Operational resilience - PwC

1 Operational Swiss army knife to survive the next crisis Operationally resilient business services provided by firms and financial markets infrastructures directly support resilient economic functions, enabling people to buy goods, borrow money and markets to transact. Resilient business services therefore support financial stability. Joint paper from FCA, Bank of England and PRASome good reasons to read this document 4 Why does resilience matter? 6 Five key drivers to build up Operational resilience 6 Operational resilience what does this really mean? 9 The client is king 10A crown-less king 10 Understanding what your clients need is the first step for Operational resilience 10 The Operational resilience Swiss army knife a framework for resilience 12 Every organisation needs six pillars in place to achieve Operational resilience 12 The building blocks of a successful framework for Operational resilience 14 The approach to Operational resilience 17 The Operational resilience function is key to restoring your client s crown 17 The eight steps to resilience 19In summary 22 Does it really work?

2 24 How can PwC help you? 26 Table of contentsSome good reasons to read this document At PwC, we define Operational resilience as an organisation s ability to protect and sustain the core business services that are key for its clients, both during business as usual and when experiencing Operational stress or disruption. It is a broad definition, and as such Operational resilience is prone to become just another buzzword in the business world. However, it is much more than that and we try to unpack what Operational resilience really means in this know your time is valuable, so you can find here a summary of what to expect in the document and what value each session may bring to | Operational resilienceSectionGood reasons to read the sectionWhy does resilience matter?

3 If you have read countless times why resilience is important to the business and what it really means, you can skip this section. If that is not the case, reading this section will give you a better understanding of: What does it mean in specific terms to be operationally resilient? What happens when organisations are not resilient? What are the drivers behind the movement towards Operational resilience ? What does the regulatory agenda look like when it comes to resilience ?The client is kingThe most important step to becoming more resilient is understanding the areas of your organisation on which you should focus.

4 Some people may have a good idea of what products and services to focus on, in which case you can skip this chapter. If, instead, you find yourself struggling to understand where to focus your resources, reading this section will help you to answer the following: Where should your starting point be when defining your path to resilience ? (spoiler: it s your clients) How do organisations fail when it comes to defining the correct starting point? How does working on your resilience help to put the client at the centre of your organisation? The Operational resilience Swiss army knife a framework for resilienceAs we delve more deeply into the topic, it is essential to explain what the key components of a framework for Operational resilience are (which we describe using the analogy of a Swiss army knife).

5 In this section you ll find our methodology and our answers to some very specific questions: What are the building blocks ( existing frameworks and methodology) for achieving Operational resilience ? What are the components (or foundational DNA) of an Operational resilience framework?The approach to Operational resilienceAs our framework leverages your existing frameworks and methodology, we try to highlight here how everything can work from a holistic point of view. This section will answer two very fundamental questions: What steps should your organisation follow to achieve Operational resilience during business as usual?

6 What governance structure should you give to a newly established Operational resilience function?Does it really work?We appreciate this is a topic that may sound quite intangible, which is why we have added this final section. Here you will find answers to the following questions: How has PwC actually implemented this? How can PwC help you to achieve Operational resilience ?Your Swiss army knife to survive the next crisis | 5 Why does resilience matter? resilience has recently become the latest global hot topic in many industries, including financial services. As many major companies still rely on old, complex and silo-structured IT landscapes and operate equally outdated and disconnected processes, achieving Operational resilience has become a crucial goal for companies looking to survive the next crisis.

7 Moreover, customer needs in any industry are ever-changing, and many organisations have often used a tactical approach to meet such needs, instead of strategically considering how to integrate new processes and ser-vices into their business in a holistic key drivers to build up Operational resilienceWe see many organisations moving towards Operational resilience . There are 5 main drivers behind this trend:1. Higher customer expectations with regard to 24/7 availability: Delivering a service that is always robust and responsive in the event of issues is both the mini-mum customer expectation and also a necessity for building and cementing the trust between organisations and Increased sophistication of cyber threats: Organisa-tions have widely benefited from technological innova-tions.

8 However, technology has enabled the creation of cheap but effective cyber weapons, the use of which has unpredictable More severe natural disasters and extreme weather events: Over recent years, we have witnessed climate change that is associated with extreme natural events. If either your organisation or your clients are global, you will be affected by such events. Are you prepared to serve them under any weather conditions ?4. Higher risk linked to internal change failures: Increasingly sophisticated systems are being used across application development and infrastructure change. Higher sophistication is translated into elevated risk and relative potential impact, both financial and Operational , in the event of internal change Increased regulatory scrutiny: In the aftermath of the last financial crisis, the financial services sector is evolv-ing into a highly regulated landscape, with the primary goal to protect the client.

9 An organisation that is not operationally resilient may find itself unable to respond appropriately to an increasingly demanding regulatory by these factors, among others, many organi-sations have started building up their resilience capabilities, and regulators have started investigating this area for the first institutions face an increasingly complex threat landscape and risks associated with their own digital innovations. This calls for Operational resilience to be viewed as no less important than financial resilience . Kuangyi Wei, Parker Fitzgerald, 2019 Operational resilience is critical to modern organisations Bank customers hit by dozens of IT shutdowns so reads the title of an article from the BBC, dated February 2019.

10 As some banks have started publishing the number of incidents they have experienced, a worrying image emerges: major banks typically suffer well over one outage per month . This should come as no surprise, as many major banks still rely on outdated, siloed IT systems, linked to a myriad of processes often disconnected from each other. Even banks that have invested in major IT restructuring programs have still maintained a large part of their legacy systems, legacy problems included. We all have happily welcomed the tech-nological innovation brought to the financial sector from the Fintech revolution; however, this has also meant increased complexity in banking systems, leading to reduced resilience to stress | Operational resilienceOperational resilience goes beyond cyber resilience and IT infrastructure, and has a clear impact on the organisation s P&LFurthermore, companies often focus on the IT aspect of resilience and disregard an equally important component: the processes and people that are crucial for the delivery of the final product or service.