Operational Resilience

For years, organizations prepared for disruption by writing plans for specific scenarios, such as a fire at the head office or a data center outage. Then a series of events, including large cyberattacks, cloud outages, supply chain shocks and the COVID-19 pandemic, showed that disruptions are often unexpected, widespread and long-lasting. Operational resilience shifts the question from how to recover from a particular event to how to keep delivering what customers and the wider economy depend on, whatever happens. It assumes that disruptions will occur and focuses on limiting the harm they cause. This shift from prevention alone to tolerance and recovery is the core of the idea.

Financial regulators have led the way. The UK's Prudential Regulation Authority and Financial Conduct Authority published operational resilience rules in 2021, requiring firms to identify their important business services, set impact tolerances and show they can stay within them. The Basel Committee published principles for operational resilience the same year, and the EU's Digital Operational Resilience Act has applied since January 2025. The ideas now extend well beyond banking. For risk, operations, IT and business leaders, operational resilience brings business continuity, disaster recovery, cyber security and third-party risk together around the services that matter most.

Definition of Operational Resilience

Operational resilience is the ability of an organization to deliver critical operations through disruption, by identifying and protecting itself from threats and potential failures, responding and adapting to disruptive events, and recovering and learning from them, so that the impact on customers, markets and the organization stays within acceptable limits.

It builds on the business continuity plan and disaster recovery plan, extends operational risk management and is required for EU financial firms under the Digital Operational Resilience Act.

Core Concepts

Important business services are the services an organization provides to external customers or users whose disruption could cause intolerable harm to those users, to the organization or to the wider market. Examples include making payments, processing insurance claims or dispensing medicines. Services are defined from the user's point of view, not by internal departments or systems.

Impact tolerances set the maximum acceptable level of disruption to each important business service, often expressed as a maximum time, such as no more than two days without the ability to make payments. Tolerances describe the point at which harm becomes intolerable, not the point at which service becomes inconvenient.

Mapping identifies the people, processes, technology, facilities, information and third parties that each important service depends on.

Scenario testing checks whether the organization could stay within its impact tolerances under severe but plausible disruptions, such as a major cyberattack or the failure of a key supplier.

How Operational Resilience Differs From Business Continuity

Business continuity traditionally focuses on recovering internal processes and sites after specific events. Operational resilience focuses on end-to-end services delivered to customers.

Business continuity often starts from internal recovery objectives. Operational resilience starts from the harm that disruption causes to customers and markets.

Operational resilience assumes that disruption will happen and tests the ability to stay within tolerance under severe scenarios, rather than only recovering from expected ones.

Operational resilience also brings together cyber security, third-party risk management, technology and continuity into a single view.

Importance of Operational Resilience in Risk and Compliance

Operational resilience protects customers. Focusing on important services makes sure that the activities customers depend on most are protected first.

It improves preparedness for the unexpected. Testing against severe but plausible scenarios reveals weaknesses that plans for specific events can miss.

It also meets regulatory expectations. Regulators in financial services, and increasingly in other critical sectors, expect firms to demonstrate that they can withstand disruption.

Operational Resilience and Financial Management

Mapping important services shows where resilience spending will do the most good, such as removing single points of failure in a critical payment chain.

Impact tolerances provide a clear standard for judging whether further investment in redundancy, recovery or alternative suppliers is needed.

Resilience investments can reduce the cost of disruption, including lost revenue, customer compensation, regulatory penalties and recovery costs.

Concentration on a small number of technology providers may lower costs but increase resilience risk, a tradeoff that finance and risk teams should weigh together.

Common Challenges

Mapping end-to-end services across many systems, teams and suppliers is complex and time-consuming. Maps also need regular updates as systems and suppliers change.

Setting impact tolerances requires judgment about customer harm, which can be difficult to agree. Customer data, complaint history and input from front-line staff can help ground the discussion.

Scenario tests may reveal that the organization cannot stay within tolerance, requiring significant investment to close the gap. Regulators generally expect firms to be open about such gaps and to show a credible plan to close them.