Operational Resilience Framework and Templates

What is Operational Resilience?

Operational resilience framework and templates can help a business to continue trading in the event of one or more operational or business incidents. Operational resilience is a company’s ability to identify, control, mitigate and manage operational disruptions. All businesses should have an operational resilience framework that identifies potential vulnerabilities and the risks posed to the business.

However, some FCA regulated business types have an obligation to comply with the SYSC 15A which requires specific operational resilience controls and measures to be in place. These mandatory processes should enable a firm to identify, risk assess, respond to and recover from operational disruptions.

Are Operational Resilience Templates Useful?

The use of template policies and procedures is extremely useful in most compliance areas. However, operational resilience and the identification of important business services are unique to each business type and industry. With this in mind, it is not easy to obtain generic operational resilience templates that are suitable for any regulated firm.

In their published guidance (PS21/3), the FCA note that the use of inflexible templates in this compliance area could result in gathering information and/or implementing processes that are too excessive for some firms and not enough for others. It could also promote a ‘tick box’ culture if templates are too rigid and structured.

Fortunately, this does not mean that foundation policies and tools cannot be used to support firms. Developed correctly, operational resilience templates can be an effective tool that negate starting policy development from scratch. Such templates must be fully customisable; allowing each firm to add, amend or delete content so that it is suitable fo their needs and obligations.

Examples of such flexible templates for an operational resilience framework can include blank assessment templates and audit checklists that can be used to gather mandatory information and assess general compliance.

Discover how our exclusive Operational Resilience Template Toolkit can support your regulatory and business compliance.

Identifying Important Business Services

An important business service is one that if disrupted, could cause potential harm to consumers and/or pose a risk to the stability and integrity of the financial market or system.

Through the identification of important business services, a company is able to assess the vulnerabilities operational disruptions could cause. This allows them to implement controls and systems to reduce the potential harm and risk.

SYSC 15A.2 requires a firm to identify its important business services and keep its compliance with the SYSC 15A requirements under review on at least an annual basis. This is especially important if there is a material change to the company’s business or the market in which it operates.

Operational Resilience Framework

The operational resilience framework should also include policies and controls for service and stakeholder mapping; communication plans and strategy; business continuity, incident response planning and scenario testing. The aim of these controls and measures is to enable a firm to identify and document the people, processes, technology, facilities and information necessary to deliver each of its important business services.

The framework of policies, procedures and assessments should be sufficient to allow the company to identify vulnerabilities and remedy these as appropriate. Completing a lessons learned exercise after each actual or test disruption is also mandatory and provide invaluable management information for improvements to be made.

Operational Resilience Template Toolkit

Our Operational Resilience Template Toolkit brings together 10 essential policies and templates that aid compliance with the FCA’s Operational Resilience requirements set out under SYSC 15A. Designed for use by the FCA regulated businesses who are obligated to have documents and controls in place to meet the operational resilience standards.

Covering the mandatory and supporting areas, including identifying and documenting important business services, stakeholder mapping and scenario testing. These templates and tools are fully customisable and can be used as a foundation on which to build a compliant and effective operational resilience framework.