What would you say is the biggest priority right now within Operational and Third Party Resilience?

The biggest priority is establishing a practical and regulator-ready operational resilience capability that can demonstrate an organization's ability to continue delivering critical operations through severe but plausible disruption scenarios. For us, that means clearly identifying critical operations, defining impact tolerances, understanding dependencies, and ensuring that appropriate resilience and recovery capabilities exist across both internal and third-party ecosystems.

At the same time, third-party resilience is becoming increasingly important due to the growing reliance on external providers, cloud services, and specialized vendors. Organizations need greater visibility into their third-party dependencies and must move beyond traditional due diligence to understand how supplier disruptions could impact critical operations. The focus is shifting from managing vendors to managing resilience outcomes.

How is dependency mapping evolving to give greater visibility over the end-to-end processes of critical operations?

Dependency mapping has evolved significantly from a technology-focused exercise into a holistic view of how critical operations are delivered. Organizations are increasingly mapping across people, processes, technology, data, facilities, and third parties to understand the complete operating environment supporting a critical service.

The next generation of dependency mapping is also focused on understanding the relationships between dependencies, not just documenting them individually. This allows firms to identify concentration risks, single points of failure, and hidden interconnections that may not be apparent through traditional process reviews. Ultimately, the goal is to move from a static inventory of assets and processes to a dynamic understanding of operational ecosystems and how disruptions can propagate across them.

This broader perspective provides more meaningful insights for scenario testing, recovery planning, and executive decision-making.

How can risk and resilience teams better work together to achieve their firm's overall operational resilience objectives?

Risk and resilience teams are most effective when resilience is viewed as an extension of sound risk management rather than a separate discipline. Risk teams provide valuable insights into emerging risks, control weaknesses, operational incidents, and external threats, while resilience teams focus on preparedness, response, recovery, and continuity of critical operations.

Collaboration can be strengthened through shared assessments, integrated reporting, common risk and resilience metrics, and coordinated scenario testing exercises. Organizations also benefit when resilience considerations are embedded into risk decisions involving technology change, outsourcing, third-party arrangements, data management, and business transformation initiatives.

Ultimately, both functions share the same objective: minimizing harm to customers, the organization, and the broader financial system when disruptions occur.

What areas are you looking at over the next 3–6 months in terms of investment for support with your Operational and Third Party Resilience strategies?

Over the next several months, I see organizations focusing investment in four key areas:

Enhancements to End to End Dependency Mapping and Critical Operations Analysis – Enhancing visibility into end-to-end operational dependencies, including external and outsourced services.

Scenario Testing and Exercising Capabilities – Expanding testing programs to validate resilience assumptions and recovery capabilities under increasingly complex disruption scenarios.

Third-Party and Supply Chain Resilience – Strengthening oversight of critical suppliers, improving recovery assessments, and gaining deeper visibility into fourth-party and concentration risks.

Data, Technology and Automation Enablement – Leveraging technology platforms, data analytics, AI, and integrated risk and resilience tooling to reduce manual effort, improve monitoring, and provide real-time visibility into resilience exposures.

Many organizations are also investing in capabilities that support regulatory expectations while creating long-term operational value through improved governance, efficiency, and transparency.

In terms of our event format, how do you see it assisting you with overcoming the challenges faced?

The peer-led and closed-door nature of the event is particularly valuable because operational resilience remains an evolving discipline across the industry. Many organizations are navigating similar challenges related to dependency mapping, third-party resilience, regulatory expectations, scenario testing, and operating model maturity.

Having the opportunity to engage directly with senior leaders from other financial institutions allows participants to share practical lessons learned, compare approaches, and discuss challenges openly in a trusted environment. These conversations often provide insights that cannot be obtained through formal guidance or industry publications alone.

The event is also an excellent opportunity to benchmark progress, identify emerging practices, and build relationships with peers facing similar resilience challenges. Those discussions ultimately help organizations accelerate their resilience programs and avoid reinventing solutions that others have already implemented successfully.