---
title: [OR] [ISACA] [CIAG] [C8] Key Challenges & Pitfalls
description: [OR] [ISACA] [CIAG] [C8] Key Challenges & Pitfalls
image: https://blog.bcm-institute.org/hubfs/Dr%20Goh%20Conference%20Graphic%20Folder/ISACA%20Conference%20Morepost/%5BISACA%5D%20%5BC8%5D%20Key%20Challenges%20%26%20Pitfalls.jpg
---
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Operational Resilience: Bridging Governance, Risk and Compliance Across Industries
![BB OR \[C\] 16](https://blog.bcm-institute.org/hs-fs/hubfs/BB%20OR%20%5BAi%20Gen%20Blog%20Photo%5D/OR%20Pictures%20A/BB%20OR%20Folder%20C/BB%20OR%20%5BC%5D%2016.jpg?width=2000&height=1333&name=BB%20OR%20%5BC%5D%2016.jpg "BB OR [C] 16")
# \[OR\] \[ISACA\] \[CIAG\] \[C8\] Key Challenges & Pitfalls
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6f8e0a67-aae8-4512-99ea-b742e31391fc)
While the concept and framework of operational resilience are increasingly well understood, many organisations encounter significant challenges in implementing and sustaining it in practice. Despite strong intentions, well-documented frameworks, and regulatory guidance, the journey from concept to capability is often complex and uneven.
These challenges are not unique to any one industry. Whether in financial services, healthcare, manufacturing, or the public sector, organisations frequently face similar obstacles—ranging from cultural resistance and organisational silos to technical complexity and unrealistic expectations.
This chapter highlights the **most common challenges and pitfalls** encountered during the implementation of operational resilience. More importantly, it provides practical insights into why these issues arise and how organisations can address them effectively.
[Dr Goh Moh Heng](https://blog.bcm-institute.org/operational-resilience/author/dr-goh-moh-heng) Mar 29, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6f8e0a67-aae8-4512-99ea-b742e31391fc)
### **Chapter 8**
### **Key Challenges & Pitfalls**
#### **Introduction**
[![\[ISACA\] \[C8\] Key Challenges & Pitfalls](https://no-cache.hubspot.com/cta/default/3893111/c36846d0-9189-4393-bf14-5ff20fbd02d2.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c36846d0-9189-4393-bf14-5ff20fbd02d2)While the concept and framework of operational resilience are increasingly well understood, many organisations encounter significant challenges in implementing and sustaining it in practice.
Despite strong intentions, well-documented frameworks, and regulatory guidance, the journey from concept to capability is often complex and uneven.
These challenges are not unique to any one industry.
Whether in financial services, healthcare, manufacturing, or the public sector, organisations frequently face similar obstacles—ranging from cultural resistance and organisational silos to technical complexity and unrealistic expectations.
This chapter highlights the **most common challenges and pitfalls** encountered during the implementation of operational resilience. More importantly, it provides practical insights into why these issues arise and how organisations can address them effectively.
#### **Purpose of the Chapter**
The purpose of this chapter is to enable the reader to:
- Identify the **key challenges** faced during operational resilience implementation
- Understand the **root causes** behind common pitfalls
- Recognise the warning signs of ineffective implementation
- Learn **practical mitigation strategies**
- Strengthen the organisation’s ability to build a **sustainable resilience capability**
By the end of this chapter, the reader will be better equipped to anticipate and avoid common mistakes.
