Charta is on Google Play: practise on the go. Get the app
Charta

Set out the steps that secure strong operational resilience and the ways to test the resilience of a firm's important business services.

FRM® Part II · Operational Risk and Resilience · Risk Measurement and Assessment · FRM2.ORR.4.g

The idea

Operational resilience is the ability to keep delivering critical services through disruption, by preventing, adapting, responding and recovering. The steps are to identify the important business services, set an impact tolerance for each, map the people, processes, technology, facilities, information and third parties behind each service, test against severe but plausible scenarios, and remediate gaps with board oversight. An impact tolerance is the maximum disruption tolerable, assuming the disruption happens, unlike risk appetite, which concerns likelihood. Tests range from tabletop exercises for decisions and communication, through simulations, to live failover and cyber exercises that prove technical recovery. Measure disruption end to end, from detection to a usable service. Remember that passing tests built only on planned scenarios gives false comfort.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which description best defines operational resilience?

  1. The absence of operational losses over a sustained period, achieved by eliminating risk.Why not: Treats resilience as zero risk; resilience accepts that disruption will occur and focuses on continuity of service.
  2. The amount of capital held against operational risk under the Pillar 1 framework of the regulator.Why not: Confuses resilience with capital requirements, which absorb losses rather than keep services running.
  3. The ability to keep critical operations running through disruption and to recover from it. - correct
  4. The share of operational risk that has been transferred to insurers or outsourced.Why not: Equates resilience with risk transfer; transferring risk does not maintain delivery of services.

Operational resilience is about continuing to deliver critical services despite disruption, whatever its cause, and returning to normal. It complements risk management by assuming that some disruptions cannot be prevented.

A harder one

Which sequence best reflects the steps for building operational resilience of a firm's important business services?

  1. Identify important services, set tolerances, map dependencies, test against severe but plausible scenarios, then remediate. - correct
  2. Set impact tolerances, test scenarios, identify important business services, map dependencies, then remediate any identified gaps.Why not: Sets tolerances and tests before the services are identified and mapped, which leaves nothing to test against.
  3. Map every system in the firm, buy insurance for each, test once a decade, then set impact tolerances.Why not: Starts with an unfocused mapping, relies on transfer, tests too rarely and sets tolerances last.
  4. Identify business services, remediate gaps, map dependencies, set tolerances, then test.Why not: Puts remediation before mapping and testing, so the gaps that need fixing are not yet known.

The logical order is to identify important services, set tolerances, map the resources and third parties they depend on, test against severe but plausible scenarios, and fix weaknesses. Lessons from tests feed back into each step.

The hardest tier

A payments service has an impact tolerance of 4 hours. A scenario test records: 30 minutes to detect the incident, 45 minutes to decide to invoke the recovery plan, 2 hours 20 minutes for the technical failover and 1 hour 10 minutes to validate and reconcile before customers can use the service again. What does the test show?

  1. Disruption is 4 hours 45 minutes, exceeding the tolerance by 45 minutes. - correct
  2. Total disruption is 4 hours 15 minutes, which exceeds the tolerance by 15 minutes only.Why not: Leaves out the 30 minutes of detection time, which still counts towards disruption experienced by customers.
  3. Total disruption is exactly 4 hours, so the service just meets its tolerance.Why not: Leaves out the 45 minutes taken to decide to invoke the plan.
  4. The service is within tolerance, with 100 minutes to spare, since the technical failover took 2 hours 20 minutes.Why not: Compares only the technical failover (140 minutes) with the 4 hours and ignores detection, decision and validation time.

Disruption runs from the start of the incident until the service is usable: 30 + 45 + 140 + 70 = 285 minutes = 4 h 45 min, against 240 minutes of tolerance. The service fails the test by 45 minutes and needs remediation.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Risk Measurement and Assessment