Sorry, the language specified is not available for this page
    Business woman using tablet with financial, cloud connectivity concept

    Yorkshire Building Society: Keeping financial services flowing

    Overview

    Yorkshire Building Society’s goal is to help its members achieve the things in life that matter most to them. Sungard Availability Services (Sungard AS) helped the Society mature and fortify its incident and crisis management framework and recovery services to ensure its important business services continue, following a significant incident or crisis.

    Solutions

    • Sungard AS Business Resilience Consulting

    • Scenario Exercising & Awareness Training

    • Sungard AS Shared Workplace Recovery

    Results

    • An alternate, geographically separated workplace for continuous trading and other key business operation resiliency needs

    • A cross-organisational framework to support enhanced incident and crisis management capability and effectiveness

    • Clearly defined incident and crisis management responsibilities

    • Demonstrated and proven resilience capability for regulators 

       

    About the Company

    Yorkshire Building Society (YBS) is the third largest building society in the UK. Headquartered in Bradford, West Yorkshire, England, the society has a 150-year history of providing ‘Real Help With Real Life’ to its borrowing and saving members. YBS received the Moneynet award for the Best Easy Access Savings Provider in 2021.

    Sungard AS supported the Society on our journey to both strengthen and embed an incident and crisis management response framework through an effective scenario exercising programme. This contributed to the Society’s ability to respond effectively to operational incidents and crises and allows us to continue providing important business services to our members.

    Euan Watson
    Senior Manager, Business Continuity, Yorkshire Building Society

    Challenge

    As a building society in the UK, Yorkshire Building Society is a financial institution owned by its members, not shareholders. Its main objective is to provide mortgages and savings products to its members, helping them meet their ‘life goals,’ from owning their own home to saving for retirement.

    When it comes to technology, the focus is on continuing to provide important business services to its members. This means ensuring systems, and the customer services they support, are highly available and resilient.

    When Euan Watson joined YBS as Senior Manager, Business Continuity in 2017, the Society’s incident and crisis response strategy had already been established, including a decade-long Workplace Recovery solution with Sungard AS.

    This off-site alternate location could be invoked quickly to relocate up to 470 customer-facing colleagues, supporting the continued delivery of important business services.

    With resilience against existing and emerging threats in mind, Watson set out to further strengthen YBS’s incident and crisis management framework with the support of Sungard AS.

    This approach is even more important when it comes to upholding the Prudential Regulatory Authorities requirement. This calls for firms to be operationally resilient and able to prevent disruption occurring to the extent practicable. It also requires financial firms to adapt systems and processes to continue providing services and functions in the event of an incident, and to return to normal operations promptly when a disruption is over. It further mandates that firms learn from both incidents and near misses.

     

    Solution

    A cross-organisational approach

    In 2018, Watson began working to improve the Society’s Incident and Crisis Management capability. His existing relationship with Sungard AS allowed for a seamless transition to further enhance and mature the Society’s competence in this space.

    YBS benefits from 12 days of consultancy expertise per annum, which includes the development
    and delivery of Incident and Crisis Management scenario exercises.

    This engaged a wide range of stakeholders from Management, Directors and Chief Officers, who naturally form part of both the Operational and Strategic response layers of the Society’s Incident and Crisis Management teams. Identifying what worked well, and what needed to improve, was a key component of this transitional journey.

    Awareness training

    Another vital element of the transition programme was to develop and deliver a series of awareness training sessions to cover the basics of business continuity, incident, and crisis management techniques. Sungard AS assisted with an awareness briefing for the Society’s board in October 2019 including the chairman and the board of directors. The briefing covered the organisation’s overall approach to resilience and incident and crisis response, as well as what the consulting services would focus on for the given year.

    This was followed by awareness training for members of the Society’s Incident & Crisis Management teams, the goal being for each to understand industry ‘best practices.’

    Of particular importance was delivering the message that minimising the impact of a disruption meant being prepared to respond to different situations in different ways. This included factoring in different senses of urgency, depending on the severity and nature of the incident or crisis. By using examples of events that could actually happen, Sungard AS explained the processes and risk-based actions that could be applied to gain control of the situation effectively, enabling prompt resolution.

