Building resilience: what are the top five operational risks for financial services firms?

he coro­n­avirus cri­sis has forced busi­ness­es of all shapes and sizes to reflect and rethink how to improve and update process­es for the dig­i­tal age. At the heart of this reeval­u­a­tion is oper­a­tional resilience: a top­ic that has become increas­ing­ly promi­nent in recent years – par­tic­u­lar­ly with­in the finan­cial ser­vices sec­tor – accord­ing to a Strate­gi­cRISK glob­al sur­vey com­mis­sioned by Riskon­nect and pub­lished in June.

“Grow­ing reg­u­la­to­ry pres­sures, a con­tin­ued shift towards intan­gi­ble assets, digi­ti­sa­tion and the Covid-19 pan­dem­ic are just some of the rea­sons why [oper­a­tional resilience has grown in impor­tance for busi­ness lead­ers],” states the report.

The research paper, ‘Eyes wide open’, explains how oper­a­tional resilience is built and offers organ­i­sa­tions tips on how to be ready for any­thing. Fur­ther, it argues that while there has been a shift in think­ing about resilience more broad­ly since the pan­dem­ic began, the more sig­nif­i­cant cat­a­lyst was the glob­al finan­cial crash of 2008.

“In part, it is a reac­tion to the feel­ing that gov­ern­ment, busi­ness and soci­ety were all tak­en by sur­prise by some­thing they should have seen com­ing in their rear-view mir­ror,” it says. Analy­sis by How­den indi­cates that near­ly 70% of total busi­ness val­ue for the world’s largest 50 cor­po­ra­tions now emanates from intan­gi­bles, equat­ing to rough­ly $11tn.

“From a super­vi­so­ry per­spec­tive, sur­viv­ing and thriv­ing in the face of a major shock requires a holis­tic frame­work, with top man­age­ment set­ting the tone from the top,” the report con­tin­ues. “Oper­a­tional resilience is the start of a jour­ney, they argue. It is not a des­ti­na­tion.”

Jim Wetekamp, chief exec­u­tive of Riskon­nect, sug­gests that while board­rooms dis­cuss this sub­ject, tak­ing action is more impor­tant. “The most well-used term at the moment is oper­a­tional resilience in risk man­age­ment,” he says. “You can go to any organ­i­sa­tion that touch­es risk right now, and they are talk­ing about oper­a­tional resilience, which is great. But it is a merg­ing of worlds that are enter­prise risk, oper­a­tional risk and con­ti­nu­ity togeth­er.

“Now, that doesn’t nec­es­sar­i­ly mean that you should think of oper­a­tional resilience as a super­set of all that func­tion­al­i­ty. It’s this idea that I need to describe my crit­i­cal busi­ness ser­vices, under­stand my tol­er­ance for inter­rup­tion and define risk impact analy­sis and response plan. And I need to be pre­pared for dif­fer­ent sce­nar­ios of acti­vat­ing that. That is very much an oper­a­tional resilience top­ic.”

This con­cept was built on the foun­da­tions of tra­di­tion­al busi­ness con­ti­nu­ity man­age­ment strate­gies, he says. But, “the rea­son it’s called oper­a­tional resilience is that it starts from the oth­er end. It’s about the out­come and the quan­tifi­ca­tion of crit­i­cal busi­ness ser­vices and the impact finan­cial­ly if dif­fer­ent risks cause them to fail.”

The report lists the top five oper­a­tional risks for busi­ness lead­ers, based on sur­vey respons­es. By far the top-ranked answer, with 88%, is cyber risk and data secu­ri­ty. Giv­en how cyber­crim­i­nals are tak­ing advan­tage of the secu­ri­ty chal­lenges posed by the new envi­ron­ment, this is not a sur­prise. “A more dis­persed work­force has allowed mali­cious actors to evolve their social engi­neer­ing and brute force hack­ing tech­niques to find new, more tar­get­ed meth­ods to com­pro­mise net­work sys­tems and defraud organ­i­sa­tions,” the report posits.

Sec­ond on the oper­a­tional risk reg­is­ter for 2021 is staff well­be­ing and peo­ple risk, select­ed by 74% of respon­dents. And the third most con­cern­ing oper­a­tional risk, with 52%, is organ­i­sa­tion­al change.

In light of these risks, Riskonnect’s CEO says there needs to be inter­nal change man­age­ment. “Risk pro­fes­sion­als need to con­tin­ue to demon­strate the ben­e­fits of hav­ing risk at the front of the deci­sion process,” he adds. “They need to explain why this sup­ports the move from mon­i­tor­ing to con­tin­u­ous improve­ment, from watch­ing to orches­trat­ing – that’s how risk will work col­lab­o­ra­tive­ly across the organ­i­sa­tion.”

To find out more about oper­a­tional risk down­load the ‘Eyes wide open’ report

Spon­sored by

Riskon­nect