In our last blog ‘The Journey to Dynamic Op Res’ we discussed some challenges firms are facing in their journey to Dynamic Op Res.
One of them is firms knowing what the right Op Res data is, where to find it and how to use it to build a picture of resilience.
So, what can be done?
Identify key resilience data points
How can you know that each of the Facilities, Information, People, Supplier and Technology pillar assets are working as they should? This could be technology availability data, people metrics or supplier performance information. How do you anticipate issues arising with each of the pillar assets in the future? This could be through system monitoring or relying on previous peak usage information. Essentially, firms need to understand the data that helps to inform and answer these questions.
Consider existing data
Data collation can be inefficient in terms of time and effort. To help alleviate this, consider if you can use data being gathered for a different purpose, for example building monitoring information, and then apply it to build the Op Res picture? Are you already pulling in Risk and Control data that can also highlight resilience vulnerabilities? Utilising existing sources will give a starting point to layer further data on top of as you mature.
Build the component level picture
The starting point needs to be to map your Important Business Services and then identify the underlying pillar data, critical to each step of each service. Due to the potential volume of data involved, it can look like a complicated picture but once you have a baseline view of Op Res then you can start to mature and progress your journey.
Now that firms have a picture of their resilience, they can use it to determine if they are resilient enough. The data should indicate if there are areas of weakness that will be high on the candidate list for scenario testing. It will also support the execution of scenario testing by highlighting where response and recovery plans are likely to fail due to any impacts that are cascaded to downstream components of the service.
Ultimately though, firms need to understand whether their services can remain within Impact Tolerance and where this cannot be achieved, they need to understand when and where to take action and invest so that the end-to-end service can deliver for customers.
Having gone through all these steps you will ultimately get to a position where you can further mature your Op Res capability.
In our view, Dynamic Op Res is forward-looking, predictive, real-time and helps to determine the path firms will take next. Due to the potential volume of data required to give a true picture of service and organisational resilience, there is no doubt that using the right tooling solutions will be beneficial in providing that view.
We expect that firms will be at different stages of maturity however the majority will be around level 2.
The leading firms will be aiming for the outcomes aligned to level 5 and this would include:
– Automation of resilience data collation;
– Real time alerting on all the key components/pillars that enable important business services, proactively identifying resilience vulnerabilities; and
-Automated and continuous scenario testing to identify any vulnerabilities preventing you from recovering within impact tolerance.
This would significantly improve a firm’s ability to manage resilience in a proactive, effective and cost-efficient manner. However…….most firms are two to four years away from this.
The next blog will focus on:
Ultimately, as understanding develops across all industries, we want to be involved in that debate and help firms in getting data driven outcomes. Stay tuned for our next resilience blog which will look at the challenges around changing the cultural mindset and adopting the change when embedding operational resilience in your organisation.
Stay tuned and please drop us a note with any feedback you have.
By our Operational Resilience Mob
Download our point of view paper
Op Res is not a side of desk tick box exercise! It should be dynamic and a strategically important activity. Read our paper to find out more about our views on Dynamic Operational Resilience and what firms should be doing now.
