Operational resilience is an organisation's ability to anticipate, withstand, respond to, recover from and adapt to operational disruption while continuing to deliver the services and outcomes that matter most.

It goes beyond preventing incidents or restoring systems after a failure. Operational resilience requires organisations to understand which services are critical, what they depend on, how disruption could affect their delivery, and whether the organisation has the capabilities to respond and recover before the consequences become unacceptable.

Disruption can arise from many sources, including technology failures, cyberattacks, third-party outages, operational errors, infrastructure failures, workforce disruption and external events. Increasingly, the most significant consequences emerge not from a single failure but from the interaction of several dependencies across the organisation.

An effective operational resilience framework therefore connects business services, risk management, technology, third-party oversight, business continuity, incident management and executive decision-making. These capabilities must work together when disruption occurs, rather than operate as separate disciplines.

What Is the Purpose of Operational Resilience?

The purpose of operational resilience is not to eliminate disruption. No organisation can prevent every incident, and attempting to do so would be neither realistic nor proportionate. Instead, operational resilience enables organisations to understand which disruptions they must be prepared to withstand, what consequences are acceptable, and what capabilities are needed to protect critical services and stakeholders.

This requires leadership to answer several fundamental questions:

Which business services are most important to customers, stakeholders and the organisation?
What people, processes, technology, information and third parties are necessary to deliver those services?
How could failures within these dependencies affect multiple services or create cascading disruption?
How much disruption can the organisation withstand before unacceptable harm occurs?
Can existing response, continuity and recovery arrangements maintain or restore services within those limits?
How effectively can leadership make decisions, coordinate responses and adapt when events do not unfold as expected?

These questions shift the focus from whether individual systems and processes are protected towards whether the organisation can continue delivering the outcomes that matter when its normal operating conditions are disrupted.

Operational Resilience Is an Organisational Capability, Not Simply a Framework

Organisations often demonstrate their commitment to resilience through policies, business continuity plans, impact tolerance statements, dependency maps and scenario-testing programmes. These are important foundations, but their existence does not establish that the organisation is resilient.

A documented recovery capability may depend on assumptions that have never been tested. A critical supplier may meet its contractual obligations while remaining a source of concentration risk. Individual business functions may have effective continuity arrangements that do not account for dependencies shared with other services.

Similarly, an organisation may successfully complete a scenario exercise without demonstrating how its governance, escalation and decision-making arrangements would perform during a prolonged or rapidly evolving incident.

The distinction is between having resilience arrangements in place and demonstrating that those arrangements work together under disruption.

This makes operational resilience a continuing management responsibility rather than a periodic compliance exercise. It must evolve as the organisation introduces new products, changes technology, expands its supplier network, transforms its operating model or encounters new forms of disruption.

From Operational Resilience Compliance to Demonstrated Effectiveness

Regulatory requirements have helped establish a more structured approach to operational resilience, particularly within financial services. Identifying important business services, setting impact tolerances, mapping dependencies and conducting scenario testing provide a foundation for understanding and managing disruption.

However, completing these activities is not the same as demonstrating operational resilience effectiveness.

An organisation may have identified its important business services without fully understanding how they depend on shared technology or external providers. It may have defined impact tolerances without establishing whether its recovery capabilities can consistently operate within them. Scenario testing may confirm that documented procedures exist while leaving weaknesses in coordination, decision-making or escalation unresolved.

The more important question is whether the organisation can demonstrate that its resilience arrangements are implemented, connected, tested and capable of protecting critical services when disruption occurs.

This requires attention to actual operating capabilities, the quality of evidence supporting resilience assessments, and how incidents, testing findings and emerging vulnerabilities inform future improvements.

Operational resilience is therefore both a protective capability and a source of organisational learning. Its effectiveness depends not only on preparing for disruption but also on recognising where assumptions fail, understanding how vulnerabilities interact and strengthening the organisation's ability to respond as circumstances change.

Ultimately, operational resilience is demonstrated through performance under disruption, not simply through the completeness of the framework designed to manage it.

2. Operational Resilience vs Business Continuity, Disaster Recovery and Risk Management

Operational resilience, business continuity, disaster recovery and risk management are closely connected, but they serve different purposes. Operational resilience brings these disciplines together around a fundamental objective: ensuring that an organisation can continue delivering its most important services when disruption occurs.

Business continuity focuses on maintaining or restoring business activities. Disaster recovery concentrates primarily on recovering technology and supporting infrastructure. Risk management identifies, assesses and manages uncertainty that could affect organisational objectives. Operational resilience considers how these capabilities work collectively to protect service delivery and limit the consequences of disruption.

The distinction matters because an organisation can have mature arrangements within each discipline without necessarily being resilient as a whole. Individual systems may recover successfully, business continuity plans may be activated, and risks may have been assessed, yet critical services can still experience unacceptable disruption because dependencies, decisions and recovery activities are not sufficiently coordinated.

How Do These Disciplines Differ?

- Operational Resilience: Maintains the delivery of important business services during disruption, limiting unacceptable harm.

- Business Continuity Management (BCM): Ensures priority business activities can continue or resume following disruption.

- Disaster Recovery (DR): Restores technology systems, infrastructure and data following failures.

- Risk Management: Identifies, assesses, manages and monitors uncertainty that could affect organisational objectives.

These disciplines are complementary rather than competing. The effectiveness of operational resilience depends on the capabilities each contributes and, critically, how they interact.

Why Business Continuity and Disaster Recovery Are Not Sufficient on Their Own

Business continuity and disaster recovery are essential components of operational resilience, but they do not necessarily provide a complete understanding of how disruption affects the delivery of business services. A business continuity plan may establish how a department should operate during an outage. A disaster recovery plan may define the technical procedures and recovery time objectives for restoring a system. Both can be effective within their respective scope while failing to address the wider consequences of disruption.

Consider a payment service that depends on internal technology, a cloud provider, an external payment processor, fraud monitoring and customer authentication. The organisation may successfully restore its internal systems within the agreed recovery time. However, customers may remain unable to complete transactions because the external payment processor is unavailable or authentication services have not recovered.

From a technical perspective, disaster recovery may have succeeded. From a business continuity perspective, individual teams may have followed their plans. Yet the payment service remains disrupted. Operational resilience shifts the unit of analysis from individual systems, processes and departments to the end-to-end delivery of important business services.

This requires organisations to understand dependencies across operational boundaries, identify where failures can propagate, and coordinate recovery according to the consequences for customers and service delivery.

How Does Operational Resilience Connect to Enterprise Risk Management?

Enterprise Risk Management (ERM) provides a broader understanding of the uncertainties that could affect organisational objectives. It supports risk identification, assessment, appetite, controls, monitoring, governance and escalation across strategic, financial, operational and other risk categories.

Operational resilience builds on these capabilities but concentrates specifically on the organisation's ability to withstand and respond to operational disruption. The relationship is particularly important in three areas.

Risk identification and interconnected exposures. ERM helps identify threats, vulnerabilities and concentrations of risk. Operational resilience examines how those exposures could affect important services, including the potential for failures to spread across shared dependencies.
Risk appetite and impact tolerances. Risk appetite informs the organisation's approach to taking and managing risk. Impact tolerances establish the maximum tolerable level of disruption to an important business service, under applicable regulatory definitions. These measures serve different purposes and should not be treated as interchangeable. An organisation may operate within its risk appetite under normal conditions while still being unable to remain within an impact tolerance during severe disruption.
Governance and decision-making. ERM establishes broader accountability, oversight and escalation arrangements. Operational resilience tests whether those arrangements enable timely and effective decisions when information is incomplete, conditions change rapidly and several business functions must coordinate their response.

The objective is not to create a separate resilience governance structure disconnected from enterprise risk management. It is to ensure that resilience considerations inform existing risk management, strategic planning, investment decisions and executive oversight.

Where Operational Resilience Creates Additional Value

The greatest contribution of operational resilience is often found at the points where established disciplines interact.

An organisation may have strong cyber security, business continuity, disaster recovery, third-party risk management and incident response capabilities. Each may be supported by its own governance, assessments, testing programme and reporting.

However, disruption rarely respects those organisational boundaries.

A cyberattack may trigger technology recovery, supplier escalation, customer communications, regulatory notifications and operational workarounds simultaneously. The effectiveness of the response depends on how these activities are prioritised and coordinated, not simply whether each function performs its individual responsibilities.

This creates several important operating challenges:

Shared dependencies: Different business services may rely on the same technology, supplier, people or infrastructure, creating concentration and cascading risks.
Conflicting recovery priorities: Individual functions may prioritise restoring their own operations without considering which services need to recover first.
Fragmented information: Leadership may receive separate technical, operational and risk assessments without a consolidated view of service disruption and customer impact.
Unclear decision authority: Response teams may understand their responsibilities but lack clarity over who can authorise exceptional measures, accept trade-offs or escalate material consequences.
Unvalidated assumptions: Recovery plans may work individually but rely on resources or dependencies that cannot support simultaneous recovery across multiple services.

These weaknesses may remain hidden during routine operations or isolated testing. They become more visible when an incident affects several interconnected activities at once.

An effective operational resilience approach therefore does not replace existing risk, continuity or recovery disciplines. It connects them around service outcomes, shared dependencies, coordinated decisions and demonstrated recovery capability.

This is also why operational resilience cannot be assessed solely through the maturity of individual functions. Organisations need to understand whether their collective capabilities are sufficient to protect important services under severe but plausible disruption, and whether the evidence supporting that conclusion remains reliable as their operating environment changes.

Explore Business Continuity and Contingency Planning in Greater Detail

The following Aevitium case study illustrates how business continuity and contingency planning can strengthen operational resilience through effective recovery arrangements, infrastructure redundancy and coordinated incident response.

Business Continuity and Contingency Planning: A FinTech Case Study →

Further Reading: Resilient Risk Management

Operational resilience is an essential component of organisational resilience, but sustaining critical services is only part of the challenge. Organisations must also strengthen their ability to navigate uncertainty, adapt to changing conditions and make effective decisions.

In Resilient Risk Management, Julien Haye explores the relationship between risk management, leadership and organisational resilience, extending the discussion beyond operational disruption to the capabilities that support long-term organisational effectiveness.

