Operational resilience: will insurers meet the March 2025 deadline?

The deadline for financial services firms to ensure they are compliant with the Financial Conduct Authority and the Prudential Regulation Authority’s operational resilience rules is now less than six months away, with firms having until 31 March 2025 to perform mapping and testing to ensure they remain within impact tolerances for each important business service.

We have recently seen the seismic effects of business disruption following the CrowdStrike security update, which left large parts of the business world incapacitated and unable to carry out basic functions. 

Firms must identify, plan for, document and test a firm’s capacity to withstand operational shocks.

This incident demonstrated why operational resilience is vital and how even the slightest of mishaps can have a devastating impact.

The looming deadline is hopefully concentrating attention on operational resilience. To meet the requirements, there are a range of activities firms should be carrying out to resolve any deficiencies in their operational resilience frameworks.

1. Integrating operational resilience processes and requirements into risk management.

Operational resilience is a complex challenge to prepare for and respond to – potential causes of operational failure can materialise from several directions and their effects can permeate numerous operational aspects. 

Consequently, firms must make sure their operational resilience culture encourages strong and effective coordination across multiple teams and divisions (including risk management functions). 

Firms must identify, plan for, document and test a firm’s capacity to withstand operational shocks.

2. Identifying IBS and ensuring they can operate these within their defined impact tolerances.

IBSs will vary across firms and sectors and change as services and business lines evolve. Firms must be cognisant of the regulatory definitions when determining their IBS and document clear and comprehensive rationales for what is, and isn’t, included. 

They need clear rationales for how impact tolerance metrics are derived and set, and should consider using additional metrics to complement the time-bound tolerances, such as customer type, value, transaction type and estimated losses.

3. Mapping and third parties.

Mapping IBS allows firms to capture the people, processes, technology, facilities, and information necessary to deliver an IBS, after which they can identify key dependencies and potential vulnerabilities, as well as interdependencies and critical points of failure. 

To address vulnerabilities and key dependencies they must implement controls, e.g. succession planning, training and upskilling to alleviate key person risk.

If a third party is involved in the delivery of an IBS, it’s the firm’s responsibility to remain within impact tolerance, although third parties should be actively involved in developing the operational resilience framework.

4. Scenario testing.

Testing of severe, yet plausible scenarios must be regularly conducted by firms and used to benchmark resilience measures to ensure all resources relevant to the delivery of IBS can be maintained within the set impact tolerances in the event of a disruption.

5. Remediating vulnerabilities.

Firms should be able to evidence how identified vulnerabilities have been remediated to enable them to operate consistently within their impact tolerances. 

Vulnerabilities should be documented and addressed by firms with a lessons learnt exercise undertaken with appropriate governance.

6. Self-assessment.

Self-assessments should provide comprehensive detail on the journey to becoming operationally resilient. 

They should include an overview of vulnerabilities found, scenarios tested and their outcomes, remediation plans, and strategy to remain within the impact tolerances for each IBS, including an ongoing testing plan.

What next?

While there is still some time to go before the March 2025 deadline, firms should be well underway in addressing and implementing these measures. 

Their focus now needs to ensure each element of their operational resilience framework has been considered appropriately, is sufficiently detailed within the self-assessment, and remains in alignment with the expectations of the board and the regulators.