#### **Challenge 1: Misunderstanding Operational Resilience**
##### **The Issue**
Operational resilience is often misunderstood as:
- A rebranding of Business Continuity Management (BCM)
- A compliance requirement
- A purely risk management exercise
##### **Impact**
- Limited scope of implementation
- Failure to integrate across functions
- Lack of meaningful outcomes
##### **Root Cause**
- Lack of clarity at the leadership level
- Insufficient awareness of resilience concepts
##### **Mitigation**
- Establish a clear, organisation-wide definition
- Conduct executive-level briefings
- Position resilience as a **strategic capability**, not a function
#### **Challenge 2: Treating Resilience as a Compliance Exercise**
##### **The Issue**
Organisations focus on:
- Documentation
- Audit readiness
- Regulatory reporting
Instead of:
- Building actual resilience capability
##### **Impact**
- “Paper compliance” without operational readiness
- False sense of security
- Failure during real disruptions
##### **Root Cause**
- Compliance-driven culture
- Overemphasis on audits
##### **Mitigation**
- Shift focus from **“Are we compliant?”** to **“Are we resilient?”**
- Incorporate scenario testing as a core requirement
- Measure outcomes, not documentation
#### **Challenge 3: Failure to Identify True Critical Business Services**
##### **The Issue**
- Too many services are classified as “critical”
- Confusion between processes and services
- Lack of clear prioritisation
##### **Impact**
- Diluted focus
- Inefficient allocation of resources
- Ineffective response during the disruption
##### **Root Cause**
- Lack of structured criteria
- Insufficient business engagement
##### **Mitigation**
- Apply clear CBS identification criteria
- Limit CBS to truly critical services
- Validate with senior stakeholders
#### **Challenge 4: Incomplete Dependency Mapping**
##### **The Issue**
- Hidden dependencies not identified
- Third-party risks underestimated
- Lack of end-to-end visibility
##### **Impact**
- Unexpected points of failure
- Cascading disruptions
- Delayed recovery
##### **Root Cause**
- Complexity of modern systems
- Limited cross-functional collaboration
##### **Mitigation**
- Map dependencies across:
- Use structured templates and workshops
- Regularly update dependency maps
#### **Challenge 5: Unrealistic Impact Tolerances**
##### **The Issue**
- Impact tolerances set too aggressively or arbitrarily
- Lack of alignment with operational capability
##### **Impact**
- Inability to meet defined targets
- Misalignment between expectations and reality
##### **Root Cause**
- Lack of data-driven assessment
- Pressure to meet regulatory expectations
##### **Mitigation**
- Base tolerances on:
- Validate with business and technology teams
#### **Challenge 6: Ineffective Scenario Testing**
##### **The Issue**
- Limited or superficial testing
- Over-reliance on tabletop exercises
- Scenarios not realistic
##### **Impact**
- Gaps remain unidentified
- False confidence in resilience capability
##### **Root Cause**
- Resource constraints
- Lack of testing expertise
- Fear of exposing weaknesses
##### **Mitigation**
- Develop **severe but plausible scenarios**
- Conduct a mix of:
- Focus on learning, not blame
#### **Challenge 7: Siloed Organisational Structures**
##### **The Issue**
- GRC functions operate independently
- Limited collaboration between business, IT, and risk
##### **Impact**
- Fragmented response during disruptions
- Lack of shared understanding
##### **Root Cause**
- Organisational design
- Cultural barriers
##### **Mitigation**
- Establish cross-functional resilience teams
- Align roles and responsibilities
- Promote shared ownership of resilience
#### **Challenge 8: Lack of Executive Ownership**
##### **The Issue**
- Operational resilience delegated to middle management
- Limited board and senior management involvement
##### **Impact**
- Lack of strategic direction
- Insufficient resources
- Weak accountability
##### **Root Cause**
- Perception of resilience as an operational issue
- Competing priorities
##### **Mitigation**
- Assign clear executive ownership
- Integrate resilience into governance structures
- Include resilience metrics in board reporting
#### **Challenge 9: Over-Reliance on Technology**
##### **The Issue**
- Focus on IT recovery as the primary solution
- Neglect of people and process factors
##### **Impact**
- Incomplete resilience capability
- Failure in non-technology disruptions
##### **Root Cause**
- Technology-centric mindset
- Underestimation of operational complexity
##### **Mitigation**
- Adopt a **holistic approach**:
#### **Challenge 10: Failure to Sustain the Programme**
##### **The Issue**
- Initial implementation completed
- Programme not maintained or updated
##### **Impact**
- Outdated CBS and dependency maps
- Reduced effectiveness over time
##### **Root Cause**
- Lack of continuous improvement processes
- Competing organisational priorities
##### **Mitigation**
- Establish a **continuous improvement cycle**
- Schedule regular reviews and updates
- Integrate resilience into business-as-usual activities
#### **Summary of Key Pitfalls and Mitigation**
| Challenge | Key Risk | Mitigation Strategy |
| --- | --- | --- |
| Misunderstanding resilience | Limited scope | Executive education |
| Compliance focus | Paper capability | Outcome-based approach |
| Poor CBS identification | Lack of prioritisation | Structured criteria |
| Incomplete mapping | Hidden risks | End-to-end visibility |
| Unrealistic tolerances | Misalignment | Data-driven thresholds |
| Weak testing | Unidentified gaps | Realistic scenarios |
| Siloed structures | Fragmentation | Cross-functional teams |
| Lack of ownership | Weak governance | Executive accountability |
| Tech over-reliance | Incomplete resilience | Holistic approach |
| Poor sustainability | Programme decay | Continuous improvement |
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/801c11f6-14e1-45e6-b75d-ff17885348f2)
The journey towards operational resilience is not without its challenges. While frameworks and methodologies provide a clear path, successful implementation depends on how organisations navigate the practical realities of execution.
