Lead Operational Resilience Manager study plan

Define operational resilience and distinguish it from related disciplines such as business continuity, disaster recovery, enterprise risk management, and crisis management, writing a one-line differentiator for each

Explain the concept of important business services and how impact tolerances differ from risk appetite statements

Map the regulatory and standards landscape (Basel Committee principles, FCA/PRA-style expectations, DORA, NIST, ISO 22301 and ISO 27001 families) at a level sufficient to compare their core obligations

Identify the roles of the governing body, senior accountable owner, and business service owner in an operational resilience programme

Describe the end-to-end lifecycle of an operational resilience management framework, from scoping through continuous improvement

Draft a scope statement that identifies critical operations, legal entities, and geographic perimeters

Distinguish maturity models from compliance checklists and select an appropriate maturity scale for a mid-size firm

Explain how resilience objectives cascade from strategy into service-level tolerances

Build a governance structure with clear decision rights across first, second, and third lines

Design an impact tolerance-setting methodology including severity scales and maximum tolerable disruption windows

Sequence a 12-month implementation roadmap with dependencies, owners, and quick wins

Identify the artefacts a framework needs, such as a service inventory, dependency map, and tolerance register

Construct a business impact analysis that links processes to important business services and their tolerances

Map critical dependencies for a sample service across people, premises, technology, data, and suppliers

Explain how cyber resilience practices (detection, response, recovery, and backup integrity) plug into the operational resilience framework

Distinguish recovery time objectives, recovery point objectives, and maximum tolerable disruption, and reconcile them for one service

Design a scenario-testing approach that exercises severe-but-plausible disruptions rather than routine outages

Evaluate third-party concentration risk and define criticality tiers for vendors

Draft contractual and due-diligence requirements for critical suppliers, including exit and substitution options

Explain how to assess a supplier's own resilience posture through evidence rather than questionnaires alone

Design a resilience culture programme that moves beyond awareness training into measurable behaviours

Define culture indicators such as near-miss reporting rates, escalation speed, and challenge behaviour in governance forums

Plan communication and training for executives, service owners, and front-line staff with differentiated content

Identify levers for embedding resilience into performance management and incentives

Design a testing programme that combines desktop exercises, simulation, live failover, and red-team-style scenarios

Write test objectives, success criteria, and severity thresholds for a single exercise

Define remediation tracking, root-cause analysis, and lessons-learned processes after an exercise or incident

Select metrics and key indicators that evidence resilience posture to a board or regulator

Synthesize all domains into a single integrated resilience narrative suitable for a board paper

Critique a weak framework design and propose specific improvements with justification

Complete timed practice questions weighted by domain percentage and review every error against source concepts

Build a personal exam-day strategy covering question triage and time allocation