    “When we first started, there was a little skepticism about why we were requesting colleagues to be involved to the degree and the level that we were,” Watson says. “The awareness training absolutely helped colleagues understand the reasons why we were looking to enhance the current incident and crisis model. This approach allowed us to overcome the perception that being involved in the incident management process would be onerous and time-consuming.”

    “Over the years, we’ve built up great momentum and a significant level of competence as a result of this approach,” Watson continues. “Members of both the Incident & Crisis Management teams engage effectively when we exercise or ‘do it for real’.”

    Developing scenarios

    Using the latest Government Risk Register and the strategic priorities of the Society, Watson and his Sungard AS team created plausible, relevant scenarios of severe situations, designed storyboards depicting a sequence of actions, developed scenario exercises and created a slide deck to present to the Incident & Crisis Management teams on exercise day.

    For example, the cyber exercise included background about why it is such a pressing issue, what the risk landscape looks like, real-world examples of incidents, as well as exam questions to make the scenario totally realistic.

    As part of each scenario exercise, the group was charged with analysing what had happened and deciding what procedures would work best to address it, then prioritising and taking actions. Periodic check-ins kept the team on their 45-minute completion schedule and served as coaching sessions, allowing them to assess progress, examine what’s working and what’s not, and to restart the exercise until conclusion. The target timeline, including initial briefings, was 1.5 hours. Exercise timelines have reduced significantly due to improved competence in this space.

    When it comes to delivering scenario exercises, Watson says it’s helped to have a Sungard AS consultant on board. “There are a lot of industry books that say, to get the best out of these exercises, you need somebody who is impartial and external to the organisation, who can run those exercises in a competent and capable manner, which our consultant does,” he says.

    “With the exercises we’ve run for the past three years, participants actually know our Sungard AS consultant and how capable he is in this space. We’ve built up a really good level of credibility with them.”

     

    Results

    Today, Yorkshire Building Society has three different response plans in place, clearly outlining responsibilities: An Incident Management Plan, a Crisis Management Plan, and an Incident and Crisis Communication Plan.

    “The big difference we have now is that we have a succinct framework and a structure that helps people concentrate on what they should be managing at their particular level, whether it’s operational, tactical or strategic,” confirms Watson.

    In addition to reducing the total scenario exercise timelines from two hours to the targeted 1.5 hours, including 45 minutes devoted to problem resolution, Watson says they’ve seen continuous improvement over the years as teams use what they’ve learned to improve the Society’s overall resilience posture.

    “We’ve made really good progress. We’re at the point where we can pretty much present our primary response teams with a scenario and say, 'Right, off you go, please follow the agenda and the plan, and we would like a formal response statement in 45 minutes time,” he reports.

    “We’re also significantly increasing the amount of workplace recovery testing we do with Sungard AS to demonstrate and prove our recovery and resilience capabilities for our important business services.”

    With a focus on keeping these services continuously available, YBS will align with Operational Resilience policy and program regulations, which come into effect in 2023.

    “It’s been a lot of hard work, and it’s been worth it. We’re continuing that journey now, as it’s never really finished—it’s a constant wheel that we turn with the people involved. Over the past three years, Sungard AS has been very much part of our journey to exercise our incident and crisis management framework, which has been really successful.”

    Managing resilience in the future

    Watson reflects on the future, and the role of Sungard AS. “Sungard AS has the skills, competence and expertise to help us further enhance our incident and crisis management exercise skills, which will help us to continue to mature our response capabilities and thereafter continue to deliver important business services to our members,” he says.

    For other organisations looking to boost resilience, Watson cautions them not to underestimate the amount of work required at the foundational level.

    “When commencing an improvement programme, it’s really important to identify your key stakeholders and put in the time to communicate with them and the rest of your organization,” he says. “The goal is to make sure everyone understands the tactical and strategic objectives you’re trying to achieve, and their role in achieving them. Without that, you won’t get to the level of buy-in that you need to be successful,” says Watson. “So don’t underplay the work in the early stages, because it will reap significant rewards at the other end.” 

    Sungard AS has the skills, competence and expertise to help us further enhance our incident and crisis management exercise skills, which will help us to continue to mature our response capabilities and thereafter continue to deliver important business services to our members.

