The new horizon for risk and resilience

The Pru­den­tial Reg­u­la­tion Author­i­ty, the Finan­cial Con­duct Author­i­ty and the Bank of Eng­land joint­ly issued a paper out­lin­ing a stronger reg­u­la­to­ry frame­work to pro­mote oper­a­tional resilience across the finan­cial ser­vices sec­tor. It deter­mined that resilient organ­i­sa­tions are those able to respond effec­tive­ly to dis­rup­tion, adapt their sys­tems and learn from crises.

Meet­ing that stan­dard is a tall order indeed. But for banks oper­at­ing both with­in the UK and glob­al­ly, oper­a­tional resilience is achiev­able.

“It seems to me, that the focus of the reg­u­la­tors is absolute­ly right,” says HSBC UK’s chief com­pli­ance offi­cer Ralph Nash. He adds that the inter­est of reg­u­la­tors in oper­a­tional resilience is inher­ent­ly linked to the industry’s abil­i­ty to con­tin­ue oper­at­ing through dis­rup­tion. If com­pa­nies are unable to do so, the risks begin to crys­tallise. “This isn’t a phan­tom risk; this is a real risk. And we’ve seen it. We’ve seen it dam­age fran­chis­es. And we’ve seen it dam­age rep­u­ta­tion.”

Nash joined a pan­el of com­pli­ance and risk lead­ers at a recent round­table exam­in­ing risk, resilience and rep­u­ta­tion in the finan­cial ser­vices indus­try. “Oper­a­tional resilience is the abil­i­ty to ful­fil your promise to your cus­tomers and the abil­i­ty for you to actu­al­ly deliv­er on what you say you’re going to deliv­er,” says Rich Coop­er, glob­al head of finan­cial ser­vice go-to-mar­ket at oper­a­tional resilience con­sul­tan­cy and soft­ware com­pa­ny Fusion Risk Man­age­ment.

The pan­el agreed with Coop­er and Nash, while also dis­cussing the dif­fer­ence between resilience and dis­as­ter recov­ery. Covid-19 was a cri­sis that few could have expect­ed. But the abil­i­ty of banks to not only sur­vive, but thrive, dur­ing the pan­dem­ic is an indi­ca­tion they had strate­gi­cal­ly con­sid­ered where their risks were and devel­oped plans to address them, regard­less of the land­scape. Doing so allows an organ­i­sa­tion to pro­tect its rep­u­ta­tion, there­by ensur­ing resilience in the future.

Achiev­ing this, how­ev­er relies on the align­ment of inter­nal process­es. Long has the sec­tor been plagued by inter­nal silos where data – and poten­tial risks – are seg­re­gat­ed by team or stake­hold­er. Coop­er says that Fusion Risk Management’s tech­nol­o­gy helps com­pa­nies gain insight into risks across the busi­ness, and across the sec­tor more broad­ly, in order to build a more robust pic­ture of risk. The inte­grat­ed nature of mod­ern rep­u­ta­tion means finan­cial ser­vices insti­tu­tions are break­ing down these silos to analyse the organisation’s over­all resilience.

Paul Bar­rett, chief risk offi­cer at AIG UK likens this to ‘revers­ing the tele­scope’ to exam­ine the organ­i­sa­tion from the customer’s point of view. “Our inter­nal process­es will always sup­port the cus­tomer, but the pri­ori­ti­sa­tion may actu­al­ly look dif­fer­ent if you’re com­ing at it from the customer’s point of view, rather than just think­ing about the which are the biggest inter­nal depart­ments or where the biggest costs are. That may not be the same met­ric that the cus­tomer would use,” he says.

The cus­tomer focus means rep­u­ta­tion mat­ters more than it has ever done before. Nash adds that social media means a sim­ple app out­age – for exam­ple – can appear on social media with­in min­utes, turn­ing a lack of resilience into a rep­u­ta­tion­al issue for the bank and a ser­vice and poten­tial con­duct issue for cus­tomers.

