Operational Resilience: Building Effective Frameworks

Session 1: Introduction – The Regulatory Position

• FCA and PRA positions – operational risk resilience to regulatory objectives

• Where we are now and how we got here

• Key milestones and practical validation requirements are covered in this operational resilience training course

• Rules or guidance – specific firm applicability concludes this session

• Case Studies: Issues at British Airways, O2, TSB Bank, HSBC

Session 2: Governance & Strategy

• Messaging – more than “Everyday Business Continuity”

• Prevent, Adapt, Respond, Recover, Learn

• SM24 responsibilities and broader Senior Managers and Certification Regime (SMCR) integration

• Roles for all leaders; line of sight to senior management

• Leadership in a hostile cyber environment

Session 3: Building an Effective and Compliant Operational Resilience Program

• Identifying key business services:

• Definitions

• Single activities – not groups

• Criteria for consistent assessment

• Alignment with other business themes

• Setting operational resilience impact tolerances:

• Identifying operational risks, resilience and disruptors

• Probability / Impact / Control Effectiveness

• Value-based / Volume-based / Time-based

• Quantifying the maximum tolerable level of disruption

• Addressing both FCA and operational resilience PRA concerns

• Operational resilience courses at Redcliffe cover the understanding of upstream/downstream dependencies by identifying and documenting:

• People

• Processes

• Technology

• Facilities

• Information

• Ongoing operational resilience management:

• First Line - Monitoring / Surveillance

• Second-line - Testing

• Scorecards / Dashboards – what, how, where

• Stress testing / Scenario modelling

• Annual review / Material change is covered during operational resilience training

• Exercise in breakout rooms for groups to discuss challenges and opportunities in building an effective program using templated handouts

Session 4: Holistic Management Considerations

• Links to Business Continuity / Disaster Recovery

• Front, middle and back office – connecting the lines to benefit consumers

• What actually happens when business services are disrupted? Roles and responsibilities

• Communication plans – internal and external are covered during operational resilience training

• Employees – engage, empower, evolve

• Documenting effective FCA operational resilience self-assessment and lessons learned

Session 5: Introducing AI opportunities

• Proactive Risk Identification and Modelling

• Automation in Disruption Response and Recovery

• Continuous Improvement and Adaptive Operations

• Data and Governance Considerations

• Managing AI-Specific Risks

Course Wrap-up:

• Summary

• Questions

• Open forum; participants attending our operational resilience framework course find this extremely helpful in concluding the session

Training Objectives

Operational resilience training courses at Redcliffe provide a comprehensive framework for understanding regulatory expectations, building robust frameworks, and equipping professionals with the knowledge to strengthen business continuity and compliance across organisations.

• Sessions aid the understanding of regulatory drivers and priorities.

• Recognise milestones and timelines for full compliance.

• We’ll consider the factors you should promote to build an inclusive operational resilience framework that staff can buy into from an FCA perspective.

• Provide a foundation for your in-house strategies.

• Understand the criteria by which you can identify operational resilience.

• Recognise common risks and disruptors to business continuity and operational resilience stability.

• Consider appropriate operational resilience governance and oversight models.

• Sessions appreciate how developing AI opportunities is included in operational resilience training.

Training Course Summary

Redcliffe’s operational resilience training covers the regulatory position, governance and strategy. Master how to build an effective resilience program and the considerations for holistic management.

One method regulators use to assess performance is by measuring whether consumers receive the products and services they need and want from firms they can trust. Principle 6 of the Principles for Operational Resilience Business and the six Treating Customers Fairly outcomes explicitly highlight the obligation to consider customers’ needs and ensure products and services perform as reasonably expected.

Yet things can go wrong and will go wrong. Regulators remain concerned that Financial Institutions are not doing enough to identify where this might happen or to remedy weaknesses in their businesses which allow this to happen.

Operational resilience courses explore the FCA building operational resilience and PRA proposals, explain the requirements and consider how we in firms can deliver a more resilient operational framework, including the potential for AI usage, to deliver what our customers and clients expect.