Showing posts with label operational resilience. Show all posts
Showing posts with label operational resilience. Show all posts

Tuesday, October 26, 2021

How More Industries Can Cultivate a Culture of Operational Resilience

A transcript of a discussion on the many ways that businesses can reach a high level of assured business availability despite varied and persistent threats.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: ServiceNow and EY.

Dana Gardner: Hi, this is Dana Gardner, Principal Analyst at Interarbor Solutions and you’re listening to BriefingsDirect.

In our last sustainable business innovation discussion, we explored how operational resiliency has become a top priority in the increasingly interconnected financial services sector.

We now expand our focus to explore the best ways to anticipate, plan for, and swiftly implement the means for nearly any business to avoid disruption.

New techniques allow for rapid responses to many of the most pressing threats. By predefining root causes and implementing advance responses, many businesses can create a culture of sustained operations.

To learn more about the many ways that businesses can reach a high level of assured business availability despite persistent threats, please join me in welcoming Steve Yon, Executive Director of the EY ServiceNow Practice. Welcome back, Steve.

Steve Yon: Thanks so much, Dana.

Gardner: We’re also here with Andrew Zarenski, Senior Manager and ServiceNow Innovation Leader at EY. Welcome, Andrew.

Andrew Zarenski: Thanks, Dana, for having me.

Gardner: Steve, our last chat explored how financial firms are adjusting to heightened threats and increased regulation by implementing operational resiliency plans and platforms. But with so many industries disrupted these days in so many ways, is there a need for a broader adoption of operational resiliency best practices?

Yon: Yes, Dana. Just as we discussed, the pandemic has widened people’s eyes -- not only in financial services but across other industries. And now, with hurricane season and those impacts, we’re continuing to see strong interest to improve operational resiliency capabilities within many firms. Being able to continuously serve clients is how the world works – and it’s not just about technology.

Gardner: What has EY done specifically to make operational resiliency a horizontal capability, if you will, that isn’t specific to any vertical industry?

Resilience solutions for all sectors

Yon: The platform we built the solution on is an integration and automation platform. We set it up in anticipation of, and with the full knowledge that it’s going to become a horizontal capability.

Yon
When you think about resiliency and doing work in operational models, it’s a verb-based system, right? How are you going to do it? How are you going to serve? How are you going to manage? How are you going to change, modify, and adjust to immediate recovery? All of those verbs are what make resiliency happen.

What differentiates one business sector from another aren’t those verbs. Those are immutable. It’s the nouns that change from sector to sector. So, focusing on all the same verbs, that same perspective we looked at within financial services, is equally as integratable when you think about telecommunications or power.

With financial services, the nouns might be things around trading and how you keep that capability always moving. Or payments. How do I keep those seems going? In an energy context, the nouns would be more about power distribution, capacity, and things like that.

With our solutions we want to ensure that you don’t close any doors by creating stove pipes -- because the nature of the interconnectedness of the world is not one of stove pipes. It’s one of huge cross-integration and horizontal integration. And when information and knowledge are set up in a system designed appropriately, it benefits whichever firm or whatever sector you’re in.

Gardner: You’ve created your platform and solution for complex, global companies. But does this operational resiliency capability also scale down? Should small- to medium-size businesses (SMBs) be thinking about this as well?

Yon: Yes. Any firm that cares about being able to operate in the event of potential disruptions, if that’s something meaningful to them, especially in the more highly regulated industries, then the expectation of resiliency needs to be there.

How to Build Resiliency into Operations

We’re seeing resiliency in the top five concerns for board-level folks. They need a solution that can scale up and down. You cannot take a science fair project and impact an industry nor provide value in the quick way these firms are looking for.

The idea is to be able to try it out and experiment. And when they figure out exactly how to calibrate the solution for their culture and level of complexity, then they can rinse, repeat, and replicate to scale it out. Your comment on being able to start small and grow large is absolutely true. It’s a guiding principle in any operational resiliency solution.

Gardner: It sounds like there are multiple adoption vectors, too. You might have a risk officer maturity level, or you might just have a new regulatory hurdle and that’s your on-ramp.

Are there a variety of different personas within organizations that should be thinking about how to begin that crawl, walk, run adoption for business continuity?

Yon: Yes. We think a proper solution should be persona-based. Am I talking to someone with responsibilities with risk, resilience, and compliance? Or am I talking to someone at the board level? Am I talking to a business service owner?

And the solution should also be inclusive of all the people who are remediating the problems on the operational side, and so unifying that entire perspective. That’s irrespective of how your firm may work. It focuses broadly on aligning the people who need to build things at the top level, to understanding the customer experience perspective, and to know what’s going on and how things are being remediated. Unifying with those operational folks is exceptionally important.

The capability to customize a view, if you will, for each of those personas -- irrespective of their titles – in a standard way so they are all able to view, monitor, and manage a disruption, or an avoidance of a disruption, is critical.

Gardner: Because the solution is built on a process and workflow platform, ServiceNow, which is highly integratable, it sounds like you can bring in third parties specific to many industries. How well does this solution augment an existing ecosystem of partners?

Yon: ServiceNow is a market-ubiquitous capability. When you look under the hood of most firms, you’ll find a workflow process capability there. With that comes the connectivity and framework by which you can have transparency into all the assets and actors.

ServiceNow is a market-ubiquitous capability. When you look under the hood of most firms, you'll find a workflow process capability there. With that comes the connectivity and framework to gain transparency into all the assets and actors.

What better platform to then develop a synthesis view of, “Hey, here’s where I’m now detecting the signal that could be something that’s a disruption”? That then allows you to be able to automatically light up a business continuity plan (BCP) and put it into action before a problem actually occurs.

We integrate not only with ServiceNow, but with any other system that can throw a signal -- whether it’s a facilities-based system, order management system, or a human resources system. That includes anything a firm defines as a critical business service, and all the actors and assets that participate in it, along with what state they need for it to be considered valid.

All of that needs to be ingested and synthesized to determine if there’s an issue that needs to be monitored and then a failover plan enacted.

Gardner: Andrew, please tell us about the core EY ServiceNow alliance operational resilience offering.

Detect disruptions with data

Zarenski
Zarenski: Corporations already have so many mitigation policies in place that understanding and responding to disruptions in real time is obviously essential. Everyone likes to think about the use case of plugging cybersecurity holes as soon as possible to prevent hackers from taking advantage of an exploit. That’s a relatively easy, relatable scenario. But think about a physical office service. For example, an elevator goes down that then prevents your employees from getting to their desks or people in a financial firm getting to their trading floor.

