Operational Resilience Mapping

Operational Resilience is no longer the new regulatory game in town, but it is not going away. Unusually however, for a collection of centrally imposed rules, it does make some considerable sense and if it is done right, it benefits clients and firms in equal measure. Additionally, we are seeing the same rules, with barely any deviation, being imposed by regulators across the world. There are clearly not too many ways of skinning this particular cat.

The cat analogy unfortunately fails when one starts to put this under the microscope. Regulators generally don’t like to provide detail for how to follow their regulation. They talk about general outputs but don’t go into detail on specific inputs. Personally, I’m in favour of this as it gives firms freedom to do what works for them and not be forced into a straitjacket. The danger in this is that firms really must “get” what it is that the regulators want, and we have seen many variations on the theme during our work. The challenge is that regulators are prone to look at things with the benefit of 20:20 hindsight.

This, in our experience, is where it all falls down.

At Aldbury International, we have now seen a good number of comments from both the PRA and the FCA about firms’ mapping. While, by definition with this type of commentary, you will only see the bad stuff, we have seen mapping commented on in every report that has crossed our path. We have also seen firms’ mapping that clearly doesn’t meet the requirements, when carrying out operational resilience reviews and audits.

Too many firms’ mapping doesn’t identify vulnerabilities, choke points and interconnections. We have seen simple lists of people, processes, technology, facilities and necessary information. This is what the rule book says you must have but it doesn’t support the identification of vulnerabilities, which in turn, supports the development of realistic and meaningful testing scenarios (also required by the rules but often missed).

At its most basic, this has been carried out on a spreadsheet. That’s a possible place to start when collating some of your information but it is most certainly not a place to finish. We have also seen the “breath in, press button 1, breath out” style of process mapping. That is definitely helpful, just not in the context of meeting Operational Resilience requirements. It does not give you a high enough view of the process to see the vulnerabilities. It is similar to looking at your destination on a street map when you don’t know where the town is in the country or even what country you need. Accurate but not overly helpful.

With no further guidance from the regulators, only the criticisms we have seen, we have gone back to the regulation and dissected it to fully understand what they want and how to produce it.

The trick is to choose the correct scale that enables you to see the start to finish passage of the IBS with all the key inputs, where they come from, who provides them  and on which systems they are carried out. At this scale, the vulnerabilities can become glaringly obvious. This can be underlaid by the aforementioned detailed, step by step mapping that frequently pre-dates the Operational Resilience rules but that isn’t a specific requirement in the rules. It is helpful however when you have inexperienced people carrying out the operations, which is a possibility if you are in a Business Continuity situation.

While mapping does sound a very beige subject, our experience is that it is one of the most frequently commented upon parts of a regulator’s review. There is no need to let this be the case. At Aldbury International, we have built up a consid

erable amount of experience in helping firms produce mapping at the right scale to achieve its intended purpose. This in turn feeds through to other regulatory requirements such as helping provide the justification for your testing programme. Good mapping requires a holistic approach to the exercise with numerous spin-off benefits for the rest of your Operational Resilience programme.

Contact us via our website www.aldburyinternational.com to discuss how we can best help you.