As SMF24 at the Building Society, I valued Paul’s energetic and hands-on approach in support of our operational resilience. He quickly identified strengths against regulatory expectations and worked seamlessly with our third‑party providers to support our ongoing due diligence processes.

Hiding in plain sight

Hiding in plain sight, their sheer scale can paradoxically obscure their true impact. When everything is interconnected, it becomes difficult to see the full picture. Welcome to technology, third‑party, and cyber risk - where countless dependencies, hidden pathways, and operational weak points sit quietly across your entire technology stack and supporting operations.

In short, these functional areas include ineffective architecture, technical debt, capacity issues, tech obsolesce, emerging tech disruption (including AI), cyber security, third party failures, data corruption, human capital shortages, and failure to deliver business requirements.  The result is an untenable mix of gaps, duplication and missed opportunities - leading inevitably to greater exposure overall.

Financial services firms must navigate overlapping tech regulations.  UK banks and building societies comply with GDPR / data protection rules and PRA / FCA operational resilience rules, including senior management systems and controls (SYSC) for IT risk management.  

Regulators increasingly use enforcement tools for digital failings - such as Section 166 reviews for poor data governance and fines for weak cyber security under Principle 2.  Global institutions also face cross-border challenges, e.g. ensuring trading apps meet the EU Digital Services Act and FCA conduct standards. 

Approach

Where do you start?  Before you can identify and assess the many risks in your organisation, you need to catalogue your capabilities.  Understanding all that your organisation does with technology can help uncover where the risks lie.  This requires having a governance framework in place that accounts for all technology, cyber and third party capabilities across the enterprise.  The point is to forge a consensus on a working taxonomy that will serve as a foundation for identifying, assessing and managing related risk across the enterprise. 

Reputable frameworks such as COBIT, ITIL, TOGAF, NIST and CQUEST can serve as a starting point, but it shouldn’t be a lift-and-shift and will require customisation and phased implementation.  The goal is to implement a widely accepted mechanism for governing technology capabilities and aligning them to business priorities, processes, functions and infrastructure.

Once you’ve done this foundational work, you’ll be well-positioned to take meaningful action.  But first things first.  Understand the risk and its many forms, know where it lives and align on terminology for describing and categorising it. 

Keep the framework current as it does little good if it hasn’t kept pace with the evolving technology and capabilities.

Why choose Green Dolphin

• Sector‑specific expertise: We understand the operational realities and regulatory expectations facing building societies, insurers and banks.
• Accelerated implementation: We've already leveraged reputable frameworks and learnings to provide a blueprint for accelerating your technology, third party and cyber risk journey.
• Stakeholder credibility: We've gained deep expertise from undertaking roles within industry from across all lines of defence, including CTO, CISO and Head of Technology and Change Risk.
• Proportionate and commercial: An understanding that budgets are not infinite and therefore the approach needs to be proportionate to the risks faced, regulatory expectations and commercial to operate.