Understanding that disruption is just as important as understanding a cybersecurity threat or if someone has compromised one of your systems or processes. Detection today is generally harder than it’s been in the past because corporations’ physical and logical assets are so fragmented. They’re hard to track in that or any building.

Steve alluded to how service mapping, to understand what assets support services, is incredibly difficult. Detection has become very complicated, and the older ways of picking up the phone just isn’t enough because most corporations don’t know what the office is supporting. Having that concrete business service map and understanding that logical mapping of assets to services makes a solution such as this help our operators or chief risk officers (CROs) able to respond in near real time, which is the new industry standard.

Gardner: So, on one hand, it’s more difficult than ever. But the good news is that nowadays there’s so much more data available. There’s telemetry, edge computing, and sensors. So, while we have a tougher challenge to detect disruptions, we’re also getting some help from the technology side.

Zarenski: Yes, absolutely. And everyone thinks of this generally as just a technology exercise, but there’s so much more to it than the tech. There is the process. The key to enterprise resiliency is understanding what the services are both internally to employees as well as externally to the customers.

We find that most of our clients are just beginning to head down the journey of what we call business service mapping to identify and understand the critical services ahead of time. What are my five critical services? How can I build up those maps to show the quick wins and understand how can I be resilient today? How can I understand those sensors? What are the networks? What objects let me understand what a disruption is and have a dashboard show services that flip from green to red or yellow when something goes wrong?

There's so much signal out there to let you know what's going on. But to be bale to cut through and synthesize those material aspects of what's truly important is what makes this solution fit for duty and usable. And it does not take a lot of time to get done.

Yon: And, Dana, there’s so much signal out there to let you know what’s going on. But to be able to cut through and synthesize those material aspects of what’s truly important is what makes this solution fit for duty and usable. It’s not a big processing sync and does not take a lot of time to get done.

A business needs to know what to focus on, from what you imprint the system with to how you define your service map and how you calibrate what the signals represent. Those have to be the minimal number of things you want to ingest and synthesize to provide good, fast telemetry.  That’s where the value comes from, knowing how to define it best so the system works in a very fast and efficient way.

Gardner: Clearly, operational resiliency is not something you just buy in a box and deploy. There’s technology, business service mapping, and there’s also culture. Do you put in the technology and processes and then hope you develop a culture of resiliency? Or do you try to instill a culture of resiliency and then put in the ingredients? What’s the synergy between them?

Cultural shift from reactivity

Zarenski: There is synergy, for sure. Obviously, every corporation wants to have a culture of resilience. But at the same time, it’s hard to get there without the enabling technology. If you think about the solution that we at EY have developed, it takes resiliency beyond being just a reactive solution.

How to Build Resiliency into Operations

It’s easy for a corporation to understand the need for having a BCP or disaster recovery plan in place. That’s generally the first line of enabling a resilient culture. But bringing in another layer of technology that enables investment in the things that are listening for disruption? That is the next layer.

If you look at financial institutions, they all have different tools and processes that look at things like trade execution volume, and so forth. One person may have a system looking to see if trade execution volume has a significant blip and can then compare that to prior history. But to understand if that dip means something is wrong is not an easy process. Using EY’s operational resilience tool helps understand the patterns, catalog the patterns, and brings in technology that ultimately further enables that culture of resilience.

Yon: Yes, you want to know if something like that blip happens naturally or not. I liken this back to the days when we went through the evolution from quality control (QC)-oriented thinking to quality assurance (QA)-oriented thinking. QC lets you test stuff out, and lets you know what to do in the event of a failure. That’s what a BCP plan is all about -- when something happens, you pick up and follow the playbook. And there you go.

QA, which went through some significant headwinds, is about embedding that thought process into the very fabric of your planning and the design to enable the outcomes you really want. If there is QA, you can avoid disruptions.

And that’s exactly the same perspective we’re applying here. Let’s think about how continuity management and the BCP are put together. Yes, they exist, but you know what when you’re using them? You’re down. Value destruction is actually occurring.

So, think about this culture of resilience as analogous to the evolution to QA, which is, “Be more predictive and know what I’m going to be dealing with.” That is better than, “Test it out and know how to respond later.” I can actually get a heck of a lot better value and keep myself off the front page of the newspaper if I am more thoughtful in the first place.

That also goes back to the earlier point of how to accelerate time to value. That’s why Andrew was asking, “Hey, what are your five critical business services?” This is where we start off. Let’s pick one and find a way to make it work and get lasting value from that.

The best way to get people to change is quickly use data and show an outcome. That’s difficult to disagree with.

Gardner: Andrew, what are the key attributes of the EY ServiceNow resilience solution that helps get organizations past firefighting mode and more into a forward-looking, intelligent, and resilient culture?

React, respond, and reduce risk

Zarenski: The key is preventative and proactive decision support. Now, if you think about what preventative decision support means, the capability lets you build in thresholds for when a service maybe approaching a lag in its operational resilience. For example, server capacity may be decreasing for a web site that delivers an essential business service to external customers. As that capacity decreases, the service would begin to flash yellow as it approaches a service threshold. Therefore, someone can be intelligent and quickly do something about it.

But you can do that for virtually any service by setting policies in the database layer to understand what the specific thresholds are. Secondly, broad transparency and visibility is very important.

We’re expanding the usefulness of data for the chief risk officer (CRO). They can log into the dashboard two or three times a day, look at their 10 or 15 critical business services, and all the subservices that support them, and understand the health of each one individually. In an ideal situation, they log in in the morning and see everything as green, then they log in at lunchtime, and see half the stuff as yellow. Then they are going to go do something about it. But they don’t need to drill into the data to understand that something is wrong, they can simply see the service, see the approaching threshold, and – boom – they call the service owner and make sure they take care of it.

Yon: By the way, Andrew, they can also just pick up their phone if they get a pushed notification that’s something’s askew, too.

Zarenski: Yes, exactly. The major incident response is built into the backend. Of course, we’re proactively allowing the CROs and services owners to understand that something’s gone wrong. Then, by very simply drilling into that alert, they will understand immediately which assets are broken, know the 10 people responsible for those assets, and immediately get them on the phone. Or they can set up a group chat, get them paged, and any number of ways to get the problem taken care of.

The key is offering not just the visibility into what's gone wrong, but also the ability to react, respond, and have full traceability behind that response -- all in one platform. That really differentiates that solution from what else is in the market.

The key is offering not just the visibility into what’s gone wrong, but also the ability to react, respond, and have full traceability behind that response -- all in one platform. That really differentiates the solution from what else is in the market.

Gardner: It sounds like one of the key attributes is the user experience and interfaces that rapidly broaden the number of appropriate people and to get them involved.

