Operational resilience is the ability to keep delivering critical services during disruption, not only to recover after it. The term came from financial regulators and is spreading into other sectors.
How it differs from business continuity
Continuity management answers how the company returns to work after a stoppage. Operational resilience puts the question more sharply: how do we ensure the service is not interrupted beyond a tolerable point at all, even when part of the system has failed.
Three practical differences follow. The unit of analysis is the service as the client sees it, not an internal process. Planning starts from the assumption that disruption will happen rather than from preventing it. And a maximum tolerable level of disruption is declared — the point beyond which harm to clients and the market is unacceptable.
The underlying concepts are covered in business continuity and the difference between management layers in BCM, BCP and DRP.
What it consists of in practice
- A list of important business services. Services delivered outward, not internal processes. Usually between five and fifteen.
- A map of what each service depends on. People, systems, sites, suppliers, data — an extension of the register of critical processes.
- An impact tolerance. The maximum duration and scale of disruption the company deems acceptable for the client.
- Severe but plausible scenarios. Not "could this happen" but "assume it has" — see the continuity stress test.
- Third-party dependencies. The weakest part for most companies, covered in losing a supplier.
Where to start
You do not need a separate programme for a new term. Add two things to the work you already do: the client's view of the service, and a declared impact tolerance for each important service. The management frame is provided by ISO 22301, and regulatory minimums by the requirements covered in regulatory continuity requirements.
FAQ
Is operational resilience the same as business continuity? No. Continuity answers how to recover after a stoppage. Resilience requires the service not to be interrupted beyond a tolerable point and plans from the assumption that disruption will occur.
Is it mandatory? As a standalone regime it applies mainly to regulated financial firms. The underlying logic is useful to any company.
Where do we start? List the services that matter to clients and state a maximum tolerable disruption for each. Then map what those services depend on.