New research reveals a widening gap between perceived compliance and true readiness in operational resilience, as firms struggle to demonstrate effective stressed exit strategies amid rising regulatory expectations and complex third-party ecosystems.
A year after Escode’s landmark study into
supplier stability and operational resilience, its latest collaboration with
CeFPro to discover how those findings have since impacted on real world action
reveals a hard truth.
Many firms believe they are compliant, but
far fewer can prove they are ready.
The new research highlights a widening
confidence gap. While 51 percent of firms say they feel fully compliant with
resilience requirements, only 18 percent express high confidence that their
stressed exit plans are complete.
For Julie Antonelli, Vice President of
Sales for North America at Escode, the reason is clear.
“Having something documented on paper is
quite different from actually running a real-world scenario to validate
stressed exit readiness,” she says. “Written policies and compliant
documentation are beyond valuable, but regulators now expect actual evidence
that an exit could truly operate under stressed conditions.”
That distinction between documentation and
demonstration is reshaping operational resilience globally. In Europe, the
Digital Operational Resilience Act has introduced mandatory testing, incident
reporting, and strict third-party risk management requirements.
In the United States, guidance such as that
issued by the Interagency guidance on third party risk management and the FFIEC
remains more principles-based, but expectations are moving in the same
direction.
Antonelli believes global firms should not
aim for the lowest common denominator.
“EU rules like DORA are very strict and
mandatory,” she explains. “For global firms operating across regions, it makes
sense to meet the tougher standards, so your overall resilience plan and
stressed exit strategy are aligned everywhere.”
Alignment, however, is only part of the
challenge. Ownership remains a significant weakness.
The research shows the majority (93
percent) of respondents rely heavily on cloud services, yet more than half are
unclear on who owns supplier failure and concentration risk.
Legal, procurement, technology, and
operational risk teams all have roles to play, but without clear accountability
progress stalls.
“There needs to be an identified primary
owner,” Antonelli says. “Without that, stressed exit planning remains a concept
on paper rather than rehearsed and managed risk.”
The cultural shift required is substantial.
For years, resilience programs have often been treated as documentation
exercises. Today, regulators expect drills, scenario testing, and continuous
validation.
