For many organisations, operational resilience has previously been viewed primarily as a regulatory consideration, driven by evolving requirements. Today the focus has moved beyond a regulatory obligation, with operational resilience being recognised as a core business capability - helping organisations protect customer outcomes, strengthen governance and support long-term business performance.

As Kim Bower, Business Manager, Legal & Risk explains:

The Drivers Behind The Shift

One of the key factors driving the increased focus on operational resilience is the growing complexity of financial services operating models.

Firms have become increasing reliant on interconnected technology infrastructure, outsourced providers and third-party partnerships to deliver critical services. From cloud platforms and technology suppliers to specialist partners, these relationships drive efficiency and deliver expertise to the business. However, they can also introduce new risks to a business including reliance issues and additional points of failure. As a result, firms are placing greater emphasis on understanding the risks that exist across their wider operating ecosystem.

Alongside this, the continued pace of technological change has expanded the risk landscape. Increasing digitisation, evolving cyber threats and the emergence of new technologies, including AI, have created new opportunities for organisations, but also new challenges that require robust oversight and governance frameworks.

Beyond Compliance: A Wider Business Priority

While regulation was once assumed the key focus for organisational resilience, many firms have discovered that resilience initiatives deliver benefits far beyond regulatory compliance.

Through operational resilience initiatives, organisations have developed a clearer understanding of the people, processes, technologies and third parties that support critical business services. This has enabled firms to identify areas for improvement across governance, operational oversight and service delivery.

According to Kim Bower, this is one of the key reasons operational resilience has become a strategic priority for many firms. Mapping critical services end-to-end can reveal important connections across technology, governance, processes and third-party providers, helping firms make more informed strategic decisions.

Consequently, operational resilience is increasingly being viewed as a framework for understanding how critical services are delivered, identifying opportunities to strengthen operational effectiveness and informing investment priorities.

This broader approach aligns with evolving regulatory developments, which increasingly position resilience as an integral part of strategy, governance and customer outcomes rather than a standalone consideration.

As Kim notes, the introduction of a new operational incident and third-party reporting regime due to come into force in March 2027, encourages organisations to place a greater emphasis on understanding their operational dependencies, strengthening oversight of critical suppliers and ensuring appropriate governance is in place.

Building Resilience Capability

As resilience becomes a strategic business priority, organisations are investing in the people, frameworks and expertise required to support long-term capability.

Technology and cyber resilience continue to be areas of significant focus, particularly as firms seek to strengthen their ability to prevent, respond to and recover from disruption. Organisations are increasingly looking for professionals who can bring expertise across risk management, governance, cyber security and operational resilience.

There is also a growing emphasis on third-party risk management. Effective due diligence, governance and oversight of external providers have become critical components of a strong resilience strategy. Firms are expected not only to understand their direct suppliers, but also the wider risks that may exist across outsourced service arrangements.

Navigating New and Evolving Risks

As operating models continue to evolve, organisations are reassessing how they identify, manage and respond to disruption across critical services. Technology and information security remain key priorities, reflecting the growing role that digital infrastructure plays in supporting day-to-day operations. At the same time, firms are placing greater emphasis on understanding their reliance on third-party providers and ensuring appropriate measures are in place.

Operational resilience remains a central focus, with organisations seeking to strengthen their ability to maintain service continuity, support positive customer outcomes and respond effectively to periods of disruption.

Emerging technologies are also introducing new considerations. As organisations explore and implement AI solutions, there is a growing focus on governance, accountability, operational oversight and risk management. While AI presents significant opportunities, firms must ensure appropriate controls are in place to support its use within highly regulated environments.

Ultimately, the challenge for many organisations is not understanding areas of risk, but developing a clear view of how people, processes, technology and third-party relationships work together to support critical business services. This broader perspective is increasingly helping firms make more informed decisions about resilience, investment and future growth.

Building for The Future

The importance of operational resilience is only expected to increase as organisations continue to navigate regulatory change, technological innovation and evolving operational risks.

Success will not only depend on the processes and technology in place, but also on the expertise, governance and oversight frameworks. Firms that invest in resilience capabilities, strengthen their understanding of operational dependencies and maintain effective oversight of third-party relationships will be better positioned to respond to disruption and support long-term business objectives.