[OR] [P2] [S5] [LL] [C9] Developing and Prioritising Improvement Actions

[P2] [S5] Chapter 9

Developing and Prioritising Improvement Actions

Introduction

Lessons learned have little value unless they are converted into tangible improvements. Many organisations fail at this stage—capturing insights but struggling to:

• Define clear actions
• Prioritise competing initiatives
• Ensure timely implementation

In operational resilience, improvement actions must be:

• Service-centric (aligned to CBS)
• Risk-based (focused on highest impact areas)
• Measurable and accountable

This chapter outlines how organisations can systematically develop, prioritise, and manage improvement actions to drive meaningful resilience outcomes.

Purpose of the Chapter

To provide a structured, risk-based approach for translating Lessons Learned into actionable improvement initiatives, ensuring that organisations prioritise efforts effectively to strengthen Critical Business Services (CBS) and enhance overall operational resilience.

From Lessons Learned to Actionable Improvements

Translating Lessons into Actions

A lesson learned should always answer:

• What went wrong?
• Why did it happen?
• What must change?

This leads to:

• Specific improvement actions addressing root causes

Example

Key Principle

Every lesson learned must result in:

• At least one clearly defined action
• A measurable outcome

Types of Improvement Actions

Improvement actions can be categorised into several domains:

Process Improvements

• Redesign workflows
• Strengthen procedures
• Eliminate bottlenecks

Technology Enhancements

• Upgrade systems
• Improve infrastructure resilience
• Enhance monitoring tools

People and Capability Development

• Training and awareness
• Role clarification
• Skills enhancement

Third-Party Risk Improvements

• Strengthen vendor oversight
• Improve SLAs and contracts
• Enhance contingency planning

Governance and Control Enhancements

• Update policies
• Strengthen controls
• Improve oversight mechanisms

Establishing a Structured Action Development Process

Step-by-Step Approach

Step 1: Define the Action

• Clearly describe what needs to be done
• Ensure alignment with root cause

Step 2: Assign Ownership

• Identify responsible party
• Ensure accountability

Step 3: Set Timeline

• Define realistic completion deadlines

Step 4: Define Success Criteria

• Establish measurable outcomes

Step 5: Assess Resource Requirements

• Identify budget, tools, and personnel needed

Action Definition Template

Risk-Based Prioritisation Framework

Not all actions can be implemented simultaneously. A structured prioritisation approach is essential.

Key Prioritisation Criteria

Risk-Based Prioritisation Matrix

Prioritisation Outcomes

• Critical Priority: Immediate action required
• High Priority: Short-term implementation
• Medium Priority: Planned improvements
• Low Priority: Monitor and review

Linking Actions to Critical Business Services (CBS)

Service-Centric Prioritisation

Actions should be prioritised based on:

• Impact on CBS
• Customer outcomes
• Service continuity

Mapping Actions to CBS

Strengthening End-to-End Resilience

• Address interdependencies
• Improve service delivery across the entire value chain

Integration with Strategic and Operational Planning

Aligning with Resilience Roadmap

Improvement actions should feed into:

• Operational resilience roadmap
• Strategic initiatives

Integration with Risk Management

• Update risk registers
• Enhance control frameworks

Budget and Resource Allocation

• Secure funding for high-priority actions
• Align with organisational priorities

Managing Trade-Offs and Constraints

Resource Constraints

• Limited budget
• Limited personnel

Balancing Priorities

• Operational vs strategic initiatives
• Short-term vs long-term improvements

Decision-Making Framework

• Use risk-based approach
• Consider cost-benefit analysis

Tracking and Monitoring Improvement Actions

Action Tracking Mechanisms

• Centralised action register
• Workflow management systems

Monitoring Progress

• Track:
• Completion status
• Delays
• Risks

Reporting to Management

• Regular updates to:
• Senior management
• Risk committees

Measuring Effectiveness of Actions

Key Performance Indicators (KPIs)

• % of actions completed on time
• Reduction in incident frequency
• Improvement in recovery times

Key Risk Indicators (KRIs)

• Number of recurring incidents
• Breaches of impact tolerance

Validation Methods

• Follow-up testing
• Scenario exercises
• Audits

Common Pitfalls

Vague or Undefined Actions

• Lack of clarity leads to poor implementation

Lack of Ownership

• No accountability for execution

Poor Prioritisation

• Resources allocated to low-impact actions

Failure to Monitor

• Actions not tracked effectively

Lack of Integration

• Actions not aligned with CBS or strategy

Best Practices

Ensure Action Clarity

• Define specific, measurable actions

Use Risk-Based Prioritisation

• Focus on high-impact areas

Assign Clear Ownership

• Ensure accountability

Integrate Across Functions

• Align with risk, IT, and business units

Continuously Monitor and Review

• Track progress and effectiveness

Case Example: Banking Sector

Scenario

A bank experiences repeated payment system outages.

Lessons Learned

• Inadequate system capacity
• Weak vendor management

Improvement Actions

• Upgrade infrastructure
• Enhance vendor SLAs
• Implement real-time monitoring

Prioritisation

• High priority due to impact on CBS

Outcome

• Reduced downtime
• Improved customer experience

Developing and prioritising improvement actions is a critical step in transforming lessons learned into measurable resilience outcomes. By adopting a structured, risk-based approach, organisations can:

• Focus on high-impact improvements
• Strengthen Critical Business Services
• Enhance operational resilience

Effective prioritisation ensures that:

• Resources are optimally allocated
• Risks are mitigated proactively
• Continuous improvement is sustained

Transition to Next Chapter

With improvement actions defined and prioritised, the next chapter will focus on embedding continuous improvement, ensuring that lessons learned become an integral part of organisational culture and operational resilience practices.