Operational Resilience Audit Courses

These operational resilience audit (ORA) courses are designed with BCM professionals operating globally in mind.

Courses are available as Blended Learning (100% Online) as well as Hybrid Learning (50% Online and 50% Onsite) and are divided into three levels of competencies:

At the end of each course, participants would be assessed through assessments and examinations to ascertain his/her level of competency.

They can look forward to receiving an internationally recognised OR certification through any of our OR certification courses.

More Information About Operational Resilience Audit ORA-5000 [ORA-5] or ORA-300 [ORA-3] Course

OR-300 Operational Resilience Implementer [OR-3] course and the OR-5000 Operational Resilience Expert Implementer [OR-5] course.

	If you have any questions, click to contact us.

Overview of the ORA-400 Operational Resilience Audit Manager Course

BCM Institute’s ORA-400 course is conducted in two modules over four weeks. Module 3 and Module 4 are the ORA-400 Operational Resilience Audit Manager* or the ORA-5000 Operational Resilience Audit Expert courses.

*Please be informed that you must complete the ORA-300 OR Audit Specialist course or BL-ORA-3 before starting the ORA-400 course.

This protracted time frame for this blended learning course allows one to understand the concepts taught in digestible bite sizes with targeted online interactions. Care and consideration have been implemented to ensure that the content and syllabus taught are of the same standard and rigour as our onsite classes.

You will learn the same syllabus and be taught by the same industry practitioners as you would onsite. The same practitioner will be available to you during the scheduled online classes.

The roadmap above provides a snapshot of the programme's content. It is divided into modules 3 to 4.  

Below is a snapshot of what you can expect from the programme. It is divided into the respective modules 3 to 4.  Find out each module's syllabus by clicking any of the two [Course Content] buttons.  The content has been carefully crafted to ensure that your participation and outcome match each day of the ORA-5000 Operational Resilience Audit Expert competency level.  Click any of the two buttons [Course Requirement] to learn more about your participation and involvement in this course.

The course fee is SGD 2,400 for 100% online and SGD 2,700 for onsite, payable before the class starts. 

Module
Course Content
Course Requirement

Breakdown of the Time Spent

Module	Mode of Study	Flexible (Hours)	Mandatory & Fixed Timing (Hours)
	Online Training and Discussion Workshop (2 Hours Reading/ Assignment + 3-Hour Schedule Online Classes)	2	6 (3-hour x 2 separate sessions)
	Online Training and Discussion Workshop (2 Hours Self Reading/ Assignment + 3 Hours Schedule Online Classes)	2	6 (3-hour x 2 separate sessions)
	Total Hours	4	12
	Attempt Qualifying Examination	Question	Duration
	Operational Resilience Audit Expert (ORAE) after ORA-5 course	100	3 and 1/2 hours

What are the Differences and Concerns?

Click the icon on the right to learn more about the difference between Blended Learning and Hybrid Learning offered by BCM Institute.

The entire process is redesigned with pre-reading (at your own time and pace) and preparatory work (rather than one hour doing the work in class) supported by proprietary guidance notes. In fact, after several cohorts, the content from those who had attended our other advanced-level courses highlights a better way to provide the same outcome.

Instructors: Note that instructors delivering the modules will remain the same as those providing the onsite training.  At BCM Institute, most instructors still practise BCM and risk management professionals (in this case, operational resilience and operational risk) with a minimum of 12 years of direct BCM experience as they hold regional or global resilience responsibilities.

International Participation: Another significant change will be the participation of more international delegates compared to the traditional majority of Asian participants.  Be expected to discuss and work as teams from around the world.

Be expected to have more pre-readings as the objective is to ensure that knowledge that could be acquired via reading should be done outside the training session.  More time is allocated to sharing experiences between the participants and facilitators.

Schedule for Courses: This is the schedule and dates for the start of the next course.  Click "ORA-5000 Course Calendar" to learn more about the "RUNs" for the year.

Find out more about ORA-5000 [ORA-5] & ORA-300 [ORA-3]

 

	Please feel free to send us a note if you have any of these questions.

 

Emerging Trends in Operational Resilience Auditing: A 2024 Report

Operational resilience has become a top priority for organizations across industries, prompting the rise of specialized auditing practices.

This report explores key emerging trends shaping the landscape of operational resilience auditing in 2024.

1. Increased Regulatory Scrutiny

Regulatory bodies worldwide are implementing stricter requirements for operational resilience, mandating regular audits and stress testing exercises. This drives demand for skilled auditors familiar with relevant regulatory frameworks.

2. Focus on Third-Party Risk Management

Modern businesses' interconnectedness amplifies third-party vulnerabilities' impact. Audits increasingly scrutinize third-party contracts, risk management procedures, and control environments to ensure supply chain resilience.

3. Integration with Cybersecurity Audits

The convergence of cyber and operational risks necessitates combined audits examining IT infrastructure, data security, and incident response capabilities alongside traditional operational resilience assessments.

4. Adoption of Technology-Assisted Auditing

Advanced analytics, artificial intelligence (AI), and automation are transforming how audits are conducted. These tools enable auditors to analyze vast datasets, identify hidden patterns, and streamline data collection, freeing time for deeper analysis and judgment.

