Operational Resilience Framework
Comprehensive guide to building operational resilience capabilities, including impact tolerances, scenario testing, and recovery planning.
View original at Bank of England
Operational Resilience Framework
What is Operational Resilience?
Operational resilience is an organization's ability to prevent, adapt, respond to, recover, and learn from operational disruptions. It goes beyond traditional business continuity by focusing on end-to-end service delivery.
Key Components
1. Important Business Services (IBS)
- Identify services critical to customers, markets, and firm viability
- Map end-to-end processes and dependencies
- Understand interconnections across services
2. Impact Tolerances
- Define maximum tolerable disruption for each IBS
- Consider customer harm, market integrity, and firm safety
- Set measurable thresholds (time, volume, quality)
3. Mapping Dependencies
- Technology systems and infrastructure
- Third-party providers and suppliers
- People and skills
- Data and information flows
- Facilities and locations
4. Scenario Testing
- Severe but plausible scenarios
- Test ability to remain within impact tolerances
- Include cyber attacks, technology failures, third-party disruptions
- Document lessons learned and remediation actions
5. Recovery Planning
- Response and recovery procedures
- Communication protocols
- Alternative delivery mechanisms
- Resource allocation priorities
Regulatory Context
- UK: FCA/PRA Operational Resilience Requirements
- EU: DORA (Digital Operational Resilience Act)
- US: OCC/Fed guidance on operational resilience
Implementation Roadmap
- Identify important business services
- Set impact tolerances
- Map resources and dependencies
- Conduct scenario testing
- Develop remediation plans
- Continuous monitoring and improvement