In June 2023, Chris Moran and I ran a round table and webinar on the subject of Operational Resilience Maturity for financial services firms.
In the events, we suggested that by the end of Q2 2024 firms should be working towards alignment of Operational Resilience with Response and Recovery domains, such as Business Continuity Management, IT Disaster Recovery and Crisis and Incident Management.
Several firms from those sessions are underway with alignment programmes and the value of establishing those links has quickly become evident.
We’ve outlined five of those benefits below for firms thinking of tackling a similar project.
- Risk Assessments and Business Impact Assessments have naturally synced to prioritising recovery of Important Business Services with the development of specific IBS-recovery tactics and playbooks. These tactics and playbooks document likely threats and can be used to create efficiencies by synchronised scenario testing and recovery testing.
- Alignment of service mapping between recovery and resilience programmes, provides a complete view of operational resilience, and recovery, threats, and vulnerabilities. In firms where alignment has yet to take place, in scenario testing we’ve seen firms state that system recovery would need to take place in order to restore an Important Business Service either without testing the recovery capability of that resource or leaving the testing to another department and relying on information sharing to ensure recovery capability.
- Incident categorisation models and invocation criteria have been aligned or redeveloped to ensure common ground across business and IT incidents.
- Similarly, previously department-led asset classification definitions have been aligned or recreated to ensure that relevant domains classify resource criticality in the same way.
- Alignment has usually meant that firms have designed an streamlined governance structure. These firms have found that escalation paths are simplified leading to smoother, more informed and more timely decision making to respond to outages, incidents, or remediation activity.
- In the best practice examples, firms with aligned domains are developing their resilience by design capability. These firms have gone beyond resilience, response, and recovery alignment to include wider domains, such as change management.
How FourthLine can help
If you'd like to understand how our enablement and full delivery approaches may help you align your operational resilience programme with your BCM and ITDR programmes, enquire here or book a time with one of our consultants here now
