Operational Resilience and COVID-19 Response within Financial Services Survey

In December 2019 the Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) released joint Consultation Papers (CP) outlining their proposals designed to improve the operational resilience of the UK financial services (FS) sector. The joint CP closed for comments in October 2020 and the regulators published their final Policy Statements on the 29th March 2021.

In Q3 2020 we conducted a survey of FS firms to understand their preparedness for adopting the expected requirements for operational resilience. The survey also asked participants to provide insight into their responses to COVID-19. With 47 respondents, the survey provided an opportunity for firms to benchmark their readiness against peers in advance of the expected Supervisory Statements. Our findings also highlight key action points for the roll out of an operational resilience programme in line with the CP and within expected required timelines.

Our survey focuses on 4 broad areas:

1. View on the Consultation Papers

2. Operational resilience programme progress and characteristics

3. Operational resilience programme governance

4. Level of preparedness and impact of COVID-19

View on the Consultation Papers

Following the release of the Supervisory Statements at the end of Q1 2021 we expect a 12 month period to allow firms to implement and embed the requirements with a further 2 year period to undertake any changes required to remain within impact tolerances. While the regulators indicated there will be little change from the CPs, 42% of respondents feel there should still be changes to the principles they contain. In particular, we saw firms concerned about the applicability and proportionality of the expected regulations dependant on the size of their business. In practice, we feel the regulator will take a pragmatic view of proportionality during implementation and firms should take commensurate action now based on expected timelines.

Explore Consultation Paper Views

Operational resilience programme progress and characteristics

Across the respondents, momentum is gathering pace during the implementation phase of operational resilience with the majority having started work on their frameworks, including identifying Important Business Services and potential harm. 59% have started working on their framework.

It is critical firms identify their Important Business Services against a consistent set of characteristics and apply potential harm resulting from disruption across customers/clients, the market, and firm viability in a proportionate manner. This will help to identify where investment needs to be made to ensure firms can remain within impact tolerances.

Explore Programme Progress and Characteristics

Operational resilience programme governance

Regulators expect boards to take a leading role in operational resilience and they should have appropriate knowledge and awareness to fulfil this role. Half of the respondents have their SMF24’s taking the lead, but engagement with Boards was lagging behind programme progress for a number of respondents, with only 29% having defined an action plan or better with their Board and half not having an estimate of the programme costs. It is widely recognised that Boards will need to approve Important Business Services, impact tolerances and self-assessments, as well as provide suitable oversight and challenge to the programme to meet the expectations of the regulators.

Explore Programme Governance

Level of preparedness and impact of COVID-19

During COVID19 much of the messaging from the regulators in their guidance to firms mirrored the principles contained in the CPs. Notably, and in line with the outsourcing consultation paper CP30/19, third party mapping was critical in having a comprehensive response to COVID-19. With almost all respondents indicating they had some third-party mapping prior to COVID-19, almost a third needed to modify their mapping during the pandemic to improve their understanding of the value chain. This emphasises the importance of accurate and sufficiently detailed mapping when firms identify their Important Business Services to allow them to swiftly and effectively respond during periods of disruption. Many respondents had resource mapping in existence they could use for COVID-19 responses. The mapping of resources to Important Business Services (IBSs) should be accurate and sufficiently detailed, especially to identify which resources are critical. Key resources include buildings, technology, third parties, people and data.

Explore COVID-19 Preparedness and Response