In support of delivering an optimal customer experience across all channels our banking client needed to ensure their services are stable and available 24 / 7. Service outages, serve only to aggravate and frustrate customers as well as cause damage to the Bank’s reputation.

Regulators had been considering how to bring about changes in the way Banks think about operational resilience, the outcome being the publication of the new regulations in March 2021. The regulators position is to:

  • Ask banks to identify their IBS and to map the assets and resources that support them;
  • Set an expectation that banks identify their vulnerabilities and invest in protecting them and their customers;
  • Assume that operational disruptions will happen and that banks are prepared to respond effectively to them.

The key dates are March 2021 (regulations published), March 2022 (final rules come into force – implementation period ends, 3 year transitional period begins for firms to address any gaps and vulnerabilities as soon as reasonably practicable) and March 2025 (Transitional Period ends).

These new operational resilience regulations bought about a number of key requirements for the Bank to deliver including:

  • Important business services
  • Impact tolerances
  • Mapping
  • Scenario testing
  • Lessons learned
  • Self-assessment

To deliver the requirements in programme and BAU mode, the Bank created the Chief Resilience & Controls Office under the SMF24 (COO) to deliver the strategy, programme, governance, frameworks, organisation and operational capability.

The solution:

Operating Model and Governance:

BSS landed the strategies and approaches for a number of the key requirements above in support of meeting the March 2022 hard stop, including defining the operating model and governance framework, the development and design of training for the Board to embed their accountabilities within the Business Readiness workstream as well as defining the approach to the resilience assessment for the purpose of delivering a self-assessment in March 2022.

Barclay Simpson Solutions designed an operating and governance model to enable the regulatory requirements to be met and support the delivery of the operational resilience strategy. It was through this governance model that we were able to articulate and demonstrate how the Board would be able to discharge their own accountabilities by agreeing and signing off on the identification of the Bank’s IBS, their Impact Tolerances, Scenario Testing and the Self-Assessment.

Board Communication and Education

Boards are accountable for agreeing their IBS, Impact Tolerances and Scenario Testing. BSS was asked to design a bespoke training package to educate the Board on the broader Operational Resilience requirements, the progress made to date and how they would be able to discharge their accountabilities through challenging and ultimately agreeing the requirements above. This training comprised of a teaching session for the Board with the purpose of outlining the required context and detail to help put them in a position to ultimately sign off the Self-Assessment come March 2022.

Subsequently BSS also designed an example Self-Assessment delivered in October 2021 for the Board which presented an example of what the forth coming Self-Assessment would look like including what they would be asked to sign off in March 2022. Currently BSS is now in the process of preparing the full Self-Assessment for the Board so that it is ready by the end of January 2022 prior to the March 2022 deadline.

Resilience assessment

The Self-Assessment in March 2022 will need to summarise all of the work that has taken place to date in support of the IBS, Impact Tolerances the Scenario Testing, the vulnerabilities associated with the IBS as well as the Bank’s remediation plan. The Self- Assessment needs to be made available upon request by the Regulator and should be maintained and updated. In order to help the Bank deliver this self-assessment BSS has defined the approach to the Resilience Assessment which will summarise where there are vulnerabilities associated in the assets that support the delivery of IBS. Ultimately, it is the Resilience Assessment which is aggregated up into the Self-Assessment which will allow the Board and Senior Executive to make informed investment decisions on Operational Resilience matters.

BSS has provided the approach for the development of a Resilience Assessment framework for each of the 5 pillars that sit across all IBS (People, Premises Technology, Information, and third parties). That approach has defined the key principles including oversight and ownership roles and responsibilities, the key indicators and controls that should be monitored in each of the pillars above and the scoring mechanisms to provide an aggregated view of the resilience performance associated with the IBS.

BSS
Tel: 020 7936 8999   info@bss.uk.com

Looking for more?

Contact us

What we think

  • Meet the team: Scott Brayshaw, senior consultant at BSS
  • Meet the Team: John Madelin, BSS advisory board
  • Meet the Team: Chris Meehan, BSS advisory board