Quantifying operational resilience: Exposure and return on investment

Financial institutions are no strangers to quantifying operational risk; it's a core component of ICAAP and ICARA frameworks. However, as the regulatory lens sharpens on operational resilience, the conversation is shifting. The focus is no longer on risk, but on the ability to prevent, adapt, respond, recover, and learn from disruption.

Whilst regulators currently stop short of explicitly mandating firms to quantify operational resilience exposure in all cases, they are increasingly calling for integrated thinking across risk, capital and resilience. This opens the door for firms to lead the way by applying financial and operational metrics to resilience scenarios, aligning with existing risk models, and demonstrating the value of resilience investments. Crucially, these quantification efforts also feed directly into the mandatory operational resilience self-assessment required by the FCA, providing a robust, data-driven demonstration of a firm’s resilience posture.

So, how can firms begin to bridge this gap and meet evolving expectations? Below are several practical strategies to help you bring quantification into your operational resilience toolkit.

Example: Quantifying resilience

A UK financial institution recently reviewed its ICARA scenarios and identified that 4 out of 10 mapped directly to critical operational resilience risks, ranging from cyber disruption to third-party failure. Using the financial impact analysis from their scenario workshops, they were able to estimate potential losses and model their operational resilience scenarios. This not only clarified their resilience exposure but also helped justify targeted investments in controls and insurance, providing concrete data for their self-assessment.

Let’s talk about it

Quantifying operational resilience isn’t just a technical exercise; it’s a strategic opportunity to enhance decision-making, justify investments, and robustly demonstrate compliance. We’re interested in how others are approaching this challenge. Have you linked your operational risk efforts to your resilience ones? Have you found ways to demonstrate ROI on resilience investments? How are your quantification methods feeding into your self-assessment?

If you're exploring these questions, or want to, our Operational Risk Solutions team is here to help. Whether you're looking to define financial impact tolerances, quantify stressed scenarios, align ICAAP/ICARA with resilience initiatives, or strengthen your self-assessment, we can support you in turning resilience into measurable value.