{"id":29550,"date":"2023-02-14T08:43:05","date_gmt":"2023-02-14T07:43:05","guid":{"rendered":"https:\/\/www.smartcockpit.ch\/?p=29550"},"modified":"2023-02-21T13:03:42","modified_gmt":"2023-02-21T12:03:42","slug":"finma-operational-risks-and-resilience","status":"publish","type":"post","link":"https:\/\/www.smartcockpit.ch\/en\/finma-operational-risks-and-resilience\/","title":{"rendered":"Operational risk management – FINMA: Circular 2023\/1 Operational risks and resilience \u2013 banks\u201d"},"content":{"rendered":"

You have probably heard about the recent FINMA publication about the revision of: \u201cCircular 2023\/1 Operational risks and resilience \u2013 banks\u201d<\/em> which will replace the previous circular 2008\/21: \u201cOperational risks<\/em> \u2013 banks\u201d.<\/em> This circular will come into force on January 1, 2024,<\/strong> and addresses major changes for your organization, starting from the title with the mention of operational resilience<\/strong>. Swiss banks, insurance companies, financial institutions will all have to comply with it within the year… Time is short and the workload is high!<\/p>\n

So, what is in this new circular? What are the new changes? And how does your company comply? For you, we will answer all these questions.<\/p>\n

What is in FINMA 2023\/1 circular?<\/h2>\n

The 2023\/1 circular \u201cOperational risks and resilience \u2013 banks\u201d<\/em> concerns risk management and business continuity in the banking sector. It also includes elements of the Basel Committee on Banking Supervision<\/strong> (BCBS). It aims to develop practices in line with international standards in terms of resilience and to meet the challenges of the growing digitalization process.<\/p>\n

As mentioned earlier, this revision of the FINMA circular includes additional principles regarding operational resilience. There are now 8 of them:<\/p>\n

    \n
  1. Overarching<\/strong> operational risk management<\/strong><\/li>\n
  2. ICT risks management, ICT strategy and governance, Change management, ICT operations (run and maintenance), incident management<\/strong><\/li>\n
  3. Cyber risk management<\/strong><\/li>\n
  4. Critical data risk management<\/strong><\/li>\n
  5. Management of risks from cross-border service business<\/strong><\/li>\n
  6. Business continuity management<\/strong><\/li>\n
  7. Operational resilience<\/strong><\/li>\n
  8. Continuation of critical services during the resolution and recovery of systemically important banks<\/strong><\/li>\n<\/ol>\n

    Operational risks are really difficult to quantify. An example of this is the risk of fraud. In this case we can quickly come to the conclusion that no organization is really safe from such a risk because it can come from the outside as well as the inside. In addition, the estimated of the financial impacts cannot be relied upon. For this reason, FINMA has refined its risk management supervision.<\/p>\n

    Financial institutions must therefore have a comprehensive risk management concept. It must enable you to cover all types of risks<\/strong> across all your activities, but also identify, analyze, evaluate and manage<\/strong> effectively significant risks. Lastly, it has to bring coherence in order to allow all control functions to interact with each other and share their views with the board in a coordinated way.<\/p>\n

    Finally, this circular sets out the recommendations for Business Continuity Management (BCM). These set out the framework that companies must follow in order to guarantee the continuity of their services in the event of a crisis. In connection with BCM, FINMA addresses the topic of operational resilience in companies based on the “Principles of Operational Resilience” published by the BCBS.<\/p>\n

    Want to learn more about resilience? Read our white paper on resilience in your organization, written with our partner Pragm@TIC<\/span><\/a>!<\/p>\n

    \"r\u00e9silience\"<\/a><\/p>\n

    What are the new changes?<\/h2>\n

    FINMA has evolved the principles of this circular to align with other regulatory provisions in the areas of digitization and Information and Communication Technology (ICT), cyber risk, and critical data processing. It also incorporates operational resiliency as an extension of previous regulatory standards for business continuity management (BCM).<\/p>\n

    Principle 2:\u00a0ICT\u00a0risk\u00a0management<\/strong><\/p>\n

    Concerning ICT risks, FINMA circular requires good change management and ICT operations by ensuring the separation of test and production environments as well as good incident management. This principle is directly linked to the former principle on IT infrastructure.<\/p>\n

    Principle 3: Cyber risk management<\/strong><\/p>\n

    Cyber risk management imposes a duty to inform FINMA of cyberattacks, but this duty is not new. However, it is required to set up a strategy that includes processes and tests to:<\/p>\n