Zarenski: You’re spot on. Another extremely important part is the direct log and record of what people did to help fix the problem. Regulations require recording what the disruption was, but also recording every single step and every person who interacted with the disruption. That can then be reported on in the future should they want to learn from it or should regulators and auditors come in. This solution provides that capability all in one place.

Yon: Such post-disruption forensics are very important for a lot of reasons.

Zarenski: Yes, exactly. A regulator will be able to look back and ask the question, “Did this firm act reasonably with respect to its responsibility?”

Easy question, but tough to answer. You would need to go back and recreate your version of what the truth was. This traps the truth. It traps the sequence, and it makes the forensics on answering that question very simple.

Gardner: While we’re talking about the payoffs when you do operational resiliency correctly, what else do you get?

Yon: I’ll give you a couple. One is we don’t have to get a 3 am phone call because something has broken because someone is already working on the issue.

Another benefit impacts the “pull-the-plug test,” where once a year or two we hold our breath to determine if our BCP plans are working and that we can recover. In that test, a long weekend is consumed with a Friday night fault or disconnection of something. And then we monitor the recovery and hope everything goes back to normal so we can resume business on the following Tuesday.

How to Build Resiliency into Operations

When we already understand what the critical business services are, we can quickly hone down essential causes and responses. When service orientation took hold, people bragged about how many services they had, perhaps as many as 900 services. Wow, that seems like a lot.

But are they all critical? Well, no, right? This solution allows you to materially keep what’s important in front of you so you can save money by not needing to drive the same level of focus across too wide of a beachfront.

Secondly, rather than force a test fault and pray, you can do simulations and tests in real time. “Do I think my resiliency strategy is working? Do I believe my resiliency machinery is fit for duty?” Well, now you can prove it, saying, “I know it is because I test this thing every quarter.”

You can frequently simulate all the different pieces, driving up the confidence with regulators, your leadership, and the auditors. That takes the nightmare out of your systems. These are but some of the other ancillary benefits that you get. They may seem intangible, but they’re very real. You can clean out unnecessary spend as well as unnecessary brand-impacting issues with the very people you need to prove your abilities to.

Gardner: Andrew, any other inputs on the different types of value you get when you do operational resiliency right?

Zarenski: If you do this right and set up your service mapping infrastructure correctly, we’ve had clients use this to do comparisons for how they might want to change their infrastructure. Having fully mapped out a digital twin of your business provides many more productivity and efficiency capabilities. That’s a prime example.

Gardner: Well, this year we’ve had many instances of how things can go very wrong -- from wildfires to floods, hurricanes, and problems with electric grids. As a timely use case, how would an organization in the throes of a natural disaster make use of this soluiton?

Prevent a data deep freeze

Zarenski: This specific use case stemmed from the deep freeze last winter in Dallas. It provides a real-life example. The same conditions can be translated over to hurricanes. Before the deep freeze hit back in the winter, we were adjusting signals from NOAA into the EY operational resiliency platform to understand and anticipate anomalies in temperatures in places that normally don’t see them.

We were able to run simulations in our platform for how some Dallas data centers were going to be hit by the deep freeze and how the power grid would be impacted. We could see every single physical asset being supported by that power grid and therefore understand how it might impact the business operations around the world.

There may be a server there that, in turn, supports servers in Hong Kong. Knowing that, we were able to prepare teams for a failover preemptively over to a data center in Chicago. That’s one example of how we can adjust data from multiple sources, tie that data to what the disruption may be, and be proactive about the response -- before that impact actually occurs.

Gardner: How broadly can these types of benefits go? What industries after power and energy should be considering these capabilities?

Yon: The most relevant ones are the regulated industries. So, finance, power, utilities, gas, and telecom. Those are the obvious ones. But other businesses need to ensure their firm is operational irrespective of whether it’s a regulatory expectation. The horizontal integration to offset disruption is still going to be important.

We’re also seeing interdependency across business sectors. So, talking to telecom, they’re like, “Yup, we need to be able to provide service. I want to be able to let people know when the service is going to go up when our power is down. But I have no visibility into what’s going on there.” So, sometimes the interdependencies cross sectors, cross industries and those are the things that are now starting to highlight.

Understanding where those dependencies on other industries are, can allow you to make better decisions on how you want to position yourself for what might be happening upstream so you can protect your downstream operations and clients.

It’s fascinating when we talk now about how each industry can gain transparency into the others, because there are clear interdependencies. Once that visibility happens, you’ll start to see firms and their ecosystem of suppliers leverage that transparency to their mutual benefit to reduce the impacts and the value disruption that may happen anywhere upstream.

Gardner: Andrew, how are organizations adopting this? Is it on a crawl-walk-run basis?

Map your service terrain

Zarenski: It all starts with identifying your critical services. And while that may seem simple at face value, it’s, in fact, not. By having such broad exposure in so many industries, we’ve developed initial service maps for what a financial institution is, or what an insurance institution looks like.

That head-start helps our clients gain a baseline to define their organizations from a service infrastructure standpoint. Once they have a baseline template, then they can map physical assets, along with the logical assets to those services.

Most organizations start with one or two critical services to prove out the use case. If you can prove out one or two, you can take that as a road show out to the rest of the organization. You’re basically setting yourself up for success because you’ve proven that it works.

Yon: This goes back to the earlier point about scale. You can put something together in a simple way, calibrating to what service you want to clear as resilient. And by calibrating what that service map looks like, you can optimize the spread of the service map, the coverage it provides, and the signals that it ingests. By doing so, you can synthesize its state right away and make very important decisions.

The cool thing about where the technology is now, we’re able to rapidly take advantage of that. You can create a service map and tomorrow you can add to it. It can evolve quickly over time.

How to Build Resiliency into Operations

You can have a simplistic view of what a service looks like internally and track that to see the nature of where faults enter the system and predict what might materialize in that service map, to see how that evolves with a different signal or an integration to another source system.

These organizations can gain continuous improvement, ensuring that they consistently raise the probability of avoiding disruptions. They can say, “I’m now resilient to the following types of faults,” and tick down that list. The business can make economic choices in terms of how complex it wants to build itself out to be able to answer the question, “Am I acting in a reasonable way for my shareholders, my employees, and for the industry? I’m not going to cause any systemic problems.”

Gardner: You know, there’s an additional pay back to focusing on resiliency that we haven’t delved into, and it gets back to the notion of culture. If you align multiple parts of your organization around the goal of resiliency, it forces people to work across siloes that they might not have easily forded in the past.

So, as we focus on a high-level objective like resilience, does that foster a broader culture of cooperation for different parts of the organization?

