Operational Resilience Audit

What is Concentration Risk?

Concentration Risk refers to the vulnerability and potential impact that arises from a significant dependence or concentration of critical operations, resources, or dependencies within an organization.

It occurs when there is an overreliance on a single point of failure or a limited number of entities, systems, or processes that, if disrupted, could significantly impact the organization's ability to deliver its critical services or functions.

• Are primary and secondary sites geographically distant enough to mitigate the impact of a localised event?
• Is there a documented plan for transitioning operations from primary to secondary sites?
• Has the secondary site been tested for readiness and functionality?
• Are the necessary infrastructure and resources available at the secondary site?
• Are there redundant systems in place to ensure seamless operations during the transition?

Checklist

• Verify if the primary and secondary sites are geographically distant enough to mitigate localised events.
• Review the documented plan for transitioning operations from primary to secondary sites.
• Assess if the secondary site has been tested for readiness and functionality.
• Verify the availability of necessary infrastructure and resources at the secondary site.
• Assess the presence of redundant systems to ensure seamless operations during the transition.

• Are critical business functions identified and documented?
• Is there segregation of critical business functions across different locations?
• Have dependencies between critical business functions been assessed and addressed?
• Is there a contingency plan to maintain critical business functions during disruption at one location?
• Are there regular tests or drills to validate the effectiveness of critical business function segregation?

• Determine if critical business functions have been identified and documented.
• Assess the segregation of critical business functions across different locations.
• Review the assessment and addressing of dependencies between critical business functions.
• Verify the existence of a contingency plan to maintain critical business functions in case of disruption at one location.
• Assess the regular testing or drills to validate the effectiveness of critical business function segregation.

• Are employees cross-trained to perform multiple roles within critical business functions?
• Is a training program in place to ensure employees have the necessary skills for cross-functional roles?
• Are cross-training records maintained for tracking employee capabilities?
• Is cross-training periodically tested or validated through drills or exercises?
• Are there escalation procedures in place to address skill gaps during disruptions?

• Determine if employees are cross-trained to perform multiple roles within critical business functions.
• Assess the presence of a training program to ensure employees have the necessary skills for cross-functional roles.
• Review the maintenance of cross-training records for tracking employee capabilities.
• Verify the periodic testing or validation of cross-training through drills or exercises.
• Assess the presence of escalation procedures to address skill gaps during disruptions.

Questionnaires and Checklist "Plan" Phase

Develop Strategy Roadmap

Confirm Risk Appetite

Develop and Embed Governance

Questionnaires and Checklist "Plan" Phase

Develop Strategy Roadmap

Confirm Risk Appetite

Develop and Embed Governance

5. Concentration Risk

Questionnaires and Checklist "Implement" Phase

Set Impact Tolerance

Conduct Scenario Testing

Improve Lesson Learnt

Questionnaires and Checklist "Sustain" Phase

Implement Training and Awareness

Provide Self-assessment

Conduct Independent Quality Review

9. Incident and Crisis Management (Communication with staff and Stakeholders)

What is Training and Awareness?

Training is a planned and organized activity to impart operational resilience skills, techniques and methodologies to all staff to assist them in establishing and maintaining their respective OR programs.

• Is there a documented training program for operational resilience?
• Are training objectives clearly defined and aligned with operational resilience goals?
• Is the training program comprehensive and covers all relevant aspects of operational resilience?
• Are training materials current and reflect the latest policies and procedures?
• Is there a process for regularly evaluating and updating the training program?

• Review the documentation of the training program for operational resilience.
• Assess the clarity and alignment of training objectives with operational resilience goals.
• Evaluate the comprehensiveness of the training program in covering all relevant aspects.
• Verify the currency of training materials and their alignment with the latest policies and procedures.
• Determine a process for regular evaluation and updating of the training program.

• Have all relevant employees received training on operational resilience?
• Is there a mechanism in place to track and monitor employee completion of training
• Are there methods to assess the effectiveness of the training program?
• Is there employee engagement and participation in operational resilience initiatives
• Are there channels for employees to provide feedback and suggestions for improving
  operational resilience?

