CASE STUDY

Operational Resilience forFinancial Services Institutions
Building operational resilience helps organizations better prepare,become more proactive, and reduce the impacts of disruptions.
Financial services institutions should be taking steps now to build
operational resilience.
For the last decade or more, regulators have been focused on the resilience(or lack thereof) of financial services institutions (FSIs) and with good reason.
The global, regional, and personal impacts created by disruptions to thissector – including financial crises, the COVID-19 pandemic, geopoliticalunrest, supply chain issues, competition, technology and cyberattacks – havebeen substantial. Disruptions have cost organizations billions of dollars andimpacted entire regions, countries, and industries.
Regulators around the world are issuing guidance on operational resilience. In
some regions, particularly Europe, it has been formalized and FSIs doing
business there must be taking specific and immediate action now to comply.
The guidance is clear that building resilience is not another ‘check the box’activity. It is a clarion call for organizations to make the changes necessary toadjust, adapt, withstand, and emerge from disruptions.

Operational Resilience is not just for FSIs

If the past few years have taught anything it is that any company,organization, region, or industry can and probably will be disrupted. FSIs are
not the only companies looking to improve their resilience. For example, anenergy utility company in the U.S., recognizing the part they play as criticalinfrastructure, is expanding on their Archer business resiliency solution tobuild operational resilience across the organization. A major cloud computingcompany that has used the Archer business resiliency solution since 2017 ismoving to an operational resilience model due to some very high-profile
system outages. They are transitioning from a very distributed model, whereindividual departments focused on their own recovery, to an enterprise-levelapproach which includes aligning on common resiliency goals acrossbusiness and IT recovery, operational risk, and third-party management
teams.
Archer has proven to be a vital part of an organization’s approach to build
resilience. In fact, an April 2022 study by analyst firm IDC showed that of theeight companies interviewed, using Archer helped reduce the number ofoutages to their company by 51%.

CUSTOMER STORY

The Building Blocks & Regulatory Guidance

Regulatory guidance for the financial services industry suggests steps thatprovide a good foundation for building operational resilience. Thismethodology can be adapted for any organization to use, and the Archer
Operational Resilience solution is aligned with this guidance, which includes:
••

•
•
•

•
•
•

•

•

Identify your important business services – focusing on what ismost important to make resilient to continue to serve your customers.
Map interconnections and interdependencies – interrelate thesupporting processes, locations, systems and third parties that support
your important business services.
Set impact tolerances – understand the organization’s true tolerance
to disruptive impacts in quantifiable terms.
Operational risk management – align on one approach across yourorganization to identify, track, assess, and mitigate risks.
Scenario analysis – identify plausible disruptive scenarios that could
adversely impact your organization’s ability to provide your mostimportant business services to customers.
Third-party risk management – include your third-party ecosystem inyour analysis and actions to manage risks and build resilience.
Incident management – identify and mitigate the impacts of incidents
early and effectively so they do not escalate to crises.
Business continuity planning and testing – continuously improveyour organization’s continuity plans for the business and IT and test
them regularly, vigorously, and progressively.
Conduct ‘lessons learned’ exercises – regularly reflect on what isworking well and what could be improved, particularly after scenario
analysis and plan testing.
Reporting and monitoring – produce insights that can be used ateach level – from tactical to executive – to monitor, manage, andreport on your organization’s resilience status.

One global wealth management company took a practical approach to thesesteps by first inventorying where the processes mentioned above werealready occurring and by which teams across the organization. This is a good
example of leveraging existing practices versus creating new processes on
top of existing ones.
Operational resilience should not be implemented as a new program. Rather,it should build upon current practices for business continuity, operational risk
management, third-party risk management and other disciplines that play arole in building resilience across the organization.

“Operationalresilience isstrong risk
management
and riskmanagement
done well.”
Risk systems
manager,
Global wealthmanagement
platformcompany

Starting with the End in Mind

The global wealth management company is using Archer to build operational
resilience by “starting with the end in mind.” To ultimately build a resilientorganization, they realized they would need to be able to track the progressand success of their efforts. To do that, they also understood they needed
supporting metrics and reporting. In turn, they would need the information anddata that feeds those metrics, and that data would need to come from various
systems, processes, and initiatives across the organization.
They also realized they needed to ‘divide and conquer’, so they organized thecompany into “pillars” – such as cyber, IT, people, premises, and suppliers -that would be made resilient. This would allow them to approach each “pillar”
individually as well as in the context of the holistic goal of building resilience
across the company. They broke out each pillar into categories – such as ananti-malware category in the cyber pillar -- that enabled them to betterorganize their efforts. They identified owners for pillars, categories, andmetrics, with distributed ownership coordinated and rolled up to working
groups and, ultimately, the executive leader.
This wealth management firm said one of the keys to their success in building
their operational resilience program was a strong program manager that
understood their business needs and translated those requirements intofunctionality delivered via their Archer implementation.
As another example, a prominent bank in Australia created a one-page
operational resilience dashboard to allow executives and team members toproactively view the status of their initiatives, including impact tolerance
scenario exercises, self-assessments, dependency mapping projects, andcurrent resilience ratings. Creating simplicity out of complexity is an important
theme for companies who are successfully building resilience in theirorganizations.

Resilience for FSIs and Beyond

If the past few years have taught anything it is that any company,
organization, region, or industry can and probably will be disrupted. FSIs are
not the only companies looking to improve their resilience. An energy utility
company in the U.S., recognizing the part they play as critical infrastructure, isexpanding on their Archer business resiliency solution to build operational
resilience across the organization. A major cloud computing company that has
used the Archer® Business Resiliency solution since 2017 is moving to an
operational resilience model due to some very high-profile system outages.
They are transitioning from a very distributed model, where individual
departments focused on their own recovery, to an enterprise-level approach
which includes aligning on common resiliency goals across business and IT
recovery, operational risk, and third-party management teams.

An April 2022
study byanalyst firm
IDC showedthat using
Archer helped
organizations
reduce outages
by 51%.

About ArcherConclusion

Building operational resilience can be complex and daunting, but as this study
illustrates, organizations are making progress. Two important themes
emerged across the companies we interviewed. First, leverage existing
business continuity, risk, and third-party programs to build upon. Second,
unified approaches, goals, teams, and Integrated Risk Management (IRM) are
the foundation to building operational resilience.
For more about how Archer's Operational Resiliency solution,
www.ArcherIRM.com/Operational Resilience.

Archer is a leader inproviding integrated risk
management solutions
that enable customers to
improve strategic decision
making and operationalresiliency. As true pioneers
in GRC software, Archer
remains solely dedicated tohelping customers
understand risk holisticallyby engaging stakeholders,leveraging a modern
platform that spans key
domains of risk andsupports analysis driven byboth business and IT
impacts.
The Archer
customer base represents
one of the largest pure risk
management communities
globally, with over 1,500
deployments including morethan half of the Fortune 100.

www.ArcherIRM.com@ArcherIRM©2022 RSA Security LLC or its affiliates. All rights reserved. RSA and the RSA logo are registered trademarks or trademarks of RSA
Security LLC or its affiliates in the United States and other countries. Al l other trademarks are the property of their respective owners.
RSA believes the information in this document is accurate. The information is subject to change without notice. 3/22 Customer Story.