Building operational resilience must be seen as a key driver of organisational resilience, says Karen Humphris, Senior Manager: Advisory Services, at ContinuitySA. Speaking during this year's Business Continuity Awareness Week, Humphris argued that building operational resilience is central to building a resilient organisation.

"Today's business environment is both complex and volatile; in response, organisations are focused on becoming more resilient and able to adapt to change as it occurs. The more resilient an organisation is, the less likely it is to have to invoke its business continuity plans," she says. "Building operational resilience is key to building organisational resilience because it addresses how the organisation acts in a resilient way. You can't have the one without the other."

Operational resilience is defined as the techniques that enable people, processes and IT systems to adapt to changing business conditions. In building resilience, organisations need to anticipate and prevent risks from materialising through risk management, and in the event of a disruption occurring, they need to know how to recover through the business continuity plan. Operational resilience, which confers the ability to adapt to change and withstand disruptions, is what bridges the gap between these two.

Essentially, says Humphris, operational risk can be seen as what organisations must do in order to become resilient.

In building operational resilience, organisations face certain challenges, including the dynamic business landscape, in which strong competition and expanding customer expectations create the need for a highly flexible organisational structure. Traditional silo business structures and reporting lines are barriers to operational resilience; organisations are also liable to find themselves short of vital skills and capabilities. Leadership shortcomings can add to the challenge. Heterogeneous technologies, inaccessible information and outdated strategies can also hamper efforts to develop operational resilience.

"To build operational resilience, it's vital to have a dynamic approach that covers all key dependencies, has the right governance in place and, critically, the right people," says Humphris. "Every effort needs to be made to create a culture of resilience in the organisation."

She argues that it is important to approach operational resilience in a structured way, advocating a fourfold operational resilience framework. This framework aims to provide a bird's eye view of the organisation's vulnerabilities and points of failure, as well as to outline the right decision-making capabilities to manage these vulnerabilities, and how these vulnerabilities should be integrated into the existing risk-management principles (depending on risk appetite).

The four steps to building an operational-resilience framework are:

* Define the organisational structure.
* Analyse the functions within each structural component.
* Classify the points of failure.
* Establish how to manage these points of failure in line with the organisation's risk appetite and particular circumstances.

It's very important to keep in mind that each organisation is unique, so these steps must be customised appropriately.

"If the framework is put in place, the overall business will become more resilient and it will be better able to allocate capital and resources to mitigate risk more effectively," she concludes. "Proactive management of operational resilience will also provide stakeholders, including regulators and business partners, with some level of assurance that the organisation has a methodology for identifying challenges to its sustainability, minimising the impact on them."