For those involved in Operational Resilience planning, 31st March 2025 is a date that will be firmly etched in their minds. Often referred to as a deadline, we prefer to use the language of the regulators, who talk about 31st March as “the end of the transition period.” It is the point in time where the regulators expect firms to have completed all their work and be in a position to transition Operational Resilience actions from the build phase to the ‘BAU’ phase, with a formal self-assessment document reviewed and approved at board level. The window for completing that self-assessment is fast closing as the Q1 Board cycle approaches.
Firms must also proceed with the expectation that it is the point in time when the regulators will begin to seek more formal assurances that firms have effectively implemented all of the requirements and:
- have a clear and detailed picture of the operational risks faced by their firm;
- have defined, with justification, the acceptable level of disruption they can tolerate without causing material harm to their customers;
- have an action plan for dealing with any disruption;
- have stress-tested their ability to deal with such disruption; and
- remediated any identified vulnerabilities by end March.
The regulators have the authority to request sight of your self-assessment review at any time, so making sure it is up to date and all necessary assurance work has been completed carries additional significance, with the review a regulatory expectation that must include certain specific elements.
With less than 6 months now to the end of this transition phase, firms should be preparing their final board reports, providing sufficient information and evidence, to enable boards to sign off compliance with the regulations. The question for firms is whether they are comfortable with the concept of the project team providing that assurance themselves – self-certification – or whether they feel some form of independent assurance is required? The regulator does not prescribe a specific approach but will welcome evidence of such questions being considered with a well-reasoned conclusion.
ICSR Operational Resilience Assurance Week
Benchmarking your approach to Operational Resilience against market norms is a key element of the assurance process and we are starting to get questions from a number of firms who value the broad experiences our team have developed. To help answer those questions will be sharing a series of daily articles between 11th – 15th November – ICSR Operational Resilience Assurance Week. Follow us at #ICSROpResWeek
During the week, we will be exploring 5 specific elements of Operational Resilience Assurance in more detail. These are:
- Monday 11th November: Operational Resilience ssurance and why is it important for firms.;
- Tuesday 12th November: Undertaking a review of the project governance process;
- Wednesday 13th November: The approach to the identification of Important Business Services, Impact Tolerances and Scenario Testing, including the creation of your Operational Resilience framework;
- Thursday 14th November: The changing landscape of outsourcing and Third-Party Risk management, including rules on Critical Third Parties;
- Friday 15th November: Remaining relevant and adaptable post transition-period.
There is a lot to cover and if you have any specific questions you would like us to address, please do email us on [email protected] in complete confidence. We will ensure that any questions submitted by Wednesday 6th November are addressed in our articles.
If you have any questions about Operational Resilience Assurance, please speak with either of the team below or your usual ICSR contact.
Additional Reading & Viewing - articles, webinars and case studies on Operational Resilience
- ICSR Operational Resilience webinars – watch on our YouTube channel:
- Operational Resilience – Introduction with Kenneth Underhill (4th June 2020)
- ICSR Webinar: Technology & Operational Resilience (16th July 2020)
- Operational Resilience: Service and Activity Mapping with Kenneth Underhill (8th October 2020)
- Operational Resilience: Impact Tolerances webinar (26th May 2021)
- Articles:
- Operational Resilience – The Final Furlong Towards Implementation (21st May 2024)
- TSB Operational Resilience Fine – What Lessons Can Insurers Learn From This? (18th January 2023)
- Outsourcing and Third-Party Arrangements – Creating Resilience In Your Operational Processes (10th February 2022)
- Operational Resilience – A Regulatory Double-Header (15th April 2021)
- Mapping Important Business Services: When Does A Service Finish? (12th November 2020)
- Operational Resilience: The First Shot Has Been Fired! (6th March 2020)
- Case Studies:
- Assisting International Insurer Manage Its Operational Resilience Obligations
- Digital Operational Resilience Act (DORA) Support For Client In The Irish Regulated Market
- Supporting The Client With The Delivery Of A New Governance, Service And Operating Model As A Part Of A Corporate Restructure
- Assisting London Market Insurance Broker With Operational Resilience
- Support Developing Operational Resilience Control Framework
- Assisting Client With Project Delivering PRA and FCA Operational Resilience Requirements
- Support Preparing For Introduction of Operational Resilience and Business Continuity Planning
Related Articles
Operational Resilience: The 31st March 2025 Deadline And Beyond
In this article we look at what firms need to have in place by the end of March 2025 to be compliant with Operational Resilience regulations in the UK, looking beyond the deadline into the areas UK regulators are expected to shift their focus towards.
Operational Resilience: An Assurance Review Of Outsourcing Policies, Third-Party Risk Management And Critical Third Parties
Outsourcing has become a fundamental aspect of operational strategy – as firms strive to meet OpRes requirements. Ensuring their outsourcing policies and third-party relationships are robust and capable of withstanding disruptions is key.
Operational Resilience: Assurance Review Of IBS, Impact Tolerances, Scenario Testing And Vulnerabilities Resolution
Explore how assurance reviews can provide firms with confidence that their OpRes measures around IBS, Impact Tolerances, Scenario Testing and vulnerability management are sound, actionable, and aligned with regulatory expectations.
Operational Resilience: The Project Governance Process – An Assurance Review
Learn more about the role of project governance in Operational Resilience, looking in particular at how assurance processes support the successful delivery of actions and deliverables.
Operational Resilience: Why Assurance Matters And What Is Required
Learn more about the vital role assurance plays in Operational Resilience, including the regulatory backdrop, the risks of non-compliance, and how firms can ensure their assurance processes are robust, transparent, and aligned with long-term business objectives.
Operational Resilience Compliance – Doing The Right Thing Is Not Enough; You Must Prove It!
The clock is ticking for insurance firms ahead of the March 2025 deadline to fully implement and demonstrate Operational Resilience. Claire King and Benoit Steulet explore the importance of being able to evidence compliance with the regulations.