Explore Resilient Risk Management →

Promotional image for Resilient Risk Management: How Risk Leadership Enables Agility by Julien Haye, published by Kogan Page. The book explores practical tools for integrating agility and adaptability into risk management, strategy, governance and culture. Includes a 30% discount code, PUBMON30, valid on Kogan Page until 4 November 2026.

3. Why Operational Resilience Matters Beyond Regulatory Compliance

Operational resilience is a strategic business capability, not simply a regulatory obligation. While regulation has accelerated the adoption of structured resilience frameworks, the underlying business objective is broader: protecting the delivery of critical services, limiting harm to customers and stakeholders, and enabling organisations to operate effectively when normal conditions are disrupted.

Regulatory compliance establishes important expectations for identifying business services, understanding dependencies, defining impact tolerances and testing resilience arrangements. However, meeting these requirements does not automatically demonstrate that an organisation can withstand a significant disruption.

An organisation may have completed its service mapping, documented recovery arrangements and conducted scenario testing while remaining exposed to vulnerabilities that emerge only when several systems, suppliers or business functions fail simultaneously. The commercial and strategic value of operational resilience therefore depends on what these activities enable the organisation to achieve, rather than their completion alone.

Protecting Customer Outcomes and Maintaining Trust

Operational disruption is ultimately experienced through its consequences, not its technical causes. A technology outage may prevent customers from accessing their accounts. A payment processing failure may interrupt transactions. A third-party disruption may affect services even when the organisation's own infrastructure remains operational.

For customers, the distinction between an internal failure and an external dependency is often irrelevant. What matters is whether the service they rely upon remains available, how the organisation responds and whether the consequences are managed effectively. Operational resilience connects internal recovery capabilities to the outcomes experienced by customers and other stakeholders.

This requires organisations to look beyond system availability and consider the duration, scale and severity of disruption, including whether alternative arrangements can maintain essential services and how effectively customers are supported when normal delivery cannot be sustained.

A resilient organisation is not one that never experiences disruption. It is one that understands the potential consequences and has credible arrangements to limit harm, respond effectively and restore service delivery.

Strengthening Strategic Decision-Making and Investment Priorities

Operational resilience also provides leadership with a clearer understanding of where the organisation is vulnerable and where investment can make the greatest difference. Traditional investment decisions may be organised around individual systems, departments, technology upgrades or control improvements. Each proposal may be justified within its own functional area, without demonstrating how it contributes to the resilience of important business services.

A service-led approach changes that perspective.

By connecting critical services to the people, processes, technology, information and third parties on which they depend, organisations can identify vulnerabilities that may otherwise remain hidden within functional boundaries.

For example, several important services may depend on the same cloud provider, specialist operational team or technology component. Individually, each service may appear adequately protected. Collectively, the organisation may be exposed to a concentration of risk that its existing recovery arrangements cannot adequately address.

This information helps leadership make more informed decisions about:

Investment priorities: Directing resources towards dependencies and vulnerabilities with the greatest potential consequences for service delivery.
Technology and transformation: Understanding how changes to systems, architecture or operating models affect resilience.
Outsourcing and third parties: Evaluating concentration, substitutability, recovery capabilities and exit arrangements.
Growth and product development: Ensuring new services and operational dependencies do not create unmanaged vulnerabilities.
Risk acceptance and remediation: Making explicit decisions about resilience weaknesses, available alternatives and the urgency of corrective action.

The value lies not simply in identifying vulnerabilities, but in translating that understanding into decisions about resources, priorities and acceptable exposure.

Understanding Connected Vulnerabilities and Cascading Disruption

Modern organisations operate through increasingly interconnected networks of technology, data, people, processes and external providers. These connections enable efficiency, scalability and innovation, but they can also create vulnerabilities that are difficult to identify when risks are assessed independently.

A failure in one dependency may affect several business services. The resulting disruption may place additional pressure on alternative systems, operational teams or third-party providers, creating further consequences beyond the original incident.

For example, a cloud service outage may affect customer authentication, payment processing and internal operational systems simultaneously. Even where individual recovery plans exist, the organisation may discover that several services compete for the same recovery resources or depend on the same unavailable infrastructure.

The resilience challenge is therefore not limited to the failure of individual components. It includes understanding how failures interact and whether the organisation can manage their combined consequences. This is particularly important where service mapping, technology recovery, third-party oversight and business continuity are managed by different functions.

An effective operational resilience approach brings these perspectives together to identify shared dependencies, challenge assumptions and assess whether recovery capabilities remain credible under more complex disruption scenarios.

Improving Leadership Response and Decision-Making Under Pressure

Operational resilience is also shaped by the quality and timing of decisions made during an incident. Disruptions rarely unfold with complete information. Early indications may be ambiguous, the scale of the impact may change, and several teams may be investigating different aspects of the same event.

Leadership may need to decide whether to activate contingency arrangements, prioritise one service over another, suspend an activity, communicate with customers or escalate to regulators before the full consequences are known.

These decisions cannot be resolved through documented procedures alone.

Effective resilience requires clear decision authority, reliable information flows, coordinated escalation and the ability to adapt as new evidence emerges.

A technically recoverable incident can become more damaging when escalation is delayed, responsibilities are unclear or teams operate with conflicting assumptions. Conversely, timely decisions and effective coordination can limit the consequences of disruption even when technical recovery takes longer than expected.

The effectiveness of operational resilience depends as much on how decisions are made during disruption as on the recovery capabilities available to the organisation. This is why scenario testing should examine leadership judgement, cross-functional coordination and decision-making under uncertainty, rather than focusing exclusively on whether recovery procedures can be executed.

Supporting Sustainable Growth and Organisational Change

As organisations grow, their operating environments become more complex. New products, markets, technologies, suppliers and business models introduce additional dependencies and change the consequences of disruption.

Resilience arrangements that were appropriate at an earlier stage may no longer reflect how the organisation operates.

For example, a FinTech may initially rely on a relatively simple technology architecture and a small number of external providers. As it expands, the same organisation may introduce additional payment services, jurisdictions, outsourcing arrangements and customer segments, increasing both the number of dependencies and the potential consequences of their failure.

Operational resilience should therefore be considered throughout business transformation, not only when existing arrangements are reviewed. This means assessing resilience implications when introducing new services, changing critical suppliers, migrating technology, restructuring operations or entering new markets.

A proportionate approach does not require every activity to receive the same level of protection. It requires organisations to understand which services and dependencies matter most, how their importance changes and whether resilience capabilities remain appropriate as the business evolves.

From Compliance Evidence to Operational Confidence

The distinction between regulatory compliance and operational resilience effectiveness becomes most visible when organisations consider the evidence they rely upon. A completed dependency map demonstrates that mapping has been performed. It does not necessarily demonstrate that all material dependencies have been identified.

A successful disaster recovery test provides evidence about a particular recovery capability. It does not necessarily demonstrate that the end-to-end business service can remain within its impact tolerance. A scenario exercise may confirm that participants understand their responsibilities while leaving uncertainty about how they would coordinate during a simultaneous supplier failure, cyber incident and customer-service disruption.

These activities are valuable, but the conclusions drawn from them must reflect what has actually been demonstrated.

Operational confidence comes from understanding the capabilities that have been tested, the assumptions that remain unvalidated and the vulnerabilities that could prevent the organisation from delivering important services under disruption.

That confidence should be supported by ongoing monitoring, credible scenario testing, actual incident experience, remediation and periodic reassessment as business conditions change. The objective is not to create additional documentation or testing for its own sake. It is to develop reliable evidence that enables leadership to understand the organisation's resilience, recognise its limitations and make informed decisions about improvement.

Ultimately, regulatory compliance establishes expectations, but operational resilience creates value when those expectations translate into stronger capabilities, better decisions and more dependable service delivery.

Is Your Operational Resilience Framework Fit for Purpose?

Whether you are developing an operational resilience framework, assessing existing capabilities, identifying critical dependencies or strengthening your ability to withstand, respond to and recover from disruption, discuss your priorities with Aevitium.

4. What Does an Effective Operational Resilience Framework Include?

An effective operational resilience framework brings together the governance, capabilities, processes and information needed to protect important business services during disruption. It enables organisations to understand what must remain operational, identify vulnerabilities across critical dependencies, establish acceptable limits of disruption and demonstrate that response and recovery arrangements can operate effectively under severe but plausible conditions.

The framework should not operate as a standalone compliance programme. It needs to connect existing capabilities across risk management, business continuity, technology, cyber security, third-party oversight, incident management and crisis response, ensuring that these disciplines contribute to a common understanding of service resilience. While regulatory requirements and organisational complexity influence how the framework is designed, its effectiveness depends on whether its components work together in practice.

What Are the Core Components of an Operational Resilience Framework?

An effective framework typically comprises eight interconnected components.

1. Governance, Accountability and Oversight

Operational resilience requires clear ownership of important business services, defined responsibilities across supporting functions and effective oversight by executive management and the Board. Governance should establish who is accountable for service resilience, who can make decisions during disruption, how material vulnerabilities are escalated and how resilience priorities influence investment and strategic decisions. Accountability must extend beyond the central resilience function. Business service owners, technology teams, operational management and specialist risk functions all contribute to resilience outcomes, even where their responsibilities differ.

2. Important Business Services and Critical Operations

Organisations need to identify the services whose disruption could cause unacceptable harm to customers, stakeholders, markets or the organisation itself. This requires looking beyond internal departments and individual processes to understand the services delivered end to end, their importance and the consequences of disruption. For firms subject to specific operational resilience regulations, the identification of Important Business Services or equivalent critical operations must reflect the applicable regulatory definitions and scope.

3. Impact Tolerances and Resilience Objectives

Impact tolerances establish the maximum tolerable level of disruption to an important business service under the applicable regulatory framework. They help leadership understand when disruption becomes unacceptable and provide a basis for assessing whether existing capabilities are sufficient. Impact tolerances should be distinguished from recovery time objectives, service-level agreements and risk appetite. These measures can support resilience management, but they answer different questions. A credible framework connects impact tolerances to service mapping, scenario testing, recovery capabilities and management action.

4. Dependency Mapping and Vulnerability Assessment

Important business services depend on combinations of people, processes, technology, information, facilities and third parties. Dependency mapping identifies the resources required to deliver each service and the relationships between them. It should extend beyond documenting individual components to understanding shared dependencies, concentration risks, potential single points of failure and vulnerabilities that could create cascading disruption. The objective is to identify where the organisation's ability to deliver important services could be compromised, including where dependencies cross organisational or supplier boundaries.