Responsible resiliency collaboration

Yon: It definitely does. Resiliency is becoming a sound engineering principle generally. It can be implemented in many different ways. It can be implemented not only with technology, but with product, people, machinery, and governance.

So many different people participate in the construction of an architectural capability like resiliency that it almost demands that collaboration occur. You can’t just do it from a silo. IT just can’t do this on their own. The compliance people can’t do this on their own. It’s not only a horizontal integration across the systems and the signals for which you detect where things are -- but it’s an integration of collaboration itself across those responsibility areas and the people who make it so.

Gardner: Andrew, what in the way the product is designed and used helps facilitate more cultural cooperation and collaboration?

Zarenski: Providing a capability for everyone to understand what’s going on is so important. For me to see that something going wrong in my business may impact someone else’s business gives a sense of shared responsibility. It gives you ownership in understanding the impacts across all the organizations.

A lot of this rolls up with being compliant to different regulations. We're providing a capability for virtually anyone to support risk and compliance activities -- without even knowing that you're supporting risk and compliance activities. It makes compliance easy to understand.

Secondly, a lot of this all rolls up to being compliant in different regulations. We’re providing a capability for virtually anyone to support risk and compliance activities -- without even knowing that you’re supporting risk and compliance activities. It makes the job of compliance visual and easy to understand. That ultimately supports the downstream processes that your risk and compliance officers must perform -- but it also impacts and benefits the frontline workers. I think it gives everyone an important role in resiliency without them even knowing it.

Gardner: How do I start the process of getting this capability on-boarded in my company regardless of my persona?

Yon: The quick answer is to turn on the news. Resiliency and continual operation awareness are now at the board level. It’s one of the top-five priorities firms say are important for them to survive through the next 10 years.

Witness all the different things that are being thrown at us all -- whether it’s weather, geopolitical, and pandemic-related. The awareness is there. The interest is definitely there. Then the demand comes from that interest.

Based on the feedback and conversations were having with so many clients across so many industries, it is resonating with them. It’s now obvious that this needs to be looked at because turning your digital storefront off is no longer an option. We’ve had too many people see the impact of that over the past year.

And the nature of disruptions just keeps getting more complex. We’ve had near-death business experiences. They’ve had the wake-up call, and that was enough of a motivation to have awareness and interests in it that’s now moving us toward how to best fulfill it.

Gardner: A nice thing about our three-part series is we first focused on the critical timing around the financial industry. We’re talking more specifically today about the solution itself and its wider applicability.

The third part of our series will share the experiences of actual customers and explore how they went about the journey of getting that germ of operational resilience planted and then growing it within their company. Meanwhile, where can our audience go for more information and to learn more about how to make operation resiliency a culture, a technology, and a company-wide capability?

Yon: For those folks who already have responsibilities in this area, their industry trade shows, conversations, and dialogues are actively covering these issues. Second, for those who are EY or ServiceNow customers, talk to your team because they can lead you back to folks like Andrew and myself to confer about more specifics based on where you are on your journey.

Gardner: I’m afraid we’ll have to leave it there. You’d been listening to a sponsored BriefingsDirect discussion on how more industries can reach a higher level of assured business availability -- despite persistent threats.

And we’ve learned some of the best ways to anticipate, plan for, and swiftly implement the means for nearly any business to avoid disruption, thanks to a holistic cultural approach to sustained operations.

Please join me in thanking our guests, Steve Yon, Executive Director for the EY ServiceNow Practice. Thank you, Steve.

Yon: Thank you.

Gardner: And we’ve also been joined by Andrew Zarenski, Senior Manager and ServiceNow Innovation Leader at EY. Thank you, Andrew.

Zarenski: Thank you, Dana.

Gardner: And a big thank you as well to our audience for joining this BriefingsDirect operational resilience innovation discussion. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host throughout this series of ServiceNow- and EY-sponsored BriefingsDirect interviews.

Thanks again for listening. Please pass this along to your business community and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: ServiceNow and EY.

A transcript of a discussion on the many ways that businesses can reach a high level of assured business availability despite varied and persistent threats. Copyright Interarbor Solutions, LLC, 2005-2021. All rights reserved.

You may also be interested in:

Tuesday, June 22, 2021

How Financial Firms Blaze a Trail to New, More Predictive Operational Resilience Capabilities


A transcript of a discussion on new ways that businesses in the financial sector are avoiding and mitigating the damage from today’s myriad business threats

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: ServiceNow and EY.

 Dana Gardner: Hi, this is Dana Gardner, Principal Analyst at Interarbor Solutions and you’re listening to BriefingsDirect.

The last few years have certainly highlighted the need for businesses of all kinds to build up their operational resilience. With a rising tide of pandemic waves, high-level cybersecurity incidents, frequent technology failures, and a host of natural disasters -- there’s been plenty to protect against.

As businesses become more digital and dependent upon end-to-end ecosystems of connected services, the responsibility for protecting critical business processes has clearly shifted. It’s no longer just a task for IT and security managers but has become top-of-mind for line-of-business owners, too.

Stay with us now as we explore new ways that those responsible for business processes specifically in the financial sector are successfully leading the path to avoiding and mitigating the impact and damage from these myriad threats.

To learn more about the latest in rapidly beefing-up operational resilience by bellwether finance companies, please join me in welcoming Steve Yon, Executive Director of the EY ServiceNow Practice. Welcome, Steve.

Steve Yon: Thanks, I’m happy to be here.

Gardner: We’re also here with Sean Culbert, Financial Services Principal at EY. Good to have you with us, Sean.

Sean Culbert: Good afternoon, Dana.

Gardner: Sean, how have the risks modern digital businesses face changed over the past decade? Why are financial firms at the vanguard of identifying and heading off these pervasive risks?

Culbert: The category of financial firms forms a broad scope of types. The risks for a consumer bank, for example, are going to be different than the risks for an investment bank or from a broker-dealer. But they all have some common threads. Those include the expectation to be always-on, at the edge, and able to get to your data in a reliable and secure way.

Culbert

There’s also the need for integration across the ecosystem. Unlike product sets before, such as in retail brokerage or insurance, customers expect to be brought together in one cohesive services view. That includes more integration points and more application types.

This all needs to be on the edge and always-on, even as it includes, increasingly, reliance on third-party providers. They need to walk in step with the financial institutions in a way that they can ensure reliability. In certain cases, there’s a learning curve involved, and we’re still coming up that curve.

It remains a shifting set of expectations to the edge. It’s different by category, but the themes of integrated product lines -- and being able to move across those product lines and integrate with third-parties – has certainly created complexity.

Gardner: Steve, when you’re a bank or a financial institution that finds itself in the headlines for bad things, that is immediately damaging for your reputation and your brands. How are banks and other financial organizations trying to be rapid in their response in order to keep out of the headlines?

