Striving for Operational Resilience: The Questions Boards and Senior Management Should Ask

Welcome to Your Journey into Operational Resilience!

Hello there! If you’ve been studying for FRM Part II, you’ve likely spent a lot of time learning how to prevent risks. But let’s be real: in the modern world, things will go wrong. Cyberattacks happen, power grids fail, and global pandemics occur. This chapter, "Striving for Operational Resilience," marks a shift in thinking. Instead of just asking "How do we stop this from happening?", we start asking, "How do we keep our most important services running when the worst happens?"

Don't worry if this feels a bit different from the math-heavy sections of the curriculum. This is all about strategy, governance, and common sense. Let’s dive in!

1. What is Operational Resilience? (The "Absorb and Recover" Mindset)

In the past, banks focused on Operational Risk Management—trying to minimize the frequency and severity of losses. Operational Resilience is broader. It is the ability of a firm to provide its critical business services even during a major disruption.

Analogy Time: Imagine a professional boxer.
Operational Risk Management is the boxer’s training to dodge punches (avoiding risk).
Operational Resilience is the boxer’s ability to take a heavy hit to the jaw, stay on their feet, and keep fighting (absorbing and recovering).

Key Difference: Risk vs. Resilience

Operational Risk: Focuses on the cause (e.g., a system failure) and the loss (e.g., money lost).
Operational Resilience: Focuses on the service (e.g., can customers still withdraw money?) and the continuity.

Quick Review: Resilience assumes that disruptions will happen. It focuses on the survival of the service, not just the prevention of the event.

2. The Role of the Board and Senior Management

Operational resilience isn't just an IT issue; it’s a leadership issue. The Board of Directors and Senior Management are responsible for setting the tone. They don't need to know how to fix a server, but they must ask the right questions to ensure the firm is prepared.

The "Big 5" Questions for Leadership

To ensure resilience, the Board should be asking these five fundamental questions:

Question 1: What are our "Critical Business Services"?

A bank does a thousand things, but not all are equal. If the "Employee Suggestion Portal" goes down, it’s fine. If the "Real-Time Gross Settlement System" goes down, the economy could freeze.
Definition: A critical service is one that, if disrupted, would cause intolerable harm to customers or the financial system's stability.

Question 2: What is our "Impact Tolerance"?

This is the "pain threshold." For every critical service, the Board must decide: How much disruption can we handle before it’s a disaster?
Impact tolerance is usually measured in time (e.g., "This service cannot be down for more than 4 hours").

Question 3: Have we mapped our dependencies?

Mapping means identifying every person, piece of technology, building, and third-party vendor required to deliver a critical service. If you don't know that your payment system relies on a specific small vendor in another country, you aren't resilient!

Question 4: Are we testing against "Severe but Plausible" scenarios?

Testing shouldn't be easy. Banks should simulate scenarios that are bad but possible—like a total cloud provider outage or a coordinated cyberattack on all branches.
Common Mistake: Only testing for "likely" scenarios. Resilience requires testing for the "extreme."

Question 5: How do we communicate during a crisis?

When things go wrong, silence is the enemy. Management needs a plan to talk to regulators, customers, and employees quickly and clearly.

Key Takeaway: The Board’s job is to move resilience from a "tech checkbox" to a "strategic priority."

3. Defining Impact Tolerances (The "Time and Severity" Metric)

Setting an Impact Tolerance is one of the most important parts of this chapter. It is different from "Risk Appetite."

Risk Appetite: "We are willing to lose \$10 million to fraud this year." (Focus on the firm's health).
Impact Tolerance: "Customers must be able to access their accounts within 2 hours of a system failure." (Focus on the service and the customer).

How to set Impact Tolerance:

1. Identify the service (e.g., Mortgage processing).
2. Determine the point of "Intolerable Harm" (e.g., if it's down for 3 days, people lose their homes because they can't close on time).
3. Set the limit (e.g., "Must be recovered within 24 hours").

Did you know? Regulators (like the Bank of England or the Fed) look closely at these tolerances. If a bank sets its tolerance too high (e.g., "We can be down for a week"), regulators will likely step in and demand a better plan!

4. Mapping: The "Plumbing" of Resilience

To protect a service, you have to know how it works from start to finish. This is called Mapping.
A "Map" includes:

• People: Who are the key staff? Do we have backups if they are sick?
• Processes: What are the step-by-step instructions?
• Technology: What hardware and software are used?
• Data: Where is the information stored?
• Third Parties: Which external vendors are involved?

Memory Aid: Think of the acronym P-P-T-D-T (People, Processes, Technology, Data, Third-Parties). These are the pillars of every service.

Key Takeaway: Mapping helps identify Single Points of Failure. For example, if one specific software programmer is the only person who knows how to run the clearing system, that’s a massive resilience risk!

5. Testing and Lessons Learned

Once you have your critical services, your impact tolerances, and your maps, you must test them.

Severe but Plausible Scenarios:
Management should ask: "What happens if our main data center is flooded at the same time that our head of IT is on a plane with no Wi-Fi?"
The goal isn't to "pass" the test; the goal is to find out where the system breaks so it can be fixed before a real crisis happens.

The Feedback Loop

Resilience is a cycle:
Test -> Fail -> Learn -> Improve -> Repeat.
Every disruption (real or simulated) should lead to a "lessons learned" report for the Board.

Common Mistake to Avoid: Don't assume that because you have a Disaster Recovery (DR) plan, you are resilient. DR is often just about "backing up data." Resilience is about "keeping the business running."

6. Summary and Final Check

Let's wrap up what we've learned. Operational Resilience is a shift in focus from prevention to recovery.

Quick Review Box:
1. Critical Services: Identify what truly matters to the customer and the market.
2. Impact Tolerance: Set a hard time limit for how long a service can be down.
3. Mapping: Know your People, Process, Tech, Data, and Vendors.
4. Testing: Use "Severe but Plausible" scenarios to find your breaking point.
5. Governance: The Board must lead by asking the right questions.

Final Encouragement: This chapter is all about the "Big Picture." When you're answering exam questions, always think: "Does this help the bank continue to serve its customers during a disaster?" If the answer is yes, you're thinking like a Resilience Expert! Good luck with your studies!