Operational resilience
Operational resilience is a bank’s ability to restore its critical functions within defined tolerances for disruption when severe but plausible events occur.
FINMA Circular 2023/1 defines operational resilience as an institution’s ability to restore its critical functions within the tolerance for disruption, which includes identifying threats and possible failures, protecting against them, responding, restoring normal operations and learning from disruptions. The question shifts from whether a business continuity plan exists to whether critical functions stay within limits the board has accepted. The circular entered into force on 1 January 2024, with a two-year transition for ensuring operational resilience that ended on 1 January 2026.
The board of directors approves the critical functions and their tolerances for disruption at least once a year and regularly approves and monitors the approach to resilience. In the EU, DORA covers the ICT dimension as digital operational resilience and makes the management body responsible for the ICT risk management framework; it has applied since 17 January 2025. Both build on the Basel Committee’s principles for operational resilience of 2021.
Common pitfalls are tolerances defined only as IT recovery times, dependency maps that leave out third parties and data, tests limited to short outages instead of severe but plausible scenarios lasting weeks or months, and resilience treated as a project rather than an ongoing capability.
In practice
- 01Keeps an inventory of critical functions with their tolerances and the processes, people, systems, data, sites and third parties they depend on.
- 02Tests regularly whether critical functions stay within tolerance in severe but plausible scenarios, including long disruptions.
- 03Brings operational risk, ICT and cyber risk, business continuity and outsourcing management together into one resilience view.
- 04Reports to the board at least annually and whenever significant control weaknesses or incidents threaten resilience.
- 05Feeds lessons from incidents and tests into remediation with owners and deadlines.
How MRM-Solution supports it
- 01See per requirement whether policy, process and governance, and controls hold it: three lamps, and the weakest one counts.
- 02Attach controls to the activities they secure, record tests or import results in your own spreadsheet layout, and track deficiencies to closure.
Too good to be true? Then we should talk.
30 minutes. Your use case, maximum impact.
info@mrm-solution.com