Financial organizations are among the most regulated in the business world. And that burden has only gotten steeper, particularly at the federal and supranational levels.
Financial regulators pivoting to operational resilience
What’s more, many of the changes have been recent. Sure, the Sarbanes-Oxley (SOX) and Dodd-Frank Acts have been on the books for over a decade – SOX for even longer. However, global regulators in the last few years have increasingly turned their attention to strategic agility and operational resilience.
What’s followed has been a tidal wave of new regulation across major economies; as summarized by EY, they seek to ensure that firms can:
- Operate in a business-as-usual environment that’s far more complex thanks to external factors, such as digitization, geopolitical risk, and the cyber threat and
- Implement positive changes, e.g., integrating a merger, upgrading technology, or improving business processes, without introducing new risks.
Firms, as a result, have been wondering where they can turn to ensure compliance and uplift their level of resilience against new threats. In this article, we respond.
After summarizing recent resilience mandates, we explain the importance of resilience management software to the sector for individual firms to meet their obligations to customers, partners, regulators, and the wider economy.
Recent operational resilience mandates
Operating in this sector, you’re likely to know many of these financial regulations intimately. Nevertheless, here’s a summary of the most significant:
U.K. Operational Resilience of the Financial Sector
Perhaps the earliest regime of this type, operational resilience mandates have come into force in the U.K. after being delayed by Covid. Broadly speaking, these are new requirements intended to ensure that no single firm poses a risk to the financial system as a whole.
Following, financial firms must identify the important business services that could impact clients or the financial system if disrupted, set an impact tolerance for disruption to each of those services, and ensure they can continue to deliver those services and remain within their impact tolerances during severe but plausible scenarios.
More recently, though, regulation has expanded, mandating firms manage systemic risks posed by their critical third parties (CTPs). Proposals, here, give supervisory authorities broad powers to assess and strengthen the resilience of material services provided by CTPs to the financial sector under outsourcing arrangements.
Australia. APRA CPS 230 Operational Risk
Issued by the Australian Prudential Regulation Authority, APRA CPS 230 seeks to ensure that regulated entities in the finance and insurance sectors remain resilient to operational risks and disruptions, maintain critical operations through disruptions, and manage risks arising from service providers.
Relevant threats include the full range of operational risks, consisting of but not limited to legal risk, regulatory risk, compliance risk, conduct risk, technology risk, data risk, reputational risk, and change management risk.
To avoid such risks, APRA mandates regulated entities maintain appropriate and sound information and information-technology infrastructure to meet current and projected business requirements and support critical operations and risk management.
European Union. Digital Operational Resilience Act (DORA)
The first such Bloc-wide policy, DORA seeks to align the approach to managing information and communications technologies (ICT) and cyber risk in the financial sector across all EU member states. It does so by addressing potential systemic and concentration risks posed by the financial sector’s reliance on ICT third-party providers (TPPs).
More specifically, DORA introduces an oversight framework for EU TPPs deemed to be critical to the stability and integrity of the bloc’s financial system. DORA also seeks to consolidate and upgrade ICT risk requirements throughout the financial sector, to ensure that all participants of the financial system are subject to a common set of standards to mitigate ICT risks for their operations.
U.S. Sound Practices to Strengthen Operational Resilience
Issued by the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation, the paper provides firms with a set of best practices they can deploy to strengthen operational resilience in the face of internal and external operational risks. These threats, if left unchecked, could lead to a wide-scale disruption.
The sound practices outlined bring together existing regulations, guidance, and statements as well as common industry standards to provide a comprehensive approach that firms may use to strengthen and maintain their operational resilience. Areas covered include governance, operational risk management, business continuity management, third-party risk management, scenario analysis, information system management, and reporting.
How is the finance sector faring in complying with resilience mandates?
Given the onslaught of regulation, financial firms now face unique challenges when it comes to risk management and compliance amidst rapidly shifting requirements.
How are they doing? Although some of the mandates aren’t fully in effect yet, last fall we got a preview.
That’s when the Basel Committee on Banking Supervision, the global standard setter for regulation of banks, issued its audit of bank adoption of its (similar) Principles for Operational Resilience and the Sound Management of Operational Risk.
When it comes to operational resilience, the audit concluded that banks in the largest economies had work left to do. Primary findings included:
- Mapping interconnections and interdependencies for critical operations and the definition of tolerances for disruption to these operations are the most common challenges.
- Better resourcing and prioritization are needed.
- Board members’ roles and responsibilities and capabilities for operational resilience remain under development.
- Banks are struggling on business continuity and testing.
- Third-party risk management is a stumbling block. For some banks, there’s still significant work left to do to develop appropriate business continuity and contingency plans and exit procedures where third parties provide critical operations.
