For those involved in Operational Resilience planning, 31st March 2025 is a date that will be firmly etched in their minds. Often referred to as a deadline, we prefer to use the language of the regulators, who talk about 31st March as “the end of the transition period.” It is the point in time where the regulators expect firms to have completed all their work and be in a position to transition Operational Resilience actions from the build phase to the ‘BAU’ phase, with a formal self-assessment document reviewed and approved at board level. The window for completing that self-assessment is fast closing as the Q1 Board cycle approaches.

Firms must also proceed with the expectation that it is the point in time when the regulators will begin to seek more formal assurances that firms have effectively implemented all of the requirements and:

  • have a clear and detailed picture of the operational risks faced by their firm;
  • have defined, with justification, the acceptable level of disruption they can tolerate without causing material harm to their customers;
  • have an action plan for dealing with any disruption;
  • have stress-tested their ability to deal with such disruption; and
  • remediated any identified vulnerabilities by end March.

The regulators have the authority to request sight of your self-assessment review at any time, so making sure it is up to date and all necessary assurance work has been completed carries additional significance, with the review a regulatory expectation that must include certain specific elements.

With less than 6 months now to the end of this transition phase, firms should be preparing their final board reports, providing sufficient information and evidence, to enable boards to sign off compliance with the regulations. The question for firms is whether they are comfortable with the concept of the project team providing that assurance themselves – self-certification – or whether they feel some form of independent assurance is required? The regulator does not prescribe a specific approach but will welcome evidence of such questions being considered with a well-reasoned conclusion.

ICSR Operational Resilience Assurance Week

Benchmarking your approach to Operational Resilience against market norms is a key element of the assurance process and we are starting to get questions from a number of firms who value the broad experiences our team have developed. To help answer those questions will be sharing a series of daily articles between 11th – 15th November – ICSR Operational Resilience Assurance Week. Follow us at #ICSROpResWeek

During the week, we will be exploring 5 specific elements of Operational Resilience Assurance in more detail. These are:

  1. Monday 11th November: Operational Resilience ssurance and why is it important for firms.;
  2. Tuesday 12th November: Undertaking a review of the project governance process;
  3. Wednesday 13th November: The approach to the identification of Important Business Services, Impact Tolerances and Scenario Testing, including the creation of your Operational Resilience framework;
  4. Thursday 14th November: The changing landscape of outsourcing and Third-Party Risk management, including rules on Critical Third Parties;
  5. Friday 15th November: Remaining relevant and adaptable post transition-period.

There is a lot to cover and if you have any specific questions you would like us to address, please do email us on [email protected] in complete confidence. We will ensure that any questions submitted by Wednesday 6th November are addressed in our articles.

If you have any questions about Operational Resilience Assurance, please speak with either of the team below or your usual ICSR contact.

Additional Reading & Viewing - articles, webinars and case studies on Operational Resilience

Related Articles

Advisory & Resourcing

Pin It on Pinterest

Share This