How COVID-19 could change operational resilience policy
13 July 2020
The current coronavirus (COVID-19) pandemic has brought the topic of operational resilience to the fore yet again - providing valuable lessons for both firms and supervisory authorities. The pandemic will have highlighted for authorities which firms have responded more effectively, and why. So, will these lessons learned lead to any changes in the policy under consultation?
While I don’t expect there to be any fundamental changes to the proposed policy wording as a result of COVID-19, the lessons learned are likely to influence how the policy is implemented in practice.
The message remains for firms to prioritise the things that matter (namely the delivery of their important business services), set clear standards of resilience, and invest to build resilience. To do this, firms will need to map out the dependencies to deliver their important business services, and test their responses to a wide range of scenarios which disrupt them.
I don’t expect a change in the minimum factors used to assess the importance of a business service. However, COVID-19 may inform where firms draw the line between important (and unimportant) services as they will have seen how this disruption has impacted customers, markets and the firm itself. This is key because the current policy requirements focus firms’ resilience work on ‘important’ business services.
In addition, while impact tolerances are here to stay, the experience of COVID-19 may have reinforced the importance of supplementary impact metrics as well as maximum toleration duration. That’s because in scenarios where a business service slows down, rather than stops completely, it will take longer to reach an intolerable impact. Such scenarios require other threshold measures, such as the number of those impacted or the size of the impact on individuals, to make them meaningful.
With regards to scenario testing, there has been much speculation around whether the nature of the COVID-19 pandemic presents the type of ‘severe but plausible’ scenario envisaged in the policy papers. For me the answer is ‘yes’ - the matter for interpretation comes in whether the authorities would expect firms to be able to stay within their impact tolerances in such ‘extreme’ cases. Of course, firms need to test a wide range of scenarios, all of which will provide unique challenges to overcome. COVID-19 presents the authorities with a view of how firms responded across the industry to the same scenario, and the relative successes of each. This will have enabled them to spot both common weaknesses, as Charlotte Gerken (Executive Director of Insurance Supervision, Bank of England) highlighted in her speech to the ABI in May, and outliers. This might encourage the authorities to expand on their approach for setting ‘stress tests’ for firms, beyond SIMEX and the 2019 Bank of England tests. This would align with views put forward by the European Commission for its Digital Operational Resilience Framework, expected to be published in the autumn.
Finally, it seems reasonable for the authorities to review the proposed firms in scope for the rules. The consultation paper suggested only around 2,000, of the 59,000 authorised firms would be in scope, which includes a catch-all of enhanced Senior Managers Regime firms whose ‘size, complexity and potential impact on consumers or markets warrant more attention’. The operational disruption caused by COVID-19 may have had a greater impact than anticipated on customers and markets related to excluded firms, which may necessitate the authorities to revisit the criteria for determining in-scope firms. One way to do this would be to link the criteria to the authorities’ in-house categorisation of firms, though this would be less transparent and more likely to change over time than the current criteria.
On reflection, I don’t expect we will see much difference to the wording in the final policy next year. I think the experience we are living through with COVID-19 may shape the practical application of the policy and support the case for stronger collaboration between the authorities and industry, but without substantive changes to the rules and guidance. The extended consultation, however, provides an opportunity for firms to engage with the authorities, particularly firms with experience of putting the concepts into practice. It is through sharing these experiences that I think firms and authorities can gain real confidence that the policy will hit the mark.