Sequencing a new operational resilience framework
Meridian Health Services, a 6,000-employee hospital group, has appointed its first head of operational resilience. The group has 8 business units, 3 regulators, 120 critical third parties and an existing business continuity plan owned by facilities management. There is no service inventory, no consistent impact analysis and no board-level resilience appetite. The CEO wants a full operational resilience management framework covering every service, every supplier and every site within 12 months. The CFO has approved a budget for four full-time staff and a GRC tool. The head has found that two business units already run mature incident management, while three have not tested a plan in two years. The board risk committee meets quarterly and expects a one-page maturity dashboard. The regulator has signalled that it will inspect governance and important business service mapping next year.
1. Design a 12-month sequencing plan. What will you do in the first 90 days, and what will you deliberately not do?
Read the worked answer
First 90 days: establish the spine, not the whole body.
- Secure an executive sponsor and terms of reference for a resilience committee linked to enterprise risk management and the board risk committee.
- Agree a risk-based scope: identify important business services using harm criteria, rather than declaring all services equally important. Run the method in two contrasting units-one mature, one weak-to test it.
- Draft a policy and a board appetite statement with measurable statements (for example, tolerance breaches, testing coverage, third-party concentration).
- Build a data inventory from existing sources: incident logs, supplier contracts, process maps, regulatory returns. Do not wait for a perfect configuration database.
- Set a baseline maturity assessment and a one-page dashboard.
- Assign service owners.
Deliberately not do: deep-dive all 120 suppliers; roll out a bespoke tool before the process is stable; test every service; or promise full coverage in 12 months. Those create activity without assurance.
Why: four full-time staff cannot cover eight units at equal depth. The regulator is inspecting governance and important business service mapping first. A pilot produces evidence and a repeatable method; a big-bang programme produces templates that business units ignore.
2. The CEO insists on including every service and every supplier. How do you respond, and what criteria would you use to define the framework's scope?
Read the worked answer
Acknowledge the intent-resilience should not have blind spots-but explain proportionality. The framework can cover all services and suppliers, but depth must be risk-based. Otherwise the programme will produce uniform paperwork and miss the services that can harm customers.
Scope criteria for important business services: potential harm to customers (financial loss, access, safety), harm to market integrity, regulatory breach, financial loss to the firm, and reputational damage. Use thresholds and evidence, and review annually or after major change.
Supplier tiering: critical if it supports an important business service, holds sensitive data, or cannot be substituted within the impact tolerance. Tier 1 gets due diligence, contract levers, exit planning and testing; tier 2 gets lighter monitoring; tier 3 gets periodic review.
For the remaining services, apply a lighter baseline: incident reporting, dependency register and annual attestation. This gives coverage without pretending every service needs the same analysis. Put the scope decision and rationale in board papers so the CEO can see the risk trade-off.
3. What should the one-page maturity dashboard contain to be useful to the board risk committee?
Read the worked answer
One page, decision-useful, with trends and asks. Suggested rows:
- Important business service coverage: percentage mapped, with owners and tolerance status.
- Tolerance gaps: number of services where current capability exceeds tolerance, with severity and remediation date.
- Testing: percentage of services tested in the last 12 months, percentage of tests that met their objective, and number of repeat findings.
- Third parties: critical suppliers, concentration, overdue exit plans, open assurance actions.
- Incidents: material incidents and near misses, time to restore, tolerance breaches.
- Remediation: open actions by age, percentage overdue, and funding requested.
- Culture: near-miss reports per 100 staff, speak-up cases, training completion.
- Maturity trend: a simple scale with movement and evidence.
Avoid counts of plans, policies or training slides. The board should see where it must decide: accept risk, fund remediation, or change appetite. Add a short 'what changed since last quarter' and 'decisions required' box. The dashboard should be traceable to the framework, not a separate reporting exercise.