5. Prevention, Response and Recovery Capabilities

Operational resilience depends on the ability to reduce vulnerabilities, respond effectively when disruption occurs and restore services before consequences become unacceptable. This includes business continuity arrangements, disaster recovery, cyber incident response, operational workarounds, crisis management, communication protocols and third-party contingency arrangements. These capabilities should be coordinated around the recovery of important business services rather than managed solely through individual functional plans. Their effectiveness also depends on the availability of resources, clear decision authority and the ability to adapt when the incident differs from the assumptions underlying existing plans.

6. Scenario Testing and Validation

Scenario testing provides evidence of whether the organisation can remain within its impact tolerances under severe but plausible disruption. Testing should challenge assumptions about the availability of critical resources, recovery capabilities, third-party dependencies and the coordination of different functions.An effective programme considers not technical recovery but also service outcomes, executive decision-making, escalation, communication and the organisation's ability to respond when several dependencies fail simultaneously. Testing findings should inform remediation priorities and provide leadership with a realistic understanding of demonstrated capabilities and remaining limitations.

7. Monitoring, Reporting and Management Information

Operational resilience requires ongoing information about the condition of important services, critical dependencies, vulnerabilities, incidents, testing results and remediation progress. Effective monitoring should help identify deteriorating resilience before a significant disruption occurs, while reporting should enable management and the Board to understand whether resilience capabilities remain appropriate. Useful measures may include service availability, recovery performance, dependency concentration, control effectiveness, unresolved vulnerabilities, scenario-testing outcomes and the progress of material remediation actions. The objective is not simply to produce additional resilience reporting, but to provide information that supports timely intervention, prioritisation and informed decision-making.

8. Continuous Improvement and Organisational Learning

Operational resilience must evolve as the organisation changes and new vulnerabilities emerge. Incidents, near misses, scenario testing, supplier failures, technology changes and operational transformation all provide information about the effectiveness of existing arrangements. A mature framework ensures that these insights lead to meaningful improvements in capabilities, governance, recovery arrangements and the understanding of critical dependencies. This requires more than recording lessons learned. Organisations need to establish whether identified weaknesses have been addressed and whether the resulting changes have improved their ability to withstand future disruption.

How Should These Components Work Together?

The effectiveness of an operational resilience framework depends on the relationships between its components, not simply the maturity of each component individually. For example, an organisation may have identified its important business services and established impact tolerances, but these activities provide limited assurance if dependency mapping does not reflect the actual operating environment or scenario testing does not challenge the assumptions underlying recovery arrangements.

Similarly, a well-designed incident management framework may fail to protect service delivery if response teams lack information about critical dependencies, recovery priorities or the consequences of disruption for customers. An effective framework connects service importance, vulnerabilities, capabilities, testing evidence and management decisions into a coherent approach to resilience.

This connection is particularly important when disruption affects several services or supporting functions simultaneously. Recovery priorities may compete, information may be incomplete and decisions taken in one area may create consequences elsewhere. The framework should support a consolidated view of operational resilience while preserving the specialist expertise required to manage individual risks and recovery activities.

How Can Organisations Assess Whether Their Framework Is Effective?

The existence of policies, mapping exercises, impact tolerance statements and testing programmes provides evidence that an operational resilience framework has been established. It does not necessarily demonstrate that the organisation can achieve its intended resilience outcomes.

A meaningful operational resilience effectiveness assessment should consider five dimensions:

Design: Does the framework address important business services, material dependencies, risks and applicable requirements?
Implementation: Are responsibilities, processes and capabilities established and operating across relevant business functions?
Embedding: Is operational resilience integrated into business decisions, change management, supplier oversight and day-to-day operations?
Demonstrated Effectiveness: Is there credible evidence that the organisation can respond, recover and remain within its impact tolerances under relevant disruption scenarios?
Continuous Improvement: Do incidents, testing results, vulnerabilities and organisational changes lead to measurable improvements in resilience capabilities?

These dimensions help distinguish a framework that is well documented from one that is genuinely capable of supporting operational resilience. A weakness identified during testing does not automatically mean the framework is ineffective. What matters is whether the organisation understands the implications, makes informed decisions about the exposure, addresses material vulnerabilities and can demonstrate improvement. Conversely, the absence of significant incidents or adverse testing results should not be interpreted as evidence of resilience without considering the scope, severity and credibility of the scenarios examined.

The ultimate measure of an operational resilience framework is whether it enables the organisation to understand its vulnerabilities, make informed decisions and demonstrate that its most important services can be protected during disruption.

This provides the foundation for the next stage of operational resilience: identifying which services matter most, understanding the consequences of their disruption and establishing clear accountability for their continued delivery.

Operational resilience framework effectiveness infographic illustrating five assessment dimensions: Design, Implementation, Embedding, Demonstrated Effectiveness and Continuous Improvement. Each dimension highlights key criteria for evaluating resilience capabilities, integration into business operations, recovery performance, scenario testing and organisational learning.

5. Identifying Important Business Services and Critical Operations

Identifying important business services and critical operations is the foundation of an effective operational resilience framework. It enables organisations to determine which services must be protected during disruption, understand the consequences of their failure and prioritise the capabilities and resources needed to maintain their delivery.

The starting point is not simply identifying critical systems, business functions or processes. It is understanding the services the organisation delivers, who depends on them and the consequences if those services become unavailable or materially degraded.

This distinction matters because a service may depend on multiple business functions, technologies, people and third parties. Assessing each component independently may overlook vulnerabilities that only become apparent when considering the service from end to end.

What Is an Important Business Service?

An Important Business Service (IBS), within the UK financial services regulatory framework, is a service provided by a firm to an external end user where disruption could cause intolerable harm to consumers or risk to market integrity, depending on the applicable regulatory requirements.

Other regulatory frameworks use different terminology, including critical or important functions and critical operations. Although these concepts overlap, they are not interchangeable, and organisations should apply the definitions and identification criteria relevant to their regulatory obligations.

Beyond regulatory classifications, the underlying management question remains consistent: which services or operations are sufficiently important that their disruption would create unacceptable consequences?

These consequences may include customer harm, financial losses, interruption of essential activities, legal or regulatory breaches, damage to market functioning or wider operational disruption.

For example, depending on the organisation and its business model, potentially important services or critical operations could include:

Banking and payments: Enabling customers to access funds, make payments or receive essential financial services.
Asset and wealth management: Supporting critical investment transactions, client asset servicing or other activities where disruption could create material customer or market consequences.
FinTech and payment institutions: Providing payment initiation, account information access or transaction processing services.
Healthcare and essential services: Maintaining the delivery of services where interruption could affect safety, welfare or essential access.
Charities and non-profit organisations: Sustaining services where disruption could materially affect vulnerable beneficiaries or the organisation's ability to fulfil critical commitments.

These are illustrative examples rather than automatic classifications. Their importance must be assessed in the context of the organisation, its customers, the consequences of disruption and any applicable regulatory criteria.

How Should Organisations Identify Their Important Business Services?

A structured identification process should begin with the organisation's business model, service proposition and the outcomes delivered to customers or other external stakeholders.

Rather than starting with an inventory of departments, applications or internal processes, organisations should examine how services are delivered and where disruption could create material consequences.

A practical assessment should consider five questions:

What services does the organisation deliver? Identify externally delivered services and, where relevant, critical internal operations that support essential outcomes.
Who depends on these services? Understand the customers, counterparties, beneficiaries, markets and other stakeholders who could be affected.
What would happen if the service were disrupted? Assess the potential severity, scale and duration of harm, including consequences that increase over time.
Which services meet the applicable importance criteria? Apply regulatory definitions where required, alongside the organisation's broader assessment of operational criticality.
Who is accountable for each service? Establish clear ownership of the service, its resilience requirements and the coordination of supporting capabilities.

This assessment should involve business leaders and service owners, supported by operational resilience, risk management, technology, compliance and other relevant functions.

The objective is to establish a defensible and consistent view of service importance, supported by evidence and appropriate management challenge.

Distinguishing Business Services from Processes, Systems and Functions

One of the most common implementation challenges is defining important business services at the appropriate level.

A service defined too broadly may combine several distinct customer outcomes, making it difficult to assess disruption consequences or establish meaningful impact tolerances.

Conversely, defining services too narrowly may create an excessive inventory of individual processes, systems or operational activities without improving the organisation's understanding of resilience.

Consider a payment service.

The end-to-end service may involve customer authentication, payment initiation, fraud screening, transaction processing, settlement arrangements and customer communications. Each activity may be supported by different technologies, teams and external providers.

Identifying these components is essential for dependency mapping, but they should not automatically be classified as separate important business services.

The relevant question is whether the organisation has defined the service at a level that reflects the outcome delivered to the end user and enables the consequences of disruption to be assessed meaningfully.

A well-defined important business service should be sufficiently specific to support impact assessment, accountability and scenario testing, while remaining focused on the service outcome rather than its individual supporting components.

This distinction also helps prevent service inventories from becoming an extension of existing organisational structures.

Assessing the Consequences of Service Disruption

Identifying important services requires an assessment of the consequences of disruption, not simply the probability of an incident occurring.

An event may be unlikely but still produce unacceptable consequences if it affects a sufficiently important service. Equally, frequent interruptions to a less critical activity may not meet the relevant importance criteria, even where they create operational inconvenience or financial cost.

The assessment should consider several dimensions:

Customer and stakeholder harm: The number and characteristics of affected users, including whether vulnerable customers or beneficiaries could experience disproportionate consequences.
Financial and economic consequences: Potential losses to customers, counterparties or the organisation, including disruption to essential transactions.
Legal and regulatory implications: The consequences of failing to meet obligations, including requirements relating to service delivery, customer protection or market integrity.
Market and systemic consequences: Whether disruption could affect other participants, interconnected services or the functioning of relevant markets.
Duration and scale: How consequences develop as disruption continues, including whether harm accelerates after particular thresholds are reached.
Availability of alternatives: Whether customers or the organisation can reasonably use alternative arrangements, and whether those alternatives would remain viable during a widespread disruption.

These considerations should be evaluated collectively rather than through a purely mechanical scoring exercise.