• Verify that all relevant employees have received training on operational resilience.
• Assesses a mechanism to track and monitor employee completion of training.
• Evaluate the methods used to assess the effectiveness of the training program.
• Determine employee engagement and participation in operational resilience initiatives.
• Review the channels available for employees to provide feedback and suggestions for improvement.

• Are there regular awareness campaigns to promote operational resilience?
• Is there effective communication about operational resilience policies and procedures
• Are employees aware of their roles and responsibilities in operational resilience?
• Is there clarity in communication regarding incident reporting and escalation procedures?
• Are there channels for employees to report concerns and seek clarification on operational resilience matters?

• Assess the frequency and effectiveness of awareness campaigns promoting operational resilience.
• Evaluate the clarity and effectiveness of communication about operational resilience policies and procedures.
• Determine employee awareness regarding their roles and responsibilities in operational resilience.
• Review the clarity of communication regarding incident reporting and escalation procedures.
• Verify the availability of channels for employees to report concerns and seek clarification on operational resilience matters.

• Is there a process to evaluate the effectiveness of the operational resilience training?
• Are there metrics and performance indicators to assess the training program's impact?
• Are there mechanisms to collect employee feedback regarding the training program?
• Is there a process for analyzing training evaluation results and implementing improvements?
• Are there mechanisms to track the application of learned knowledge and skills in operational resilience practices?

• Review the process for evaluating the effectiveness of the operational resilience training.
• Assess the availability of metrics and performance indicators to assess the training program's impact.
• Determine the existence of mechanisms to collect feedback from employees regarding the training program.
• Evaluate the process for analyzing training evaluation results and implementing improvements.
• Verify the existence of mechanisms to track the application of learned knowledge and skills in operational resilience practices.

Questionnaires and Checklist "Sustain" Phase

Implement Training and Awareness

Provide Self-assessment

Conduct Independent Quality Review

What is Governance?

The need to embed operational resilience in the governance structure is essential.  

This will start with the board of directors and senior management, who will actively oversee the organisation’s operational resilience framework concerning its strategy and risk appetite, which empowers them to make the correct investment and risk decisions.

• Review the documented governance framework for operational resilience.
• Evaluate if the framework aligns with industry best practices and regulatory requirements.
• Assess the framework's effectiveness in providing clear roles, responsibilities, and decision-making authority.
• Verify if the governance framework is communicated and understood by relevant stakeholders.
• Check if there is a process to review and update the governance framework periodically.
  
  

• Are senior management and executives actively involved in driving operational resilience? 
• Is a designated individual or team responsible for overseeing the operational resilience program? 
• Is there a reporting mechanism for the operational resilience program to senior management and the board?
  

• Assess the level of senior management and executive involvement in operational resilience initiatives.
• Determine if a designated individual or team oversees and implements the operational resilience program.
• Evaluate the communication channels between senior management, the operational resilience team, and other stakeholders.
• Verify if there is a process to escalate operational resilience issues to senior management and the board.
• Assess the effectiveness of leadership in promoting a culture of operational resilience throughout the organization.

• Has a comprehensive risk assessment been conducted to identify and prioritize operational risks?
• Are risk mitigation strategies and controls in place to address identified risks?
• Are risk management policies and procedures effectively communicated and implemented?

• Review the methodology and process used for conducting operational risk assessments.
• Evaluate the comprehensiveness and accuracy of the identified risks.
• Assess if there are clear risk mitigation strategies and controls in place.
• Verify if risk management policies and procedures are effectively communicated and implemented.
• Assess the monitoring and reporting mechanisms for identified risks and risk mitigation efforts.

• Has a BIA been conducted to assess the potential impact of disruptions on critical business processes?
• Are the identified critical processes adequately documented?
• Are there contingency plans and backup arrangements in place for critical processes?

