BCAW 2023 Using the ‘3 Gs’ in Operational Resilience | BCI

The UK’s Financial Conduct Authority (FCA) defines operational resilience as “the ability of financial services firms and the finance services sector to prevent, adapt, respond to, recover, and learn from operational disruptions.”[1] The wider resilience profession is generally accepting of this definition, and is also adopting much of the wider work of the UK financial regulators in this area. The principles of operational resilience are relevant beyond the financial sector and, as such, we should all acknowledge and on-board those principles.

Within my organization we do a lot of work on ‘prevent and adapt,’ as that has always slotted neatly into the business continuity framework — often being the bulk of the workload. However, we sometimes pass the ‘response and recover’ phase over to operational teams to form part of SOPs or workplace instructions.

In terms of the response phase, I have recently started teaching our senior leaders some simple principles which help incident response to be more effective. We call these the ‘3 Gs,’ and they are as follows:

The Grasp element is focused on building situational awareness in a way that makes sense for your organization. This could be internally, through SCADA telemetry, first- or second-hand accounts, business systems, etc, or even looking at social media channels and news outlets to assess what is happening in real time. If you are lucky, you may have a lot of information to sift through, however, this is often not the case and you need to move on with limited situational awareness.

The Grip step is about identifying the need for leadership during an incident in a prudent and timely approach. This could be by your incident response teams, local leadership, or from elsewhere, but the key is a structured response to the incident. Those involved are typically trained and informed personnel who have already built relationships with each other.

Now you have established your incident response team, you can provide Guidance to ensure the response is an effective one. This typically involves following a response framework, crisis plan, playbooks, etc, to deploy a strategy to manage the incident.

It’s worth noting that, while it’s easy to talk about ‘Grasp, Grip and Guide’, there is a substantial amount of work, training, and validation that goes into implementing each step. The expression is a nice takeaway for senior leaders to make the training more memorable.

As a postscript for my German colleagues, I am now aware that the ‘3Gs rule’ which was also your COVID-19 restriction policy of geimpft, genesen, getestet (vaccinated, recovered, or tested) but I have yet to think of a better way to describe Grasp, Grip, and Guide!

Get involved in BCAW 2023 and access more resources - follow the link below: