The statement that firms are required to reduce their reliance on third parties is not a regulatory expectation for operational resilience in line with the BCBS. The Federal Reserve’s Sound Practices for Strengthening Operational Resilience does not encourage firms to reduce their use of third parties. Instead, it encourages firms to properly manage third parties as they are among typical areas that can expose firms to significant risks. This includes ensuring that third parties adhere to the same standards of operational resilience as the firm itself, and that they have robust contingency plans in place to manage potential disruptions. This approach recognizes the interconnected nature of modern financial systems, where third-party service providers often play a critical role in a firm's operations. Reducing reliance on third parties is not a practical or effective strategy for enhancing operational resilience. Instead, firms should focus on managing and mitigating the risks associated with third-party relationships.

Choice A is incorrect. The Basel Committee on Banking Supervision (BCBS) indeed expects effective coordination of ORM to rely on a solid foundation of governance and assigning roles and responsibilities to each party. This is a key aspect of operational resilience as it ensures that all parties involved in the ORM process understand their roles and responsibilities, thereby reducing the risk of errors or oversights.

Choice B is incorrect. According to BCBS, firms are indeed required to monitor and report the coordination and maintenance of Business Continuity Management (BCM) and IT systems resilience. This requirement ensures that firms are actively managing their operational risks, including those related to business continuity and IT systems.

Choice C is incorrect. As per BCBS guidelines, a strong ORM framework is necessary in order to achieve operational resilience. Without an effective ORM framework in place, it would be difficult for a firm to manage its operational risks effectively.

Things to Remember

• Operational Resilience: The ability of an organization to continue operating and delivering services in the face of disruptive events.
• Business Continuity Management (BCM): The process of creating systems of prevention and recovery to deal with potential threats to a company.
• Third-Party Risk Management: The process of managing risks associated with third-party vendors, suppliers, and service providers.
• Basel Committee on Banking Supervision (BCBS): An international standard-setting body.