Planning the Operational Resilience Management Framework
What this domain tests
This domain tests framework design: how a lead manager turns resilience intent into a governed, repeatable management system integrated with risk, continuity, technology, and third-party processes. Questions often ask which component is missing or who owns what.
Core rules
- A framework needs board-approved policy, clear accountabilities, an IBS inventory, impact tolerances, mapping, a scenario library, a testing programme, incident and crisis arrangements, third-party oversight, metrics, and assurance.
- Governance must be explicit: the board sets appetite and receives evidence; an accountable executive owns delivery; business service owners own tolerances; the second line challenges; internal audit provides independent assurance.
- The framework is an operating cycle, not a binder. Plan, map, test, remediate, report, and refresh on a defined calendar and after material change.
- Integrate rather than duplicate: use existing BIA, risk register, vendor risk, cyber incident, and change management data, but reconcile definitions so IBS and impact tolerances are consistent.
- Metrics should measure outcomes: tolerance breaches, remediation ageing, dependency concentration, test coverage, and third-party criticality.
Worked example
An insurer’s framework has policies and a BIA but no impact tolerances. The lead manager maps IBS to systems, sets tolerances with business owners, adds a scenario library, and schedules tests. Board reporting moves from “BCP plans updated” to “percentage of IBS tested against tolerance and open remediation.” The gap was not documentation; it was outcome measurement and accountability.
Traps
- Writing a framework that only the second line uses.
- Confusing BCP ownership with IBS ownership.
- Setting an annual review cycle that ignores trigger events such as outsourcing or platform migration.
- Overbuilding a new system instead of integrating existing risk and continuity processes.
- Reporting activity counts rather than tolerance and remediation outcomes.