What steps did the report recommend banks take to strengthen operational resilience? A few broad themes emerged:
- Leverage all aspects of operational risk management to achieve operational resilience and to recognize the latter’s importance alongside financial resilience
- Acknowledge that operational resilience is more than just business continuity
- Adequately resource and prioritize POR and PSMOR adoption
The role of resilience software
The report is clear. The industry must prioritize resilience, and they must do so as regulators ratchet up external pressure.
For this, individual firms, whether looking to be viewed more favorably by the public, maintain regulatory compliance, stay competitive, minimize costs associated with a disruption, build confidence across stakeholders, and/or uncover potential opportunities, will need to take a comprehensive and holistic approach to resilience.
How can they do so? Firms can turn to digital resilience management tools that will help them simultaneously anticipate and adapt to change as well as respond to disruption more effectively.
Indeed, these centrally governed platforms consolidate disparate data to provide a comprehensive view of risks, threats, resources, and capabilities. This, in turn, helps to identify potential vulnerabilities and gaps in resilience planning and improve communication and awareness among different stakeholders.
4 ways resilience software can help financial services firms
How else can resilience management software help financial services firms? Here are four ways:
1. Anticipate operational risks to strengthen resilience
These solutions help financial services organizations proactively identify, assess, and mitigate potential risks that could cause operational failures or disruptions to their normal operations. A centralized workspace provides a holistic view of risks, streamlines operational risk-related processes, and fosters effective stakeholder collaboration and communication.
The platforms also manage risk across the entire third-party ecosystem, by connecting firms with third parties to foster seamless collaboration within a unified workspace dedicated to enhancing resilience. From onboarding and due diligence to risk monitoring, contract, and action management, these platforms equip teams to pinpoint and address the top issues across the vendor ecosystem.
2. Be better prepared
The tools also connect the people, processes, and tools required for organizations to enhance their operational resilience.
And thanks to streamlined, integrated, and automated business continuity management that facilitates engagement and collaboration across all stakeholders and ensures a unified approach to resilience, financial services organizations using these platforms remain prepared for adverse events and disruptions and stay ahead of the curve.
3. Respond more effectively to safeguard people and assets to maintain operations
These digital tools also help organizations proactively safeguard their people, assets, and reputation with actionable threat intelligence, enhanced situational awareness, and robust incident reporting to restore normal operations quickly and strengthen their resilience when faced with adverse events.
How? Resilience management software empowers organizations to plan, coordinate, and streamline their response efforts to minimize the negative consequences of an incident, crisis, or emergency and return operations to normal as quickly as possible with integrated threat intelligence, response plan activation, team collaboration, and post crisis reviews.
4. Ensure continuous improvement
Finally, these integrated resilience workspaces help financial services organizations cultivate a culture of continuous improvement by consolidating lessons learned from planning and response processes, harnessing resilience data to derive valuable insights for informed decision making, and taking proactive actions to strengthen resilience.
Noggin’s capabilities for financial services organizations
Not all resilience software platforms are created equal, though. An industry-leader in resilience and critical event management, Noggin provides an ROI-enhancing integrated resilience workspace.
A ten-in-one solution, Noggin seamlessly unifies operational & third-party risk management, operational resilience, business continuity, incident & crisis management, emergency management, and security & safety operations.
Relevant functionality for financial services firms includes but are not limited to:
Business continuity management
-
Dependency mapping. Quickly identify dependencies between business activities and supporting assets or vendors and stay informed when one is at risk. Visualize and track dependencies to make informed decisions and take appropriate actions to mitigate risks effectively.
-
Exercises and scenario testing. Don’t wait for a real-world crisis to test your organization’s readiness. With Noggin’s exercise management solution, you can be confident that teams are prepared to handle any situation that comes their way.
Operational risk management
Noggin helps organizations proactively identify, assess, and mitigate potential risks that could cause operational failures or disruptions to their normal operations. The centralized workspace provides a holistic view of risks, streamlines operational risk-related processes, and fosters effective stakeholder collaboration and communication.
Third-party risk management
Seamlessly collaborate with third parties in a unified workspace dedicated to enhancing resilience. From onboarding and due diligence to risk monitoring, contract, and action management, Noggin equips teams to pinpoint and address the top issues across the vendor ecosystem.
Citing the wider deterioration of the risk environment, regulators are ratcheting up pressure on financial services organizations, making resilience their mantra. How can firms themselves remain compliant while navigating a turbulent threat environment? We vote resilience management software.
But not any platform will do. Firms should consider an integrated platform, like Noggin, to remain prepared, protect what matters, and meet obligations, all the while strengthening their resilience.
Don’t take our word for it, though. Request a demonstration to check out Noggin for yourself.
.svg)
.svg)
.svg)