The challenges outlined in this chapter highlight a common theme: operational resilience cannot be achieved through isolated efforts, documentation, or technology alone.
It requires a coordinated, organisation-wide approach that integrates governance, risk, compliance, and operations into a unified capability.
By recognising these pitfalls early and applying the outlined mitigation strategies, organisations can avoid common mistakes and accelerate their resilience journey.
More importantly, they can move beyond theoretical preparedness to build a capability that is tested, adaptive, and sustainable.
In the final chapter, we will consolidate the key insights from this eBook and present a **clear roadmap for organisations to begin or enhance their operational resilience journey**.
| ###### Operational Resilience: Bridging Governance, Risk and Compliance Across Industries | | | | |
| --- | --- | --- | --- | --- |
| **ISACA 2026 Cybersecurity, IT Assurance, and Governance (CIAG) Conference** | | | | |
| **C1** | **C2** | **C3** | **C4** | **C5** |
| [![\[ISACA\] \[C1\] Bridging GRC Across Industries](https://no-cache.hubspot.com/cta/default/3893111/4056c202-1430-4e6b-b692-30c7beba4701.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4056c202-1430-4e6b-b692-30c7beba4701) | [![\[ISACA\] \[C2\] Why OR Matters Now](https://no-cache.hubspot.com/cta/default/3893111/5db0406a-8925-4f78-ac00-493ec9b40283.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/5db0406a-8925-4f78-ac00-493ec9b40283) | [![\[ISACA\] \[C3\] Understanding OR Concept & Framework](https://no-cache.hubspot.com/cta/default/3893111/daa721cd-a788-4825-9b36-39d71e919ce2.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/daa721cd-a788-4825-9b36-39d71e919ce2) | [![\[ISACA\] \[C4\] The GRC Disconnect](https://no-cache.hubspot.com/cta/default/3893111/78667faf-f49a-420b-8a12-e0d081f9794d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/78667faf-f49a-420b-8a12-e0d081f9794d) | [![\[ISACA\] \[C5\] Bridging GRC Through OR](https://no-cache.hubspot.com/cta/default/3893111/8c6ff496-7b97-4e21-b176-f50ddf5bc98e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/8c6ff496-7b97-4e21-b176-f50ddf5bc98e) |
| **C6** | **C7** | **C8** | **C9** | |
| [![\[ISACA\] \[C6\] Implementation Framework](https://no-cache.hubspot.com/cta/default/3893111/8dc8d748-0278-4d76-9c36-27a3009290a4.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/8dc8d748-0278-4d76-9c36-27a3009290a4) | [![\[ISACA\] \[C7\] Cross-Industry Application](https://no-cache.hubspot.com/cta/default/3893111/3a6d8e9b-4c2e-4026-9d43-8615856cb3d6.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3a6d8e9b-4c2e-4026-9d43-8615856cb3d6) | [![\[ISACA\] \[C8\] Key Challenges & Pitfalls](https://no-cache.hubspot.com/cta/default/3893111/c36846d0-9189-4393-bf14-5ff20fbd02d2.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c36846d0-9189-4393-bf14-5ff20fbd02d2) | [![\[ISACA\] \[C9\] Summing Up](https://no-cache.hubspot.com/cta/default/3893111/05c8b887-0736-4f91-8999-26414e1578ef.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/05c8b887-0736-4f91-8999-26414e1578ef) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0f14396-4e25-42c7-9ebd-1b6159bf45c7) |
| | | | | |
**[](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)**
For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the **OR-5000 Operational Resilience Expert Implementer course**, provide in-depth insights and practical toolkits for effectively embedding this model.
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
To learn more about the course and schedule, click the buttons below for the \[OR-3\] OR-300 Operational Resilience Implementer course and the \[OR-5\] OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Your Comments Here:**
### More Posts
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/d41714c9-8019-4282-95bf-08d62ddc4710)
All rights reserved. Copyright 2026