[OR] [BOK] [5] [P1] [S5] Develop and Embed Governance

Element

Description

Purpose

• To establish a structured governance framework that defines accountability, ownership, oversight, and decision-making processes for Operational Resilience (OR).
• Embedding governance ensures that OR is not treated as a one-off initiative but is sustained through leadership, policies, and organisational culture.

• Define the organisational structure, roles, and responsibilities for OR governance.
• Establish oversight committees and reporting lines.
• Ensure senior management and board accountability for resilience.
• Integrate OR into existing governance structures (e.g., risk, compliance, audit).
• Develop policies, charters, and mandates that formalise OR governance.
• Promote transparency, communication, and escalation protocols.

Inputs

• OR Strategy and Policy (from earlier stages of Phase 1).
• Organisational Risk Appetite and Tolerance.
• Regulatory and industry governance expectations.
• Existing corporate governance frameworks (risk, compliance, BCM, IT, cyber, etc.).
• Stakeholder requirements and board directives.

Activities

• Define governance structure: committees, working groups, and reporting mechanisms.
• Assign accountability to senior management and board-level oversight.
• Develop OR governance documents (charters, terms of reference, policies,  mandates).
• Establish escalation and decision-making protocols for disruptions.
• Integrate governance requirements into the wider organisational governance ecosystem.
• Conduct awareness and engagement sessions with stakeholders to embed governance culture.
• Align with regulatory expectations and industry best practices.

Outputs

• Operational Resilience Governance Framework.
• Governance Charter and Terms of Reference.
• Defined accountability and ownership matrix (RACI model).
• Established committees (e.g., OR Steering Committee, Risk Committee).
• Documented escalation and reporting procedures.
• Integration of OR governance into enterprise risk and compliance structures.

Linkages

• Upstream: OR Strategy (P1-S2), Establish Leadership & Accountability (P1-S3), Identify Critical Business Services (P1-S4).
• Downstream: Implementation of governance through OR Program (Phase 2), Monitoring & Reporting (Phase 3).
• Cross-linkages: Enterprise Risk Management (ERM), Business Continuity Management (BCM), Compliance & Regulatory Governance, Information Security Governance.