For example, a service affecting a relatively small number of customers may still be important where those customers are particularly vulnerable or the consequences of disruption are severe. Similarly, an organisation may underestimate the importance of a service if it assesses immediate financial losses without considering how customer harm, operational backlogs or market consequences develop over time.

The assessment should examine plausible disruption outcomes and their implications, supported by clear assumptions and documented management judgement.

Establishing Service Ownership and Accountability

Once important services have been identified, organisations need to establish who is accountable for their resilience. This can be challenging because service delivery often crosses several business functions, technology platforms and third-party arrangements. No single team may directly control every dependency required to maintain the service.

Service ownership should therefore establish accountability for the resilience outcome, rather than imply direct operational control over every supporting component.

A business service owner should have sufficient authority, information and access to relevant functions to understand the service's resilience position and coordinate action where vulnerabilities are identified. Responsibilities should include maintaining an understanding of material dependencies, supporting the definition of impact tolerances, reviewing testing outcomes, overseeing remediation and escalating material weaknesses.

Supporting functions retain responsibility for the capabilities they operate, including technology recovery, business continuity, cyber security, supplier management and incident response.

This distinction is particularly important where resilience weaknesses cannot be resolved by one function alone.

For example, addressing a critical third-party concentration may require coordinated decisions involving business leadership, procurement, technology, legal, risk management and executive management. Without clear ownership and escalation arrangements, such vulnerabilities may remain recognised but unresolved.

Keeping Important Business Services Relevant as the Organisation Changes

The identification of important business services should not be treated as a one-off regulatory exercise. Business models evolve, new products are introduced, customer expectations change and operational dependencies become more complex. These developments can alter both the importance of a service and the consequences of its disruption.

Organisations should therefore reassess service classifications when material changes occur, including:

Launching new products or entering new markets.
Changing the customer base or the scale of service delivery.
Introducing or replacing material technology and third-party providers.
Restructuring operations, outsourcing activities or changing service delivery arrangements.
Identifying new vulnerabilities through incidents, scenario testing or emerging risk assessments.

Periodic review should complement these event-driven assessments, ensuring that the service inventory remains aligned with the organisation's actual operating environment. A service that was previously considered non-critical may become important as transaction volumes grow, customer dependency increases or alternative providers become less accessible.

Equally, changes to the business model may reduce the importance of certain activities, allowing resources to be redirected towards more material exposures.

From Service Identification to End-to-End Resilience

Identifying important business services establishes what the organisation needs to protect. It does not, by itself, demonstrate that those services are resilient.

The next challenge is understanding how each service is delivered, which dependencies are essential, where vulnerabilities exist and how disruption could propagate across interconnected activities. This requires connecting service identification with dependency mapping, impact tolerances, scenario testing and recovery arrangements.

For example, two important services may rely on the same cloud infrastructure, specialist team or external provider. Their individual resilience assessments may appear satisfactory, while the organisation remains unable to recover both services simultaneously during a shared dependency failure. The value of service identification lies in making these relationships visible and enabling leadership to prioritise resilience based on the consequences of disruption.

A well-defined inventory of important business services and critical operations therefore provides the foundation for a more connected understanding of operational resilience. It establishes the scope for dependency mapping, supports meaningful impact tolerances and enables organisations to assess whether their recovery capabilities are sufficient to protect the services that matter most.

Website - Operational Resilience_ Payment Service Dependencies.png

Operational resilience infographic illustrating how an important business service, using payment processing as an example, connects customer outcomes to key activities and six supporting dependencies: people, processes, technology, information, facilities and third parties. It highlights how disruption can lead to customer harm, financial losses, regulatory consequences, market disruption and reputational damage.

6. Mapping Dependencies and Understanding Connected Vulnerabilities

Operational resilience depends on understanding not only what an organisation relies upon, but how failures across interconnected dependencies could compromise important business services.

A service may appear resilient when its technology, processes, suppliers and recovery arrangements are assessed individually. Yet these components rarely operate independently. They share infrastructure, information, specialist resources and external providers, creating vulnerabilities that may only become visible when the organisation considers how disruption could spread.

Dependency mapping should therefore move beyond documenting resources to identifying where failures could combine, amplify consequences or undermine recovery capabilities.

What Should Operational Resilience Dependency Mapping Cover?

Dependency mapping connects important business services to the resources and activities required for their end-to-end delivery.

Six areas should be considered:

People: Critical skills, specialist teams, decision-makers and operational capacity.
Processes: Essential activities, controls, handovers and operational workarounds.
Technology: Applications, infrastructure, networks, cloud services and system interfaces.
Information: Critical data, records, access arrangements and information flows.
Facilities: Operational locations, workplaces, data centres and recovery sites.
Third Parties: Outsourced providers, suppliers, subcontractors and external service dependencies.

The objective is not to produce the most detailed possible inventory. It is to identify dependencies that could materially affect service delivery, understand their relationships and establish whether suitable alternatives or recovery arrangements exist.

Why Do Shared Dependencies Create Hidden Vulnerabilities?

The greatest resilience weaknesses often emerge between services, rather than within them.

Consider a payment institution that relies on a common cloud provider for payment processing, customer authentication and operational communications.

Each service may have its own recovery plan and testing programme. However, a disruption affecting the shared infrastructure could compromise all three simultaneously. The organisation may then face competing recovery priorities, limited technical resources and an inability to communicate effectively with customers.

This illustrates three connected vulnerabilities:

Concentration: Several important services depend on the same resource or provider.
Cascading disruption: Failure in one component creates consequences across other activities or services.
Recovery interdependence: Restoring one service depends on resources or capabilities also required elsewhere.

These vulnerabilities can remain hidden when service assessments, supplier oversight and technology recovery are conducted independently.

How Can Organisations Identify and Address Connected Vulnerabilities?

Effective dependency mapping should challenge assumptions about how services operate and recover under disruption.

Five questions are particularly important:

Where are dependencies shared? Identify resources supporting multiple important services, including indirect third-party dependencies.
What happens if they fail simultaneously? Assess combined consequences rather than relying exclusively on individual service scenarios.
Are alternatives genuinely available? Examine whether backup systems, alternative suppliers and manual workarounds can operate within the required timeframe.
Can recovery capabilities cope with competing demands? Consider specialist resources, operational capacity, decision-making and coordination.
What evidence supports resilience assumptions? Use incidents, scenario testing and recovery exercises to validate whether arrangements work in practice.

A documented alternative is not necessarily an effective contingency. For example, a FinTech may have an exit strategy for a critical cloud provider but lack the data portability, technical architecture or operational capability needed to execute it during a major disruption. The existence of an exit plan provides limited assurance unless its feasibility, dependencies and execution requirements have been assessed.

From Dependency Mapping to Better Resilience Decisions

Mapping becomes valuable when it changes how organisations manage vulnerabilities. Findings should inform decisions about technology architecture, supplier concentration, investment priorities, recovery arrangements and the acceptance or remediation of material exposures.

This also requires keeping dependency information current as organisations introduce new services, migrate technology, change suppliers or transform their operating models. Rather than treating mapping as a periodic documentation exercise, material business changes and incident findings should trigger reassessment of affected dependencies.

The measure of effective dependency mapping is not how many relationships have been documented, but whether the organisation can identify where service delivery could fail, understand the consequences and take informed action.

This understanding provides the foundation for establishing meaningful impact tolerances and assessing whether available resilience capacity and recovery capabilities are sufficient to protect important services.

Operational resilience infographic showing how payment processing, customer authentication and customer communications rely on shared dependencies across people, processes, technology, information, facilities and third parties. It illustrates how the failure of a common cloud provider can disrupt multiple services simultaneously, causing customer harm, financial losses, regulatory consequences, operational disruption and reputational damage.

7. Impact Tolerances, Resilience Capacity and Recovery Capabilities

Operational resilience requires organisations to establish how much disruption they can tolerate, understand their actual capacity to withstand it and demonstrate that recovery capabilities are sufficient to protect important business services.

These three elements are closely connected but serve different purposes. Impact tolerances define the boundary of unacceptable disruption, resilience capacity reflects the organisation's ability to absorb and manage disruption, and recovery capabilities determine how effectively services can be restored.

The distinction matters because setting an impact tolerance does not mean an organisation can operate within it. Equally, having recovery plans and technical recovery objectives does not establish that an important business service can be restored before unacceptable harm occurs.

What Is an Impact Tolerance in Operational Resilience?

An impact tolerance defines the maximum tolerable level of disruption to an important business service, expressed in accordance with the applicable regulatory framework. Under the UK FCA and PRA operational resilience regimes, impact tolerances are established for Important Business Services, with time forming a required measure and additional metrics used where appropriate.

Impact tolerances should reflect the consequences of disruption, particularly the point at which harm to consumers or risks to market integrity become intolerable under the applicable rules.

For example, a payment service may experience increasing customer harm as an outage continues. The consequences may depend not only on duration but also on the number of affected customers, transaction volumes, the availability of alternatives and the timing of the disruption.

An impact tolerance establishes the limit the organisation must be capable of remaining within. It is not a statement of how quickly existing systems can currently recover.

This distinction prevents organisations from setting tolerances around their current technical capabilities rather than the consequences of service disruption.

How Do Impact Tolerances Differ from Risk Appetite and Recovery Objectives?

Although these concepts are related, they should not be used interchangeably.

Impact Tolerance: The maximum tolerable disruption to an important business service, determined by the applicable regulatory criteria.
Risk Appetite: The nature and level of risk an organisation is willing to accept in pursuing its objectives.
Recovery Time Objective (RTO): The targeted time within which a system, process or activity should be restored following disruption.
Recovery Point Objective (RPO): The targeted point to which data should be restored, indicating the acceptable extent of potential data loss.
Service-Level Agreement (SLA): A contractual or operational commitment concerning service performance, availability or recovery.

An organisation may establish a two-hour recovery objective for a critical application while setting a different impact tolerance for the important business service it supports. The distinction arises because restoring an application does not necessarily restore the service. Additional activities may be required, including data reconciliation, customer authentication, operational validation or coordination with third parties. Recovery objectives should therefore support the organisation's ability to remain within impact tolerances, rather than being treated as equivalent measures.

What Is Resilience Capacity?

Resilience capacity describes the resources, capabilities and operational flexibility available to absorb disruption, sustain essential activities and support recovery. Unlike impact tolerance, resilience capacity is a broader management concept rather than a universally prescribed regulatory metric.

