Introduction
Organizations are being required to adapt to new ways of working daily. The move to greater digitization since COVID-19 had resulted in organizations making digital transformation central to their growth strategy. Businesses sought to quickly digitalize a lot of what they could and now seem to be shifting again to enable organizations to bend and flex when confronted by emerging risks rather than get trapped by them. But to be truly resilient, businesses must continue to move from simple risk management to establishing true resilience.
While resilience was often thought of as a fairy tale or a nice to have – the reality is that this is a critical new capability that organizations need to attain and prove to regulators. There are often aspects of managing and monitoring processes across various business siloes. A proactive approach that centralizes these processes forms the basis of a robust resilience strategy. Having meaningful metrics and measurement techniques is essential as organizations continue to move beyond the simple measurement of the red, yellow, and green of previous scoring techniques toward quantifying risks that resonate with leadership.
Operational Resilience – Now a Regulatory Priority
Operational resilience is quickly becoming a key regulatory priority. Whether it’s the Bank of England’s operational resilience rules, the Digital Operational Resilience Act (DORA) for the EU financial sector, the soon-to-be-finalized Australian Prudential Regulation Authority’s (APRA’s) Prudential Standard CPS 230 Operational Risk Management, or even the US Federal Reserve’s joint paper on sound practices to strengthen operational resilience – the regulatory discussion around resilience, what it means and how to manage it is constantly evolving.
What is a True Resilience Strategy?
Traditionally resilience has always been approached in terms of how quickly something can ‘bounce back’ from an impact. The thought process was “if a catastrophic event happened tomorrow how quickly could I serve my customers and be back in business.” Business continuity teams focus on metrics such as the number of days or hours to return to operations (RTO) or a recovery point (along a process) objective (RPO). RTO and RPO are typically used to measure resilience goals through business impact assessments (BIAs). Disaster recovery teams execute playbooks that have been tested in different user environments then struggle to bring processes and functionality back online after an incident.
In a world where human speed is surpassed by digital transaction speed and decisions are made using real-time analytics – old approaches to business continuity and disaster recovery simply don’t cut it.
Organizations and processes need to improve their ability to cope with any disruptions and continually test their existing controls and refine them where necessary. Businesses need to continue to assess different scenarios to create small ‘incidents’ to challenge the integrated fabric of people, processes, and technology. Why? Because risks are interconnected, and can easily cascade. Any reduction or restriction in access to an area due to catastrophic events can remove access to a critical single-source supplier. Thorough testing can also ensure organizations are able to create greater diversity across suppliers by reworking resource plans and partnerships.
Building a Proactive Resilience Practice
To futureproof your organization, your teams must do more and ensure resilience across a digital environment within your organization and across your vendors and cloud service providers (CSPs). If you have incorporated Risk Quantification techniques, with a bottom-up, top-down approach to scoring risks, you can start moving beyond managing risk to building true resilience.
This can be achieved by aligning processes, such as incident response across the distributed, virtual stakeholder groups. Ensure teams embrace digital transformation and confidently understand where there can be a chain reaction across the technology and business process workflow. This can be best achieved with an understanding of the upstream and downstream processes across CSPs connected to other third and fourth parties. Strengthen resilience programs by acting with agility. Begin building a strong capability to quickly adapt, leverage early warning signals, and have tested, executable plans to bounce back on.
Let’s look at some general categories with examples of how current reactive practices can be transformed by our GRC programs and technologies.
Future-Proof Organizational Resilience with MetricStream
Remember, business continuity planning is not enough. Real resilience requires a commitment to developing robust processes across the entire extended enterprise. In the next few years, we will see more digitalization and greater diversity, in both people and technologies that will continue to transform our third-party relationships and the way we work. Get ahead of the curve and be ready to embrace this change! Build robust processes into your resilience strategy and plans to help future-proof organizational resilience.
MetricStream’s ConnectedGRC products help you strategically manage risk in the interconnected risk landscape with an integrated and holistic approach to GRC. Designed with advanced analytics and AI capabilities at the core, it enables businesses to proactively identify, assess, manage, and mitigate various risks.
