Loading…

DarkLight mode

News – 18.11.24

International Men's Day - breaking the silence around men's mental health

International Men's Day - breaking the silence around men's mental health … Read more

Insight – 20.11.24

A change in US Presidency: How might it affect your finances?

In this article, we explore the potential economic and financial impacts of Donald Trump's return to power. … Read more

Upcoming event – 10.12.24

Funding innovation in the technology sector: Are the government doing enough?

Join us for an exclusive roundtable breakfast to explore the question of whether the government are doing enough to support innovation in the technology sector. … Read more

Find us quickly

130 Wood Street, London, EC2V 6DL
enquiries@buzzacott.co.uk T +44 (0)20 7556 1200

Last updated: 27 Sep 2024

Building operational resilience: implications for your business

On 28 May 2024, the Financial Conduct Authority (FCA) published a new  webpage  providing key insights and observations for firms preparing to comply with PS21/3: Building operational resilience, by the end of the transition period on 31 March 2025.

PS21/3 sets out the FCA's final rules and guidance on building operational resilience, developed following an initial consultation (CP19/32) held in December 2019. The FCA expects firms to use the observations set out on the webpage to review their approaches to compliance with the rules and assess readiness in relation to several key areas, including:

About the author

Priya Mehta

+44 (0)20 7556 1372
mehtap@buzzacott.co.uk
LinkedIn

Important business services: Firms are required to identify 'important business services' (by reference to the FCA's  Handbook) and keep these under review.
Impact tolerance: Firms are required to set 'impact tolerances' for each identified important business service, also to be kept under review. The FCA recommends providing a full rationale for impact tolerances in any self-assessment, to ensure the FCA can understand what has been set and why.
Mapping and third parties: Firms must identify and document the people, processes and facilities necessary for delivery of any identified important business services, including relationships with third parties which could impact a firm's ability to remain within an impact tolerance. The FCA expects to see firms' mapping of resources and processes to develop over time, to enable firms to create a clear picture of all relevant dependencies required to deliver the services.
Scenario testing: Firms must develop and maintain testing plans that detail how firms can remain within their respective impact tolerances for important business services. The FCA expects this scenario testing and mapping to have 'matured' throughout the transition period, providing firms with a greater understanding of their resilience capabilities.
Vulnerabilities and remediation: Firms' mapping and scenario testing should identify any vulnerabilities which may put impact tolerances at risk. The FCA expects firms to have significantly progressed remediation activities for vulnerabilities identified in the early part of the transition period.
Response and recovery plans: The FCA highlights exercise and testing of recovery plans as fundamental to understanding whether firms can remain within impact tolerance, noting that reviews of self-assessments so far show 'limited evidence' of the testing in this regard.
Governance and self-assessment: The self-assessment is a tool for firms to document their journey to becoming operationally resilient. The FCA expects self-assessments to develop over time. These should include an overview of identified vulnerabilities, scenarios tested (including relevant outcomes), remediation plans and firms’ strategies for ensuring they remain within impact tolerances for all important business services.
Embedding operational resilience: The webpage highlights that PS21/3 is an outcomes-based policy, and reminds firms that the most effective operational resilience frameworks are embedded within existing enterprise-wide risk frameworks.
Horizon scanning: The FCA also reminds firms that risks from 'severe but plausible' scenarios should be refreshed regularly, and recommends horizon scanning as key to maintaining an understanding of new and emerging risks.

Firms have until the end of the transition period to carry out relevant mapping and scenario testing to ensure they will be able to operate consistently within their set impact tolerances for important business services.

What is operational resilience?

Operational resilience is the ability of individual financial firms, financial market infrastructures (FMIs) and the wider financial system to prevent, adapt and respond to, as well as recover and learn from, operational disruptions. Operational disruptions have the potential to create financial stability impacts due to the structure of the financial system, and the behaviour of institutions and other participants.

Operational resilience has become more important to maintaining financial stability, particularly as the financial system has become more digitalised and interconnected.  All businesses – large or small – must be able to build and demonstrate operational resilience.

This checklist outlines the key requirements your business must understand and implement to effectively demonstrate operational resilience.

Define optimum operational resilience expectations: Businesses should determine what optimum operational resilience looks like for their firm and define the minimum targets and key pillars that should be met.
Manage critical technical testing: Businesses should implement and maintain a framework to support the inventory of evidenced operational resilience.
Identify barriers: Businesses should be aware of technological and contractual barriers in providing evidence of a robust framework and develop strategies to overcome them.
Identify operational dependencies: Businesses should be aware of and uncover operational dependencies that could significantly impact deliverables.
Incorporate vulnerability assessments: Businesses should conduct regular assessments to identify areas of exposure and weak connection points across business departments.