5. Shift Towards Scenario-Based Testing

Static assessments give way to dynamic scenario-based testing that simulates real-world disruptions. This approach helps organizations refine their resilience plans and identify vulnerabilities under pressure.

6. Evolving Threat Landscape

Auditors must stay informed about emerging threats like climate change, geopolitical instability, and cyberattacks, continuously adapting their methodologies to address these dynamic risks.

7. Growing Demand for Skilled Professionals

The burgeoning field of operational resilience auditing creates a talent gap.

Training and certification programs are crucial to upskill existing professionals and attract new talent to meet the rising demand.

8. Emphasis on Business Continuity Management (BCM) Integration

Effective operational resilience relies on integrating resilience principles into existing BCM frameworks.

Auditors focus on ensuring BCM programs align with organizational objectives and address emerging threats.

9. Continuous Improvement and Learning

Operational resilience is an ongoing journey, not a destination.

Audits should emphasize the importance of continuous improvement, learning from incidents, and adapting resilience plans based on evolving threats and organizational changes.

10. International Collaboration and Harmonization

Harmonization across jurisdictions and industries is critical as regulations and best practices evolve.

International collaboration among regulators, auditors, and professional bodies is gaining momentum to facilitate knowledge sharing and consistent approaches.

By staying informed about these trends, audit professionals can adapt their practices, embrace new technologies, and contribute to building robust and adaptable operational resilience for organizations in the face of ever-changing risks.

	Please feel free to send us a note if you have any of these questions.

Internal vs External OR Auditing: Roles, Responsibilities and Ethics

While internal and external auditors contribute to assessing and strengthening operational resilience, their roles, responsibilities, and ethical considerations differ significantly.

Hence, it is helpful to understand the differences in roles, responsibilities and ethical considerations between IA and EA.

Internal Auditors (IA)

Roles of IA

• Independent assurance provider. Evaluating the effectiveness of existing resilience programs and controls within the organization.
• Risk consultant. Collaborating with business units to identify and mitigate operational risks impacting resilience.
• Process improvement advocate. Proposing recommendations to enhance OR posture and optimize processes.
• Change agent. Driving improvements in risk management culture and awareness across the organization.

Responsibilities of IA

• Conducting risk assessments and audits focused on operational resilience.
  Testing controls and processes designed to mitigate identified risks.
• Evaluating the adequacy and effectiveness of resilience plans and preparedness.
• Reporting findings and recommendations to management and relevant stakeholders.
• Monitoring and measuring the effectiveness of implemented improvements.

Ethical Considerations of IA

• Maintaining independence and objectivity: Avoiding undue influence from management or bias towards specific outcomes.
• Confidentiality: Protecting sensitive information obtained during audits while ensuring adequate reporting for oversight purposes.
• Competence and professional diligence: Continuously updating knowledge and skills to perform audits effectively and adhere to professional standards.
• Acting in the organisation's best interests: Balancing adherence to regulations with supporting the organization's long-term sustainability and ethical conduct.

External Auditors (EA)

Roles of EA

• Independent opinion provider: Offering an external perspective on the organization's overall risk management and resilience posture.
• Regulatory compliance assurer: Verifying adherence to relevant regulations and standards impacting operational resilience.
• Stakeholder assurance provider: Building confidence for investors, creditors, and other stakeholders regarding the organization's resilience capabilities.

Responsibilities of EA

• Conducting audits focused on specific regulatory requirements or contractual obligations related to operational resilience.
• Assessing the design and effectiveness of controls based on agreed-upon procedures.
• Reporting findings and opinions to relevant stakeholders, potentially including public disclosure.
• May not delve as deeply into operational details as internal auditors.

Ethical Considerations of EA

• Maintaining independence and objectivity. Avoiding conflicts of interest and undue influence from clients or regulators.
• Professional scepticism. Maintaining a critical questioning stance ensures audit conclusions are based on accurate and sufficient evidence.
• Confidentiality. Protecting sensitive information obtained during audits while fulfilling reporting requirements to designated parties.
• Communication and transparency. Communicating limitations and uncertainties associated with their audit findings and opinions.

Key Differences

• Focus.  Internal auditors focus on broader operational resilience within the organisation, while external auditors may have a narrower scope dictated by regulations or contracts.
• Reporting. Internal auditors report primarily to management and internal stakeholders, while external auditors report to their clients and potentially publicly.
• Depth of engagement. Internal auditors typically understand the organisation's internal workings and may conduct more in-depth assessments.
• Impact. Internal auditors directly impact internal change and improvement within the organisation, while external auditors provide assurance and may trigger regulatory consequences.

Collaboration and Coordination

While their roles and responsibilities differ, effective operational resilience relies on collaboration and coordination between internal and external auditors.

• Sharing information and insights. Internal auditors can provide external auditors valuable context and understanding of the organisation's operations and risk landscape.
• Joint assessments. In some cases, collaborative audits can leverage the strengths of both parties for a more comprehensive evaluation.
• Mutual respect and understanding. Recognising the value each type of auditor brings to building a robust operational resilience framework.

By understanding internal and external auditors' different roles, responsibilities, and ethical considerations, organisations can effectively leverage their combined expertise to assess and strengthen their operational resilience posture.

	Please feel free to send us a note if you have any of these questions.