Operational Resilience Fails Without Understanding Human Risk

𝐑𝐞𝐩𝐞𝐚𝐭 𝐚𝐟𝐭𝐞𝐫 𝐦𝐞 – “𝐢𝐟 𝐈 𝐡𝐚𝐯𝐧’𝐭 𝐩𝐫𝐢𝐨𝐫𝐢𝐭𝐢𝐳𝐞𝐝 𝐚𝐧 𝐮𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐢𝐧𝐠 𝐨𝐟 𝐡𝐮𝐦𝐚𝐧 𝐫𝐢𝐬𝐤 𝐚𝐧𝐝 𝐛𝐞𝐡𝐚𝐯𝐢𝐨𝐮𝐫𝐚𝐥 𝐝𝐫𝐢𝐯𝐞𝐫𝐬 𝐢𝐧 𝐦𝐲 𝐨𝐫𝐠𝐚𝐧𝐢𝐳𝐚𝐭𝐢𝐨𝐧 𝐢𝐭 𝐰𝐢𝐥𝐥 𝐧𝐨𝐭 𝐛𝐞 𝐨𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐚𝐥𝐥𝐲 𝐫𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐭”

In 11 days time the final PRA and FCA requirements on Operational Resilience come into force (for financial services firms).

Doubtless everyone has now dotted their I’s & crossed their T’s, on their important business services, impact tolerances and the myriad of technical, process & governance obligations.

But is there the danger that this could lead to the “illusion-of-resilience” or “resilience-theatre”?

Tackling the technical risks that arise from cyber, technology & key third parties is of the utmost importance, but without (also) addressing the human factor it is a 2 legged stool – likely to be wobbly when you sit on it.

I was reminded of these imperatives over the last 2 days as I attended the 1LoD Culture & Conduct deep dive.

The excellent opening debate covered what Financial Services can learn from other highly regulated industries. Whether Aircraft Safety, the UK Met Police or Nuclear Accidents it was clear that when an incident happened there was always a human element entwined within the root causes.

Prior thoughts on the lessons from nuclear accidents and Fukushima here:

https://lnkd.in/e_ui9xaT

And on the difference between proximate and ultimate causation here:

https://lnkd.in/eQfRYgBg

As I was (once again) pondering why key behavioural risks take a back seat, as everyone clambers for the comforting balm of technical solutions, a new survey popped into my feed from KPMG USA on Risk & Resilience.

https://lnkd.in/ebvGZVr4

This majored on the usual risk & resilience levers – but it did note (in passing) that “two-thirds to nearly three-quarters (of firms) - face moderate to strong barriers in effectively managing risk”.

These barriers included performing duplicative efforts (71%), cultural resistance (66%) & lack of awareness and communication (72%).

These obstacles are not technical they are behavioural.

𝐑𝐞𝐩𝐞𝐚𝐭 𝐚𝐟𝐭𝐞𝐫 𝐦𝐞 – “𝐢𝐟 𝐈 𝐡𝐚𝐯𝐧’𝐭 𝐩𝐫𝐢𝐨𝐫𝐢𝐭𝐢𝐳𝐞𝐝 𝐚𝐧 𝐮𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐢𝐧𝐠 𝐨𝐟 𝐡𝐮𝐦𝐚𝐧 𝐫𝐢𝐬𝐤 𝐚𝐧𝐝 𝐛𝐞𝐡𝐚𝐯𝐢𝐨𝐮𝐫𝐚𝐥 𝐝𝐫𝐢𝐯𝐞𝐫𝐬 𝐢𝐧 𝐦𝐲 𝐨𝐫𝐠𝐚𝐧𝐢𝐳𝐚𝐭𝐢𝐨𝐧 𝐢𝐭 𝐰𝐢𝐥𝐥 𝐧𝐨𝐭 𝐛𝐞 𝐨𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐚𝐥𝐥𝐲 𝐫𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐭”*