With global regulators adopting differing levels of scrutiny within resiliency, some financial services companies have responded by appointing a global head of operational resilience, invariably reporting to the Chief Technology Officer.

This is understandable when much of the resiliency risk sits within technology – but importantly – not all of it.

In the UK, the Senior Manager’s regime imposed an obligation on the COO, appointed SM24, as the senior executive with responsibility for the operations and technology of the company. This manifested itself with the requirement to establish an operational resilience framework.

The regulatory interim deadline of April 2021 – March 2022 was an initial implementation period, which required the SMF24 to implement all aspects of the policy, except being able to stay within impact tolerances at all times.

We entered the next phase in March 2022, carrying through to March 2025 which is the transitional period whereby firms are required to invest in their ability to remain within their impact tolerances.

This confirmed a focus on cyber security, 3rd party vendor management, technology, and the link into business continuity, all being scenario stress tested.

One COO noted:

‘‘These are all established risks, nothing new, but we must now look at them through a nuanced lens, called resiliency. It’s become a wrapper around what we already do, where this can lead to a fragmented approach.’’

Most argue this fragmented approach can be managed by taking a horizontal view across business activities to test resiliency, some suggest a framework would be better aligned to established non-financial risk taxonomies, providing oversight to meet resiliency requirements.