Interconnected, system-wide security

Yon: It’s not just about having the wrong headline on the front cover of American Banker. As Sean said, the taxonomy of all these services is becoming interrelated. The suppliers tend to leverage the same services.

Yon

Products and services tend to cross different firms. The complexity of the financial institution space right now is high. If something starts to falter -- because everything is interconnected -- it could have a systemic effect, which is what we saw several years ago that brought about Dodd-Frank regulations.

So having a good understanding of how to measure and get telemetry on that complex makeup is important, especially in financial institutions. It’s about trust. You need to have confidence in where your money is and how things are going. There’s a certain expectation that must happen. You must deal with that despite mounting complexity. The notion of resiliency is critical to a brand promise -- or customers are going to leave.

One, you should contain your own issues. But the Fed is going to worry about it if it becomes broad because of the nature of how these firms are tied together. It’s increasingly important -- not only from a brand perspective of maintaining trust and confidence with your clients -- but also from a systemic nature; of what it could do to the economy if you don’t have good reads on what’s going on with support of your critical business services.

Gardner: Sean, the words operational resilience come with a regulatory overtone. But how do you define it?

The operational resilience pyramid

Culbert: We begin with the notion of a service. Resilience is measured, monitored, and managed around the availability, scalability, reliability, and security of that service. Understanding what the service is from an end-to-end perspective, how it enters and exits the institution, is the center to our universe.

Around that we have inbound threats to operational resilience. From the threat side, you want the capability to withstand a robust set of inbound threats. And for us, one of the important things that has changed in the last 10 years is the sophistication and complexity of the threats. And the prevalence of them, quite frankly.

We have COVID, we have proliferation of very sophisticated cyber attacks that weren't around 10 years ago. Geopolitically, we're all aware of tensions, and weather events have become more prevalent. It's a wide scope of inbound threats.

If you look at the four major threat categories we work with -- weather, cyber, geopolitical, and pandemics -- pick any one of those and there has been a significant change in those categories. We have COVID, we have proliferation of very sophisticated cyber attacks that weren’t around 10 years ago, often due to leaks from government institutions. Geopolitically, we’re all aware of tensions, and weather events have become more prevalent. It’s a wide scope of inbound threats.

And on the outbound side, businesses need the capability to not only report on those things, but to make decisions about how to prevent them. There’s a hierarchy in operational resilience. Can you remediate it? Can you fix it? Then, once it’s been detected, how can minimize the damage. At the top of the pyramid, can you prevent it before it hits?

So, there’s been a broad scope of threats against a broader scope of service assets that need to be managed with remediation. That was the heritage, but now it’s more about detection and prevention.

Gardner: And to be proactive and preventative, operational resilience must be inclusive across the organization. It’s not just one group of people in a back office somewhere. The responsibility has shifted to more people -- and with a different level of ownership.

What’s changed over the past decade in terms of who’s responsible and how you foster a culture of operational resiliency?

Bearing responsibility for services

Culbert: The anchor point is the service. And services are processes: It’s technology, facilities, third parties, and people. The hard-working people in each one of those silos all have their own view of the world -- but the services are owned by the business. What we’ve seen in recognition of that is that the responsibility for sustaining those services falls with the first line of business [the line of business interacting with consumers and vendors at the transaction level].

Yon: There are a couple of ways to look at it. One, as Sean was talking about, the lines of defense and the evolution of risk has been divvied up. The responsibilities have had line-of-sight ownership over certain sets of accountabilities. But you also have triangulation from others needing to inspect and audit those things as well.


The time is right for the new type of solution that we’re talking about now. One, because the nature of the world has gotten more complex. Two, the technology has caught up with those requirements.

The move within the tech stack has been to become more utility-based, service-oriented, and objectified. The capability to get signals on how everything is operating, and its status within that universe of tech, has become a lot easier. And with the technology now being able to integrate across platforms and operate at the service level -- versus at the component level – it provides a view that would have been very hard to synthesize just a few years ago.

What we’re seeing is a big shot in the arm to the power of what a typical risk resilience compliance team can be exposed to. They can manage their responsibilities at a much greater level.

Before they would have had to develop business continuity strategies and plans to know what to do in the event of a fault or a disruption. And when those things come out, the three-ring binders, the war room gets assembled and people start to figure out what to do. They start running the playbook.

What we're seeing is a big shot in the arm to the power of what a typical risk resilience compliance team can be exposed to. They can manage their responsibilities at a mch greater level. 

The problem with that is that while they’re running the playbook, the fault has occurred, the destruction has happened, and the clock is ticking for all those impacts. The second-order consequences of the problem are starting to amass with respect to value destruction, brand reputational destruction, as well as whatever customer impacts there might be.

But now, because of technology and moving toward Internet of things (IoT) thinking across assets, people, facilities, and third-party services, technology can self-declare their state. That data can be synthesized to say, “Okay, I can start to pick up a signal that’s telling me that a fault is inbound.” Or something looks like it’s falling out of the control thresholds that they have.

That tech now gives me the capability to get out in front of something. That would be almost unheard-of years ago. The nexus of tech, need, and complexity are all hitting right now. That means we’re moving and pivoting to a new type of solution rising out of the field.

Gardner: You know, many times we’ve seen such trends happen first in finance and then percolate out to the rest of the economy. What’s happened recently with banking supervision, regulations, and principles of operational resilience?

Financial sector leads the way

Yon: There are similar forms of pressure coming from all regulatory-intense industries. Finance is a key one, but there’s also power, utilities, oil, and gas. The trend is happening primarily first in regulatory-intensive industries.

Culbert: A couple years ago, the Bank of England and the Prudential Regulation Authority (PRA) put out a consultation paper that was probably most prescriptive out of the UK. We have the equivalent over here in the US around expectations for operational resiliency. And that just made its way into policy or law. For the most part, on a principles basis, we all share a common philosophy in terms of what’s prudent.

A lot of the major institutions, the ones we deal with, have looked at those major tenets in these policies and have said they will be practiced. And there are four fundamental areas that the institutions must focus on.

One is, can it declare and describe its critical business services? Does it have threshold parameters logic assigned to those services so that it knows how far it can go before it sustains damage across several different categories? Are the assets that support those services known and mapped? Are they in a place where we can point to them and point to the health of them? If there’s an incident, can they collaborate around the sustaining of those assets?

As I said earlier, those assets generally fall into small categories: people, facilities, third parties, and technology. And, finally, do you have the tools in place to keep those services within those tolerance parameters and have other alerting systems to let you know which of the assets may well be failing you, if the services are at risk.

