Operational Resilience

By ‘operational resilience’, we mean the ability of firms, and the financial sector as a whole, to absorb and adapt to shocks and disruptions, rather than contribute to them.

It extends beyond business continuity and disaster recovery. Financial firms and FMIs must have robust plans in place to deliver essential services, no matter what the cause of the disruption. This includes man-made threats such as physical and cyber attacks, IT system outages and third-party supplier failure. And it also includes natural hazards such as fire, flood, severe weather and pandemic.

As a central bank and as a regulator of financial firms and FMIs, we have an important part to play in improving the resilience of the sector.

Bank of England definition

Definitions

Tech supplier concentration increases risk of downtime - Control Risks

Control Risks released their predictions for the top business risks for 2025, calling out Digital Concentration Risk as companies outsource their specialist IT services to external providers, such as cloud and security. “The concentration of risk in centralised technological ecosystems in a worsening threat landscape will be a top risk for organisations in 2025.” Global technology disruptions such as the July 2024 Crowdstrike outages shows how human error or system misconfigurations can create a correlated industry-wide impact to customer organisations. And as these companies pass control to external tech vendors, they may be losing the in-house skills needed to respond to future incidents and outages. ...

The EU’s Digital Resilience act - known as DORA - comes into effect next month - ESMA

You Have Less Than Two Months to Become DORA Compliant - Security Boulevard With the EU’s Digital Operational Resilience Act (DORA) coming into effect next month, financial services firms in the EU are updating processes, policies and provisions to comply with the new regulation. DORA Contractual Compliance: A Race Against Time - International Banker / PwC As part of TPRM, DORA stipulates that all ICT contracts must contain specific baseline contract terms. There are also more onerous additional requirements for contracts supporting critical or important functions (CIFs). ...

Operational resilience

Operational resilience for an organisation can be defined as the ability to prevent, adapt, withstand, respond to, recover, and learn from operational disruptions to ensure the continuity of critical business services. Further reading The Concept of Resilience: A New Buzzword - CMS Wire What Is True Resilience? - Forbes Response and resilience in operational-risk events - McKinsey Operational resilience: Regulation Around the World - Norton Rose Fulbright Operational resilience for insurers - PwC Operational resilience for insurance firms - Grant Thornton Operational resilience insights for insurance firms - Financial Conduct Authority Operational Resilience - Bank of England & PRA & FCA Cyber operational resilience and cyber insurance - EIOPA Toward True Organisational Resilience - Deloitte Risk Resilience Report - Marsh McLennan BCI launches Continuity & Resilience Report 2022 - BCI The Business of Resilience: summary report 2022 - UK Gov Resilience Reports - European Commission Resilience: Building back better - HSBC International regulatory alignment on operational resilience - Deloitte UK Resilience without borders - Deloitte UK PS21/3 Building operational resilience - Financial Conduct Authority SS1/21: Operational resilience: Impact tolerances for important business services - Bank of England

Operational Resilience OR-2 | HKMA

The OR-2 module sets out the HKMA’s supervisory expectations for authorised institutions to maintain operational resilience in the event of a disruption. Further reading OR-2 SPM Module | HKMA (PDF) Operational Resilience: A new SPM module from HKMA | Deloitte Operational Resilience | KPMG The HKMA proposes new standards for operational resilience | Herbert Smith Freehills Fostering operational resilience | PwC Hong Kong SFC issues operational resilience standards and recommended techniques and procedures in the age of remote working | Herbert Smith Freehills Operational resilience and remote working | SFC Circular Related pages Operational Resilience (wiki) SPM TM-G-1 General Principles for Technology Risk Management SPM TM-G-2 Business Continuity Planning OR-1 Operational Risk Management SA-2 Outsourcing Cyber Resilience Assessment Framework 2.0

Principles for Operational Resilience (POR) | BCBS

The Principles for Operational Resilience (POR) were published by the Basel Committee on Banking Supervision (BCBS) in March 2021. The POR defines operational resilience as the ability of a bank to continue to deliver critical operations while undergoing disruptive events. Further reading Principles for operational resilience (BIS)

Operational Resilience#

Definitions#

Related articles#

Operational Resilience

Definitions

Related articles