ebook

A Pragmatic Approach to

UK Regulations &Operational Resiliency

The Rising Tide ofResiliency Regulation

A Tata Consulting Services
COVID-19 Business Impact
Survey revealed that mostorganisations were caught
off guard and ill-prepared toadapt their operational model tocontinue serving their customers

Business ecosystems are complex — Disruptions will occur
Organisations across the United Kingdom (UK) and European Union (EU) have felt disruptive impacts
from the global financial crisis, COVID-19, Brexit and more. Most have relied on traditional businessrecovery, but COVID-19 has shown that disruption can be prolonged and evolving, so organisations
must adapt. The paradigm has also shifted from not ‘if’ disruption will occur, but ‘when’.
Disruption takes many forms, such as business impacts from sending an entire workforce to workfrom home, sudden impacts from an unforeseeable cyber event, loss of market share to a stronger
competitor, or a drastic change in an industry business model.
The EU Commission, Basel Committee on Banking Supervision, UK Prudential Regulation Authority(PRA) and Financial Conduct Authority have issued guidance related to the need for financial
services firms and the financial sector to become more operationally resilient - which is the ability
to prevent, adapt, respond to, recover and learn from operational disruptions. This is sound advice forany organisation.
Organisations are searching for answers to questions, such as: How does our organisation become
more resilient? Where do we start and what are the steps needed to build resilience? There are noquick or easy answers, but there are ways and means to build resilience. Read this eBook for someideas that can help your organisation get on the right track.

FCA Policy Statement:
By 31 March 2022, firms musthave identified their importantbusiness services, set impact
tolerances for the maximum
tolerant disruption and carriedout mapping and testing

A Pragmatic Approach to UK Regulations & Operational Resiliency | 2

Step 1:
Identify Important
Business Services

Step 2:
Know Your Risks
and Threats

Building resilience starts with identifying the products and services most important to yourcustomers and business. A business impact analysis (BIA) helps determine their criticality, as
well as your tolerance to impact tolerances and recovery objectives.
The BIA is also used to identify the business processes, systems, data, people, locations andthird parties so that you can make them a priority in your resilience planning. This focus helps
prioritize your efforts and resources to build resilience in where it matter most.

Building resilience is contingent on understanding and managing the impacts of risks and threats
to your organisation. The events from the recent past have taught that anything can happen –and probably will.
So many of today’s risks are inter-related and can have a ‘domino effect’ on complex organisations, sorisk management must be approached in an integrated way. For example, a third-party breach
could impact your customer data, leaving your organisation exposed to a compliance violation,
cyber threats, reputation risk and financial loss. Therefore, you must understand and approach
the risks, threats and disruptive scenarios that could occur like they will – and mitigate thepotential impacts.

A Pragmatic Approach to UK Regulations & Operational Resiliency | 3

Step 3:
Mitigate andRespond

Addressing threats and risks needs to occur on an ongoing basis - before, during and after the crisis.
Risk and threat identification, performing scenario analysis of what could occur, and addressing
gaps in resiliency are proactive, mitigating steps that are vital to managing negative impacts tothe organisation.
However, things can still go wrong. A supply chain disruption. A customer who falls on a slippery
floor. A disgruntled employee on social media – are kinds of incidents that occur often enoughinside companies to merit standard procedures for handling them efficiently and effectively.
But what happens when an incident develops into a crisis? This ‘perfect storm’ can require theability to manage the crisis from growing, respond in many ways, recover disrupted areas ofthe organisation and deal effectively with the fallout. Preventive and reactive steps are vital tomanaging the threats, risks and scenarios and reducing the impact to the organisation.

Step 4:
Build Operational
Resiliency

Resilient organisations are adaptable, integrated, risk-driven. They not only implement plansto recover from different types of disruption; they also build resiliency into the fabric of their business– processes, systems and infrastructure. For example, that means identifying concentration
risk – like over-reliance on one customer segment, or single points of failure — such as using
only one facility that manufactures a key part for your product and having alternate plans forcontingencies that could occur. Then taking action to mitigate the risks.
Successful business resiliency programs enable building resiliency across the organisation bycoordinating risk management, business resiliency planning, response activities, and crisis
management. However, they also align these activities with business strategies and objectives,and across all three lines of defense to build resiliency into the way the organisation operates anddoes business. Resilient organisations self-assess to ensure they are continuously improving.

A Pragmatic Approach to UK Regulations & Operational Resiliency | 4

How We Help
Building a resilient organisation doesn’t happen overnight and it’s a long-term commitment. However, it
can be done. It starts at the top with a change in mindset, and a focus on the right strategic priorities. It’s
founded on the commitment to understand your business, be prepared, become adaptable and always
learning. As in the case of the UK financial sector, it’s also understanding that your organisation is partof the greater whole, and that the rising tide of resiliency can lift all ships.

Discover More
Archer is a pioneer in risk management delivering solutions for the heroes tasked with helping theirorganization deal with uncertainty. We enable better decision making with a technology platform to manage
all types of risk. With more than 20 years of experience, Archer is solely dedicated to helping organizations
manage risk, ensure compliance and meet emerging challenges such as ESG and operational resilience.
Working with the largest pure risk management community globally with more than 1,200 customers of
all sizes and industries, we help our customers not by building a wall around their business but by buildinga bridge to their next opportunity.
Visit www.ArcherIRM.com.

@ArcherIRM

Archer Integrated Risk Management©2024 Archer Technologies LLC. All rights reserved. Archer and the Archer logo are registered trademarks or trademarks of ArcherTechnologies LLC in the United States and other countries. All other trademarks are the property of their respective owners. Archerbelieves the information in this document is accurate. The information is subject to change without notice. 04/24 eBook.