    Euan Watson
    Senior Manager, Business Continuity

     

    Yorkshire Building Society’s goal is to help its members achieve the things in life that matter most to them. Sungard Availability Services (Sungard AS) helped the Society mature and fortify its incident and crisis management framework and recovery services to ensure its important business services continue, following a significant incident or crisis.

    Solutions

    • Sungard AS Business Resilience Consulting

    • Scenario Exercising & Awareness Training

    • Sungard AS Shared Workplace Recovery

    Results

    • An alternate, geographically separated workplace for continuous trading and other key business operation resiliency needs

    • A cross-organisational framework to support enhanced incident and crisis management capability and effectiveness

    • Clearly defined incident and crisis management responsibilities

    • Demonstrated and proven resilience capability for regulators 

       

    About the Company

    Yorkshire Building Society (YBS) is the third largest building society in the UK. Headquartered in Bradford, West Yorkshire, England, the society has a 150-year history of providing ‘Real Help With Real Life’ to its borrowing and saving members. YBS received the Moneynet award for the Best Easy Access Savings Provider in 2021.

    Sungard AS supported the Society on our journey to both strengthen and embed an incident and crisis management response framework through an effective scenario exercising programme. This contributed to the Society’s ability to respond effectively to operational incidents and crises and allows us to continue providing important business services to our members.

    Euan Watson
    Senior Manager, Business Continuity, Yorkshire Building Society

    As a building society in the UK, Yorkshire Building Society is a financial institution owned by its members, not shareholders. Its main objective is to provide mortgages and savings products to its members, helping them meet their ‘life goals,’ from owning their own home to saving for retirement.

    When it comes to technology, the focus is on continuing to provide important business services to its members. This means ensuring systems, and the customer services they support, are highly available and resilient.

    When Euan Watson joined YBS as Senior Manager, Business Continuity in 2017, the Society’s incident and crisis response strategy had already been established, including a decade-long Workplace Recovery solution with Sungard AS.

    This off-site alternate location could be invoked quickly to relocate up to 470 customer-facing colleagues, supporting the continued delivery of important business services.

    With resilience against existing and emerging threats in mind, Watson set out to further strengthen YBS’s incident and crisis management framework with the support of Sungard AS.

    This approach is even more important when it comes to upholding the Prudential Regulatory Authorities requirement. This calls for firms to be operationally resilient and able to prevent disruption occurring to the extent practicable. It also requires financial firms to adapt systems and processes to continue providing services and functions in the event of an incident, and to return to normal operations promptly when a disruption is over. It further mandates that firms learn from both incidents and near misses.

     

    A cross-organisational approach

    In 2018, Watson began working to improve the Society’s Incident and Crisis Management capability. His existing relationship with Sungard AS allowed for a seamless transition to further enhance and mature the Society’s competence in this space.

    YBS benefits from 12 days of consultancy expertise per annum, which includes the development
    and delivery of Incident and Crisis Management scenario exercises.

    This engaged a wide range of stakeholders from Management, Directors and Chief Officers, who naturally form part of both the Operational and Strategic response layers of the Society’s Incident and Crisis Management teams. Identifying what worked well, and what needed to improve, was a key component of this transitional journey.

    Awareness training

    Another vital element of the transition programme was to develop and deliver a series of awareness training sessions to cover the basics of business continuity, incident, and crisis management techniques. Sungard AS assisted with an awareness briefing for the Society’s board in October 2019 including the chairman and the board of directors. The briefing covered the organisation’s overall approach to resilience and incident and crisis response, as well as what the consulting services would focus on for the given year.

    This was followed by awareness training for members of the Society’s Incident & Crisis Management teams, the goal being for each to understand industry ‘best practices.’

    Of particular importance was delivering the message that minimising the impact of a disruption meant being prepared to respond to different situations in different ways. This included factoring in different senses of urgency, depending on the severity and nature of the incident or crisis. By using examples of events that could actually happen, Sungard AS explained the processes and risk-based actions that could be applied to gain control of the situation effectively, enabling prompt resolution.