It encompasses more than technology redundancy or available financial resources. Relevant considerations include:

Operational capacity: The ability of teams, processes and alternative arrangements to manage disrupted activity and increased demand.
Technology capacity: The availability, scalability and resilience of infrastructure, applications and recovery environments.
People and specialist expertise: Access to the skills, decision-makers and operational resources required during disruption.
Third-party capacity: The ability of external providers to maintain services, support recovery and accommodate exceptional demand.
Financial and organisational flexibility: Resources available to sustain operations, implement contingencies and manage prolonged disruption.

Capacity must also be considered across interconnected services. An alternative processing environment may be capable of supporting one important service but insufficient to accommodate several services requiring recovery simultaneously.

This is where shared dependencies and concentration risks become particularly relevant.

How Can Organisations Demonstrate Effective Recovery Capabilities?

Recovery capability should be assessed at the level of the important business service, rather than solely through the restoration of individual systems or processes.

A credible assessment should establish whether the organisation can:

Detect and assess disruption: Recognise incidents, determine their potential consequences and identify affected services.
Activate appropriate responses: Escalate promptly, establish decision authority and coordinate business, technology and third-party actions.
Maintain essential delivery: Use contingency arrangements, alternative resources or operational workarounds where feasible.
Restore services safely: Recover critical activities, validate data and operational integrity, and manage accumulated backlogs.
Demonstrate recovery effectiveness: Test whether these arrangements can operate under severe but plausible conditions and remain within relevant impact tolerances.

Recovery may also require prioritising competing services when resources are constrained. For example, an organisation recovering from a major cloud outage may have sufficient technical resources to restore applications individually but insufficient capacity to recover all affected services simultaneously. Without established priorities and decision rights, recovery activity may become fragmented, delaying restoration of the services where disruption has the greatest consequences.

When Does a Recovery Gap Become a Material Resilience Vulnerability?

A material vulnerability arises when the organisation cannot demonstrate that its available capabilities are sufficient to manage disruption within the relevant impact tolerance. This may result from technical limitations, inadequate operational capacity, untested third-party arrangements, shared dependencies or weaknesses in incident coordination.

Illustrative example of an operational resilience recovery gap:

Impact Tolerance: Four hours of service disruption.
Technical Recovery Objective: Two hours.
Demonstrated Technical Recovery: Three hours.
Additional Operational Reconciliation: Two hours.
Total End-to-End Recovery: Five hours, exceeding the impact tolerance by one hour.

Although the technology is restored within four hours, the end-to-end service recovery takes five hours, exceeding the illustrative impact tolerance. The example demonstrates why technical recovery metrics alone can create an incomplete picture of resilience.

The appropriate response is not necessarily to introduce additional technology. Management should first understand the causes of the gap, which may involve reconciliation processes, operational resources, supplier coordination or recovery sequencing.

The objective is to close the gap between the disruption the organisation must be able to withstand and the recovery performance it can actually demonstrate.

Connecting Impact Tolerances to Resilience Decisions

Impact tolerances become meaningful when they influence investment, operational priorities, scenario testing and decisions about material vulnerabilities. Organisations should use them to challenge whether existing capabilities remain sufficient as services, dependencies and business volumes change.

This includes assessing whether:

Recovery arrangements remain effective under severe but plausible disruption.
Shared resources can support simultaneous service recovery.
Third-party commitments are supported by credible operational capabilities.
Material vulnerabilities have clear owners and proportionate remediation plans.
Scenario testing demonstrates service-level outcomes rather than isolated technical recovery.

Where gaps remain, leadership needs sufficient information to understand their consequences, prioritise improvements and oversee remediation. For firms subject to prescribed impact-tolerance requirements, accepting a vulnerability does not remove the obligation to meet those requirements. Ultimately, impact tolerances establish the required resilience outcome, capacity determines what the organisation can sustain, and recovery capabilities provide the means to restore service delivery.

Their effectiveness can only be established through credible evidence of how these elements perform together during disruption. This makes scenario testing central to demonstrating operational resilience, rather than simply confirming that recovery plans exist.

Operational resilience infographic illustrating the relationship between risk appetite, impact tolerance, resilience capacity and recovery objectives (RTO and RPO). It includes a disruption and recovery timeline showing how technical recovery, end-to-end service restoration and stabilisation relate to impact tolerances, alongside key metrics for assessing recovery performance and protecting important business services.

8. Scenario Testing and Demonstrating Operational Resilience Effectiveness

Scenario testing provides the evidence needed to determine whether an organisation can withstand severe but plausible disruption while protecting its important business services. It connects the assumptions underlying resilience frameworks, dependency mapping, impact tolerances and recovery arrangements with the organisation's ability to perform under pressure.

However, completing a testing programme is not the same as demonstrating resilience. The value lies in what testing reveals about actual capabilities, where those capabilities fall short and whether the findings lead to better decisions and measurable improvements.

From Testing Individual Capabilities to Validating End-to-End Services

Traditional business continuity and disaster recovery exercises often focus on specific systems, processes or recovery procedures. These remain essential, but successful individual tests do not necessarily establish that an important business service can be maintained or restored within its impact tolerance. For example, a technology platform may recover within its target timeframe while the business service remains unavailable because transaction reconciliation, customer authentication or third-party connectivity has not been restored.

Operational resilience testing must therefore consider the combined performance of the resources and capabilities supporting the service. It should also challenge the assumption that recovery arrangements will remain effective when several services compete for the same resources.

What Should Scenario Testing Demonstrate?

An effective testing programme should provide management with evidence across five areas:

Service continuity: Can important business services remain within their impact tolerances under severe but plausible disruption?
Dependency resilience: How do shared dependencies, concentration risks and cascading failures affect service delivery?
Recovery effectiveness: Do contingency arrangements, operational workarounds and recovery capabilities perform as expected?
Decision-making and coordination: Can teams recognise escalating consequences, make timely decisions and coordinate an effective response?
Organisational adaptability: Can the organisation respond when disruption develops differently from the assumptions underlying its plans?

These questions shift attention from whether an exercise was completed successfully to what it demonstrates about the organisation's resilience.

Why Passing a Scenario Test Does Not Necessarily Demonstrate Resilience

A successful test provides assurance only within the boundaries of what was examined. A tabletop exercise may demonstrate that participants understand escalation procedures without establishing whether the underlying technology can recover. A technical failover test may confirm that infrastructure can be restored without demonstrating that business operations can resume safely.

Similarly, a scenario may produce a favourable outcome because it assumes that alternative providers, specialist personnel or communication channels remain available. The credibility of resilience evidence depends on the realism of the assumptions, the scope of the test and the extent to which actual capabilities have been validated.

This does not mean every exercise must reproduce a complete operational failure. Different testing approaches provide different forms of evidence. The important consideration is whether management understands what has been demonstrated and where uncertainty remains.

Turning Testing Results into Management Decisions

The most significant weakness in scenario testing is not necessarily poor scenario design. It is the failure to translate findings into decisions and improvements. An organisation may identify the same recovery constraints across several exercises without addressing the underlying causes. Findings can remain within individual teams, while their combined implications for important business services receive limited management attention.

Testing results should therefore inform:

Vulnerability remediation: Addressing weaknesses that could cause services to exceed impact tolerances.
Investment priorities: Directing resources towards capabilities with the greatest effect on resilience outcomes.
Recovery arrangements: Revising contingency plans, recovery sequencing and operational capacity assumptions.
Governance and accountability: Clarifying decision rights, escalation responsibilities and cross-functional coordination.
Future validation: Establishing whether remediation has improved resilience rather than simply confirming that actions were completed.

This creates a direct connection between scenario testing, risk management and strategic resource allocation.

How Should Boards and Executives Interpret Resilience Testing Results?

Boards and executive management need more than confirmation that scheduled exercises have been completed. They should understand which important services have been tested, the severity and scope of disruption considered, whether impact tolerances were met, and which material vulnerabilities remain.

Equally important is the distinction between demonstrated capability and assumed capability. For example, a recovery arrangement supported by a successful end-to-end exercise provides different evidence from one supported only by a supplier commitment or documented procedure. Reporting should make these distinctions visible so that leadership can assess the reliability of resilience arrangements and prioritise unresolved weaknesses.

The ultimate purpose of scenario testing is to reduce uncertainty about the organisation's ability to protect important services, not simply to increase the number of exercises performed.

Explore Scenario Testing and Impact Tolerance in Greater Detail

Scenario design, testing methods, impact tolerance assessment and evidence requirements warrant more detailed consideration than is appropriate within this broader operational resilience framework. Aevitium's dedicated guide covers these topics, including severe but plausible scenarios, testing approaches, practical examples, governance responsibilities and the evidence needed to support resilience assessments.

Explore the Scenario Testing and Impact Tolerance Guide →

9. Third-Party, Technology and Supply Chain Resilience

Organisations increasingly depend on external providers, technology platforms and interconnected supply chains to deliver important business services. These relationships enable efficiency, innovation and scale, but they also create dependencies that can expose multiple services to disruption beyond the organisation's direct control. Operational resilience therefore requires more than assessing whether individual suppliers are reliable. It requires understanding how external dependencies affect service delivery, whether disruption can be contained and what options remain available when a critical provider fails.

Why Does Third-Party Resilience Extend Beyond Supplier Risk Management?

Traditional third-party risk management focuses on due diligence, contractual obligations, supplier performance, compliance and ongoing monitoring. These activities remain essential, but they do not necessarily demonstrate that an important business service can withstand the failure of a critical provider.

A supplier may meet its contractual commitments and maintain recognised certifications while the organisation remains exposed to material vulnerabilities arising from:

Concentration risk: Several important services depend on the same provider, infrastructure or technology.
Limited substitutability: Alternative suppliers exist but cannot realistically be activated within the required timeframe.
Fourth- and nth-party dependencies: Critical activities rely on subcontractors or infrastructure outside the organisation's immediate visibility.
Recovery interdependencies: Restoring one service depends on the availability or recovery of other systems, providers or operational processes.
Insufficient contingency capacity: Alternative arrangements cannot accommodate the volume or complexity of disrupted activities.

The central question is not simply whether a supplier is adequately controlled, but whether the organisation can continue delivering its important services when that supplier becomes unavailable.

How Do Technology and Supply Chain Dependencies Affect Operational Resilience?

