A key project for APRA over 2022 will be to review its current prudential requirements for operational risk management, service provision and business continuity, Wayne Byres, the APRA chief, told a financial regulators conference on Friday.

There is a need “to better understand operational resilience, and particularly the potential vulnerabilities that emerge from third-party relationships,” Byres said.

COVID-19 has been a real-world stress test of operational risk management, and “the good news is the financial sector has come through it fairly well so far: financial services have, on the whole, been provided pretty seamlessly despite the disruption COVID-19 caused, ” Byres said.

“That said, that outcome required, at times, a scramble behind the scenes to find urgent responses to unexpected issues. Sometimes, short cuts and control over-rides were necessary, creating new risks. It is essential those gaps are registered and rectified as quickly as possible.”

Often, the biggest vulnerabilities in financial firms’ systems and processes were found in third party partners and suppliers - and sometimes triggered by vulnerabilities in the suppliers to the suppliers. 

“That adds another layer of complexity to the task of financial supervisors, given the limits of our regulatory reach,” Byres said. 

“When these suppliers are essential for the provision of critical functions, as is increasingly the case, financial supervisors need to think harder about how to gain assurance as to their robustness.”

Byres went on to highlight  concentration risk: 

“That is especially the case where the third party is a critical supplier to multiple firms can itself be a source of concentration risk within the system. 

“We can increasingly see the emergence of a new class of systemically important institution: that of the systemically important provider (or SIP). And of course, a number of providers may not just be a source of concentration risk domestically, but internationally as well (or, if you like, a G-SIP).”

Byres was speaking at an event jointly sponsored by the Arab Monetary Fund, Financial Stability Institute, Bank for International Settlements and the Basel Committee on Banking Supervision.