The Canadian Office of the Superintendent of Financial Institutions (OSFI) has released Enhanced Guideline E-21 on Operational Resilience and Operational Risk Management, which sets out expectations for regulated organizations in the areas of operational resilience and operational risk.
Enhanced Guideline E-21 sets expectations for operational resilience. It modernizes OSFI’s guidance on operational risk management, including new expectations for business continuity management, crisis management, change management, and data risk management. It builds on the consultation OSFI held in 2021 and supports Guideline B-13, Technology and Cyber Risk Management and Guideline B-10, Third-Party Risk Management.
There will be a four-month public consultation on this enhanced guideline. Input can be sent to resilience@osfi-bsif.gc.ca until February 5, 2024.
The guideline sets out OSFI’s expectations for operational resilience and managing operational risks. It is applicable to all FRFIs, including foreign bank branches and foreign insurance company branches to the extent it is relevant to their ability to meet applicable requirements and legal obligations. OSFI’s expectations for branches are set out in Guideline E-4 on Foreign Entities Operating in Canada on a Branch Basis.
What is the relationship between operational risk management and operational resilience?
Setting the scene for Enhanced Guideline E-21, OFSI has clarified its approach to the relationship between operational risk management and operational resilience. OFSI states that:
Effective operational risk management involves the identification, assessment, monitoring and reporting of operational risks, and implementing appropriate risk responses. Operational resilience is built on a foundation of effective operational risk management, which should include such areas as technology and cyber risk management, third-party risk management and business continuity management and, as appropriate, leverage existing risk and governance frameworks.
Operational resilience emphasizes the end-to-end performance of the FRFI’s critical operations across the organization. As the FRFI’s operational resilience approach matures, the operational risk management underpinning it should transition from a business-unit approach to one that focuses on the performance of operations end-to-end.
Operationally resilient organizations understand that disruptions can and will occur. They respond, adapt to, recover, and learn from such disruptive events.
