In recent months KPMG and UK Finance have been engaging with a wide variety of financial services organisations to explore their strategies for responding to the pending operational resilience policy statements. To support with this, we have been running regular training sessions to provide an overview of the practical steps required to transition to the proposed regulatory requirements. Our aim has been to help participants consider their organisation's strengths and priority focus areas and provide tangible guidance for embedding service-based operational resilience within their organisations.

The sessions we have delivered have generated a variety of insightful discussions across a range of topics, including:  

1. Granularity of services: determining the ?right level? of an organisation's service taxonomy is fundamental to the long-term success of any operational resilience initiatives. The taxonomy will be used to achieve a number of objectives including the prioritisation of business services, to map underlying resources, complete service resilience assessments, define impact tolerances and be used to assess the ability to recover within tolerance from a severe, but plausible scenario.   
2. Impact tolerances: this is a new concept for the industry and some confusion still exists around the differences between a Recovery Time Objective, Recovery Point Objective and impact tolerance.  The session provides a clear approach to defining an impact tolerance and helps attendees to understand how to identify end-user cohorts, define end-user harm and articulate the impact a service disruption may have on broader market stability or a firm's own long-term viability.
3. Data quality:  To assess the resilience of an important business service and to enable an organisation to produce a service resilience dashboard on an ongoing basis, access to high-quality data is a key requirement.  Organisations should begin to identify the golden sources of data and understand how to access all relevant information on a timely basis.

With the policy statement expected in Q1 of this year, it's critical that organisations prioritise Operational Resilience and ensure the right foundations are in place. Twelve months from policy release, organisations will be expected to demonstrate that they have embedded the requirements of the policy statement into business as usual and are able to generate a self-assessment for their important business services.   

Join us in our next session on 22 February 1pm-4pm to explore this further. Click here to book:  Driving business value from service-based operational resilience with KPMG | UK Finance.