That’s a lay-person, high-level description of the Bank of England policy on operational risks for today’s Financial Management Information Systems (FMIS). Thematically most of the institutions are focusing on those four areas, along with having credible and actionable testing schemes to simulate disruptions on the inbound side.

In the US, Dodd-Frank mandated that institutions declare which of those services could disrupt critical operations and, if those operations were disrupted, could they in turn disrupt the general economy. The operational resilience rules and regulations fall back on that. So, now that you know what they are, can you risk-rate them based on the priorities of the bank and its counterparties? Can you manage them correctly? That’s the letter-of-the-law-type regulation here. In Japan, it’s more credential-based regulation like the Bank of England. It all falls into those common categories.

Gardner: Now that we understand the stakes and imperatives, we also know that the speed of business has only increased. So has the speed of expectations for end consumers. The need to cut time to discovery of the problems and to find root causes also must be as fast as possible.

How should banks and other financial institutions get out in front of this? How do we help organizations move faster to their adoption, transform digitally, and be more resilient to head off problems fast?

Preventative focus increases

Yon: Once there’s clarity around the shift in the goals, knowing it’s not good enough to just be able to know what to do in the event of a fault or a potential disruption, the expectation becomes the proof to regulatory bodies and to your clients that they should trust you. You must prove that you can withstand and absorb that potential disruption without impact to anybody else downstream. Once people get their head around the nature of the expectation-shifting to being a lot more preventative versus reactive, the speeds and feeds by which they’re managing those things become a lot easier to deal with.

You'd get the phone call at 3 a.m. that a critical business service was down. You'd have the tech phone call that people are trying to figure out what happened. That lack of speed killed because you had to figure a lot of things out while the clock was ticking. But now, you're allowing yourself time to figure things out.

Back when I was running the technology at a super-regional bank, you’d get the phone call at 3 a.m. that a critical business service was down. You’d have the tech phone call that people are trying to figure out what happened because they started to notice at the help desk that a number of clients and customers were complaining. The clock had been ticking before 3 a.m. when I got the call. And so, by now, by that time, those clients are upset.

Yet we were spending our time trying to figure out what happened and where. What’s the overall impact? Are there other second-order impacts because of the nature of the issue? Are other services disrupted as well? Again, it gets back to the complexity factor. There are interrelationships between the various components that make up any service. Those services are shared because that’s how it is. People lean on those things -- and that’s the risk you take.

Before, the lack of speed literally killed because you had to figure a lot of those things out while the clock was ticking and the impact was going on. But now, you’re allowing yourself time to figure things out. That’s what we call a decision-support system. You want to alert ahead of time to ensure that you understand the true blast area of what the potential destruction is going to be.

Secondly, can I spin up the right level of communications so that everybody who could be affected knows about it? And thirdly, can I now get the right people on the call -- versus hunting and pecking to determine who has a problem on the fly at 3 a.m.?

The nature of having speed is when you deal with an issue by buying time for firms to deal with the thing intelligently versus in a shotgun approach and without truly understanding the nature of the impact until the next day.

Gardner: Sean, it sounds like operation resiliency is something that never stops. It’s an ongoing process. That’s what buys you the time because you’re always trying to anticipate. Is that the right way to look at it?

Culbert: It absolutely is the way to look at it. A time objective may be specific to the type of service, and obviously it’s going to be different from a consumer bank to a broker-dealer. You will have a time objective attached to a service, but is that a critical service that, if disrupted, could further disrupt critical operations that could then disrupt the real economy? That’s come into focus in the last 10 years. It has forced people to think through: If you were if a broker-dealer and you couldn’t meet your hedge fund positions, or if you were a consumer bank and you couldn’t get folks their paychecks, does that put people in financial peril?

These involve very different processes and have very different outcomes. But each has a tolerance of filling in the blank time. So now it’s just more of a matter of being accountable for those times. There are two things: There’s the customer expectation that you won’t reach those tolerances and be able to meet the time objective to meet the customers’ needs.

And the second is that technology has made it more manageable as the domino or contagion effect of one service tipping over another one. So now it’s not just, “Is your service ready to go within its objective of half an hour?” It’s about the knock-on effect to other services as well.

So, it’s become a lot more correlated, and it’s become regional. Something that might be a critical service in one business, might not be in another -- or in one region, might not be in another. So, it’s become more of a multidimensional management problem in terms of categorically specific time objectives against specific geographies, and against the specific regulations that overhang the whole thing.

Gardner: Steve, you mentioned earlier about taking the call at 3 a.m. It seems to me that we have a different way of looking at this now -- not just taking the call but making the call. What’s the difference between taking the call and making the call? How does that help us prepare for better operation resiliency?

Make the call, don’t take the call

Yon: It’s a fun way of looking a day in the life of your chief resiliency officer or chief risk officer (CRO) and how it could go when something bad happens. So, you could take the call from the CEO or someone from the board as they wonder why something is failing. What are you going to do about it?

You’re caught on your heels trying to figure out what was going on, versus making the call to the CEO or the board member to let them know, “Hey, these were the potential disruptions that the firm was facing today. And this is how we weathered through it without incident and without damaging service operations or suffering service operations that would have been unacceptable.”

We like to think of it as not only trying to prevent the impact to the clients but also from the possibility of a systemic problem. It could potentially increase the lifespan of a CRO by showing they can be responsible for the firm’s up-time, versus just answer questions post-disruption. It provides a little bit of levity but it’s also a truth that there are more than just the consequences to the clients, but also to those people responsible for that function within the firm.

Gardner: Many leading-edge organizations have been doing digital transformation for some time. We’re certainly in the thick of digital transformation now after the COVID requirements of doing everything digitally rather than in person.

But when it comes to finance and the services that we’re describing -- the interconnections in the interdependencies -- there are cyber resiliency requirements that cut across organizational boundaries. Having a moat around your organization, for example, is no longer enough.

What is it about the way that ServiceNow and EY are coming together that helps make operational resiliency an ongoing process possible?

Digital transformation opens access

Yon: There are two components. You need to ask yourself, “What needs to be true for the outcome that we’re talking about to be valid?” From a supply-side, what needs to be true is, “Do I have good signal and telemetry across all the components and assets of resources that would pose a threat or a cause for a threat to happen from a down service?”

With the move to digital transformation, more assets and resources that compose any organization are now able to be accessed. That means the state of any particular asset, in terms of its preferential operating model, are going to be known.

With the move to digital transformation, more assets and resources that compose any organization are now able to be accessed. That means the state of any particular asset, in terms of its preferential operating model, are going to be known. I need to have that data and that’s what digital transformation provides.

