Operational Resilience Audit

Guidelines on Operational Resilience by the Hong Kong Monetary Authority

Operational resilience is critical for financial institutions in ensuring uninterrupted services and maintaining the financial system's stability. The Hong Kong Monetary Authority (HKMA) has issued guidelines to provide a comprehensive framework for financial institutions in Hong Kong to enhance their operational resilience. 

Referring to the actual "Supervisory Policy" or "SPM OR-2" is important, which sets out HKMA’s approach and supervisory expectations on operational resilience.  Refer to the guideline by clicking on the HKMA webpage.

Objective

This blog aims to provide participants attending the Operational Resilience Implementer and Expert Implementer course with global or regional responsibilities to understand the:

• The general principles outlined by the Hong Kong Monetary Authority (HKMA) that institutions must consider when developing their operational resilience framework.  
• Guidelines and be able to compare with those issued by other central banks from other regional justifications.

Definition of Operational Resilience

Operational resilience refers to a financial institution's ability to consistently deliver critical operations and services, even during disruptions or unexpected events.

It encompasses the organisation's ability to prevent, adapt, respond, and recover from operational disruptions to maintain continuity and protect the interests of customers and stakeholders.

Operational Resilience Framework

Financial institutions are expected to establish an operational resilience framework that integrates people, processes, and technology to enhance their overall resilience.

The framework should include the following components:

Governance and Accountability

The board and senior management should demonstrate clear responsibility and accountability for operational resilience. They should oversee and approve the institution's operational resilience strategy, policies, and risk tolerance levels.

Risk Identification and Assessment

Financial institutions should identify and assess the potential risks and vulnerabilities associated with their critical business services, processes, and systems. This includes conducting regular impact assessments and scenario analyses to understand the potential consequences of operational disruptions.

Business Impact Tolerance

Institutions should define their business impact tolerance, reflecting the maximum tolerable disruption to critical services, processes, and systems. This determination should consider the institution's risk appetite, customer expectations, and market conditions.

Planning and Strategy

Institutions should develop robust and comprehensive plans to address operational disruptions effectively. Considering various scenarios and potential impacts, these plans should cover incident response, crisis management, and business continuity.

Testing and Validation

Regular testing and validation exercises should be conducted to evaluate the effectiveness of the operational resilience framework. Institutions should identify gaps, areas for improvement and implement corrective actions based on the test results.

Reporting and Communication

Institutions should establish clear lines of communication and report for operational disruptions. This includes promptly reporting incidents to the HKMA and maintaining effective communication with customers, stakeholders, and regulatory authorities.

Role of the Board and Senior Management

The guidelines emphasise the board's and senior management's crucial role in ensuring operational resilience. They should demonstrate strong leadership, establish a culture of resilience, and promote effective governance practices within the organisation. Key responsibilities include:

Setting the Operational Resilience Strategy

The board and senior management should define the institution's strategic objectives regarding operational resilience, aligning them with the overall business strategy.

Risk Management Oversight

They should oversee the identification, assessment, and management of operational risks, ensuring appropriate risk controls and mitigation measures are in place.

Resource Allocation

The board and senior management should allocate sufficient resources, including budget, staff, and technology, to support the implementation and maintenance of the operational resilience framework.

Monitoring and Reporting

They should establish mechanisms to monitor the effectiveness of the operational resilience framework and receive regular reports on key resilience indicators and performance metrics.

Determining Operational Resilience Parameters

Financial institutions should establish operational resilience parameters to define the levels of resilience required for their critical business services, processes, and systems. These parameters should be determined based on factors such as:

Criticality and Impact

Institutions should consider the criticality and potential impact of a disruption on customers, financial stability, and the broader economy.

Recovery Time Objectives (RTOs)

RTOs specify the maximum tolerable downtime for critical services, processes, and systems, guiding the planning and recovery strategies.

Recovery Point Objectives (RPOs)

RPOs define the maximum acceptable data loss in case of disruptions, guiding data backup and recovery measures.

Dependencies and Interconnections

Institutions should consider the dependencies and interconnections between their internal and external systems and third-party service providers to ensure comprehensive resilience.

Mapping Interconnections and Interdependencies

Financial institutions must map the interconnections and interdependencies that underlie their critical operations. This includes identifying the key business services, processes, systems, and resources, both internal and external, on which their operations rely. 

By mapping these interconnections, institutions can understand the potential impact and dependencies in the event of disruptions. This knowledge enables them to identify vulnerabilities and implement appropriate measures to enhance resilience.

Preparing for and Managing Risks to Critical Operations Delivery

Financial institutions should proactively prepare for and manage risks that could affect the delivery of critical operations. 

This involves robust risk assessments to identify potential threats, vulnerabilities, and impacts. Institutions must establish risk management frameworks that identify, measure, monitor, and mitigate risks. These frameworks should align with the institution's risk appetite and regulatory requirements. By effectively managing risks, institutions can enhance their ability to withstand disruptions and ensure the continuity of critical operations.

Testing Ability to Deliver Critical Operations under Severe but Plausible Scenarios

Financial institutions must test their ability to deliver critical operations under severe yet plausible scenarios. 

This includes scenario-based exercises to simulate disruptions and assess the institution's response and recovery capabilities. Testing should cover various aspects, such as incident response, crisis management, communication, and business continuity. Regular testing helps identify weaknesses, refine response plans, and enhance the institution's overall operational resilience.

Responding to and Recovering from Incidents

Financial institutions should establish robust response and recovery plans to address operational incidents effectively. 

This involves defining clear roles, responsibilities, and escalation procedures to ensure a coordinated response. Institutions should also establish mechanisms for timely communication with stakeholders, including customers, regulators, and relevant authorities.

By promptly responding to incidents and implementing effective recovery measures, institutions can minimise the impact on critical operations and expedite the restoration of services.

Implementation of Operational Resilience Requirements

Financial institutions are expected to implement operational resilience requirements throughout their organisation. 

This includes embedding a culture of resilience, providing appropriate training and awareness programs for employees, and integrating operational resilience considerations into decision-making processes. 

Institutions should allocate sufficient resources to support the implementation of operational resilience requirements and establish mechanisms for monitoring, reporting, and ongoing improvement.

Conclusion

The HKMA's guidelines on operational resilience provide financial institutions in Hong Kong with a comprehensive framework to strengthen their operational resilience. 

By considering the general principles outlined in these guidelines, institutions can develop robust operational resilience frameworks that ensure the continuity of critical operations and protect the interests of customers and stakeholders.

Implementing these guidelines is essential for maintaining the financial system's stability and safeguarding the reputation of financial institutions in Hong Kong.

 

 

To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.