For example, how would you feel after a ransomware attack, if you find out that your backed-up data is intact but it will take months and millions of dollars to restore? Or, if your first corrective action is the wrong solution and makes the problem worse? It takes time and resources to develop the tools, procedures, and skills to accurately diagnose causes, contain the immediate threat, and implement a long-term solution. Will you be satisfied with the performance of your corrective controls when you need them? There’s also a bias towards automated controls that is not always well considered. Both manual and automated controls have a place in a control system. While machines are better than people at repetitive tasks with clear decision criteria, people are better than machines (for now) at tasks that are ambiguous and require judgment and flexibility. When you automate controls, are you preserving the knowledge and skills of staff who need to understand the system well enough to solve problems when automation fails? So, we’ve seen how controls are part of a dynamic system in an environment of uncertainty. We can’t know whether our controls are sufficient unless we look at the behavior of the control system as a whole. And, we can’t achieve our desired outcomes unless we design for them.10  Conclusions Today, I’ve highlighted two challenges to resilience: organizational silos and the complexity of control.
1/5  BIS central bankers' speeches  Take the case of a vendor that provides critical services and is on the brink of bankruptcy. Are credit risk analysts, operational risk and business continuity professionals, and the business affected working together to share information, insights, and potential responses? Or, are silos preventing information from getting to the right people at the right time to prepare and act? Risk silos can result in siloed decisions, and looking at risks one by one is incoherent. We could drive operational risk to zero by having no operations (I guess we can all go home early), but then strategic risk rises to infinity. Since most meaningful decisions involve balancing risks, to get to the right decision, we need a risk picture that covers all relevant risk types and engages all relevant risk experts. Similarly, real world vulnerabilities do not have to conform themselves to a particular risk type. Think about weaknesses in identity and access management. This is a driver for risks ranging from cyber, to compliance, to operations, and more. This is also a type of risk that can’t be mitigated solely through technical controls put in place by information security experts; that is, a siloed risk response is insufficient. So, stronger collaboration and coordination across risk disciplines is one solution to the negative effects of risk silos. Another specific pain point created by risk silos is the flourishing, and perhaps overgrowth, of risk assessments. Most organizations have many risk reviews: often a different review for each type of risk.