Regulatory TrainingCASE STUDY 01
Developing Non-Financial Risk Management Capabilities at a Middle Eastern Regulator
The Challenge
A Middle Eastern financial services regulator wanted to strengthen the knowledge and capabilities of policy and supervisory staff in Non-Financial Risk Management. The programme needed to address its specific requirements and support important policy work.
Our Approach
We worked closely with the client to understand its objectives, participant experience and priorities. Following agreement on a detailed programme, we developed two days of technical instruction, practical case studies, facilitated discussion and interactive exercises. Participation was a central design objective, enabling delegates to apply the concepts to their regulatory work. The complete materials were shared well in advance for review, feedback and refinement.
The Outcome
The programme was delivered successfully and received very positive feedback from the client and participants. It helped inform the regulator’s thinking on important NFR policy work. In-person delivery also enabled valuable discussions during breaks, over lunch and after the formal sessions.
Operational ResilienceCASE STUDY 02
Implementing the UK Operational Resilience Framework for an International Bank
The Challenge
The UK subsidiary required support implementing the UK operational resilience framework. A key consideration was meeting regulatory expectations proportionately, reflecting the nature, scale and complexity of the business and making effective use of existing capabilities.
Our Approach
Working with the Chief Operating Officer and his team, we scoped the engagement and undertook a gap analysis and maturity assessment. We reviewed existing risk management, business continuity and related frameworks to identify capabilities that could be leveraged and gaps to address. We agreed the findings, developed a detailed implementation plan and supported delivery through regular project governance meetings, status management information, action tracking and escalation. Proportionality guided the design throughout.
The Outcome
The engagement was completed on schedule, with the resulting work reviewed and signed off by the UK Management Committee and senior regional management. It demonstrated the value of combining regulatory knowledge with practical implementation experience.
Our wider operational resilience experience
We have supported eight UK banking entities on UK operational resilience: six subsidiaries and two branches of overseas-headquartered banks. Four of the subsidiary engagements involved substantial hands-on implementation assistance, sometimes over a prolonged period. Our work has ranged from specialist advice, gap analyses and maturity assessments to framework development, implementation support and training. Former regulatory experience has been especially valuable in judging what is appropriate and proportionate, including where UK operations depend on Group arrangements.
Operational Risk ManagementCASE STUDY 03
Assessing Operational Risk Management Maturity Outside Financial Services
The Challenge
The organisation wanted an independent assessment of its operational risk management capabilities and practical recommendations for strengthening the framework over the following year.
Our Approach
We undertook a structured maturity assessment of existing arrangements, identifying strengths, gaps and improvement opportunities. Recommendations were tailored to the business context and designed to be proportionate, practical and achievable, with priorities for the next 12 months.
The Outcome
The assessment was completed on schedule. The client subsequently engaged us to repeat the assessment a year later to evaluate progress and identify further priorities. The engagement demonstrates how effective ORM principles extend beyond regulated financial services.
Regulatory TrainingCASE STUDY 04
Building Operational Resilience Capabilities at a Central Bank
The Challenge
A central bank required specialist training to strengthen participants’ understanding of operational resilience and its practical application.
Our Approach
We designed and delivered a virtual programme addressing operational resilience concepts, regulatory approaches and implementation considerations. Drawing on our regulatory and industry experience, we used practical examples and discussion to connect principles to real-world challenges.
The Outcome
The engagement delivered specialist operational resilience training to central bank participants in a virtual format, demonstrating how tailored training can help build regulatory capability.
Regulatory AdvisoryCASE STUDY 05
Supporting Consumer Duty Implementation at a UK Bank
The Challenge
A UK banking subsidiary of an international banking group engaged us to provide substantial support in preparing for the implementation of the FCA’s Consumer Duty.
The new regulatory framework introduced significant expectations for firms to deliver good outcomes for retail customers, including the Consumer Principle, the cross-cutting rules and the four outcomes.
The challenge was to understand how the requirements applied to the firm’s particular business model, assess existing arrangements, identify gaps and implement the necessary changes within the regulatory timetable.
Our Approach
We worked closely with the client over approximately six months, providing ongoing regulatory advice and practical implementation support.
- Gap analysis and maturity assessment: Reviewing existing arrangements against the Consumer Duty requirements to identify gaps, strengths and improvement priorities.
