[OR] [P3] [S4] [SA] [1-2] Prepare Self-Assessment: Identify Assessment Criteria

[1-2] Identifying Assessment Criteria

The self-assessment stage in the Sustain phase of the Operational Resilience (OR) planning methodology requires a clear set of criteria to evaluate your organisation's resilience performance.

These criteria should align with your OR strategy and be measurable, relevant, and practical to implement.

When selecting assessment criteria, consider risk management effectiveness, adequacy of business continuity planning, technology resilience, employee awareness, regulatory compliance, and performance indicators.

By carefully choosing these criteria, you can gather the necessary data to assess your organisation's strengths and weaknesses and identify areas for improvement.

Purpose

Once you've defined the scope and objectives of your self-assessment in the Sustain phase of the Operational Resilience (OR) planning methodology, the next step is to identify the specific criteria for evaluating your organisation's resilience.

These criteria should align with your overall OR strategy and objectives.

Key Considerations

• Alignment with OR Strategy: Ensure the assessment criteria are directly related to your organisation's OR goals and objectives.
• Measurability: Choose criteria that can be quantified or measured to provide tangible evidence of progress.
• Relevance: Select criteria that are relevant to your specific industry, regulatory requirements, and organisational context.
• Practicality: Avoid criteria that are overly complex or difficult to collect data for.

Potential Assessment Criteria

• Risk Management
  • Effectiveness of risk identification and assessment processes
  • Adequacy of risk mitigation strategies
  • Compliance with regulatory requirements related to risk management
    
    
• Business Continuity Planning
  • Completeness and comprehensiveness of BC and DR Plans
  • Regularity of testing and updating plans
  • Effectiveness of incident response procedures
    
    
• Technology Resilience
  • Security posture of IT infrastructure and systems
  • Data backup and recovery capabilities
  • Business continuity planning for IT systems
    
    
• Employee Awareness and Preparedness
  • Level of employee understanding of OR principles and procedures
  • Participation in training and exercises
  • Compliance with OR-related policies and procedures
    
    
• Regulatory Compliance
  • Adherence to relevant industry regulations and standards
  • Effectiveness of compliance monitoring and reporting
    
    
• Performance Indicators
  • Key performance indicators (KPIs) related to operational resilience, such as downtime, financial losses, or customer satisfaction.

By carefully selecting assessment criteria, you can gather the necessary data to evaluate your organisation's OR performance, identify areas for improvement, and demonstrate compliance with regulatory requirements.

Additional Explanatory Note 

	Definition	Explanation	Definition
	Self-Assessment	is to capture and document the steps taken towards operational resilience. is to provide a comprehensive and objective evaluation of the organisation's strategy and ability to respond to disruptions.
	Self-Assessment Document	is to demonstrate the organisation’s resilience journey and how they have achieved compliance with the regulations.
	Important Business Service	is a service provided by an organisation, or by another person on behalf of the organisation, to one or more clients which, if disrupted, could: cause intolerable harm to any one or more of the organisation’s clients, or pose a risk to the soundness, stability or resilience of the financial system or the orderly operation of the financial markets.
	Critical Business Service	is a business service that, if disrupted, is likely to significantly impact the FSI’s safety and soundness, its customers or other FSIs that depend on the business service.
	Critical Operations	Is defined as a business output that, if interrupted during the operational period, will cause financial loss, damage, or interruption to the delivery of goods or services essential to the organisation’s continued operation or success.

"Sustain" Phase of the OR Roadmap

Introduce Culture Change	Develop Communication Strategy	Implement Training and Awareness	Provide Self-assessment	Conduct Independent Quality Review

More Information About Operational Resilience OR-5000 [BL-OR-5] or OR-300 [BL-OR-3] Course

To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.