The latest report from the Business Continuity Institute (BCI), on operational resilience, sponsored by Riskonnect, points to ‘a steady rise in the number of organizations developing and maintaining resilience’.
The authors point to regulatory requirements such as, in the European Union, under the Digital Operational Resilience Act (DORA); the Australian APRA CPS 230 standard; and, in the UK, financial services and Bank of England operational resilience requirements. Most practitioners, the study found, regularly deal with up to five sets of compliance requirements. Such programmes, then, are for showing commitment to best practices and the need to comply with regulations, rather than for commercial benefits.
Definition
While a definition of operational resilience is still evolving, some viewing it as a ‘natural evolution’ of business continuity, according to the report, it’s ‘the identification of high-priority services and suppliers, enabling a clearer understanding of potential risk scenarios and their consequences’. Most members when surveyed agreed that operational resilience is centred on customer and market impacts, distinguishing it from business continuity, which is generally more internally focused. Measures may include exit planning, successor planning for critical roles, regular top-management reviews, and the use of proactive tools to assess potential impacts. As for who has oversight, the BCI found it’s typically the Business Continuity Manager (BCM), though the world is seeing the rise of dedicated resilience job titles roles such as the Head of Resilience and Operational Resilience Manager.
Concern
A recurring concern among practitioners, according to the report, ‘is the lack of dedicated resources and outdated infrastructure’, which hinder embedding resilience; besides dependencies on third-party suppliers that may lack adequate resilience.
What they say
Maria Garcia, Thought Leadership Manager at the BCI, said that data shows that resilience is no longer just a compliance exercise, but a strategic imperative. She said: “As awareness of the importance of operational resilience practices grows, the role of resilience professionals evolves and cross-functional collaboration becomes the norm, we’re seeing the emergence of a more integrated, proactive approach to resilience.”
About the BCI
You can freely download the report from the BCI website; you have to register first. Visit https://www.thebci.org. Next week is the BCI’s Business Continuity Awareness & Resilience Week; more on this link.
Photo by Mark Rowe: Twickenham Stadium.
