You may have heard the terms 'operational resilience' and 'business continuity' used fairly interchangeably, but there are distinct differences between the two practice areas, check out this article for a breakdown. You can also read a quick overview of Organizational Resilience, here.
What is Operational Resilience and Why does it matter?
After a series of financial crises and near-banking crises, operational resilience has belatedly become a key corporate objective. But what is operational resilience, anyway?
Too often, key stakeholders aren’t certain. They consider operational resilience a mere extension or appendage of the business continuity programs that they’ve had around for decades now.
This lack of awareness of what operational resilience is is a key problem in the corporate world. For one, despite their similarities, there are clear differences between operational resilience and business continuity.
Indeed, it was the absence of operational resilience that contributed directly to numerous corporate crises and disruptive events, most notably the Financial Crisis of the late 2000s and the more recent collapse of Silicon Valley Bank.
Given the stakes in deploying effective operational resilience programs, we’ve decided to pen this blog that tackles the question of what operational resilience means, exactly.
Not just that, the blog also addresses (1) why operational resilience is important, (2) the four stages of operational resilience, (3) the differences between operational resilience and organizational resilience, (4) the rise of operational resilience regulations, and (5) how to improve your business operations with operational resilience management software.
What does Operational Resilience mean?
So, what is operational resilience, anyway?
The industry-standard answer comes unsurprisingly from the world of financial services regulation. After all, that’s where operational resilience first emerged.
The Bank of England (BoE), one of the most important financial services regulators, defines operational resilience as the ability of firms to absorb and adapt to shocks and disruptions, rather than contribute to them.
Although the BoE is referring to financial firms under its purview, that clear and concise definition of operational resilience – the ability of firms to absorb and adapt to shocks and disruptions, rather than contribute to them – has been adopted all over.
Why is Operational Resilience important?
Understanding what operational resilience is helps to explain why operational resilience is so important. So, why is operational resilience important?
Business leaders are aware of how crisis-laden the world has become.
Operational risks loom large. The pressing threats businesses must address now include the pandemic and associated crises, such as the supply shock, mental health and wellbeing crisis, and acute rise in cyberattacks.
Meanwhile, more traditional setbacks in business operations aren’t going away. Systems have always malfunctioned; severe weather events have always occurred; and other local disasters have always surfaced.
Sure, global pandemics are Black Swan events, but those other forms of disruptions have been happening more frequently, as well.
In this context, operational resilience is important, because it’s all about proactively anticipating, preventing, responding to, recovering from, as well as adapting to these adverse disruptions, so that your business doesn’t go under.
The four stages of Operational Resilience
How then do businesses achieve the requisite level of operational resilience to prevent them from going under?
Well, they have done so by building the capability to proactively anticipate, prevent, recover from, and adapt to adverse disruption. Those four elements constitute the four stages of operational resilience or the operational resilience lifecycle.
In practice, the four stages of operational resilience work like this:
1. Preparation
At this stage, businesses identify the most likely events that could adversely disrupt – not just merely inconvenience – their operations based on their risk profile. For instance, a retailer in a high crime area would have to identify theft as a likely source of disruption.
2. Prevention
Once the risk or risks have been identified, organizations, at this stage, create preventive strategies to manage them. Of course, levels of resilience achieved through preventive strategies will inevitably vary. Simple issues like IT system failures, for instance, can be mitigated through redundancy and automation.
3. Response and recovery
Organizations develop preventive strategies so they can put them into practice should an event occur. That’s because at the stage when an event does occur, organizations will have to put their preventive strategies into action promptly.
4. Adaption
The final stage of operational resilience comes after addressing an incident. That’s when a thorough review of the successful elements of the implemented plan becomes essential. At this stage, organizations consider making necessary adjustments for future preparedness.
What is the difference between operational resilience and organizational resilience?
If those sound like the stages of organizational resilience or crisis management, they aren’t despite sharing the same basic framework.
So, what are the differences between operational resilience and organizational resilience that you need to know to get the former capability up and running?
Well, organizational resilience deals more broadly with the ability of an enterprise to absorb change and adapt to a new environment.
Operational resilience has different mechanisms that support the basic capability. Unlike with organizational resilience, these mechanisms include initiatives that expand business continuity management programs to focus on the impacts, connected risk appetite, and tolerance levels for disruption of product or service delivery to internal and external stakeholders.
The rise of Operational Resilience regulations
We know about these mechanisms in operational resilience, because regulators have detailed what constitutes operational resilience.
Other regulators have taken up the path paved by the BoE. For instance, the Australian Prudential Regulation Authority (APRA) released draft Prudential Standard CPS 230, focusing on operational risk management and operational resilience. The U.S. Federal Reserve released a joint regulatory paper on Sound Practices to Strengthen Operational Resilience.
And in the EU, the Digital Operational Resilience Act (DORA) seeks to align the approach to managing ICT and cyber risk.
However, there’s no reason to believe that these regulations will remain cloistered in financial services. What’s more, organizations, irrespective of their industry, should want to develop operational resilience capabilities given the larger risk environment. But how?
Improve operations with Noggin's Operational Resilience Software
That’s where operational resilience software comes in handy. Noggin’s own operational resilience software makes best-practice operational resilience and business continuity easy. With Noggin, you say goodbye to the headaches of manual processes and hello to a cutting-edge platform that empowers you to stay agile, responsive, and always one step ahead of challenges. Noggin also helps to ensure you follow and comply with best practices and regulations such as ISO 22301, DORA, BoE, FCA, and CPS 230.
Keen to learn more about Noggin Resilience? Check out our best practice operational resilience and business continuity management software capabilities.
.svg)
.svg)
.svg)