|
Element
|
Description
|
|
Purpose
|
- To establish a structured governance framework that defines accountability, ownership, oversight, and decision-making processes for Operational Resilience (OR).
- Embedding governance ensures that OR is not treated as a one-off initiative but is sustained through leadership, policies, and organisational culture.
|
| Objectives |
- Define the organisational structure, roles, and responsibilities for OR governance.
- Establish oversight committees and reporting lines.
- Ensure senior management and board accountability for resilience.
- Integrate OR into existing governance structures (e.g., risk, compliance, audit).
- Develop policies, charters, and mandates that formalise OR governance.
- Promote transparency, communication, and escalation protocols.
|
|
Inputs
|
- OR Strategy and Policy (from earlier stages of Phase 1).
- Organisational Risk Appetite and Tolerance.
- Regulatory and industry governance expectations.
- Existing corporate governance frameworks (risk, compliance, BCM, IT, cyber, etc.).
- Stakeholder requirements and board directives.
|
|
Activities
|
- Define governance structure: committees, working groups, and reporting mechanisms.
- Assign accountability to senior management and board-level oversight.
- Develop OR governance documents (charters, terms of reference, policies, mandates).
- Establish escalation and decision-making protocols for disruptions.
- Integrate governance requirements into the wider organisational governance ecosystem.
- Conduct awareness and engagement sessions with stakeholders to embed governance culture.
- Align with regulatory expectations and industry best practices.
|
|
Outputs
|
- Operational Resilience Governance Framework.
- Governance Charter and Terms of Reference.
- Defined accountability and ownership matrix (RACI model).
- Established committees (e.g., OR Steering Committee, Risk Committee).
- Documented escalation and reporting procedures.
- Integration of OR governance into enterprise risk and compliance structures.
|
|
Linkages
|
- Upstream: OR Strategy (P1-S2), Establish Leadership & Accountability (P1-S3), Identify Critical Business Services (P1-S4).
- Downstream: Implementation of governance through OR Program (Phase 2), Monitoring & Reporting (Phase 3).
- Cross-linkages: Enterprise Risk Management (ERM), Business Continuity Management (BCM), Compliance & Regulatory Governance, Information Security Governance.
|