What is Operational Resilience?
Operational resilience refers to a company’s ability to respond, adapt, withstand, and recover from potential disruptions, including natural disasters, cyberattacks, technical malfunctions, and power outages. Strengthening your organization’s resilience is not just about protecting against disruptions; it’s also about creating a robust, adaptable, and forward-thinking organization.
Notable Benefits
Here are the notable benefits of operational resilience:
- Improved risk management – Implementing resilience strategies allows companies to anticipate potential issues and mitigate their impact.
- Improved business continuity – Operational resilience strengthens business continuity by reducing disruptions and keeping critical functions running smoothly.
- Compliance with existing regulations – Depending on the industry, businesses are required to have operational resilience plans in place. Having operational resilience ensures that businesses are compliant with applicable regulations and helps them avoid fines and other legal liabilities.
- Competitive advantage – Companies that are operationally resilient often tend to outperform competitors, especially during large-scale natural disasters. Gaining this upper hand is essential in maintaining market share and driving business growth.
- Agility and adaptability – A resilient organization continuously prepares for future uncertainties and enhances its business agility, allowing it to adapt to every challenge and constantly evolve with the changing business landscape.
Improve your GRC management
Pillars of Operational Resilience
Operational resilience is a critical concept for organizations aiming to withstand disruptions and maintain essential functions. To do so, businesses should focus on the following operational resilience pillars:
The Essential Pillars of Operational Resilience | SafetyCulture
- Employee Resilience – involves equipping staff with skills through operational resilience training and support to adapt to and recover from disruptions.
- Technology Resilience – is the implementation of robust IT infrastructure and security measures to safeguard against cyber threats and system failures.
- Facilities Resilience – focuses on maintaining and securing physical infrastructure to withstand and recover from natural disasters, accidents, or other disruptions.
- Financial Resilience – involves having the financial strategies and reserves in place to absorb shocks and sustain operations during economic disruptions.
- Governance Resilience – ensures that robust policies, procedures, and oversight are in place to guide the organization through crises and maintain regulatory compliance.
- Culture Resilience – fosters an organizational mindset that values adaptability, continuous learning, and proactive risk management, enabling the company to thrive amid challenges.
Best Practices
Operational resilience has become a critical focus for businesses aiming to survive and thrive amid uncertainties. Whether facing cyber threats, natural disasters, or economic downturns, resilient operations ensure that companies can continue to deliver essential services.
1. Conduct a comprehensive risk assessment.
Systematically identifying potential threats is the first step towards resilience. Assess all risks across your business areas, including IT systems, machinery, and human resources. Then, identify vulnerabilities and prioritize them based on their severity.
2. Establish clear KPIs.
Key performance indicators (KPIs) are a staple in any business strategy, including operational resilience. These metrics enable the organization to gauge its performance against industry standards or historical data by highlighting which areas need to be improved. They help operations managers make informed decisions and enhance the company’s overall resilience.
3. Develop a robust business contingency plan.
A contingency plan outlines the procedures and instructions a business should follow in case of emergency. Depending on the identified possible risks, this documented set of processes can inform employees on what to do in matters such as safety protocols and business continuity.
4. Engage employees.
Involve employees in the discussion as you craft your operational resilience framework. Encourage your employees to ask questions and give suggestions as this opens up communication about potential risks and solutions. This openness also fosters a culture of resilience that helps employees understand their role during times of crisis.
5. Leverage technology and automation.
Enhance operational resilience by automating routine tasks, leveraging machine learning and artificial intelligence, and using Internet of Things (IoT) devices for real-time monitoring. These technologies boost productivity, improve customer experience, and ensure smooth operations even on normal business days.
6. Train and develop employees.
Training and development are vital for building a resilient workforce capable of achieving operational resilience in the face of challenges. By investing in your employees’ skills and preparedness, organizations can create a robust foundation for enduring and thriving through disruptions.
7. Regularly review and improve your strategies.
Operational resilience is an ongoing process, so it’s best to stay updated on the latest resiliency trends. Regularly review your strategies and make improvements based on new insights and technologies and feedback from employees and stakeholders.
Operational Resilience Regulations and Standards
Various regulations and standards globally address operational resilience, focusing on different industries and concerns. Here’s a list of some operational resilience requirements:
| Category | Name of Regulation/Standard | Overview |
| Financial Sector | Basel III | Set by the Basel Committee on Banking Supervision (BCBS), includes
guidelines for risk management and operational resilience in banks |
| EU Digital Operational Resilience Act (DORA) | Aims to ensure that financial institutions in the EU can withstand and respond to cyber threats and other disruptions | |
| Federal Financial Institutions Examination Council (FFIEC) Guidelines | Provides guidelines for IT and operational resilience for financial institutions in the United States | |
| Bank of England’s Operational Resilience Policy | Framework to enhance the resilience of the UK’s financial system | |
| Operational Resilience Guidelines by the U.S. Federal Reserve | Specific guidelines issued by the Federal Reserve to enhance the resilience of financial institutions | |
| Sarbanes-Oxley Act (SOX) | A U.S. regulation that includes requirements for internal controls and auditing | |
| General Data Protection | EU General Data Protection Regulation (GDPR) | While primarily focused on data protection, this includes requirements for ensuring data availability and resilience |
| Critical Infrastructure | NIST Cybersecurity Framework (CSF) | A voluntary framework providing guidelines for improving cybersecurity and operational resilience for critical infrastructure in the US |
| Information Security | ISO/IEC 27001 | An international standard for information security management systems (ISMS),
touching aspects of operational resilience |
| Business Continuity | ISO 22301 | International standard for business continuity management systems, focusing on maintaining and improving resilience |
| Risk Management | ISO 31000 | Provides guidelines on risk management, which is a core component of operational resilience |
| IT Governance | COBIT (Control Objectives for Information and Related Technologies) | Framework for managing and governing enterprise IT and ensuring that IT supports operational resilience |
| Cybersecurity | Cybersecurity Information Sharing Act (CISA) | Encourages sharing of cybersecurity threat information between private companies and the government to enhance resilience |
| EU Network and Information Systems (NIS) Directive | Aims to improve the overall level of cybersecurity in the EU |
FAQs about Operational Resilience
Business continuity focuses more specifically on the immediate response and recovery processes to maintain operations during and after a disruption. Meanwhile, operational resilience is a much broader and proactive approach. It involves not only planning for specific incidents but also building the overall capacity to withstand and respond to various unforeseen challenges, risks, and disruptions.
The board and executive team are accountable for defining strategic direction and priorities for operational resilience. They set the tone, allocate resources, and ensure resilience is embedded in the company’s strategy.
Oftentimes, companies assign a chief risk officer who works closely with senior leaders to ensure that the resilience considerations are integrated into business processes.
The frequency of reviewing may vary based on factors like business nature, regulations, and risk profile. Many companies choose annual reviews as a standard practice. However, a dynamic work environment or significant changes in the organization may need more frequent reviews.
Conducting periodic drills, simulations, or post-incident reviews can provide valuable insights for refining and updating the plan as needed. Keep in mind that the purpose of the review is to take a proactive approach to operational resilience.
While operational resilience benefits companies, implementing it is not without its challenges that often include:
- Lack of executive support
- Resource constraints
- Resistance to change
- Technology challenges
Ramon Meris
