Financial institutions must treat operational resilience as a continuously evolving discipline rather than a periodic testing requirement. Risk practitioners argue that increasingly plausible cyber, third-party and technology disruptions demand progressive scenarios, clear executive accountability, credible workarounds and the ability to adapt rapidly when several responses must happen simultaneously.
Financial institutions should
continually reassess whether their resilience scenarios still reflect the
disruptions they are most likely to face, rather than repeatedly testing
threats that have become less relevant.
Scenario programs should evolve
alongside the business and external environment, with lessons feeding directly
into investment, governance and transformation decisions.
Speaking at CeFPro’s 2026 Vendor Risk
Europe event, the Head of Operational Resilience and Business Transformation at
a bank said her organization had been forced to revisit the scenario-testing
plan developed only a year earlier to determine whether it remained relevant.
New threats had made other scenarios
more plausible, reinforcing the need for a continuous cycle of assessment,
design, testing and learning.
The senior resilience executive
argued that resilience should also be embedded directly into business
transformation.
Every organizational change should
prompt questions about whether it addresses vulnerabilities, improves processes
or strengthens the institution’s ability to withstand disruption.
That approach requires organizational
commitment rather than ownership by a specialist team.
A Business Transformation, Resilience
and Oversight Officer at the same bank emphasized the importance of senior
leadership engagement, arguing that executive backing is necessary to embed
resilience throughout the business.
“Everything starts at the top
essentially,” he said, stressing that leadership support helps resilience
priorities penetrate the wider organization.
Impact tolerances must be equally
dynamic. The resilience officer described them as the maximum disruption an
organization can withstand before customers, reputation or financial integrity
suffer unacceptable harm.
Those thresholds should be
continuously reassessed as services and businesses evolve rather than
established once and treated as permanent.
The practical difficulty was
demonstrated through a scenario involving an outsourced instant-payments
platform suffering a critical outage with an expected recovery window of four
to eight hours.
Participants acting as an executive
committee were given minutes to determine their response while customers, media
and regulators were already becoming aware of the disruption.
The exercise exposed one of scenario
testing’s most important lessons: real incidents rarely present organizations
with a single neat decision.
Customer communication emerged as a
priority because affected users needed reassurance that the institution
understood and was managing the disruption.