    “When we first started, there was a little skepticism about why we were requesting colleagues to be involved to the degree and the level that we were,” Watson says. “The awareness training absolutely helped colleagues understand the reasons why we were looking to enhance the current incident and crisis model. This approach allowed us to overcome the perception that being involved in the incident management process would be onerous and time-consuming.”

    “Over the years, we’ve built up great momentum and a significant level of competence as a result of this approach,” Watson continues. “Members of both the Incident & Crisis Management teams engage effectively when we exercise or ‘do it for real’.”

    Developing scenarios

    Using the latest Government Risk Register and the strategic priorities of the Society, Watson and his Sungard AS team created plausible, relevant scenarios of severe situations, designed storyboards depicting a sequence of actions, developed scenario exercises and created a slide deck to present to the Incident & Crisis Management teams on exercise day.

    For example, the cyber exercise included background about why it is such a pressing issue, what the risk landscape looks like, real-world examples of incidents, as well as exam questions to make the scenario totally realistic.

    As part of each scenario exercise, the group was charged with analysing what had happened and deciding what procedures would work best to address it, then prioritising and taking actions. Periodic check-ins kept the team on their 45-minute completion schedule and served as coaching sessions, allowing them to assess progress, examine what’s working and what’s not, and to restart the exercise until conclusion. The target timeline, including initial briefings, was 1.5 hours. Exercise timelines have reduced significantly due to improved competence in this space.

    When it comes to delivering scenario exercises, Watson says it’s helped to have a Sungard AS consultant on board. “There are a lot of industry books that say, to get the best out of these exercises, you need somebody who is impartial and external to the organisation, who can run those exercises in a competent and capable manner, which our consultant does,” he says.

    “With the exercises we’ve run for the past three years, participants actually know our Sungard AS consultant and how capable he is in this space. We’ve built up a really good level of credibility with them.”

     

    Today, Yorkshire Building Society has three different response plans in place, clearly outlining responsibilities: An Incident Management Plan, a Crisis Management Plan, and an Incident and Crisis Communication Plan.

    “The big difference we have now is that we have a succinct framework and a structure that helps people concentrate on what they should be managing at their particular level, whether it’s operational, tactical or strategic,” confirms Watson.

    In addition to reducing the total scenario exercise timelines from two hours to the targeted 1.5 hours, including 45 minutes devoted to problem resolution, Watson says they’ve seen continuous improvement over the years as teams use what they’ve learned to improve the Society’s overall resilience posture.

    “We’ve made really good progress. We’re at the point where we can pretty much present our primary response teams with a scenario and say, 'Right, off you go, please follow the agenda and the plan, and we would like a formal response statement in 45 minutes time,” he reports.

    “We’re also significantly increasing the amount of workplace recovery testing we do with Sungard AS to demonstrate and prove our recovery and resilience capabilities for our important business services.”

    With a focus on keeping these services continuously available, YBS will align with Operational Resilience policy and program regulations, which come into effect in 2023.

    “It’s been a lot of hard work, and it’s been worth it. We’re continuing that journey now, as it’s never really finished—it’s a constant wheel that we turn with the people involved. Over the past three years, Sungard AS has been very much part of our journey to exercise our incident and crisis management framework, which has been really successful.”

    Managing resilience in the future

    Watson reflects on the future, and the role of Sungard AS. “Sungard AS has the skills, competence and expertise to help us further enhance our incident and crisis management exercise skills, which will help us to continue to mature our response capabilities and thereafter continue to deliver important business services to our members,” he says.

    For other organisations looking to boost resilience, Watson cautions them not to underestimate the amount of work required at the foundational level.

    “When commencing an improvement programme, it’s really important to identify your key stakeholders and put in the time to communicate with them and the rest of your organization,” he says. “The goal is to make sure everyone understands the tactical and strategic objectives you’re trying to achieve, and their role in achieving them. Without that, you won’t get to the level of buy-in that you need to be successful,” says Watson. “So don’t underplay the work in the early stages, because it will reap significant rewards at the other end.” 

    Sungard AS has the skills, competence and expertise to help us further enhance our incident and crisis management exercise skills, which will help us to continue to mature our response capabilities and thereafter continue to deliver important business services to our members.

    Euan Watson
    Senior Manager, Business Continuity