Technology resilience and supply chain resilience are closely connected, particularly where organisations depend on cloud infrastructure, outsourced processing, digital platforms and specialist providers. For example, a financial institution may use separate suppliers for payment processing, fraud detection and customer communications. However, those suppliers may depend on the same cloud infrastructure or telecommunications network.

An incident affecting that shared dependency could disrupt several services simultaneously, even where each supplier has individually demonstrated strong operational controls. The same principle applies beyond technology. Logistics providers, facilities, specialist personnel and outsourced business processes can create dependencies that are difficult to replace during widespread disruption.

Supplier diversification does not necessarily eliminate concentration risk when apparently independent providers share the same underlying infrastructure or subcontractors. Organisations should therefore consider both their direct contractual relationships and the wider ecosystem supporting important business services.

Can Organisations Recover Without Their Critical Third Parties?

A critical consideration is whether an organisation can maintain or restore service delivery when a provider is unable to recover within the required timeframe.

This requires distinguishing between three potential responses:

Continuity: Maintaining essential activities through alternative processes, contingency arrangements or reduced service capacity.
Recovery: Restoring service delivery through the existing provider, infrastructure or operating environment.
Exit or substitution: Transferring services to another provider, bringing activities in-house or implementing a different delivery model.

These options are not interchangeable.

For example, a cloud exit strategy may be appropriate for prolonged provider failure or strategic withdrawal, but it may be impossible to execute quickly enough to address a short-term service disruption. Similarly, contractual exit rights do not establish that data can be transferred, applications reconfigured or alternative infrastructure activated within an acceptable timeframe.

The practical question is whether contingency, recovery and exit arrangements are credible under the circumstances in which they might be needed.

What Should Organisations Monitor to Identify Emerging Third-Party Vulnerabilities?

Supplier monitoring should provide early warning of conditions that could undermine service resilience, rather than focusing exclusively on contractual performance.

Relevant indicators include:

Deteriorating service availability, incident frequency or recovery performance.
Increasing concentration across critical services or shared infrastructure.
Changes to subcontracting arrangements, technology architecture or service locations.
Financial, operational or regulatory developments affecting provider viability.
Reduced recovery capacity, untested contingency arrangements or unresolved vulnerabilities.
Changes in business volumes or service criticality that exceed existing supplier capabilities.

Monitoring becomes particularly valuable when indicators are connected to predefined escalation and management actions. A deterioration in supplier performance may justify enhanced oversight, additional contingency capacity, accelerated remediation or reassessment of exit options before service failure occurs.

Who Remains Accountable When Critical Services Are Outsourced?

Outsourcing transfers the performance of activities, but it does not remove the organisation's responsibility for managing the resulting risks and service outcomes. This principle is particularly relevant to regulated financial institutions, where applicable outsourcing, operational resilience and third-party requirements establish expectations for oversight and accountability.

The UK's Critical Third Parties regime also recognises that certain providers can create risks across the financial system. However, direct oversight of designated providers does not replace individual firms' responsibility for understanding and managing their dependencies.

Effective governance requires coordination between business service owners, technology, procurement, risk management and third-party oversight functions. Leadership should have a clear understanding of which external dependencies could compromise important services, whether recovery arrangements are credible and where vulnerabilities require investment or management intervention.

Third-party resilience is ultimately measured by the organisation's ability to protect service delivery despite external disruption, not simply by the quality of its supplier management documentation.

Explore Third-Party Risk Management and Resilience in Greater Detail

The following Aevitium resources provide practical guidance on the governance, monitoring, regulatory expectations and exit arrangements that support third-party resilience.

Operational resilience infographic illustrating how important business services depend on interconnected third-party providers, cloud infrastructure, technology, telecommunications, subcontractors and supply chains. It highlights how shared dependencies can cause cascading disruption, customer harm, financial losses and regulatory consequences, alongside five resilience priorities: dependency mapping, monitoring, contingency planning, scenario testing and governance.

10. Incident Management: From Detection to Recovery and Learning

Operational resilience is tested when disruption occurs. The effectiveness of incident management depends not only on how quickly an organisation responds, but on whether it recognises the wider consequences, coordinates decisions and restores important business services before disruption becomes intolerable.

Incidents rarely remain confined to the function where they originate. A technology failure can disrupt customer services, create operational losses, trigger regulatory obligations and expose weaknesses in third-party arrangements.

An effective incident management framework must therefore connect technical response, business continuity, risk management, compliance and executive decision-making throughout the incident lifecycle.

What Does an End-to-End Incident Management Lifecycle Include?

Incident management should operate as a connected process, from the earliest indication of disruption through recovery, remediation and organisational learning.

The core stages are:

Detection and identification: Recognise incidents and emerging warning signals, including information from internal operations, technology monitoring and external providers.
Assessment and classification: Determine severity, affected services, potential customer harm, operational consequences and applicable reporting obligations.
Escalation and coordination: Activate the appropriate response structure, assign decision authority and coordinate affected functions and third parties.
Containment and continuity: Limit further disruption while maintaining essential activities through contingency arrangements where possible.
Recovery and stabilisation: Restore services, validate operational integrity, address backlogs and confirm that normal service delivery can safely resume.
Investigation and remediation: Establish root causes, identify contributing control and governance weaknesses, and address underlying vulnerabilities.
Learning and improvement: Translate findings into changes to resilience capabilities, risk assessments, scenario testing and management oversight.

These stages are not necessarily sequential. Impact assessment, escalation, regulatory reporting and recovery often need to progress simultaneously as new information becomes available.

Why Do Connected Incidents Create Greater Management Challenges?

An isolated incident may be managed effectively within a single operational function. Connected incidents require a broader understanding of how disruption propagates across services, systems and organisational boundaries. Consider a technology outage affecting payment processing. The initial incident may be identified and managed by IT, but its consequences can quickly extend to customer authentication, transaction settlement, customer communications and regulatory reporting.

Different teams may assess the same event through separate frameworks, each with its own classifications, escalation criteria and reporting processes.

This creates three significant vulnerabilities:

Fragmented visibility: No single function has a complete picture of the incident's consequences.
Conflicting priorities: Technical recovery decisions may not reflect customer harm, service criticality or business recovery requirements.
Delayed escalation: Information reaches decision-makers at different times, reducing their ability to intervene before consequences increase.

An integrated incident management approach does not require every specialist process to be identical. It requires consistent information, connected assessments and coordinated decisions across those processes.

How Should Incident Management Connect to Impact Tolerances?

Impact tolerances provide an important reference point when assessing disruption to important business services.

Incident teams should understand not only the current severity of an event but also how its consequences may develop if recovery is delayed. For example, an incident may initially appear manageable because financial losses are limited and technical recovery remains possible. However, the projected duration of service disruption may indicate that the organisation is approaching its impact tolerance.

This requires forward-looking assessment of:

Which important business services are affected or potentially exposed.
How disruption duration, customer harm and other consequences are developing.
Whether recovery estimates remain credible.
Which dependencies or resource constraints could delay restoration.
When additional management intervention or contingency arrangements are required.

Effective escalation should occur while management still has meaningful choices, rather than only after a tolerance has been exceeded.

How Do Regulatory Incident Reporting and Operational Response Connect?

Regulatory reporting is an important component of incident management, but it serves a different purpose from operational response. The organisation must establish whether an incident meets applicable notification thresholds, gather sufficiently reliable information and communicate with regulators within the required timeframes.

These activities depend on effective incident identification, classification, information sharing and governance.

A fragmented incident management framework can therefore create both operational and regulatory vulnerabilities. Different functions may hold incomplete information about the same event, delaying assessment or producing inconsistent reporting.

Regulatory notification should be integrated into the incident lifecycle without diverting resources unnecessarily from containment, customer protection and service recovery.

What Does Effective Post-Incident Learning Look Like?

Closing an incident does not necessarily mean that the organisation has addressed the vulnerabilities it revealed.

A technical root cause analysis may explain why a system failed without identifying why escalation was delayed, why alternative arrangements were ineffective or why several services depended on the same point of failure.

Effective post-incident reviews should consider three dimensions:

The initiating failure: What caused the incident, and which preventive or detective controls were ineffective?
The organisational response: How well did assessment, escalation, coordination, communication and recovery decisions work?
The resilience implications: What did the incident reveal about dependencies, capacity, impact tolerances and the ability to maintain important services?

Findings should be assessed collectively, particularly where similar weaknesses recur across incidents or functions.

The objective is to improve the organisation's ability to recognise, respond to and recover from future disruption, rather than simply demonstrate that corrective actions have been completed.

An incident management framework becomes a resilience capability when the organisation can demonstrate that experience leads to stronger controls, better decisions and more reliable service recovery.

Explore Incident Management and Operational Resilience in Greater Detail

These Aevitium articles examine the regulatory, operational and organisational dimensions of effective incident management.

11. Governance, Accountability and Decision-Making Under Disruption

Operational resilience depends on more than effective controls, recovery arrangements and documented responsibilities. It requires governance that enables organisations to make timely, informed decisions when disruption creates uncertainty, competing priorities and potentially significant consequences for customers and important business services.

Governance frameworks establish accountability and oversight. Their effectiveness becomes visible when an organisation must act under pressure, often before the full nature or consequences of an incident are understood.

The challenge is to preserve decision quality while conditions evolve, rather than allowing uncertainty, organisational boundaries or excessive approval requirements to delay necessary action.

What Does Effective Operational Resilience Governance Require?

Effective governance connects Board oversight, executive accountability and operational decision-making without concentrating every decision at senior management level.

The respective responsibilities should be clear:

Board and governing body: Oversee the organisation's resilience strategy, material vulnerabilities, impact tolerances and evidence of operational resilience effectiveness.
Executive management: Allocate resources, resolve competing priorities and remain accountable for addressing material resilience weaknesses.
Important business service owners: Understand service dependencies, recovery capabilities and the consequences of disruption.
Operational and incident response teams: Assess emerging conditions, activate contingency arrangements and make decisions within delegated authority.
Risk, compliance and assurance functions: Provide independent challenge, assess exposure and support regulatory obligations and oversight.

The objective is not to introduce additional governance layers. It is to ensure that authority, information and accountability remain connected from the operational frontline to executive leadership.

How Should Decision-Making Work Under Disruption?

