Defining metrics is key to a successful operational resilience programme and BAU governance.
Through the mapping phase, firms should identify the key processes and resources that underpin an Important Business Service, and from there identify metrics in the five pillars (data, facility, people, 3rd party, technology) that compose each service.
To create a meaningful set of metrics, firms must cover 3 fundamental steps:
- Specify a target level of resilience with the key stakeholders
- Design specific metrics for each resource type (IT, Third Party etc.) that must be identified to assess the current level of resilience
- Find the gap between these two points that indicates a potential vulnerability that must be considered within the governance framework.
It is useful to organise a workshop with pillar owners to understand how to measure the defined resilience gap and how to reach the target level.
Topics to consider in the workshop are:
- What data is currently available for each resource (Master supplier lists, Technology management systems etc.)
- Which data points or current metrics will be used as a measure of resilience e.g. recovery test dates, assurance assessment data, system architecture
- There may be an overlap with existing reporting, however, it is important to ensure there is only one version of the truth across the organisation
If you'd like to hear more about how we are providing support to financial services clients when defining their metrics, please get in touch here
How FourthLine can help:
FourthLine is working with financial services clients to help them achieve compliance and react to the challenges of operational resilience, through a mixture of consulting and resourcing propositions.
Download our Operational Resilience Service Pack here>
