Operational resilience: When policy meets reality

Operational resilience is ultimately tested when something stops working.

Regulation, cyber security and new technology are putting increasing focus on how organisations manage operational risk. DORA, NIS2 and other regulatory requirements are important drivers – but compliance alone does not make an organisation resilient.

The real question is whether critical operations can continue when technology, suppliers, people or infrastructure are disrupted.

From compliance to capability

Policies, risk assessments and continuity plans provide an important foundation. But operational resilience requires more than documentation.

Organisations need to understand which services are truly critical, what they depend on and what happens when those dependencies fail. This includes technology and data, but also suppliers, people, facilities and decision-making capabilities.

The challenge is to connect these perspectives and turn them into practical resilience.

Technology creates both capability and dependency

Digitalisation has made organisations more efficient, but also increasingly dependent on complex technology ecosystems.

Cloud services, outsourced IT, interconnected platforms and AI can create significant business value. At the same time, they introduce dependencies that need to be understood and managed.

This makes the connection between cyber security, business continuity, IT operational resilience and supplier management increasingly important.

AI adds another dimension

AI is rapidly becoming part of business processes and decision-making. This creates opportunities, but also new questions about governance, data, security and dependency.

As AI becomes embedded in critical processes, organisations need to consider not only what AI can do, but also what happens when an AI-enabled service is unavailable, produces an incorrect result or becomes dependent on technology outside the organisation’s control.

AI governance and operational resilience therefore need to develop together.

When policy meets reality

Operational resilience is not primarily demonstrated by having the right policy.

It is demonstrated by the ability to respond when something actually happens: knowing what matters most, understanding dependencies, making decisions under pressure and restoring critical operations.

That capability needs to be designed, exercised and continuously improved.

Resilience is ultimately about making sure the business continues to work – also when conditions change.