The BCBS (Basel Committee on Banking Supervision) has thrown its hat into the debate around operational resilience and business continuity, stressing its view that ‘operational resilience is more than just business continuity’.
The statement is made in the BCBS’s latest newsletter, a ‘Supervisory newsletter on the adoption of POR and PSMOR’, which provides information on the Committee’s assessment of the adoption of the Principles for Operational Resilience (POR) and the revised Principles for the Sound Management of Operational Risk (PSMOR).
The assessment revealed several themes ‘that have proved to be particularly relevant for the adoption of POR and PSMOR’. These themes include that:
- Banks should acknowledge that operational resilience is more than just business continuity.
- It is crucial for banks to leverage all aspects of operational risk management to achieve operational resilience and to recognise its importance alongside financial resilience.
- A key differentiator is the critical operations lens, in conjunction with the end-to-end view, the focus on impact, the use of the tolerance for disruption to drive decisions about resilience investment, and the consideration of third parties’ resilience.
- Banks should establish and maintain accurate data at an appropriate level of granularity on critical operations and recognise the foundational role of mapping interconnections and interdependencies for successfully adopting POR and PSMOR.
The assessment found that the effectiveness and maturity of POR and PSMOR adoption vary across banks and jurisdictions and these are discussed in the newsletter.
The newsletter states that: “Despite progress in adopting POR and PSMOR, further effort is needed by banks to enhance practices, which will require adequate resourcing and prioritisation. In some jurisdictions, full adoption of the POR and revised PSMOR may take until at least 2025. The challenges that banks in all jurisdictions face when adopting the Principles [POR and PSMOR] include the mapping of interconnections and interdependencies for critical operations, and the definition of tolerances for disruption to these critical operations. If mapping and tolerances are not defined and implemented effectively, the reliability of other activities such as risk management and testing is called into question, potentially compromising operational resilience. This is further exacerbated by deficiencies in capturing, structuring and using data on critical operations that may have originally been collected for resolution and recovery planning, business continuity, or some other purpose.”
The BCBS states that it will continue to support the adoption of the POR and PSMOR by carefully monitoring the progress that regulated entities are making.
Have your say
Take part in our survey asking whether the BCBS is correct to say that ‘operational resilience is more than just business continuity’.
