This topical piece is by Rupert Bull, CEO and Co-Founder, The Disruption House.
The recent chaos at Heathrow Airport, triggered by the failure of a single substation, resulted in the cancellation of approximately 1,300 flights. It also serves as a reminder of a brutally simple truth: operational disruptions can cripple even the most established and seemingly robust organisations.
The more interconnected, digitised and automated our operations become, the more we cannot afford to forget this. We know this because the ripple effects extended far beyond delayed passengers, impacting airlines, suppliers, and overall confidence in what is a critical piece of national infrastructure.
While the immediate consequences at Heathrow were first felt in travel schedules and logistical nightmares, the incident carries profound lessons for the financial services sector. It highlights the urgent need for firms of all sizes, particularly those deemed critical to the UK’s financial stability, to not only acknowledge, but actively fortify their operational resilience. This isn’t just about avoiding inconvenience; it’s about safeguarding the integrity of the financial system, protecting consumers, and maintaining trust in an increasingly volatile landscape.
Regulators have taken a stance
Regulators are already acutely aware of this imperative. The Bank of England, the Prudential Regulation Authority (PRA), and the Financial Conduct Authority (FCA) have recently introduced new rules under PS16/24, specifically targeting the operational resilience of critical third parties (CTPs) within the financial and insurance sectors.
These regulations are not merely box-ticking exercises. They represent a fundamental shift in expectations. And those expectations spell out a clear demand for proactive and comprehensive approaches to operational risk.
This means regulated firms must act decisively and with speed. Failure to comply with PS16/24 will not only result in potential penalties but also significant reputational damage and lost business opportunities, particularly if a supplier or business partner is seen as an operational liability across any form of outage, digital or physical.
Resilience must come in many forms
The Heathrow incident is a powerful analogy. It highlights the inherent fragility in complex, interconnected systems and the potential for a single point of failure to trigger widespread disruption. For financial services providers, this should serve as a potent reminder that resilience is not just about protecting against cyber threats. It encompasses all potential sources of operational instability, from technological glitches and infrastructure failures to supplier outages and even unforeseen environmental events.
That’s why it’s worth shifting perspectives. Operational resilience is not a static state, but an ongoing commitment. Waiting for a disruption to occur before addressing vulnerabilities is akin to waiting for a storm to hit before reinforcing your foundations – the damage may already be irreparable. As a result, proactive measures and continuous monitoring are the two key aspects of safeguarding business continuity.
The building blocks of operational resilience
So, where do financial services firms and their providers begin this journey towards enhanced operational resilience?
The first step, naturally, is understanding the current state of affairs. A comprehensive readiness assessment must be completed, involving a thorough evaluation of existing operational capabilities. This assessment should be a genuine deep dive into the intricacies of IT and physical infrastructure, third-party dependencies, and incident response abilities. No stone can be left unturned. The aim is to identify gaps and vulnerabilities across key areas, including governance frameworks, monitoring tools, and stress-testing existing measures.
Addressing the identified gaps will require a multi-faceted approach. Be it investing in more resilient infrastructure, implementing advanced monitoring and alerting systems, or developing robust, regularly-tested incident response plans – firms must be ready to take all of these steps.
The rigorous testing of systems cannot be emphasised enough. The fact that a single substation failure could lead to such widespread disruption, despite backup systems being in place, shows that plans are not enough – tests must be regular and rigorous. Having resilience measures in place is only valuable if they are usable and have endured under various scenarios. We must ensure we go beyond theoretical resilience and demonstrate practical effectiveness in testing processes.
As hinted earlier, this is why a deeper shift in mindset must take place. We must truly embed operational resilience into the very fabric of organisational culture and decision-making processes for our businesses to weather today’s storms.
It takes an ecosystem to build resilience
The Heathrow incident also highlights the role of collaboration in building a truly resilient ecosystem. This is especially the case as the complexity of modern technology often sits outside the direct experience of senior business leaders. For the regulated institutions, this means fostering deeper and more transparent relationships with their technology providers. Joint testing exercises and collaborative risk assessments will be essential – if not prerequisite – to ensure an effective resilience strategy that is aligned to standards throughout the whole supply chain.
Further, collaboration is key to bridging the knowledge gap that may exist at senior levels regarding the intricacies of modern technology and cyber resilience. Here, it’s important to highlight this isn’t necessarily a case of willful ignorance, but rather a reflection of diverse career paths and the rapid pace of technological evolution. It is no bad thing, but one we must work in recognition of.
Planning ahead
Operational resilience is not a niche concern – especially for critical sectors like insurance. The new regulatory landscape demands proactive engagement, thorough assessments, and deep collaboration between industry players.
By embracing operational resilience as a strategic priority, institutions can not only meet regulatory expectations but also build greater trust, enhance their competitive advantage, and ultimately safeguard the stability of the financial system in an increasingly unpredictable world.
They are also less likely to make their own business interruption insurance claims, helping to reduce the premiums they themselves pay.
Be the first to comment