Preventative mitigation is obviously very important, but having impact tolerance means acknowledging that disruptive events will happen, and that firms need to be able to recover within their set tolerance. I’m talking about planning for scenarios that are severe but plausible – we expect firms to be resilient against a wide range of scenarios, but not against Armageddon. I think it likely that the ordering of these impact tolerances between firms and the PRA will often be the opposite way round from capital. On capital, inserting the public interest means that as a general matter we will require firms to hold more capital than they would if left to their own devices – hence, a battleground. For operational resilience, a firm is likely to experience significant private costs – for instance, impact on their profits or damage to their brand – before their safety and soundness is at risk. The exception to this may be a subset of operations whose failure might pose a systemic risk to financial stability. But in most cases, I think interests are likely to be aligned – we all just need to get better at managing this set of risks, as some recent events have illustrated all too painfully. In this context, I will expand briefly on the PRA’s particular focus in this important area. Our general statutory objective is safety and soundness, with policyholder protection on the insurance side and a secondary objective to facilitate competition.
But nested within these objectives is an instruction that our objectives are to be advanced by avoiding adverse effects on the stability of the UK financial system. In other words, although our work is primarily microprudential we have an important role to play in ensuring financial stability. What does this imply for how the PRA should take an interest in operational resilience? It implies that we are interested in operational resilience for its own sake, not just because its absence can have a financial consequence for firms. But we are interested only to the extent that it could have a negative impact on safety and soundness and/or the stability of the UK financial system. That is a fairly high bar. In practice this is likely to mean that we put more emphasis on operational resilience for larger firms doing activity whose disruption could have a financial stability impact. For smaller firms we are only strongly interested where something is going on that is big enough to threaten the firm’s safety and soundness. So for example: if you are a big bank you can expect us to take an interest in your ability to process payments; if you are an insurer with a large annuity book, we will want to know what the operational risks are to your ability to supply people’s retirement income; and if you are a smaller firm spending huge sums on a 5  All speeches are available online at www.bankofengland.co.uk/speeches  5  major IT project, we will be interested in that.