Secondly, I need a platform that has wide integration capabilities and that has workflow at its core. Can I perform business logic and conditional synthesis to interpret the signals that are coming from all these different systems?

That’s what’s great about ServiceNow -- there hasn’t been anything that it hasn’t been able to integrate with. Then it comes down to, “Okay, do I understand the nature of what it is I’m truly looking for as a business service and how it’s constructed?” Once I do that, I’m able to capture that control, if you will, determine its threshold, see that there’s a trigger, and then drive the workflows to get something done.

For a hypothetical example, we’ve had an event so that we’re losing the trading floor in city A, therefore I know that I need to bring city B and its employees online and to make them active so I can get that up and running. ServiceNow can drive that all automatically, within the Now Platform itself, or drive a human to provide the approvals or notifications to drive the workflows as part of your business continuity plan (BCP) going forward. You will know what to do by being able to detect and interpret the signals, and then based on that, act on it.

That’s what ServiceNow brings to make the solution complete. I need to know what that service construction is and what it means within the firm itself. And that’s where EY comes to the table, and I’ll ask Sean to talk about that.

Culbert: ServiceNow brings to the table what we need to scale and integrate in a logical and straightforward way. Without having workflows that are cross-silo and cross-product at scale -- and with solid integration of capabilities – this just won’t happen.

When we start talking about the signals from everywhere against all the services -- it’s a sprawl. From an implementation perspective, it feels like it’s not implementable.

The regulatory burden requires focus on what’s most important, and why it’s most important to the market, the balance sheet, and the customers. And that’s not for the 300 services, but for the one or two dozen services that are important. Knowing that gives us a big step forward by being able to scope out the ServiceNow implementation.

And from there, we can determine what dimensions associated with that service we should be capturing on a real-time basis. To progress from remediation to detection on to prevention, we must be judicious of what signals we’re tracking. We must be correct.

We have the requirement and obligation to declare and describe what is critical using a scalable and integrable technology, which is ServiceNow. That’s the big step forward.

Yon: The Now platform also helps us to be fast. If you look under the hood of most firms, you’ll find ServiceNow is already there. You’ll see that there’s already been work done in the risk management area. They already know the concepts and what it means to deal with policies and controls, as well as the triggers and simulations. They have IT  and other assets under management, and they know what a configuration management database (CMDB) is.

These are all accelerants that not only provide scale to get something done but provide speed because so many of these assets and service components are already identified. Then it’s just a matter of associating them correctly and calibrating it to what’s really important so you don’t end up with a science fair integration project.

Gardner: What I’m still struggling to thread together is how the EY ServiceNow alliance operational resiliency solution becomes proactive as an early warning system. Explain to me how you’re able to implement this solution in such a way that you’re going to get those signals before the crisis reaches a crescendo.

Tracking and recognizing faults

Yon: Let’s first talk about EY and how it comes with an understanding from the industry of what good looks like with respect to what a critical business service needs to be. We’re able to hone down to talking about payments or trading. This maps the deconstruction of that service, which we also bring as an accelerant.

We know what it looks like -- all the different resources, assets, and procedures that make that critical service active. Then, within ServiceNow, it manages and exposes those assets. We can associate those things in the tool relatively quickly. We can identify the signal that we’re looking to calibrate on.

Then, based on what ServiceNow knows how to do, I can put a control parameter on this service or component within the threshold. It then gives me an indication whether something might be approaching a fault condition. We basically look at all the different governance, risk management, and compliance (GRC) leading indicators and put telemetry around those things when, for example, it looks like my trading volume is starting to drop off.

Based on what ServiceNow knows how to do, I can put a control parameter on this service or component within the threshold. It then gives me an indication whether something might be approaching a fault condition.

Long before it drops to zero, is there something going on elsewhere? It delivers up all the signals about the possible dimensions that can indicate something is not operating per its normal expected behavior. That data is then captured, synthesized, and displayed either within ServiceNow or it is automated to start running its own tests to determine what’s valid.

But at the very least, the people responsible are alerted that something looks amiss. It’s not operating within the control thresholds already set up within ServiceNow against those assets. This gives people time to then say, “Okay, am I looking at a potential problem here? Or am I just looking at a blip and it’s nothing to worry about?”

Gardner: It sounds like there’s an ongoing learning process and a data-gathering process. Are we building a constant mode of learning and automation of workflows? Do we do get a whole greater than the sum of the parts after a while?

Culbert: The answer is yes and yes. There’s learning and there’s automation. We bring to the table some highly effective regulatory risk models. There’s a five-pillar model that we’ve used where market and regulatory intelligence feeds risk management, surveillance, analysis, and ultimately policy enforcement.

And how the five pillars work together within ServiceNow -- it works together within the business processes within the organization. That’s where we get that intelligence feeding, risk feeding, surveillance analysis, and enforcement. That workflow is the differentiator, to allow rapid understanding of whether it’s an immediate risk or concentrating risk.

And obviously, no one is going to be 100 percent perfect, but having context and perspective on the origin of the risk helps determine whether it’s a new risk -- something that’s going to create a lot of volatility – or whether it’s something the institution has faced before.

We rationalize that risk -- and, more importantly, rationalize the lack of a risk – to know at the onset if it’s a false positive. It’s an essential market and regulatory intelligence mechanism. Are they feeding us only the stuff that’s really important?

Our risk models tell us that. That risk model usually takes on a couple of different flavors. One flavor is similar to a FICO score. So, have you seen the risk? Have you seen it before? It is characterizable by the words coming from it and its management in the past.

And then some models are more akin to a bar calculator. What kind of volatility is this risk going to bring to the bank? Is it somebody that’s recreationally trying to get into the bank, or is it a state actor?

Once the false-positive gets escalated and disposed of -- if it’s, in fact, a false positive – are we able to plug it into something robust enough to surveil for where that risk is headed? That’s the only way to get out in front of it.

The next phase of the analysis says, “Okay, who should we talk to about this? How do we communicate that this is bigger than a red box, much bigger than a red box, a real crisis-type risk? What form does that communication take? Is it a full-blown crisis management communication? Is it a standing management communication or protocol?”

We take that affected function and very quickly understand the health or the resiliency of other impacted functions. We use our own proprietary model. It helps to shift from primary states to alternative states.

And then ultimately, this goes to ServiceNow, so we take that affected function and very quickly understand the health or the resiliency of other impacted functions. We use our own propriety model. It’s a military model used for nuclear power plants, and it helps to shift from primary states to alternative states, as well as to contingency and emergency states.

At the end, the person who oversees policy enforcement must gain the tools to understand where they should be fixing the primary state issue or moving on from it. They must know to step aside or shift into an emergency state.

