Operational resilience as a new concept and extension of operational risk management

In March 2021, the Basel Committee on Banking Supervision published new ‘Principles for Operational Resilience’, which define resilience as a bank’s ability to respond to and recover from disruptions, and the Bank of England published a ‘Statement of Policy on Operational Resilience’ that financial services firms should be able to prevent disruption occurring to the extent practicable, adapt systems and processes to continue to provide services and functions in the event of an incident, return to normal running promptly when a disruption is over and learn and evolve from both incidents and near misses. Both publications use the concept of a ‘disruption’ for a rare/plausible/severe event, which can be viewed through the prism of Frank Knight’s distinction between ‘known’ risk and ‘unknown’ uncertainty. We know that a pandemic, a financial crisis or even a global cyberattack can happen within a lifetime, but we do not know the probability and cannot estimate a frequency by number. A more general approach for risk — as applied in risksensitive industries — extended the traditional view of risk in ‘repeated games’ to rare events with catastrophic impact and includes our ‘strength of knowledge’ as a crucial factor in determining how much the past can be forecasted into the future. This approach and best practices from risksensitive industries such as power grids can help to integrate operational resilience into existing operational risk management in the financial services industry. Nonetheless, any precautionary measure of redundancy, flexibility and adaptivity requires additional investments and is antagonistic to the paradigm of economies of scale with minimisation of buffers. Therefore, the governance of operational resilience will require a fundamental and new understanding about rare ‘severe but plausible scenarios’, which might happen beyond typical timescales of management in a bank and require an intertemporal investment, which transcends usual economic reporting timescales.