Operational resilience and the ‘new normal’

What is operational resilience?

Operational resilience is not a new concept. Defined as the ability to adapt to changing environments, it historically may have been more of a concern for firms whose operations were affected by conflicts or war, for example.

Now, however, operational resilience is key in a regulatory environment. The global pandemic has impacted almost every business and organisation – and one year on from remote working, individuals and firms alike have had to become more resilient.

Many smaller firms may think of operational resilience as an issue for larger organisations – but in actual fact, it applies to all firms that provide a service to clients. Allan noted that it is particularly important to recognise the difference between a good business continuity plan and operational resilience: the latter being far more outcome-focused than the former, with the purpose of preventing detriment to clients further down the line.

Continuity in a global pandemic

In a COVID-19 context, businesses are being challenged in a way they have never been before. It is no longer enough to have a plan in place for the short-term – staff will continue to work remotely, and the road to recovery will be long and slow.

When discussing how firms can mitigate these challenging times, Currie noted that it can be difficult to plan ahead for real life scenarios – especially when planning for years, rather than days or weeks. For smaller firms, it is far easier to make existing business continuity plans work well in a remote environment than those larger firms that are often reliant upon footfall.

Currie added that firms will only find out if their business continuity plans work when worst-case scenarios become reality. To ensure they have strong operational resilience and a good business continuity plan, firms must identify any challenges and put measures in place to rectify them while remaining as forward-looking as possible.

Regulating operational resilience

The FCA had first started referencing operational resilience before the pandemic, in December 2019. However, the sudden shift in working practices as a result of the onset of COVID-19 posed a significant challenge to the regulator, which has also been forced to adapt.

Despite the challenges the FCA has been grappling with, Currie expects that operational resilience guidance is coming down the track, and will be an issue that the regulator will be looking at closely in due course. The various lockdowns and length of the pandemic may mean that some firms have operational resilience fatigue, constantly adapting to shifting restrictions. Despite this, firms of all sizes will need to continue to ensure they are adept at dealing with their operational resilience as a business continuity arrangement.

When considering the issues that auditors may be expected to focus on, Pittas flagged that auditors have a duty to report any issues that might affect consumers; and have thus increased the work they are doing with the regulators, factoring in stress testing in a financial context. Allan added that operational resilience stress tests must be extreme and plausible, and if it is determined that a firm has ineffective operational resilience in place, the individual responsible could be personally liable for any failings.

Looking ahead to a new normal

No one had envisaged a global pandemic, and forecasting and stress testing have played a more vital role than ever before. Pittas explained that if a firm is projecting an influx of funding, for example, they need to also consider the possibility that there could be rising costs – such as increased entertainment costs when social distancing measures are eased, or returning to rented office spaces. Firms will need to factor these points into their forecasting, as they look ahead to the new normal.

When preparing for operational resilience in the context of a ‘new normal’, Allan recommended that firms should focus on the senior managers responsible, ensuring that their prescribed roles and responsibilities cover operational resilience in some form. Pittas added that ensuring oversight of outsourcing is up to scratch will be key – COVID-19 is not going anywhere, and there will always be new issues and hurdles for firms to overcome.

Lessons learnt

With the FCA expected to roll out its guidance on operational resilience soon, it’s vital for firms to prepare, remain agile, and look at the lessons they have learnt over the past year. Some are already making use of template guidance documents, Currie noted, which provide them with the overarching infrastructure to use when reporting continuity plans and operational resilience.

Curtis added that the pandemic has forced organisations to assess how to be better; firms need to consider how they have coped, beyond their financials, particularly in maintaining open communication with staff. There is much to be taken away from the past year, and this must be used to enhance the systems firms are putting in place for the future.

Whatever the ‘new normal’ will be, it will be different to pre-pandemic. Firms have been forced to maintain the strength of their culture and financial resilience, and as we emerge, they will need to reflect on what went well, as well as what didn’t. The transition to new working practices will not be easy, but as we come out of lockdown, we should be able to have the best of both worlds – and operational resilience will play a key role in this.

If you’re interested in finding out more about operational resilience, the full webinar can be found here.