Toby Mason, chief oper­at­ing offi­cer at Alli­ca Bank, a younger com­pa­ny cater­ing to SMEs, agrees: “We’re dras­ti­cal­ly impact­ed a lot more than the big banks if we get things wrong, in par­tic­u­lar, if we get things wrong for our cus­tomers. Resilience for us is a life and death mat­ter.” He adds that resilience relies on agili­ty. “We’re a speed­boat in a world of super-tankers. Although a large super-tanker could the­o­ret­i­cal­ly crush us, we are able to turn quick­ly and adjust our course. That abil­i­ty to react very quick­ly helps to build resilience and com­pet­i­tive advan­tage.”

Even for the larg­er banks, agili­ty res­onates as a strat­e­gy toward achiev­ing oper­a­tional resilience. The chal­lenges posed by the pan­dem­ic proved this time and time again. “His­tor­i­cal­ly, banks have been wor­ried about keys and cash. What they should also be wor­ried about is data and sys­tems,” says Nash. “To be resilient, you’re solv­ing for your cur­rent and future busi­ness mod­el, not your past one.”

Coop­er sim­i­lar­ly says the pan­dem­ic has height­ened the need for resilience. Because Covid touched every ele­ment of the organisation’s oper­a­tions and strat­e­gy, com­pa­nies had to con­sid­er their peo­ple, their sys­tems and their dig­i­tal strate­gies cohe­sive­ly. That has in turn accel­er­at­ed oper­a­tional resilience and risk man­age­ment.

Risk, resilience and rep­u­ta­tion are clear­ly con­nect­ed,” says Bar­rett. When con­sid­er­ing oper­a­tional resilience, as an insur­er, AIG has to con­sid­er the impact third-par­ties may have, what mat­ters most to the cus­tomer, and above all, focus on the crit­i­cal ser­vices that cus­tomers rely on. Ensur­ing risk is mit­i­gat­ed and the com­pa­ny is resilient has helped it main­tain its rep­u­ta­tion through­out the pan­dem­ic; a sen­ti­ment shared by the pan­el.

But it’s not just the organ­i­sa­tion itself that is in con­trol of its own des­tiny. Rela­tion­ships with third par­ties, cus­tomers and reg­u­la­tors all shape an organisation’s strat­e­gy around oper­a­tional resilience. David Glendin­ning, UK head of risk, Société Générale, says: “The way our stake­hold­ers look at it, includ­ing reg­u­la­tors, proves that finan­cial ser­vices is a process chain… Unfor­tu­nate­ly resilience is one of those areas where you won’t get much cred­it for doing well, but you will attract scruti­ny if you get it wrong. For this rea­son, we don’t have an appetite for this risk in a busi­ness sense, but must deter­mine our tol­er­ance lev­el.”

How­ev­er, the chal­lenge still lies in com­mit­ting to change. For organ­i­sa­tions large and small across the sec­tor, resilience relies on a lev­el of strate­gic fore­sight that has been chal­leng­ing to imple­ment. “Future resilience requires deep tech­no­log­i­cal invest­ment and inno­va­tion. That goes beyond the typ­i­cal three-year plan­ning cycle,” says Blair McAu­li­ffe, VP region­al chief risk offi­cer EMEA at Metlife. “It can con­flict with more imme­di­ate busi­ness pri­or­i­ties. But, what I’m see­ing, par­tic­u­lar­ly since the pan­dem­ic is stake­hold­ers talk­ing about a much longer-term view. And that’s reflect­ed in what many com­pa­nies are now doing in terms of dig­i­tal invest­ment and inno­va­tion.”

Mason adds: “If we’ve learned noth­ing else in the last few years it’s that these black swan events are going to hap­pen. Agili­ty is the only chance that we have to respond to some of these things. We’re going to need to respond in real time and make deci­sions on the fly.”
Coop­er echoes that com­mit­ment to agile deci­sion mak­ing and says that informed deci­sions are cru­cial to oper­a­tional resilience, par­tic­u­lar­ly dur­ing times of change. Data and insights helps com­pa­nies make these fact-based deci­sions and mit­i­gate risks.
As the new reg­u­la­tions come into place around oper­a­tional resilience, it seems the finan­cial ser­vices indus­try is well-equipped to meet new chal­lenges. Com­pa­nies that remain agile in the face of change will ensure that oper­a­tional resilience tru­ly becomes the new hori­zon in risk and rep­u­ta­tion man­age­ment.

For more infor­ma­tion please vis­it fusionrm.com

Spon­sored by

Fusion Risk Man­age­ment