- Regulatory interpretation and applicability: Advising how requirements applied to the firm’s activities, products, services and customer relationships.
- Consumer Duty framework: Supporting understanding and implementation of the Consumer Principle, the three cross-cutting rules and the four outcomes: products and services, price and value, consumer understanding and consumer support.
- Implementation planning and governance: Supporting the compliance programme through weekly project meetings, progress reviews and discussion of implementation challenges.
- Practical advisory support: Helping the client make difficult regulatory judgements and develop proportionate arrangements reflecting its business model and risk profile.
We had previously supported the same client on its UK operational resilience programme. This continuity enabled us to bring a more holistic perspective to the engagement, including exploring the relationship between the Consumer Duty’s focus on avoiding foreseeable harm and operational resilience requirements aimed at preventing intolerable harm from operational disruption.
Although the regimes have distinct objectives and requirements, considering them together helped the client develop a more integrated understanding of customer outcomes, operational risk and resilience.
The Outcome
The engagement was completed over approximately six months, with the client meeting the relevant UK regulatory implementation deadlines.
Our work supported the firm’s compliance with the Consumer Duty through regulatory interpretation, gap analysis, maturity assessment, ongoing advice and practical implementation assistance.
The engagement demonstrates the value of sustained advisory support and the ability to bring together different regulatory disciplines, helping clients address specific requirements while strengthening their wider approach to risk management, resilience and customer outcomes.
Operational Risk ManagementCASE STUDY 06
Strengthening Operational Risk Management at a UK Wealth Manager
The Challenge
A wealth management firm sought independent assessment of its NFR capabilities, detailed reviews of key processes and advice on technology to support operational risk management.
Our Approach
We conducted a structured NFR maturity assessment and two deep-dive reviews. The first examined the Risk and Control Self-Assessment methodology and the identification and assessment of risks and controls. The second reviewed the end-to-end incident management process, including identification, review, escalation, reporting and workflow. We also helped the firm identify suitable Governance, Risk and Compliance technology providers. Our recommendations reflected the firm’s business model and risk profile.
The Outcome
The client received independent findings and practical recommendations across core ORM processes, together with support in identifying technology solutions for further development. The work combined framework review, targeted deep dives and technology advice.
Regulatory AdvisoryCASE STUDY 07
Developing a Risk Policy Framework for a UK Investment Firm
The Challenge
An investment firm required support reviewing and strengthening its risk policy framework, identifying gaps, developing missing policies and ensuring existing documentation remained fit for purpose.
Our Approach
We undertook a structured gap analysis, drafted new policies to address identified gaps and reviewed and updated existing policies. We considered consistency across the wider framework and developed and delivered training to help staff understand and implement the revised requirements. Proportionality and usability were central to the approach.
The Outcome
The engagement delivered new and updated risk policies supported by training. It illustrated why effective policy development is more than a documentation exercise: requirements must be understood and embedded in everyday business processes.
Training & Capability BuildingCASE STUDY 08
Building Board and Staff Capabilities in Operational Resilience and TPRM
The Challenge
The bank wanted to strengthen understanding of operational resilience and TPRM across the organisation, recognising that staff, executive directors and non-executive directors have different responsibilities and perspectives.
Our Approach
We agreed the programme with the client and developed two sets of materials: practical staff training on regulatory requirements, concepts and responsibilities, and a strategic Board programme focused on accountability, oversight, management information, challenge and questions directors should ask. After client review, we delivered three sessions: TPRM for staff, operational resilience for staff, and an integrated resilience and TPRM session for executive and non-executive directors. Interactive elements encouraged practical discussion.
The Outcome
All three sessions were completed. The Board session generated further discussion and requests for additional support in several areas. The engagement demonstrated the value of tailoring training to each audience.
Training & Capability BuildingCASE STUDY 09
Practical Root Cause Analysis Training for First and Second Lines of Defence
The Challenge
The firm wanted to strengthen incident investigation and root cause analysis, with training tailored to the distinct responsibilities of first-line business teams and the second-line risk function.
Our Approach
We developed separate workshop materials for the first and second lines. Working with the firm, we created anonymised case studies based on actual incidents, supplemented by an exploration of how the Titanic sank to illustrate the 5 Whys and Bow Tie techniques. The sessions distinguished immediate, contributing and underlying causes, and examined first-line investigation and second-line oversight and challenge. We delivered three workshops to business areas and one dedicated workshop to the second line.
