[OR] [PM] [P3] [T] [J] Self-assessment Questionnaire

Sustain Phase Appendices

:

• Introduce Change Management
• Develop Communication Strategy 
• Implement Training and Awareness
• Provide Self-Assessment
  
• Conduct an Independent Quality Review

The templates should be adapted to reflect the organisation’s size, complexity, regulatory environment, risk profile, governance structure, and operational resilience maturity.

Appendix J: Self-assessment Questionnaire 

Governance

• Is an approved operational resilience framework in place?
• Are Board and senior management responsibilities defined?
• Are critical business service owners formally assigned?
• Does management receive regular resilience reporting?
• Are high-risk weaknesses escalated appropriately?

Critical Business Services

• Are critical business services clearly defined?
• Are identification criteria documented?
• Are services periodically reviewed?
• Are service owners accountable?
• Are material organisational changes reflected?

Interconnections and Interdependencies

• Are people dependencies documented?
• Are process dependencies documented?
• Are technology dependencies documented?
• Are facility dependencies documented?
• Are information and data dependencies documented?
• Are third-party dependencies documented?
• Are single points of failure identified?
• Are concentration risks understood?
• Are maps updated following material change?

Impact Tolerance

• Are impact tolerances established?
• Are tolerances supported by appropriate analysis?
• Are customer impacts considered?
• Are tolerances approved?
• Are tolerances reviewed periodically?
• Are tolerances used in scenario testing?
• Are breach escalation procedures documented?

Scenario Testing

• Is a structured testing programme established?
• Are scenarios severe but plausible?
• Are critical dependencies challenged?
• Are third-party failures included where relevant?
• Are technology disruptions included?
• Are communication arrangements tested?
• Are lessons documented?
• Are remediation actions tracked?

Cultural Change

• Has resilience culture been assessed?
• Are desired behaviours defined?
• Does senior management visibly support resilience?
• Are employees encouraged to escalate concerns?
• Is resilience incorporated into business decisions?

Communication

• Is a communication strategy documented?
• Are stakeholders identified?
• Are alternative communication channels established?
• Are customer communication arrangements documented?
• Are regulatory notification arrangements defined?
• Are communication channels tested?

Training and Awareness

• Has a training needs analysis been completed?
• Is training role-based?
• Are key roles exercised?
• Is competency assessed?
• Are training records maintained?
• Are deputies and alternates trained?

Self-assessment and Assurance

• Is self-assessment evidence-based?
• Are findings consistently rated?
• Are repeated findings highlighted?
• Is independent review established?
• Are reviewers sufficiently independent?
• Are significant findings independently validated?
• Are high-risk actions retested?

"Plan" Phase of the OR Planning Methodology

Assess Capability and Maturity	Analyse Gap	Develop Strategy and Roadmap	Confirm Risk Appetite	Develop and Embed Governance

More Information About Blended Learning OR-5000 [BL-OR-5] or OR-300 [BL-OR-3]

Contact our course consultant colleagues to learn more about our blended learning program and about the next course's schedule.  They are the BL-OR-3 Blended Learning OR-300 Operational Resilience Implementer and the BL-OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer.

 

	If you have any questions, click to contact us.