During an incident, decisions must often be made with incomplete or conflicting information. Recovery estimates may change, suppliers may provide uncertain updates and different functions may prioritise competing outcomes. Waiting for complete certainty can allow disruption to escalate, while acting without sufficient challenge can introduce further vulnerabilities.

Effective decision-making therefore requires:

Clear decision rights: Defined authority to activate contingency arrangements, prioritise recovery and commit resources.
Timely information: Visibility of affected services, developing consequences, recovery estimates and material uncertainties.
Explicit assumptions: Recognition of what is known, what remains uncertain and which conditions underpin the chosen response.
Constructive challenge: Opportunities to question recovery estimates, proposed actions and emerging conclusions.
Decision review: Agreed triggers for reconsidering decisions as circumstances change.

These disciplines allow organisations to act with sufficient confidence while retaining the flexibility to adapt.

Why Can Governance Delay Rather Than Enable Recovery?

Formal governance can become a vulnerability when escalation arrangements are unclear, decision authority is fragmented or approval requirements are disproportionate to the urgency of the situation. For example, a business service owner may recognise that an alternative processing arrangement is needed to protect customers, but lack authority to activate it. If the decision must pass through several committees or senior executives, the available recovery window may narrow before action is taken.

The opposite weakness is equally important. Excessive decentralisation can result in individual functions making locally appropriate decisions that undermine enterprise-wide recovery priorities. Effective governance balances delegated authority with clear boundaries, coordinated oversight and escalation when consequences exceed those boundaries.

This requires organisations to test decision-making arrangements during disruption scenarios, rather than assuming that governance structures designed for normal operations will remain effective under pressure.

How Does Leadership Behaviour Influence Operational Resilience?

The quality of information reaching decision-makers depends partly on how leaders respond to uncertainty, challenge and bad news. Early warning signals may be incomplete, operational teams may disagree about likely consequences and recovery estimates may deteriorate as an incident develops.

Where leaders expect certainty before concerns are escalated, valuable time can be lost. Similarly, defensive reactions to emerging problems can discourage people from sharing information that challenges the prevailing assessment. Resilient leadership creates conditions in which concerns are raised early, assumptions can be questioned and decisions are revised when new evidence emerges.

This is particularly important during prolonged disruption, when maintaining a previous course of action may become less appropriate as circumstances change.

How Can Boards Assess Governance Effectiveness?

Boards should look beyond the existence of governance committees, incident procedures and reporting structures. A more meaningful assessment examines whether governance improves organisational outcomes.

Five questions are particularly relevant:

Can material disruption be escalated before important business services exceed their impact tolerances?
Are decision-makers receiving a connected view of service consequences, dependencies and recovery options?
Can competing recovery priorities be resolved without unnecessary delay?
Are decisions and their underlying assumptions reviewed as new information becomes available?
Do scenario tests and actual incidents demonstrate that governance arrangements work under pressure?

The answers provide insight into whether governance supports operational resilience or simply documents accountability.

Ultimately, operational resilience governance is effective when it enables the right decisions to be made, challenged and implemented while meaningful options remain available.

Explore Governance, Leadership and Decision-Making in Greater Detail

These Aevitium resources explore the wider leadership and governance disciplines that support effective decisions under uncertainty.

From Operational Resilience Assessment to Implementation

The depth of review required will depend on the organisation's existing resilience capabilities, regulatory obligations and operational complexity. Some may need a focused assessment of impact tolerances, critical dependencies, scenario testing or recovery arrangements. Others may require broader improvements spanning governance, important business services, third-party resilience, incident management and operational capabilities.

Aevitium's Operational Resilience Pathway™ supports organisations through this process, from assessing current capabilities and identifying material vulnerabilities to designing, implementing and validating improvements. The emphasis is on demonstrating resilience in practice, strengthening the ability to withstand, respond to and recover from disruption, rather than simply establishing regulatory compliance or additional documentation.

Explore Aevitium's Operational Resilience Advisory Services →

Operational resilience illustration showing a row of wooden dominoes, with a gold shield protecting the remaining blocks from a cascading failure. Symbolising how effective operational resilience helps organisations anticipate disruption, protect critical services, maintain business continuity, recover from incidents and adapt to emerging risks.

12. Measuring Operational Resilience Maturity and Effectiveness

An operational resilience framework may be well documented, supported by established governance and aligned with regulatory expectations without necessarily demonstrating that the organisation can withstand and recover from disruption.

Measuring operational resilience therefore requires two complementary perspectives: the maturity of the organisation's resilience capabilities and evidence of how effectively those capabilities perform in practice. Maturity assessments identify weaknesses in the design, implementation and embedding of resilience arrangements. Effectiveness assessments examine whether those arrangements deliver the intended outcomes, including protecting important business services, coordinating decisions and sustaining recovery under operational pressure.

What Is the Difference Between Operational Resilience Maturity and Effectiveness?

Maturity and effectiveness answer different questions:

Maturity: How well developed, implemented and embedded are the organisation's resilience arrangements?
Effectiveness: Do those arrangements enable the organisation to withstand, respond to and recover from disruption within its impact tolerances?

An organisation may have mature policies, comprehensive dependency mapping and regular testing programmes, yet still experience significant recovery failures. Conversely, it may demonstrate effective recovery from a particular incident while relying on informal processes, specialist individuals or arrangements that are difficult to sustain.

Neither perspective provides a complete assessment on its own.

A comprehensive evaluation should consider three complementary aspects of operational resilience:

Framework and Control Maturity: Whether governance, important business services, impact tolerances, dependencies, controls and recovery arrangements are appropriately designed, implemented and embedded.
Crisis Response Capability: Whether leadership, escalation, information flows, decision-making and coordination mechanisms remain effective during disruption.
Organisational Resilience Capacity: Whether the organisation can absorb operational pressure, sustain essential activities, manage cascading disruption and adapt during prolonged uncertainty.

Together, these perspectives distinguish the existence of resilience arrangements from the organisation's ability to operate effectively when those arrangements are tested.

How Should Operational Resilience Maturity Be Assessed?

A structured maturity assessment should examine five connected dimensions:

Design: Are important business services, impact tolerances, material dependencies, governance arrangements and recovery requirements appropriately defined?
Implementation: Have the necessary controls, resources, contingency arrangements and recovery capabilities been established?
Embedding: Are resilience considerations integrated into operational decisions, technology change, supplier oversight and business planning?
Demonstrated Effectiveness: Is there credible evidence from scenario testing, incidents and recovery exercises that resilience arrangements work under disruption?
Continuous Improvement: Do testing results, incidents, emerging vulnerabilities and changes in the operating environment lead to measurable improvements?

These dimensions help distinguish weaknesses in framework design from problems arising during execution. For example, an organisation may have a well-designed incident management framework but experience delayed escalation because responsibilities are poorly understood or decision-making becomes centralised under pressure. The weakness may therefore lie in how the framework operates rather than its underlying design.

Aevitium's Five-Level Operational Resilience Maturity Model

Aevitium applies a consistent five-level maturity scale across its Integrated Risk Management and Operational Resilience assessment methodologies. This provides a common approach to evaluating capabilities while recognising the distinct objectives and requirements of each discipline.

Level 1 – Initial: Resilience arrangements are fragmented, reactive and heavily dependent on individuals. Coordination and recovery capabilities are limited.
Level 2 – Emerging (Managed): Basic governance, response and recovery arrangements exist, but their application and effectiveness remain inconsistent under operational pressure.
Level 3 – Defined: Resilience responsibilities, processes and recovery arrangements are established, consistently applied and supported by repeatable response capabilities.
Level 4 – Quantitatively Managed: Resilience performance is measured and validated against defined objectives and impact tolerances. Evidence informs recovery priorities, resource allocation and management decisions.
Level 5 – Optimising: Resilience capabilities are continuously refined through testing, learning and forward-looking analysis. The organisation adapts its resources, coordination and decisions to sustain operations during prolonged uncertainty and disruption.

The maturity levels are cumulative. More advanced capabilities should build on established foundations rather than compensate for weaknesses in governance, implementation or operational execution. The assessment considers not only whether resilience arrangements exist, but also how consistently they operate, how their effectiveness is demonstrated and whether the organisation can adapt as disruption intensifies.

Which Metrics Demonstrate Operational Resilience Effectiveness?

Effective measurement requires a combination of leading indicators, operational performance measures and evidence of actual resilience outcomes.

Service Resilience: Important business services operating within impact tolerances; duration and severity of service disruption.
Recovery Capability: Actual versus targeted recovery times; end-to-end service restoration time; recovery capacity under concurrent disruption.
Dependency Resilience: Material single points of failure; concentration exposures; critical dependencies without validated alternatives.
Scenario Testing: Coverage of important business services; material vulnerabilities identified; successful validation of remediation.
Incident Management: Time to detect, assess and escalate incidents; time to activate contingency arrangements; recurring incident causes.
Third-Party Resilience: Critical provider recovery performance; unresolved supplier vulnerabilities; effectiveness of contingency arrangements.
Leadership and Decision-Making: Timeliness of critical decisions; effectiveness of delegated authority; delays arising from unclear accountability or competing priorities.
Coordination and Information Flow: Time required to establish a shared understanding of disruption; effectiveness of cross-functional coordination and communication.
Organisational Adaptability: Ability to sustain operations under prolonged pressure; effectiveness of alternative arrangements; capacity to reallocate resources as conditions change.
Continuous Improvement: Overdue material remediation actions; recurrence of previously identified weaknesses; demonstrated improvements following testing.

These measures should not be interpreted independently. Faster incident detection may indicate improved monitoring, but it does not necessarily demonstrate effective recovery. Similarly, a high percentage of completed scenario tests provides limited assurance if testing does not challenge material vulnerabilities.

The value of resilience metrics lies in their ability to reveal whether capabilities are improving, where important services remain exposed and whether the organisation can maintain effective coordination and judgement under pressure.

Why Can Operational Resilience Metrics Create False Confidence?

Measurement can become misleading when organisations prioritise activity completion over resilience outcomes.

Common examples include:

Reporting the percentage of recovery plans reviewed without validating whether they can be executed.
Measuring technical system availability without considering end-to-end service disruption.
Treating successful tabletop exercises as evidence of demonstrated recovery capability.
Reporting remediation closure without confirming that the underlying vulnerability has been addressed.
Measuring incident response speed without assessing decision quality or coordination.
Aggregating resilience scores in ways that conceal material weaknesses affecting individual important business services.

