In financial services? You’ve experienced the crush of recent regulatory changes, with your compliance team likely working overtime to mitigate risk and adjust to a more activist role on part of regulators.
How to do so efficiently is the million dollar question, though. And so, in the following, we examine the role of incident management software for financial institutions seeking to adapt to the jumble of new regulations.
Recent regulatory changes
Indeed, the finance industry has just witnessed a period of regulatory change unprecedented since the Great Recession. As in the late 2000s and early 2010s, contemporary regulators and policymakers have been busy redefining the arrangements under which the industry must now operate.
These changes haven’t just been isolated to one jurisdiction, either. Across many advanced economies, regulators and policymakers have crafted new rules, if not passed new laws.
Some of the most significant include:
European Union: Digital Operational Resilience Act (DORA)
Digital Operational Resilience Act (DORA). A binding EU regulation on digital operational resilience for the financial sector, DORA addresses potential systemic and concentration risks posed by the financial sector’s reliance on information and communication technology (ICT) third-party providers (TPPs).
United States: Sound Practices to Strengthen Operational Resilience
Sound Practices to Strengthen Operational Resilience. Like their counterparts in the EU, U.S. regulators have also acknowledged that firms have become increasingly dependent on third parties for business-critical functions and that these third parties are themselves vulnerable to disruption, disruption which can then imperil financial services organizations.
As a result, the Sound Practices to Strengthen Operational Resilience, which brings together already-existing regulations and guidance to better assist in the development of comprehensive approaches to operational resilience, outlines concrete measures to ensure operational resilience.
Australia: APRA CPS 230
APRA CPS 230: Operational Risk Management. APRA CPS 230 is a relatively new prudential standard designed to strengthen the management of operational risk in the Australian banking, insurance, and superannuation industries. It works by establishing minimum standards for managing operational risk, including updated requirements for service provider management.
United Kingdom: Policies relating to operational resilience for banks, building societies and investment firms
Policies relating to operational resilience for banks, building societies and investment firms. The first in the space, U.K. regulators put out operational resilience regulations in the late 2010s whose effective date was subsequently delayed due to COVID. Parsing out these sprawling regulations, we find that regulated entities are required to map their important business services and test their ability to remain within impact tolerances for the purposes of building operational resilience.
A guide to navigating these regulatory changes
The astute will have noticed that these rules have many similarities. For one, regulators in the last few years have increasingly turned their attention to strategic agility and operational resilience.
As a result, organizations are being called on to implement positive changes without introducing new risks, as regulators deem that the industry is operating in a business-as-usual environment that’s far more complex.
More specifically, the list of serious disruption threats now includes:
- Technology-based failures
- Cyber incidents
- Pandemic outbreaks
- Natural disasters
Add to these, digitization has been a double-edged sword. On the one hand, firms have benefited from increased ability to identify and recover from various types of disruptions. But on the other, increasingly sophisticated, technology-based threats, i.e., cyber and growing reliance on third parties, pose a higher order of operational risk.
To that end, regulatory agencies have sought to draw a line in the sand. They’ve taken a more active approach to promoting flexible operational resilience that can enhance the ability of firms to prepare, adapt, withstand, and recover from disruptions and continue operations.
Sound practices for regulatory compliance
What do the regulations themselves say?
Irrespective of the jurisdiction, the regulations tend to compel firms to identify and address the resilience of their critical operations and core business lines, with each term defined as follows:
- Critical operations. Those operations of the firm, including associated services, functions, and support, the failure or discontinuance of which would pose a threat to the financial stability of the jurisdiction.
- Core business lines. Those business lines of the firm, including associated operations, services, functions, and support, that, in the view of the firm, upon failure would result in a material loss of revenue, profit, or franchise value.
- Operational resilience. The ability to deliver operations, including critical operations and core business lines, through a disruption from any hazard. It is the outcome of effective operational risk management combined with sufficient financial and operational resources to prepare, adapt, withstand, and recover from disruptions.
Beyond those elementary practices, the regulations urge firms to develop business continuity plans to consider market- and enterprise-wide stresses and idiosyncratic risks that can imperil the continuity of a firm’s critical operations and core business lines.
Further practices to promote sound business continuity management include:
- Incorporate business impact analysis testing, training, and awareness programs, as well as communication and crisis management policies.
- Periodically review the business continuity plan to ensure contingency strategies remain consistent with current operations, risks and threats, its tolerance for disruption, and recovery priorities.
- Test business continuity plans, review the execution of tests, and improve plans by incorporating lessons learned.
- Confirm that functional testing procedures for assessing the ability of a firm’s IT systems to deliver minimum service capacity to critical operations and core business lines are consistent with the firm’s business continuity objectives.
- Identify and manage the availability of personnel who are essential to the execution of the firm’s critical operations and core business lines.
- Include remote-access contingencies that allow personnel to continue delivering the firm’s critical operations and core business lines through a disruption.
- Train essential personnel who have responsibility for executing critical operations and core business lines to perform back-up roles should a disruption occur.
- Integrate recovery and resolution planning into governance and operating processes and ensure they are a part of business-as-usual activities, including firm-wide risk management processes.
- Leverage information contained in recovery or resolution plans, where applicable, to identify options to respond to a wide range of severe but plausible internal and external stress scenarios.
Incident management software for financial services
The gist of the regulations discussed here is to guard firms against disruption risk and ensure that they can return to business as usual quickly should an incident happen.
One way for firms to prepare is with incident management software. These solutions help manage any type of incident or event that occurs across financial services – from the smallest customer complaint through to a major crisis event.
What else is the role of incident management software for financial services? These single integrated platforms manage safety and security, service outages, critical events, and more:
Business continuity management
Apply industry standards and best practices to determine disruption impacts, develop plans and prepare recovery strategies to address risks. Easily guide people through the business impact assessment process across your business, identify dependencies and gaps, and track plan and recovery strategy approval and testing.
Critical event management
Manage any critical event, from corporate crises to full-scale emergency management and business continuity disruption. All the tools to manage any incident through the entire lifecycle of mitigation, preparedness, response, and recovery. Keep your crisis or emergency teams following the same plans, collaborating effectively, and sharing the right information. Deploy digital playbooks and checklists to automate responses and track critical tasks.
Health and safety
Manage all aspects of health and safety in a centralized, easy-to-use platform. Increase efficiency with powerful automation capabilities and a single source of truth for all your data. Gain real time insights to all levels of your business and empower personnel with configurable notifications, workflows, analytics, and mapping.
Security management
Proactively manage all aspects of your security operations from anywhere, in one platform. Gain access to integrated security incident, shift, log, patrol, asset, visitor, and event management functionality. Streamline your operations using workflow automations to guide personnel through information capture, enrichment, follow up tasks, and notifications.
Critical infrastructure protection
Maintain key details of critical assets and stakeholder contacts, assess risks and threats using industry standard tools, disseminate notifications and notices such as official advice to asset custodians, track logs and tasks, and prepare for or respond to planned events or incidents.
Finally, the financial services industry has recently experienced a regulatory overhaul like nothing before. Enforcers remain on high alert.
For firms to adapt to the changes, they will need to embrace a wholistic framework for operational resilience. But a key part of developing the capacity to withstand, adapt to, and recover from disruptive events is having the ability to manage any type of incident or event that occurs across financial services.
That’s where incident management software comes in. But where to turn? Solutions like Noggin give you the integrated functionality needed to manage any type of incident – from the smallest customer complaint through to a major crisis event.
Don’t take our word for it, though. Check Noggin out for yourself in a tailored software demonstration.
.svg)
.svg)
.svg)