Operational Resilience for FCA regulated firms

The first stage of our process involves mapping the firm’s environment (clients, systems, and suppliers) and major internal stakeholders.

We perform the mapping with our clients using our tried and tested Trilayer Business Process Analysis™. It analyses the process on three levels: process execution, supporting data, and risk management. This way, we capture the potential impacts of disruptions in a broad spectrum of scenarios.

Based on these maps, the first FCA requirement can be met, namely the identification of important business processes. FCA defines such processes as ones that, “if disrupted, could cause intolerable harm to consumers of your firm or risk to market integrity, threaten the viability of firms or cause instability in the financial system”.

Once the critical processes are identified, the FCA requires the firms to set operational tolerances, i.e., maximum tolerable disruption for these services. Although FCA expects time/duration to be the primary metric used across the processes, they also allow some flexibility in using additional appropriate metrics, depending on the specifics of the firms’ processes.

We work with our clients to define appropriate metrics and calibrate tolerable disruption levels, considering clients’ requirements, the orderly operation of financial markets, and the firm’s overall tolerable risk levels and reputation.

FCA mandates testing based on severe but plausible scenarios to ensure that the calibrated operational tolerances are met. The level of testing will depend on the sophistication level of the firm and the risk level of the service.

We offer our clients several approaches to testing, depending on the identified requirements, including theoretical scenario analysis, interactive reviews and walkthroughs, and full-scale simulations. These are applied depending on the client"s requirements, such as risk levels, systems availability, and specific scenarios.