Operational resilience and restructuring: a bridge too close? by Thibaud de Barmon

operational resilience and restructuring: a bridge too close?

by Thibaud de Barmon

Operational resilience is often described by regulators and practitioners as the ability to deliver financial services in both good and bad times. For regulators, bad times are temporary disruptions such as natural events, civil unrests, terrorist attacks, cyber attacks or system outages. In these bad times, delivery is achieved through business continuity management, incident management, information security management, or third-party management.

This prevailing consensus excludes disruptions leading to sudden but lasting changes of operational environments such as those incurred by political shifts or international crisis. It also excludes businesscentric capabilities such as change management or restructuring.

In light of the most recent developments, and not least of the ongoing pandemic, are such exclusions still for purpose? If not, how should firms adapt both the types of threats and the types of capabilities underpinning their operational resilience?

The commonly accepted threats to operational resilience (natural events, civil unrests, terrorist attacks, cyber attacks or system outages) lead to disruptions that are abrupt and most likely temporary. Resilience disruptions do not durably change firms’ operational environments; instead, they are followed by a return to business-as-usual. This is supported by the prevailing assumption that structural changes in operational environments are always gradual.

In the past few decades, this assumption has held true. Lasting changes in operational environments are typically driven by changes in competition, technology, legislation, and/or geopolitical conditions and in the recent past, these four elements have either remained stable or evolved slowly. Even the 2008 financial crisis didn’t fundamentally change the competitive landscape. As for the regulatory and legislative ones, even the most radical reforms such as Dodd-Frank, UK Ring Fencing, and the clearing of derivatives have been developed and implemented over a period of 5-10 years.

Is such relative stability here to stay? Three recent developments indicate that it is not.

First, the pandemic has shown that even natural events can lead to sudden and lasting structural changes in firms’ operational environments.

the new resilience threats

Secondly, the economic stress induced by the pandemic, combined with changing behaviors and rapid adoptions of new technologies, are bound to lead to abrupt changes in business models and impact competitive landscapes.

Lastly, new ranges of geopolitical risks could also lead to abrupt legislative changes that may have profound negative impacts on a firm’s operational structures. In some aspects, Brexit and the Euro crisis gave us a foretaste of this emerging threat.

Had the UK left the EU without a deal when the transition period first expired in March 2019, most cross-border arrangements between the UK and the EU financial entities would have been permanently discontinued. This would have led to abrupt legal, physical, and logical separations of operating structures that would have required a very different level of resilience. Similarly, had some countries been excluded from the Eurozone in 2013, the operational challenges of the inevitable currency re-denominations which would have followed would have been beyond the capacity of most European financial firms. In both cases cliff edges were avoided, but at a time of less predictable politics and escalating international tensions, one cannot assume such cliff edges will always be avoided.

The emergence of abrupt, but lasting, structural changes will probably be a significant departure from the operational condition firms have enjoyed, which have developed their current resilience strategies. These strategies will need to be renewed, and the range of capabilities that support them will need to be extended.

Firms’ responses to lasting structural changes are usually delivered through restructuring, be they reorganizations, wind-downs, divestments, acquisitions, or mergers, of some or whole, of their services.

As explained in “the Principles for Operational Resilience,” published by the Basel Committee for Banking Supervision in August 2020, operational resilience is achieved through the effective delivery of four other capabilities: business continuity management, incident management, information security management, and third-party management.

Restructuring capabilities are rarely part of this resilience equation. Most firms view them as supporting the management of strategic risks rather than operational risks. This separation means that these two sets of capabilities have developed independently from each other with limited day-to-day interactions.

Yet there is growing evidence of a negative relationship between restructuring capabilities and operational resilience outcomes.

Restructuring inevitably requires realignments of skills, experience, systems, and process. This realignment often weakens both existing and future controls even when the restructuring itself has been executed successfully.

restructuring as a resilience capability

In the UK, the RBS outage took place two years after the start of the bank’s downsizing and the TSB outage took place three years after the start of its integration into the Sabadell Group. TP ICAP encountered the largest money-broking outage recorded to date, just 18 months after the merger between Tullett Prebon and ICAP.

Operational resilience and restructuring also deliver several key outcomes: both require perfectly documented and transparent mapping of operational processes that would stand the scrutiny of potential acquirers; both require well drafted third-party contracts and effective monitoring framework and processes of these third-party relationships; and both require clear and transparent tested contingency options. As such, firms that fail to deliver these key resilience outcomes are unlikely to deliver successful restructuring.

For larger firms, which tend to restructure regularly, restructuring and resilience capabilities inevitably go hand in hand. Restructuring therefore needs to be a key capability within their operational resilience strategy.

What could this interaction of resilience and restructuring mean to firms in practice? Here the extension of the impact or risk tolerance frameworks, present in most resilience policies, is particularly pertinent. For each of their services or group of services, firms would set several risk or impact tolerances which when breached would trigger different types of restructuring: the lowest tolerance level would, when breached, allocate additional resources and investments to the relevant services so that the risk or impact levels are reduced.

Then for every pre-defined restructuring that the firm may have included as a viable recovery option for this service or group of services, then another tolerance level will be set. The least desirable the option, the higher the tolerance level. For instance, the second-lowest tolerance could just be a freeze of the onboarding of new clients and the highest a wind-down or the divestment of the related services.

Let us take a large, internationally focused clearing bank as an example. As CHAPS clearer, this bank may set their first impact tolerance at one extension request per year and allocate additional resources when it concludes that it operates beyond that level. If it concludes it operates beyond two extension requests per year other options could be considered, for instance, client onboarding could be put on hold. At three requests and above, the firm may go further and conclude that it has not the right capabilities to operate this service and decide to scale or wind it down altogether.

There is growing evidence that financial services’ operational environments are becoming less predictable. Be they pandemics, erratic politics or geopolitical crises, structural changes in operational environments are bound to increasingly crystallize in abrupt manners.

resilience restructuring in practice

conclusion

This means that operational resilience will not only require firms to prevent and recover from temporary disruptions, but also to adapt to unexpected “new normals.”

Financial services firms are not well-equipped for this development. Their operational structures are rigid, and restructuring capabilities are often weak. Firms should be mindful of this emerging vulnerability and put their restructuring capabilities at the center of their resilience strategies. Thus, they will ensure that simple operational rigidity doesn’t become one of the first hurdles they fall at and that it doesn’t become “their bridge too close.”

author

Thibaud de Barmon

Thibaud de Barmon has been working in financial services’ operations for the past 25 years, first as a practitioner, running large investment banking programmes and back-offices and as a UK regulator.

From 2008 to 2020 at the FSA and the Bank of England he ran the department of risk specialists dedicated to change, IT and operational risks. He was particularly involved in the supervision and policy developments of operational risk and resilience, banking restructuring, structural reform, Brexit and Fintech.

He now runs Milton House, an advisory consultancy dedicated to operational effectiveness and operational resilience in financial services.

Thibaud de Barmon was a co-author for the recent publication of PRMIA Institute’s paper Operational Resilience - A New Age of Reason.