Operational Resilience
Operational resilience is a firm's ability to prevent, adapt to, respond to, recover from, and learn from disruptions so that important business services continue within impact tolerances. The exam tests the distinction from business continuity, service identification, impact tolerances, dependency mapping, scenario testing, and governance of remediation.
Core rules and concepts
- Basel's Principles for Operational Resilience (2021) cover governance, business continuity, mapping, third-party dependency management, incident management, ICT and cyber resilience, change management, scenario testing, and situational awareness.
- UK PRA/FCA rules use important business services and impact tolerances; the EU's DORA imposes digital operational resilience requirements.
- Impact tolerance is the maximum tolerable disruption to an important business service, often time-based. It is not an RTO, which is an internal recovery target.
- Mapping covers people, process, technology, facilities, and third parties, exposing concentration and single points of failure.
- Scenario testing uses severe but plausible events; third-party contracts need notification, continuity, and exit provisions.
Worked example
A retail bank sets a four-hour impact tolerance for retail payments. Mapping shows the payment API depends on one cloud region and a card processor without tested failover. In a severe-but-plausible cloud outage at peak, internal systems recover in two hours (the RTO), but the processor reroute takes six hours. The gap is against the four-hour tolerance, not the RTO. Remediation: add a second processor route, test failover, and report residual risk to the board risk committee.
Traps that cost marks
Confusing tolerance with RTO; treating resilience as only cyber; ignoring fourth parties; labelling every service important; having plans without testing or board oversight.