The Outcome
All four workshops were completed successfully and received positive feedback. Practical techniques, real incidents and audience-specific exercises helped participants explore how better investigations support learning and stronger risk management.
Training & Capability BuildingCASE STUDY 10
Delivering Operational Risk, Resilience and TPRM Training to an Insurance Group’s Clients
The Challenge
An insurance group wanted to provide its clients with practical specialist training across several related areas of Non-Financial Risk Management, suitable for a broad audience.
Our Approach
We developed and delivered four virtual sessions covering operational risk management maturity, operational resilience and TPRM. Drawing on regulatory and industry experience, the programme combined key concepts with practical considerations and examples, enabling delivery to a large client audience.
The Outcome
Each session attracted more than 100 participants, and attendees made several follow-up enquiries. The programme showed how virtual delivery can share specialist knowledge at scale.
Operational ResilienceCASE STUDY 11
Implementing UK Operational Resilience Requirements for Branches of Overseas Banks
The Challenge
Two UK branches needed support meeting applicable operational resilience requirements. Their reliance on Group systems, infrastructure, processes and governance created difficult judgements about how to achieve UK regulatory outcomes in a proportionate manner.
Our Approach
We worked with each branch to understand its activities, dependencies and existing Group arrangements. We considered where Group capabilities could be leveraged and what additional UK-specific arrangements were appropriate. Our experience as former regulators was particularly valuable in interpreting supervisory objectives and making informed judgements about proportionality rather than adopting an unnecessarily standardised solution.
The Outcome
The engagements supported both branches in developing approaches reflecting their circumstances while addressing applicable UK expectations. They demonstrated the importance of informed regulatory judgement and sustainable, proportionate implementation.
Regulatory AdvisoryCASE STUDY 12
Advising an International Financial Services Group on EU DORA and Operational Resilience
The Challenge
An international financial services group sought advice on operational resilience and the EU Digital Operational Resilience Act (DORA), including a clearer understanding of the framework and its implications for Board and senior management.
Our Approach
We provided specialist advice and developed and delivered training for the Board and senior management. The programme first explained operational resilience as a wider discipline, then examined DORA’s particular focus on ICT risk management, incident management, resilience testing and ICT third-party risk. We explored governance, accountability, implementation challenges and the need for effective oversight and challenge.
The Outcome
The engagement provided specialist regulatory advice and senior-level training, helping the client understand the relationship between broader operational resilience and DORA’s digital resilience requirements.
Third-Party Risk ManagementCASE STUDY 13
Strengthening Third-Party Risk Management Frameworks for UK Banks
The Challenge
Four UK banking entities engaged us to enhance TPRM frameworks, including compliance with PRA Supervisory Statement SS2/21 on outsourcing and third-party risk management. Two engagements required substantial redesign of methodologies for assessing materiality, inherent risk and resilience risk, and allocating relationships to control and oversight tiers.
Our Approach
We began with gap analyses and maturity assessments of existing policies, procedures, methodologies, governance and oversight arrangements. We then designed proportionate Target Operating Models and action plans. For two banks we substantially redesigned materiality, inherent risk and resilience risk assessments, linking results to proportionate control and oversight tiers. Work also included redrafting policies and procedures, clarifying responsibilities and delivering training to Relationship Managers on the revised approach. Throughout, we aimed to meet regulatory expectations without imposing identical controls on every relationship.
The Outcome
The engagements supported four banks in strengthening TPRM arrangements and addressing SS2/21 expectations. Two included substantial methodology redesign and tiering enhancements. The work combined regulatory interpretation, framework design, implementation and training, illustrating how TPRM supports resilience throughout the third-party relationship lifecycle.
How We Work
While each engagement is different, our approach is underpinned by consistent principles:
Understand the organisation. Start with objectives, business model, existing capabilities and practical challenges.
Apply regulatory expertise. Translate supervisory expectations into clear, actionable requirements.
Be proportionate. Use judgement to develop arrangements appropriate to the organisation’s nature, scale and complexity.
Build on what exists. Leverage existing frameworks, tools and processes wherever possible.
Focus on implementation. Deliver practical outcomes rather than unnecessary documentation.
Transfer knowledge. Help teams build the understanding and capabilities to sustain improvements.
Our objective is not simply to help organisations demonstrate compliance, but to help them build more effective and sustainable risk management capabilities.