Operational Resilience: Building Effective Frameworks

Session 1: Introduction – The Regulatory Position

• Operational Resilience training begins with FCA and PRA positions – operational risk resilience to regulatory objectives
• Where we are now and how we got here
• Key milestones and practical validation requirements
• Rules or guidance – specific firm applicability concludes this session
• Further expectations by March 31, 2025

Case Studies: Issues at British Airways, O2, TSB Bank, HSBC

Session 2: Governance & Strategy

• Messaging – more than “Everyday Business Continuity”
• Prevent, Adapt, Respond, Recover, Learn
• SM24 responsibilities and broader Senior Managers and Certification Regime (SMCR) integration
• Roles for all leaders; line of sight to senior management
• Session two of this operational resilience course concludes with leadership in a hostile cyber environment 

Session 3: Building an Effective and Compliant Operational Resilience Program

• Identifying key business services:
  • Definitions
  • Single activities – not groups
  • Criteria for consistent assessment
  • Alignment with other business themes

• Setting operational resilience impact tolerances:
  • Identifying operational Risks resilience and Disruptors
  • Probability / Impact / Control Effectiveness
  • Value-based / Volume-based / Time-based
  • Quantifying the maximum tolerable level of disruption
  • Addressing both FCA and operational resilience PRA concerns

• Understanding of upstream/downstream dependencies by identifying and documenting:
  • People
  • Processes
  • Technology
  • Facilities
  • Information

• Ongoing operational resilience management:
  • First Line - Monitoring / Surveillance
  • Second-line - Testing
  • Scorecards / Dashboards – what, how, where
  • Stress testing / Scenario modelling
  • Annual review / Material change is covered within operational resilience training

Exercise – Breakout Rooms – Groups to discuss challenges and opportunities in building an effective program using templated handouts  

Session 4: Holistic Management Considerations

• Links to Business Continuity / Disaster Recovery
• Front, middle and back office – connecting the lines to benefit consumers
• What actually happens when business services are disrupted? Roles and responsibilities
• Communication plans – internal and external
• Employees – engage, empower, evolve
• Documenting effective FCA operational resilience self-assessment and lessons learned 

Course Wrap-up:

• Summary
• Questions
• Open forum; participants attending operational resilience framework training find this extremely helpful in concluding the session

With over 20 years of training experience in Operational Resilience in Financial Services, our specialist is well-placed to support participants across a range of compliance-related topics. He is a former Head of Education for HSBC covering the UK and Europe and is responsible for regulatory and financial crime-related compliance learning. His time at HSBC was during intense scrutiny from regulators and government functions during the bank’s Deferred Prosecution Agreement.

Alongside expert delivery of Redcliffe’s operational resilience course, our trainer has had roles that include leading the Monitoring and Operational Resilience Scenario Testing programme for a UK Wealth Manager. He was Senior Vice President responsible for Global Risk & Compliance training at a US-based bank and also worked in the Operational Resilience Insurance Firms division at the Financial Conduct Authority; back in the Financial Services Authority (FSA) days. Here he was the divisional expert for the rules and outcomes required under the Training & Competence handbook.

The HSBC role, along with five years at Barclays in their Private Clients and Wealth functions has seen this trainer work with retail, commercial, wholesale and private operational resilience in banking channels. Since leaving HSBC, our specialist has worked with the compliance, HR and operational teams of firms to enhance their operational resilience regulations understanding, as well as delivering content across private equity firms, investment houses, banks and wealth managers. He regularly provides core programmes for the Truth in Savings Act (TISA) and the Investment Association, highlighting the experience our trainer brings to our operational resilience framework course.

He is a former member of the Investment Management Association Training & Education Committee and won the Thomson Reuters award for “Most Effective Compliance Training at a Regulated Firm” in 2010. Participants taking part in this operational resilience training course are learning directly from a trainer with a wealth of dedicated experience.

• Operational Resilience training helps participants understand the regulatory drivers and priorities.
• Recognise the milestones and timelines to full compliance.
• Consider the factors you should promote to build an inclusive operational resilience framework FCA that staff can buy into.
• Provide a foundation for your in-house strategies.
• Understand the criteria by which you can identify operational resilience.
• Recognise common risks and disruptors to business continuity and operational resilience stability.
• Consider appropriate operational resilience governance and oversight models.

• At Redcliffe Training our Operational Resilience Framework course is led by an expert with the knowledge of how FCA expectations have changed alongside the best practices and mandatory updates.
• We have served clients of all shapes and sizes in the financial sector and are fully aware of the obligations of a regulated firm and what is expected from them by the regulator.
• We have delivered training for over 20 years and have a profound understanding of the industry.
• Your course director is experienced as both a regulator and in training operational resilience regulation requirements across wholesale and retail financial firms. He will pass on past experiences to enhance the session and help bring it to life.
• We do not use academics for operational resilience training. All our trainers are highly experienced professionals with relevant vocational experience in the real world.
• Our case studies enhance learning points and are often found essential in truly understanding the requirements and growing the skills to apply them.
• We are always judged by our results which speak for themselves and the feedback received from previous delegates has always been excellent.

At Redcliffe Training our operational resilience course is delivered by a time-served industry expert. PRA and FCA have differing application criteria though in the main. Banks, building societies, Prudential Regulation Authority (PRA) designated investment firms, RIEs and ‘Enhanced’ SM&CR firms will have rules mandated. That said, the FCA expects that all firms will have properly tested contingency plans and it is considered likely that the rules will apply as guidance for Core SM&CR firms who are solo-regulated.

Relevant staff roles applicable to operational resilience training include Operational Risk Resilience and Compliance, Operational Oversight and Operational Resilience Management. Plus, those in Business Continuity and Disaster Recovery who will have crossover responsibility for FCA PRA operational resilience will also benefit from this session.

At Redcliffe Training our Operational Resilience Framework training course covers the regulatory position, governance and strategy, how to build an effective resilience program and includes considerations for holistic management.

One method regulators use to assess their performance is by measuring whether consumers get the products and services they need and want from firms they can trust. Principle 6 (of the Principles for Operational Resilience Business) and the subsequent 6 Treating Customers Fairly Outcomes explicitly call out the obligation to pay due regard to our customer’s needs and for products and services to perform as reasonably expected.

Yet things can (and do) go wrong. Regulators remain concerned that Financial Institutions are not doing enough to identify where this might happen or to remedy weaknesses in their businesses which allow this to happen.

This operational resilience training course explores the FCA building operational resilience and PRA proposals, explains the requirements and considers how we in firms can deliver a more resilient operational framework to deliver what our customers and clients expect.