SR 20-24

1. Governance

• Institutions should set up a structured governance framework for operational resilience, providing board and senior management oversight.
• The board should set and review, at least annually, the institution’s risk appetite and tolerance for disruption.
• Senior management should lead the implementation of operational resilience work, provide resourcing and foster a culture of awareness to operational risk.

2. Operational Risk Management Framework

• Firms must implement a comprehensive operational risk management framework to identify, assess, mitigate, and report risks.
• It should be consistent with the broader risk strategies of the institution, and appropriate to its size, complexity, and activities.
• The framework should be subject to regular review and updates in response to the evolving threat environment.

3. Business Continuity Management (BCM)

• Robust business continuity plans (BCPs) should be maintained in institutions, to ensure continuity of critical operations in the event of a disruption.
• Regular scenario analysis and simulation exercises should be carried out to test the effectiveness of resilience arrangements.
• Cyber-attacks, IT outages, natural catastrophes, and operations incidents are some of the frequent risks in focus.

4. Third-Party Risk Management

• Due to the increased reliance on outsourcing, robust third-party risk management should be implemented by institutions.
• Prior to engaging with vendors, institutions should conduct due diligence and ensure conformity with regulatory and security requirements.
• Contracts entered into should include service level agreements (SLAs), terms on security and fallback solutions in the event of provider default.
• The ongoing monitoring and auditing of third-party suppliers are to be conducted for compliance purposes.

5. Scenario Analysis and Resilience Testing

• Regular resilience testing should be conducted to determine the ability to recover from significant operational disruptions.
• Common scenarios to test are cyber-attacks, failures of third-party services, data breaches, significant staff disruption & supply chain interruptions.
• Cross-firm resilience exercises ought to be employed for comparison purposes against industry peers.

6. Secure & Resilient Information Systems

• Information systems, supporting critical operations, need to be secure, resilient, and regularly tested.
• Strong access controls, encryption and cyber security methods are encouraged to minimize data exposures.
• Routine cyber security audits should be undertaken to confirm the conformity with industry benchmarks.

7. Surveillance & Reporting

• Real-time surveillance and reporting should be established in institutions to identify and manage operational risk.
• Monitoring of cyber threats, incidents and operational break-downs ought to be continuous.
• Frequent updates to senior management and board members should facilitate timely decision-making.