• Review the BIA methodology and documentation to ensure it covers critical business processes and dependencies.
• Verify if there is a process for identifying and prioritizing critical business processes. 
• Assess if the BIA adequately addresses the potential impact of disruptions on critical processes.
• Evaluate the existence and effectiveness of contingency plans and backup arrangements for critical processes.
• Verify if the BIA is periodically updated to reflect organisational operations and risk landscape changes.

• Evaluate the existence and effectiveness of incident response plans for different operational disruptions.
• Verify if the incident response plans are regularly tested, reviewed, and updated.
• Assess the adequacy of incident escalation and communication procedures.
• Review documentation of past incidents, including response actions and lessons learned.
• Assess if there is a process for continuous improvement of incident response and recovery capabilities.

Questionnaires and Checklist "Plan" Phase

Develop Strategy Roadmap

Confirm Risk Appetite

Develop and Embed Governance

What is Strategy Roadmap?

A strategy roadmap is a bridge between strategy and execution. It visualizes the critical outcomes of the operational resilience effort that must be delivered over a particular time horizon to achieve the organisation’s strategic vision.

The outcomes on the strategy roadmap are substantiated by a clear understanding of the organisation’s capabilities; gaps and priorities must be addressed.

• Is there a clear governance structure in place for the operational resilience program?
• Are roles and responsibilities for program leadership clearly defined?
• Is there senior management oversight and involvement in the program?
• Are there mechanisms to escalate and resolve issues related to operational resilience?

• Establish a clear governance structure with defined roles and responsibilities for operational resilience.
• Ensure senior management oversight and involvement in the program.
• Develop policies and procedures to support effective governance and decision-making.
• Define mechanisms for escalation and resolution of operational resilience issues.

• Has a comprehensive risk assessment been conducted to identify potential operational risks?
• Are all critical business processes and dependencies identified?
• Have risk thresholds and impact tolerances been established?
• Is there a process to regularly update and reassess risks and dependencies?

• Has a business impact analysis been performed to assess the potential consequences of operational disruptions?
• Are critical functions and processes prioritized based on their impact on the organization?
• Are recovery time objectives (RTOs) and recovery point objectives (RPOs) defined for critical processes?
• Has the impact of interdependencies between processes been considered?

• Conduct a comprehensive business impact analysis to assess the potential consequences of operational disruptions.
• Prioritize critical functions and processes based on their impact on the organization.
• Define recovery time objectives (RTOs) and recovery point objectives (RPOs) for critical processes.
• Analyze interdependencies between processes to identify potential ripple effects.

4. Strategy Development

• Define the vision, goals, and objectives of the operational resilience program.
• Align the strategy with the organization's overall risk management and business continuity plans.
• Identify resource requirements, including budget, personnel, and technology.
• Develop a roadmap with clear milestones and timelines for implementation.

5. Incident Response and Recovery

• Establish an incident response plan that outlines procedures for responding to and recovering from operational disruptions.
• Define roles and responsibilities for incident management, including incident response teams.
• Regularly test and update the incident response plan to ensure its effectiveness.
• Establish mechanisms for learning from incidents and incorporating improvements into the operational resilience program.

6. Communication and Coordination

• Define the vision and objectives of the operational resilience program.
• Conduct a thorough assessment of the current state of operational resilience.
• Identify key stakeholders and establish communication channels.
• Develop a governance structure with clear roles and responsibilities.
• Define risk assessment methodologies and criteria.
• Perform a comprehensive risk assessment and document the findings.
• Conduct a business impact analysis to prioritize critical functions and processes.
• Develop recovery strategies and plans for critical processes.
• Identify resource requirements and budget considerations.
• Establish performance metrics and key performance indicators (KPIs) for measuring progress.
• Develop an incident response plan with clear escalation procedures.
• Test and validate the incident response plan through simulations and drills.
• Develop a communication plan for internal and external stakeholders.
• Establish mechanisms for ongoing monitoring and reporting of operational resilience.
• Regularly review and update the strategy roadmap to incorporate lessons learned and evolving risks.

Questionnaires and Checklist "Plan" Phase

Develop Strategy Roadmap

Confirm Risk Appetite

Develop and Embed Governance