Are you ready for the next disruption? Why scenario data matters now

In today’s rapidly evolving risk landscape, regulators like the FCA are sharpening their focus on operational resilience. Their message is clear: firms must prepare for a wide range of severe yet plausible scenarios, ones that could cause intolerable harm to customers, disrupt market integrity, or threaten the firm’s survival.

While scenario planning isn’t new to financial institutions, the expectations are shifting. At WTW, we’ve been exploring the intersection between operational resilience scenarios (as defined by regulators) and operational risk scenarios (used in ICAAP/ICARA). We also draw on other valuable sources, like historical incidents and emerging risk surveys, to build a more complete picture.

What the scenario data reveals

Over the past decade, WTW has supported Banks, Asset Managers, FinTech’s, and other financial institutions in navigating scenario-based risk frameworks. From this work, we’ve developed a robust scenario database focused on operational resilience threats.

Risk themes and scenarios

Here’s what we’re seeing:

• Existing scenario data is a valuable asset: On average, around 25% of the operational risk scenarios identified, assessed, and mitigated by financial institutions are related to operational resilience. This makes them an excellent foundation for a focused operational resilience strategy.
• Technology Risks Dominate: Non-malicious tech failures, like application errors, system outages, and network disruptions, make up about 33% of all scenarios. Many involve cloud infrastructure, such as connectivity issues between cloud environments and data centers, or compliance breaches tied to cloud data storage.
• Severity Matters: One major advantage of using operational risk data is the inclusion of estimated financial impacts. For example, a cyberattack on payment infrastructure could cost a firm billions. In our database, tech-related failures have reached losses exceeding £500 million, with average losses of around £28 million. This level of detail is often missing from operational resilience scenarios.

Emerging risks: Elevating horizon scanning

Our recent Emerging & Interconnected Risks Survey revealed a striking trend: organizations now view nearly everything as an emerging risk. While climate change often tops industry reports, technology is currently dominating the agenda.

Artificial intelligence, cyber threats, and the future of tech occupy three of the top four emerging risk categories. That doesn’t mean other risks are fading – economic uncertainty, geopolitical tensions, and climate transition risks remain highly interconnected and influential.

The role of historical data

Industry-wide and firm-specific historical data reveal real and significant vulnerabilities. At WTW, we leverage anonymised insurance claims data to generate actionable risk insights. Our analysis highlights a high frequency of technology-related risks, most notably, severe incidents stemming from third-party software failures during updates and sophisticated data breaches.

Why this matters now

Scenario data has long been a cornerstone of risk management. But as operational resilience becomes a regulatory priority, firms must go beyond internal data. Relying solely on your own scenarios may leave blind spots. Incorporating external data, like peer scenarios, emerging risk trends, and anonymized insurance claims, ensures a more comprehensive and forward-looking approach.

Let’s talk about it

What internal data are you using to inform your operational resilience strategy? Where are you sourcing insights on emerging risks and how are you integrating them into your planning?

At WTW, we bring deep experience and a rich dataset to help you clarify your risk landscape. Whether it’s peer scenario data, emerging risk insights, or historical incident analysis, we’re here to support your journey toward greater resilience.