From our perspective, it is constant learning. But there are fundamental pillars that these events flow through that deliver the problem to the right person and give that person options for minimizing the risk.

Gardner: Steve, do we have any examples or use cases that illustrate how alerting the right people with the right skills at the right time is an essential part of resuming critical business services or heading off the damage?

Rule out retirement risks

Yon: Without naming names, we have a client within Europe, the Middle East and Africa (EMEA) we can look at. One of the things the pandemic brought to light is the need to know our posture to continuing to operate the way we want. Getting back to integration and integrability, where are we going to get a lot of that information for personnel from? Workday, their human resources (HR) system of record, of course.

Now, they had a critical business service owner who was going to be retiring. That sounds great. That’s wonderful to hear. But one of the valid things for this critical business service to be considered operating in its normal state is to check for an owner. Who will cut through the issues and process and lead going forward?

If there isn’t an owner identified for the service, I would be considered at risk for this service. It may not be capable of maintaining its continuity. So, here’s a simple use case where someone could be looking at a trigger from Workday that asks if this leadership person is still in the role and active.

Is there a control around identifying if they are going to become inactive within x number of months’ time? If so, get on that because the regulators will look at these processes potentially being out of control.

There’s a simple use case that has nothing to do with technology but shows the integrability of ServiceNow into another system of record. It turns ServiceNow into a decision-support platform that drives the right actions and orchestrates timely actions -- not only to detect a disruption but anything else considered valid as a future risk. Such alerts give the time to get it taken care of before a fault happens.

Gardner: The EY ServiceNow alliance operational resilience solution is under the covers but it’s powering leaders’ ability to be out in front of problems. How does the solution enable various levels of leadership personas, even though they might not even know it’s this solution they’re reacting to?

Leadership roles evolve

Culbert: That’s a great question. For the last six to seven years, we’ve all heard about the shift from the second to the first line of primary ownership in the private sector. I’ve heard many occasions for our first line business manager saying, “You know, if it is my job, first I need to know what the scope of my responsibilities are and the tools to do my job.” And that persona of the frontline manager having good data, that’s not a false positive. It’s not eating at his or her ability to make money. It’s providing them with options of where to go to minimize the issue.

The personas are clearly evolving. It was difficult for risk managers to move solidly into the first line without these types of tools. And there were interim management levels, too. Someone who sat between the first and the second line -- level 1.5. or line 1.5. And it’s clearly pushing into the first line. How do they know their own scope as relates to the risk to the services?

Now there’s a tool that these personas can use to be not only be responsible for risk but responsive as well. And that’s a big thing in terms of the solution design. With ServiceNow over the last several years, if the base data is correctly managed, then being able to reconfigure the data and recalibrate the threshold logic to accommodate a certain persona is not a coding exercise. It’s a no-code step forward to say, “Okay, this is now the new role and scope, and that role and scope will be enabled in this way.” And this power is going to direct the latest signals and options.

But it’s all about the definition of a service. Do we all agree end-to-end what it is, and the definition of the persona? Do we all understand who’s accountable and who’s responsible? Those two things are coming together with a new set of tools that are right and correct.

Yon: Just to go back to the call at 3 a.m., that was a tech call. But typically, what happens is there’s also going to be the business call. So, one of the issues we’re also solving with ServiceNow is in one system we manage the nature of information irrespective of what your persona is. You have a view of risk that can be tailored to what it is that you care about. And all the data is congruent back and forth.

It becomes a lot more efficient and accurate for firms to manage the nature of understanding on what things are when it’s not just the tech community talking. The business community wants to know what’s happening – and what’s next? And then someone can translate in between. This is a real-time way for all those personas to become a line around the nature of the issue with respect to their perspective.

Gardner: I really look forward to the next in our series of discussions around operational resilience because we’re going to learn more about the May announcement of this solution.

But as we close out today’s discussion, let’s look to the future. We mentioned earlier that almost any highly regulated industry will be facing similar requirements. Where does this go next?

It seems to me that the more things like machine learning (ML) and artificial intelligence (AI) analyze the many sources of data, they will make it even more powerful. What should we look for in terms of even more powerful implementations?

AI to add power to the equation

Culbert: When you set up the framework correctly, you can apply AI to the thinning out of false positives and for tagging certain events as credible risk events or not credible risk events. AI can also to be used to direct these signals to the right decision makers. But instead of taking the human analyst out of the equation, AI is going to help us. You can’t do it without that framework.

Yon: When you enable these different sets of data coming in for AI, you start to say, “Okay, what do I want the picture to look like in my ability to simulate these things?” It all goes up, especially using ServiceNow.

But back to the comment on complexity and the fact that suppliers don’t just supply one client, they connect to many. As this starts to take hold in the regulated industries -- and it becomes more of an expectation for a supplier to be able to operate this way and provide these signals, integration points, telemetry, and transparency that people expect -- anybody else trying to lever into this is going to get the lift and the benefit from suppliers who realize that the nature of playing in this game just went up. Those benefits become available to a much broader landscape of industries and for those suppliers.

Gardner: When we put two and two together, we come up with a greater sum. We’re going to be able to deal rapidly with the known knowns, as well as be better prepared for the unknown unknowns. So that’s an important characteristic for a much brighter future -- even if we hit another unfortunate series of risk-filled years such as we’ve just suffered.

I’m afraid we’ll have to leave it there. You’ve been listening to a sponsored BriefingsDirect discussion on the need for businesses to build up their operational resilience.

And we’ve learned how those responsible for business processes in the financial sector specifically are successfully leading the charge to avoid and mitigate the impact and damage from myriad business threats. These new imperatives to achieve operation resilience are sure to spread soon in the global economy.

So please join me in thanking our guests, Steve Yon, Executive Director of the EY ServiceNow Practice. Thank you so much, Steve.

Yon: Thank you.

Gardner: And we’ve also been with Sean Culbert, Financial Services Principal at EY. Thank you so much.

Culbert: Thanks, Dana.

Gardner: And a big thank you as well to our audience for joining this BriefingsDirect operational resilience innovation discussion. I’m Dana Gardner, Principal Analyst at Interarbor Solutions, your host throughout this series of ServiceNow- and EY-sponsored BriefingsDirect interviews.

Thanks again for listening. Please pass this along to your business community, and do come back next time.

Listen to the podcast. Find it on iTunes. Download the transcript. Sponsor: ServiceNow and EY.

A transcript of a discussion on new ways that businesses in the financial sector are avoiding and mitigating the damage from today’s myriad business threats. Copyright Interarbor Solutions, LLC, 2005-2021. All rights reserved.

You may also be interested in: