Last week, David Bailey, Executive Director for UK Deposit Takers Supervision at the BoE, delivered his speech on the key next steps on the PRA's supervisory Operational Resilience roadmap.
David started his speech by saying that he was going to focus on one of The PRA's highest supervisory priorities at the moment, Operational Resilience.
He went on to say: "It is a particularly timely moment to be discussing the topic as it has been just over 12 months since our Op Res policy was published. Since then firms have been on a journey towards the end of March deadline that recently passed to identify their Important Business Services (IBS), set impact tolerances, and start mapping and testing to ensure they can remain within those impact tolerances."
David reiterated the following regarding Important Business Services (IBS) identification, highlighting that an IBS should:
- Deliver a specific outcome or service to an identifiable external user. This means if it’s more than one outcome, or the user cannot be identified, then the granularity is too high
- Be granular enough that they are distinguished from business lines which are a collection of services
- Be at a level where one impact tolerance per regulatory objective can be set
- Not be at the level of internal services (where the granularity would be too low)
- Be at a level where boards can make prioritisation and investment decisions
Of particular interest were the following two statements:
"deliver a specific outcome or service to an identifiable external user. This means if it’s more than one outcome, or the user cannot be identified, then the granularity is too high"
"be granular enough that they are distinguished from business lines which are a collection of services"
Considering the guidance above, the FourthLine technical team has more recommendations to share:
They recommend that firms review their IBSs specifically, to ascertain if the IBS deliver more than 1 outcome.
This can also be viewed as delivering more than 1 benefit to a customer.
Of particular focus should be IBSs which span multiple products and/or customer types. For IBSs covering multiple possible customer deliverables, it is probable that this IBS is not sufficiently granular to meet PRA expectations and should therefore be reassessed.
In a slight departure from the policy wording, David implied that impact tolerances should be set per policy objective (and not a single impact tolerance covering all PRA objectives);
"be at a level where one impact tolerance per regulatory objective can be set"
At this time FourthLine would recommend continuing to set a single impact tolerance covering the PRA objectives however, the accompanying analysis and justification should specifically refer to each of the PRA's objectives to ensure completeness.
For impact tolerances, David noted quite a wide variance in the setting of impact tolerances, with more granular IBSs tending to have shorter timeframes;
"our teams will be pushing firms to justify their judgements"
Of note was the mention of how the PRA teams would have a specific focus on the justifications for these impact tolerances to better understand this variance and to help guide the industry to closer alignment.
How FourthLine can help:
FourthLine is working with a number of financial service firms to help them with Operational Resilience enablement, through a mixture of end-to-end consulting and resourcing options.
Download our Operational Resilience Service Deck here now>
Download our Outsourcing and Third-Party Service Deck here now>
To find out more about how we can help you with your Operational Resilience framework, click here>
