Hong Kong Financial Services
Business Continuity Management Forum
Whole Industry Simulation Exercise (WISE) 2023
HONG KONG WISE 2023
The HK Whole Industry Simulation Exercise (WISE) is a biennial exercise that is led and managed by the HK Financial Services Business Continuity Management (HKFSBCM) forum. The HKFSBCM forum is an independent, non-profit organization that brings together BCM professionals to discuss operational risks and industry developments that may impact the financial services sector in HK.
As we see more instances of severe weather or cyber-attacks or communicable diseases, it is more important than ever to ensure firms strengthen their recovery strategies and preparedness. The role of business continuity management keeps evolving to meet the changing risk landscape as regulators are keen to embed Operational Resilience into the management priorities of authorized institutions.
The exercise objectives of WISE 2023 included practicing the crisis management capabilities of senior managers when BCP is invoked and assessing the ability of the Crisis Management Team (CMT) to respond to a cyber-attack incident that impacts multiple firms across HK. A new and significant addition was that WISE was the first BCM industry exercise in the world that integrated Operational Resilience requirements into the traditional framework of a crisis management exercise.
PARTICIPANTS
WISE 2023 involved the participation of multiple firms to achieve its collective outcome:
- Regulators: The HK Monetary Authority (HKMA) and the Securities and Financial Commission (SFC) engaged in active communications with select firms during the exercise, while the HK Insurance Authority (HKIA) participated at the command center.
- Financial Services Firms: Most firms have been active members of the HKFSBCM forum and WISE 2023 enabled participants to simultaneously join a large-scale exercise in response to a systemic threat affecting the HK market. There were forty-two financial firms that participated in WISE 2023.
- Vendor: 4C Strategies was hired to facilitate the delivery of WISE 2023. Using their internal platform, Exonaut, 4C Strategies developed a framework of planning and engagement with single points of contact, facilitators, scenario leads and evaluators across each participating firm.
THE EXERCISE
WISE 2023 was successfully conducted on Thu, 16 Nov 2023. The last exercise was held in Oct 2019 but was then put on hold in 2021 while the world navigated Covid-19. Coming out of the pandemic, firms had enhanced their resilience through technological investments and upskilled their knowledge base of contingency planning.
WISE 2023 was delivered both in person and online: (1) the command center included ~50 scenario leads and vendor staff to manage the injects, (2) a video conference was available for overseas participants with a role in the exercise, and (3) each firm’s crisis management team operated within their own established internal crisis response structures.
The baseline scenario primarily revolved around a malware that was distributed by a hostile actor through a key software patch. There were optional injects that included slowness to a key financial market data provider and complaints being published on social media platforms. To incorporate Operational Resilience testing requirements, firms could further stretch their own suite of internal injects to prioritise their Critical Business Services. Injects were input into 4C Strategies’ Exonaut system, where the vendor could sense-check and validate the range of injects across the HK market.
Overall, an estimated 900-1,000 people joined and supported WISE 2023 whether they were regulators, BCM teams (single points of contact, facilitators, scenario leads and evaluators), Operational Resilience leads or CMTs (senior decision-makers within banks).
Lastly, as part our partnership with 4C Strategies, a Crisis Management Capability Maturity Model has been developed which defines what “good” looks like for HK’s financial sector when responding to a disruption. It is based on 4C Strategies’ methodology of the 10 fundamentals of Crisis Management in close partnership and collaboration with organisations and sectors across the world as well as in line with international standards, guidelines, and best practice. Behind each function there is a set of performance indicators, i.e., the definition of what “good” looks like for that function, which has been developed as part of the WISE 2023 project to allow organisations to benchmark themselves against the industry.
CONCLUSION
4C Strategies will deliver a post-exercise report in Jan 2024. The Board of the HKFSBCM forum thanks all the participants for collaborating on WISE 2023 to deliver a successful large-scale exercise that aims to continuously strengthen the resilience of the HK financial services industry.
REFERENCE LINKS