Organizations are being required to adapt to new ways of working daily. The move to greater digitization since COVID-19 had resulted in organizations making digital transformation central to their growth strategy. Businesses sought to quickly digitalize a lot of what they could and now seem to be shifting again to enable organizations to bend and flex when confronted by emerging risks rather than get trapped by them. But to be truly resilient, businesses must continue to move from simple risk management to establishing true resilience.
While resilience was often thought of as a fairy tale or a nice to have – the reality is that this is a critical new capability that organizations need to attain and prove to regulators. There are often aspects of managing and monitoring processes across various business siloes. A proactive approach that centralizes these processes forms the basis of a robust resilience strategy. Having meaningful metrics and measurement techniques is essential as organizations continue to move beyond the simple measurement of the red, yellow, and green of previous scoring techniques toward quantifying risks that resonate with leadership.
Operational Resilience – Now a Regulatory Priority
Operational resilience is quickly becoming a key regulatory priority. Whether it’s the Bank of England’s operational resilience rules, the Digital Operational Resilience Act (DORA) for the EU financial sector, the soon-to-be-finalized Australian Prudential Regulation Authority’s (APRA’s) Prudential Standard CPS 230 Operational Risk Management, or even the US Federal Reserve’s joint paper on sound practices to strengthen operational resilience – the regulatory discussion around resilience, what it means and how to manage it is constantly evolving.
Traditionally resilience has always been approached in terms of how quickly something can ‘bounce back’ from an impact. The thought process was “if a catastrophic event happened tomorrow how quickly could I serve my customers and be back in business.” Business continuity teams focus on metrics such as the number of days or hours to return to operations (RTO) or a recovery point (along a process) objective (RPO). RTO and RPO are typically used to measure resilience goals through business impact assessments (BIAs). Disaster recovery teams execute playbooks that have been tested in different user environments then struggle to bring processes and functionality back online after an incident.
In a world where human speed is surpassed by digital transaction speed and decisions are made using real-time analytics – old approaches to business continuity and disaster recovery simply don’t cut it.
Organizations and processes need to improve their ability to cope with any disruptions and continually test their existing controls and refine them where necessary. Businesses need to continue to assess different scenarios to create small ‘incidents’ to challenge the integrated fabric of people, processes, and technology. Why? Because risks are interconnected, and can easily cascade. Any reduction or restriction in access to an area due to catastrophic events can remove access to a critical single-source supplier. Thorough testing can also ensure organizations are able to create greater diversity across suppliers by reworking resource plans and partnerships.
To futureproof your organization, your teams must do more and ensure resilience across a digital environment within your organization and across your vendors and cloud service providers (CSPs). If you have incorporated Risk Quantification techniques, with a bottom-up, top-down approach to scoring risks, you can start moving beyond managing risk to building true resilience.
This can be achieved by aligning processes, such as incident response across the distributed, virtual stakeholder groups. Ensure teams embrace digital transformation and confidently understand where there can be a chain reaction across the technology and business process workflow. This can be best achieved with an understanding of the upstream and downstream processes across CSPs connected to other third and fourth parties. Strengthen resilience programs by acting with agility. Begin building a strong capability to quickly adapt, leverage early warning signals, and have tested, executable plans to bounce back on.
Let’s look at some general categories with examples of how current reactive practices can be transformed by our GRC programs and technologies.
Remember, business continuity planning is not enough. Real resilience requires a commitment to developing robust processes across the entire extended enterprise. In the next few years, we will see more digitalization and greater diversity, in both people and technologies that will continue to transform our third-party relationships and the way we work. Get ahead of the curve and be ready to embrace this change! Build robust processes into your resilience strategy and plans to help future-proof organizational resilience.
MetricStream’s ConnectedGRC products help you strategically manage risk in the interconnected risk landscape with an integrated and holistic approach to GRC. Designed with advanced analytics and AI capabilities at the core, it enables businesses to proactively identify, assess, manage, and mitigate various risks.
