience. Later stages will include looking at scenario testing and effective measures and tolerances.
In October 2020, we published a short report looking at how firms can address the regulatory challenge of operational resilience:
