[OR] [PM] [P3] [T] [J] Self-assessment Questionnaire

Sustain Phase Appendices

:

• Introduce Change Management
• Develop Communication Strategy 
• Implement Training and Awareness
• Provide Self-Assessment
  
• Conduct an Independent Quality Review

The templates should be adapted to reflect the organisation’s size, complexity, regulatory environment, risk profile, governance structure, and operational resilience maturity.

Appendix J: Self-assessment Questionnaire 

Governance

• Is an approved operational resilience framework in place?
• Are Board and senior management responsibilities defined?
• Are critical business service owners formally assigned?
• Does management receive regular resilience reporting?
• Are high-risk weaknesses escalated appropriately?

Critical Business Services

• Are critical business services clearly defined?
• Are identification criteria documented?
• Are services periodically reviewed?
• Are service owners accountable?
• Are material organisational changes reflected?

Interconnections and Interdependencies

• Are people dependencies documented?
• Are process dependencies documented?
• Are technology dependencies documented?
• Are facility dependencies documented?
• Are information and data dependencies documented?
• Are third-party dependencies documented?
• Are single points of failure identified?
• Are concentration risks understood?
• Are maps updated following material change?

Impact Tolerance

• Are impact tolerances established?
• Are tolerances supported by appropriate analysis?
• Are customer impacts considered?
• Are tolerances approved?
• Are tolerances reviewed periodically?
• Are tolerances used in scenario testing?
• Are breach escalation procedures documented?

Scenario Testing

• Is a structured testing programme established?
• Are scenarios severe but plausible?
• Are critical dependencies challenged?
• Are third-party failures included where relevant?
• Are technology disruptions included?
• Are communication arrangements tested?
• Are lessons documented?
• Are remediation actions tracked?

Cultural Change

• Has resilience culture been assessed?
• Are desired behaviours defined?
• Does senior management visibly support resilience?
• Are employees encouraged to escalate concerns?
• Is resilience incorporated into business decisions?

Communication

• Is a communication strategy documented?
• Are stakeholders identified?
• Are alternative communication channels established?
• Are customer communication arrangements documented?
• Are regulatory notification arrangements defined?
• Are communication channels tested?

Training and Awareness

• Has a training needs analysis been completed?
• Is training role-based?
• Are key roles exercised?
• Is competency assessed?
• Are training records maintained?
• Are deputies and alternates trained?

Self-assessment and Assurance

• Is self-assessment evidence-based?
• Are findings consistently rated?
• Are repeated findings highlighted?
• Is independent review established?
• Are reviewers sufficiently independent?
• Are significant findings independently validated?
• Are high-risk actions retested?

"Plan" Phase of the OR Planning Methodology