Operational resilience for midsize companies
A practical starting point for identifying critical operations, testing disruption scenarios and prioritizing resilience improvements.
Facultas Advisory · Originally published
Revised edition
Start with what must keep working
Operational resilience concerns the ability to sustain critical operations through disruption and recover when needed. It complements operational risk management and business continuity. It does not promise uninterrupted service or eliminate every risk.
Map the dependencies
Choose a critical service and identify the people, systems, premises, information and suppliers needed to deliver it. Examine common dependencies: two suppliers may still rely on the same infrastructure. Set clear accountability for the service and its supporting capabilities.
Test a difficult but useful scenario
Consider a prolonged technology outage, loss of a key supplier or unavailable premises. Define the disruption the organization can tolerate, test response arrangements and identify where evidence is missing. Include communications, workarounds and recovery decisions.
Prioritize the next improvements
Assign owners and dates to the most consequential gaps. Revisit the assessment after significant changes and exercises. OSFI’s E-21 is a useful financial-sector reference; its supervisory scope should not be treated as a legal requirement for every midsize business.
Reference
OSFI / BSIF — E-21 (opens in a new tab)
This website provides general information about Facultas Advisory and its services. Its content is not professional advice for any particular circumstances; advice requires an agreed engagement scope.