Operational Resilience
Operational resilience is the ability of a firm to prevent, adapt to, respond to, recover from, and learn from disruptions to important business services. The PRM exam tests whether you can distinguish resilience from traditional operational risk: resilience is outcome-focused and assumes severe disruption, while operational risk often focuses on causes and capital.
Core rules
- Identify important business services and set impact tolerances, expressed as maximum acceptable disruption to customers and markets.
- Map end-to-end dependencies: people, premises, technology, data, processes, and third parties, including fourth parties.
- Test severe but plausible scenarios, not just historical events; record vulnerabilities and remediation owners.
- Govern through board accountability, incident escalation, and lessons learned.
Worked example
A retail bank’s instant payment service has an impact tolerance of two hours. A severe-but-plausible cloud-region outage disables authentication and settlement for six hours. The gap is four hours. Mapping shows a single identity provider and no manual fallback. The correct reasoning is not to rewrite the BCP only; the firm should reduce dependency concentration, add a tested failover, define manual payment limits, and set a remediation date approved by the board. Residual risk must be reported against the tolerance.
Traps
- Treating recovery time objective (RTO) as impact tolerance: RTO is an internal recovery target; tolerance is the customer/market harm limit.
- Assuming a documented BCP proves resilience.
- Ignoring third- and fourth-party concentration and data integrity.
- Testing only plausible past incidents.
- Leaving remediation unowned.