Charta is on Google Play: practise on the go. Get the app
Charta

Define operational resilience, list the components of a resilience framework, and outline what regulators expect of firms in this area.

FRM® Part II · Operational Risk and Resilience · Introduction to Operational Risk and Resilience · FRM2.ORR.1.d

The idea

Operational resilience is the ability of a firm to deliver its critical operations through disruption. That means to prevent, adapt to, respond to, recover from and learn from adverse events. It differs from traditional operational risk management and business continuity because it starts from the services that matter to customers and markets, rather than from individual systems or loss events. A framework identifies critical operations or important business services and maps the people, processes, technology, data and third parties they depend on. It sets impact tolerances for maximum tolerable disruption, tests against severe but plausible scenarios, manages incidents and third-party dependencies, and feeds lessons back to the board. Regulators, including the Basel Committee in its operational resilience principles, expect board accountability, evidence of testing and remediation of any gap against tolerance. Tolerances reflect harm from disruption, not what the firm finds convenient.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which statement best defines operational resilience?

  1. The ability to avoid every operational loss through strong preventive controls and independent assuranceWhy not: Resilience accepts that disruption will occur; zero loss is not the goal.
  2. Delivering critical operations through disruption: preventing, adapting to, responding to, recovering from and learning from events - correct
  3. A capital buffer large enough to absorb the worst operational loss in the firm's own historyWhy not: Capital absorbs losses but does not keep services running through disruption.
  4. The ability to restore each individual IT system within its own recovery time objectiveWhy not: This is system-level disaster recovery, narrower than delivering critical operations.

Operational resilience focuses on continuity of critical operations during and after disruption, not on avoiding all losses or on holding capital.

A harder one

A bank outsources cloud hosting for a critical payments service, and the provider suffers a prolonged outage. Which regulatory expectation best applies?

  1. The bank stays responsible and must manage the dependency, including testing and exit plans - correct
  2. Responsibility for service continuity transfers to the provider through the outsourcing contractWhy not: Outsourcing does not transfer the firm's accountability to regulators and customers.
  3. It is enough to assess the provider once at onboarding, since the contract fixes service levelsWhy not: Third-party dependencies must be monitored and tested on an ongoing basis.
  4. Providers that are themselves regulated fall outside the bank's own resilience scopeWhy not: Provider regulation does not remove the bank's duty to manage its dependency.

Regulators expect firms to manage third-party risk end to end for their critical services: due diligence, monitoring, testing and exit plans. Accountability stays with the firm.

The hardest tier

A firm shows its supervisor a disaster recovery plan for each IT system, with recovery time objectives met in annual tests. The supervisor still concludes resilience has not been demonstrated. Which gap is most likely?

  1. The firm has not held enough Pillar 1 capital for operational risk, so it must raise its bufferWhy not: Resilience is about service continuity, and capital does not address the gap.
  2. The plan should aim for zero downtime for every system, whatever the cost and the service importanceWhy not: Regulators do not require zero downtime; they require tolerances to be met for important services.
  3. Annual tests are too frequent and should be replaced by a single full initial test of the planWhy not: Testing must be ongoing and risk-based, not a one-off.
  4. System recovery targets do not show the end-to-end service stays within impact tolerance in severe scenarios - correct

System recovery metrics are necessary but not sufficient. Supervisors expect testing that the whole important business service stays within tolerance, including dependencies and severe but plausible scenarios.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Introduction to Operational Risk and Resilience