COVID-19 and Operational Resilience: How Past Crises Shape Today's Response

The COVID-19 health crisis has changed how we live and work, and while the pandemic is unprecedented, many of its impacts on financial services firms and their operations are not unlike what we've experienced in the past. Crises such as the September 11 terrorist attack and Superstorm Sandy were also uncharted events but have provided the industry with experiences that have helped shape the resiliency plans in place at many firms today.

Of course, COVID-19 is unique in its global reach and severity, impacting individuals across borders. It differs from previous crises, which typically have been confined regionally. Nevertheless, COVID-19 presents an opportunity for the financial services industry to leverage lessons from the past, learn from the current situation, and develop new ways to drive even greater resiliency in the future.

Lessons Learned

The conditions brought about by September 11 and Superstorm Sandy led to key improvements in infrastructure and automation. Those events also reinforced the financial industry's increased focus on its entire operational footprint, as well as the interdependencies between firms including private and public entities.

Specifically, following the September 11 attacks, resilience initiatives primarily centered on improving contingency plans and safeguarding business operations against the risk of wide-area physical disruptions. Regulators initially focused on the recovery and resumption of critical financial market infrastructures such as wholesale payment systems.

The scale and scope of these operational resilience programs have expanded since then to include a wider range of services. Furthermore, the industry increased their attention on third-party service providers, as the interconnectedness of the markets continued to grow.

Dispersed Operations

More recently, Superstorm Sandy, which struck the northeastern seaboard in 2012 and brought unprecedented flooding to New York City and New Jersey, limited on-site access to many offices, including those of market participants. As a result, firms had to move quickly to shift key operations to regional offices.

Like most of our industry colleagues, DTCC transitioned our New York City-based staff to work remotely utilizing virtual desktop infrastructure (VDI), laying the groundwork to support today's environment. VDI technology has been a big reason why the move to work from home has been relatively seamless for the industry.

At the same time, companies that embraced automation in the wake of Superstorm Sandy have found themselves better prepared to operate under the current circumstances. Moving forward, we can expect that remote working capabilities and automation will continue to play a key role in resiliency planning.

Looking Ahead

Resilience is the summation of preventing, withstanding and quickly recovering from disruptive events. It is something that is built not just internally, but also collaboratively across the industry. Although we are currently facing uncertain and difficult times, we have overcome past challenges and learned from them. The current crisis will be no different.

Resilience initiatives should focus on safeguarding critical services against a wide range of technical and financial disruptions. As the COVID-19 crisis unfolds, firms must continue to maintain daily operations while also remaining vigilant in defending against growing cyberattacks and addressing new considerations including remote patching, home Wi-Fi networks and more. One way they're addressing the increased cybersecurity threat from working at home is by pushing out the most up-to-date protocols for remote workforces.

In the months ahead, the industry will continue its conversations around resiliency and learnings from the pandemic. It is likely that the interconnectivity risk between firms and the importance of sector-wide coordination will continue to be elevated in those discussions.

Just as no individual is alone in combating the virus from a health perspective, no firm is alone in maintaining the delivery of key industry services. As we continue to work together - regulators, market participants, industry associations, lawmakers and others - we continue to see that a collaborative response and coordinated preparations will further enhance the industry's ability to withstand and overcome crises.

Dan Thieke is managing director, business risk and resilience management, Depository Trust & Clearing Corp. (DTCC)