Increasing Operational Resilience maturity for a major financial services organisation

Our client, a multinational financial services provider, needed help to mature their Operational Resilience capabilities at both group and divisional levels. They wanted to ensure they were better prepared for adversities and minimise any impact when disruptions occurred.

As with many other firms, Operational Resilience was a key priority for them to protect their clients, customers, staff, business, and the wider market. This was re-enforced by a major systems outage that occurred in their largest division, and the subsequent impacts of the Covid-19 pandemic.

Another driver was the change in regulatory landscape to increase focus on resilience. Our client was required to comply with a major policy update by the FCA and the PRA, the UK’s main regulators. They were driving a paradigm shift in organisations to focus on protecting the delivery of “important business services”. This required a wide array of new governance, documentation, processes, testing and remediation to be put in place.

Over a 2-year period more than 10 Wavestone consultants supported the client on several Operational Resilience projects, covering strategy, sourcing, and leadership of implementations. Our work focused on bridging the skills and experience gap on Operational Resilience topics to strategically drive maturity in the divisions. We also supported the implementation of the strategic agenda for the Group programme.

Our initial engagement focused on stabilising the management and leading the delivery of a major Operational Resilience remediation programme in the client’s largest division. We introduced programme controls and assurance, revamped the governance and reporting, and delivered the business continuity and crisis management workstreams.

When the COVID-19 pandemic hit, we supported the divisional crisis management teams with scenario planning & coordination of execution. This included critical staff identification and prioritisation, kit/software requirements gathering and provisioning, physical dependency identification (such as fax, post), and workaround validation and deployment (including training sessions).

We subsequently led the creation of a permanent operational resilience function. As part of this we co-designed and implemented the Group Operational Resilience operating model within the division. This covered governance & reporting, awareness and communications, testing planning & execution (incl. preparation of crisis simulation exercises), and assurance and risk oversight for business services (processes, people, systems, data, locations).

Wavestone also led the Operational Resilience team for the client’s second largest division, providing oversight on 7 key workstreams: Business Continuity, IT and Business Change, Management Information (MI) and Tooling, Target Operating Model, Incident Response, IT resilience and Supplier resilience. As part of this we defined the Agile operating model for the project team and the transition plan into Business as Usual processes once the function was enabled. Our consultants also provided SME support at key workshops and in the creation of deliverables.

Finally, we supported the Group in defining a target model for ongoing operational resilience MI. This covered reporting, governance, data, tooling selection plan, and readiness assessment and implementation planning. Working in tandem with the other Wavestone operational resilience teams, we ran a proof of concept for MI metrics and dashboards providing a service-centric view that fulfilled regulatory reporting obligations. It also provided an assessment on Operational Resilience capabilities and the supporting risk management and controls. We also undertook a tooling project to support the implementation of the MI, hosting workshops to define high-level requirements, facilitating vendor meetings and defining the project roadmap.

Initially, a small team of Wavestone consultants was mobilised to stabilise and support the delivery of an Operational Resilience remediation programme for the key division. Within the first few weeks, our team more than doubled. Word about our successful contributions spread, which led to expansion across several key divisions and at Group level.

Given the nature and importance of the topic, our Wavestone team had exposure to first, second and third lines of defence. We worked closely with the business to ensure that their needs and regulatory requirements were met simultaneously.

We ensured that the Operational Resilience programme was delivered within budget, time, and resource constraints. There was a particular focus on creating clear audit trails (incl. formal change control), validating delivery closures against success criteria, and ensuring robustness of the RAID.

Strategic deliverables for the target were created based on industry best practices as well as alignment to the client’s Operational Resilience policy, operating model, and framework.