A particularly important limitation is the use of a single enterprise-wide maturity score. While an overall assessment can help communicate progress, it may obscure critical differences between services, capabilities and organisational functions. Strong performance across most of the organisation does not compensate for a material vulnerability affecting an important business service.

Resilience reporting should therefore preserve visibility of material service-level weaknesses and distinguish between documented capabilities, demonstrated effectiveness and assumptions that remain unvalidated.

How Can Organisations Measure Progress Over Time?

Operational resilience assessments should establish both the current state and the improvements required to achieve the intended resilience outcomes.

This involves examining:

Current Capability: What arrangements exist, how consistently are they applied and what evidence supports their effectiveness?
Material Gaps: Which weaknesses could compromise important business services, undermine coordination or prevent the organisation from remaining within impact tolerances?
Target Capability: What level of resilience is required, considering service criticality, operational complexity and applicable regulatory obligations?
Improvement Priorities: Which actions will produce the greatest reduction in material vulnerabilities and strengthen organisational resilience?
Validation: What evidence will demonstrate that improvements have strengthened actual resilience?

Progress should be assessed through changes in capability and outcomes, rather than simply the completion of planned activities. For example, implementing an alternative cloud recovery arrangement represents progress in capability. Demonstrating that it can restore an important business service within its impact tolerance provides stronger evidence of effectiveness.

Equally, introducing a revised crisis governance structure represents a design improvement. Demonstrating that it enables timely decisions, effective coordination and appropriate delegation during disruption provides evidence that the change is embedded and effective.

What Should Boards and Executives See in Operational Resilience Reporting?

Boards and executive management need a clear view of whether the organisation can protect its important business services and where material uncertainty remains.

Effective reporting should distinguish between:

Demonstrated Resilience: Capabilities supported by credible testing or incident evidence.
Assumed Resilience: Arrangements supported primarily by plans, contractual commitments or unvalidated assumptions.
Known Vulnerabilities: Material weaknesses, their potential consequences, ownership and remediation progress.
Emerging Exposures: Changes in technology, business activity, third parties or operating conditions that may affect resilience.
Organisational Response Capacity: The ability to sustain coordination, decision-making and recovery under increasing operational pressure.
Management Decisions Required: Investment, prioritisation, risk reduction or strategic choices needed to strengthen resilience.

This enables leadership to challenge the reliability of existing arrangements and direct resources towards the areas where disruption could have the greatest consequences. The ultimate measure of operational resilience is not the maturity of the framework itself, but the organisation's demonstrated ability to protect important services, sustain effective decisions and adapt when its operating assumptions are challenged.

How Does Aevitium Assess Operational Resilience Maturity and Effectiveness?

Aevitium's Operational Resilience Maturity Assessment evaluates three complementary dimensions: Framework and Control Maturity, Crisis Response Capability and Organisational Resilience Capacity.

The methodology combines a structured assessment of resilience arrangements with an evaluation of how effectively organisations coordinate, make decisions and recover under disruption.

From an initial digital diagnostic to a more detailed evidence-based assessment, the approach identifies material vulnerabilities, establishes current and target maturity, and prioritises improvements to strengthen operational resilience.

Explore Aevitium's Operational Resilience Maturity Assessment →

Operational resilience maturity assessment infographic illustrating Aevitium's three assessment dimensions: Framework and Control Maturity, Crisis Response Capability, and Organisational Resilience Capacity. It presents five maturity levels, from Initial to Optimising, and a four-stage improvement process: Assess, Prioritise, Strengthen and Validate, connecting resilience assessment with measurable improvements in organisational effectiveness.

13. Regulatory Expectations and Implementation Challenges

Operational resilience regulation has shifted the emphasis from establishing policies and recovery plans towards demonstrating that organisations can continue delivering important services through severe but plausible disruption.

Although regulatory requirements differ across jurisdictions, a common expectation is emerging: organisations should understand their critical services, identify the dependencies that support them, establish appropriate resilience objectives and demonstrate that their response and recovery capabilities are effective.

For organisations operating across multiple jurisdictions, the challenge is to meet these requirements through a coherent resilience framework without creating overlapping governance structures, duplicated assessments or disconnected reporting processes.

What Are the Main Operational Resilience Regulatory Requirements?

Regulatory approaches share common principles, but their scope, terminology and specific obligations differ.

United Kingdom, FCA and PRA: The UK operational resilience framework requires firms in scope to identify important business services, establish impact tolerances, map dependencies and conduct severe but plausible scenario testing. The transition period ended on 31 March 2025, making the ability to remain within impact tolerances an ongoing requirement.
European Union, Digital Operational Resilience Act (DORA): Applicable since 17 January 2025, DORA establishes requirements covering ICT risk management, incident reporting, digital operational resilience testing, ICT third-party risk and information-sharing arrangements. Its focus on digital resilience complements, but is not identical to, the UK's service-led framework.
Third-Party and Sector-Wide Resilience: Regulatory oversight increasingly recognises the systemic consequences of concentrated dependencies, including critical technology providers. Organisations must still manage their own operational resilience obligations when relying on external services.

These frameworks should be interpreted according to each organisation's regulatory perimeter, operating model and jurisdictions.

What Are the Most Common Operational Resilience Implementation Challenges?

The principal challenge is no longer simply establishing the required framework. It is maintaining credible evidence that resilience arrangements remain effective as organisations, technologies and external dependencies evolve.

Common difficulties include:

Defining Important Business Services: Identifying meaningful service boundaries and distinguishing customer outcomes from internal processes or systems.
Establishing Defensible Impact Tolerances: Demonstrating how thresholds reflect intolerable harm rather than existing recovery capabilities.
Understanding Connected Dependencies: Identifying concentration risks, shared infrastructure and vulnerabilities extending across functions and third parties.
Demonstrating Recovery Effectiveness: Moving beyond technical recovery tests to validate end-to-end service restoration under severe but plausible disruption.
Integrating Governance and Accountability: Connecting operational response, risk oversight, technology, compliance and executive decision-making.
Maintaining Reliable Evidence: Ensuring self-assessments, testing results, incident learning and remediation records support credible management conclusions.
Managing Regulatory Overlap: Aligning related requirements without assuming that compliance with one framework automatically satisfies another.

These challenges are reflected in the FCA's supervisory observations, including its March 2026 review of firms' operational resilience self-assessments. The regulator continues to emphasise clear methodologies, credible testing, effective vulnerability management and evidence of ongoing improvement.

How Can Organisations Move from Regulatory Compliance to Demonstrated Resilience?

A proportionate approach should build on existing risk management, business continuity, technology, incident management and third-party oversight arrangements rather than automatically introduce separate processes.

The priority is to establish whether these capabilities work together to protect important business services.

This requires organisations to:

Assess existing capabilities against applicable regulatory requirements and intended resilience outcomes.
Identify material vulnerabilities that could compromise service delivery or recovery.
Prioritise improvements according to service criticality, potential consequences and demonstrated capability gaps.
Validate effectiveness through scenario testing, operational evidence and incident learning.
Embed continuous review into governance, business change and ongoing management oversight.

For UK-regulated firms, the written operational resilience self-assessment is particularly important. It should provide Boards and supervisors with a coherent account of important business services, impact tolerances, vulnerabilities, testing evidence and remediation priorities.

Regulatory compliance establishes the obligations an organisation must meet. Operational resilience effectiveness demonstrates whether its capabilities can deliver the required outcomes when disruption occurs.

This distinction is central to moving from periodic compliance exercises towards resilience as an embedded organisational capability.

Frequently Asked Questions About Operational Resilience

These questions focus on implementation decisions, organisational trade-offs and emerging challenges not addressed in detail in the main guide.

1. Should organisations centralise operational resilience or delegate it to business functions?

A hybrid model is generally more effective. Central oversight provides consistent standards, challenge and enterprise-wide visibility, while business and service owners remain accountable for resilience within their areas. The critical consideration is whether responsibilities, escalation arrangements and decision rights remain clear during disruption.

2. How should operational resilience influence investment and budget decisions?

Resilience investment should reflect the consequences of service disruption, the significance of identified vulnerabilities and the effectiveness of existing capabilities. This helps organisations distinguish necessary improvements from expenditure that adds complexity without materially strengthening resilience. Investment decisions should also consider shared dependencies and the benefits delivered across multiple services.

3. Can an organisation become less resilient as it grows or transforms?

Yes. Growth, acquisitions, outsourcing, automation and technology transformation can introduce new dependencies faster than resilience capabilities develop. Organisations may become operationally more efficient while simultaneously increasing concentration risk, reducing flexibility or creating additional recovery complexity.

4. How should organisations manage operational resilience during mergers, acquisitions or major transformations?

Resilience considerations should be integrated into due diligence, integration planning and change governance. Particular attention should be given to inherited dependencies, incompatible recovery arrangements, transitional operating models, overlapping suppliers and the potential for disruption during migration. Resilience should be evaluated throughout the transformation, rather than only after implementation.

5. What role should artificial intelligence play in operational resilience?

Artificial intelligence can support monitoring, anomaly detection, dependency analysis and incident investigation. However, its introduction may also create additional technology dependencies, model risks and challenges around explainability and human oversight. Organisations should assess both how AI strengthens resilience capabilities and how failures involving AI-enabled processes could affect service delivery.

6. How can organisations avoid operational resilience becoming an expensive compliance exercise?

By integrating resilience requirements into existing governance, risk management, technology, procurement and change processes. Activities should be assessed against their contribution to service continuity, recovery and organisational adaptability. Where reporting, controls or testing activities do not improve decisions or provide meaningful assurance, their purpose and design should be reconsidered.

7. How should operational resilience influence product development and business strategy?

Resilience should be considered when designing new services, entering markets, selecting technology architectures and evaluating outsourcing decisions. Strategic choices determine future operational dependencies and recovery options. Addressing resilience during design is generally more effective than attempting to remediate structural vulnerabilities once services are established.

8. How can organisations balance operational efficiency with resilience?

Efficiency initiatives often seek standardisation, consolidation and reduced redundancy, while resilience may require alternative capabilities, spare capacity or operational flexibility. These objectives are not inherently incompatible, but their trade-offs should be explicit. Leadership should understand when efficiency improvements increase exposure to common failures or reduce the organisation's ability to respond to disruption.

Operational Resilience

1. What Is Operational Resilience?