NQA Measuring Operational Resilience Guide
0 likes78 views
The document outlines a framework for measuring operational resilience within organizations, emphasizing the necessity of governance in managing operational risk for business continuity. It details a customizable method for assessing resilience, including steps like risk analysis, implementation of controls, and testing, allowing organizations to identify vulnerabilities and continuously improve. Benefits include quick assessments that can drive audits and are simple to use without requiring specific expertise.
NQA Measuring Operational Resilience Guide
- 2. INTRODUCTION Any threat to operational resilience is also a risk to business viability and continuity. The role in which governance and managerial entities play in controlling operational risk is directly linked to financial performance and reduction of losses through ensuring continuity of business services. Operational resilience is the ability to alter operations in the face of changing business conditions. It is the ability to quickly ramp up or slow down with quick and local process modification. An operationally resilient organisation is operating within the Plan Do Check Act cycle. It is continuously: • Finding and assessing its vulnerabilities and its supply chain vulnerabilities • Reducing the likelihood of disruption with planning, controls, flexibility and redundancies • Detecting disruption in itself and supply chains • Measuring its operational resilience METHOD There are various methods for measuring operational resilience, some of which are complex, protracted and involve various disciplines. Yet often the best way is the simplest way. This method is one of those, and the only requirement is that you know what you know and what you don’t know about your organisation. The method is explained using an example which is entirely customizable – you can change all the weighting values, scores, numbers and structures of the objectives and tasks. The important thing to note is that whatever you do, make sure it’s repeatable so you can carry out before and after measurements as part of your internal governance processes. It is often best achieved by a group of people from within the organisation. BENEFITS • Demonstrates continuous improvement towards objectives, and can help drive internal audit planning • Quick and requires no expertise, just knowledge of the performance of your organisation and key suppliers • A powerful presentational tool for top management • Customizable • Used to measure other business functions or capabilities, such as security or procurement
- 3. STEP BY STEP Overall Objective Objectives Tasks Activities OPERATIONAL RESILIENCE Overall Objective Objectives Measuring your organisation’s operational resilience is the overall objective. This comprises 3 main objectives (or whatever you choose): • Perform a risk analysis of the organisation • Implement controls • Test and maintain the controls STEP 1 1. Functionally decompose the objectives into tasks 2. Functionally decompose the tasks into activities STEP 2 Understand organisation Vulnerability assesment Strategy selection Business objectives Internal resources Business impact analysis Understanding strategies Test Strategic External resources Risk assesment Strategy selection Maintenance Operational Business continuity plans Test and maintenance OPERATIONAL RESILIENCE Risk analysis Risk analysis Implementation Test and maintenance Communication Leadership Generic risk control Implementation of risk treatment BCM embedded Training Risk transfer Cultural aspects Supplier management Prevention Incident reporting Human resource Physical resource Implementation
- 4. Overall Objective Objectives Tasks 1. Assign a weighting to each objective. The sum of the weightings must be 1. 2. Assign a weighting to each task. The sum of each objective group of tasks must be 1. STEP 3 Overall Objective Objectives Tasks Activities 1. Assign a weighting to each activity, so that for each parent task, they add up to 1. STEP 4 0.323 Risk analysis 0.588 Implementation 0.089 Test and maintenance 0.250 Understand organisation 0.425 Vulnerability assesment 0.250 Strategy selection 0.400 Leadership 0.400 Generic risk control 0.200 Implementation of risk treatment 0.075 Business objectives OPERATIONAL RESILIENCE 0.323 Risk analysis 0.588 Implementation 0.089 Test and maintenance 0.250 Understand organisation 0.425 Vulnerability assesment 0.250 Strategy selection 0.400 Leadership 0.400 Generic risk control 0.200 Implementation of risk treatment 0.075 Business objectives 0.500 Internal resources 0.500 Business impact analysis 0.118 Understanding strategies 0.667 BCM embedded 0.141 Training 0.066 Risk transfer 0.250 Test 0.167 Strategic 0.500 External resources 0.500 Risk assesment 0.268 Strategy selection 0.333 Cultural aspects 0.263 Supplier management 0.249 Prevention 0.750 Maintenance 0.833 Operational 0.614 Business continuity plans 0.141 Incident reporting 0.312 Human resource 0.455 Communication 0.373 Physical resource OPERATIONAL RESILIENCE
- 5. Assign a score from between 0 and 1 to each activity (shown in brown). This is a subjective assessment of how optimal the task is, although if you have data to support your assessment then all the better. The score reflects your confidence in the task, and if you don’t know then give it a low score. This is deliberately subjective; it should be a quick debate. Some organisations define criteria for scoring e.g. what good and bad is. STEP 5 0.118 0.90 Understanding strategies 0.268 0.91 Strategy selection 0.614 1.00 Business continuity plans Multiply the score by the weighting. The product is shown in green. STEP 6 0.105 Understanding strategies 0.244 Strategy selection 0.614 Business continuity plans 1. The sum of the products is the score for the parent task (shown in pink). 2. Multiply the sum by the weighting to give the weighted score (shown in blue). STEP 7 0.105 Understanding strategies 0.244 Strategy selection 0.241 Strategy selection 0.250 0.963 0.614 Business continuity plans *as taken from above
- 6. OPERATIONAL RESILIENCE www.nqa.com Overall Objective Objectives Tasks Activities Risk analysis Implementation Test and maintenance Understand organisation Vulnerability assesment Strategy selection Leadership Generic risk control Implementation of risk treatment Business objectives Test Maintenance 1. For each objective group of tasks, add up the task’s weighted scores (sum shown in pink). 2. Multiply the sum by the objective’s weighting (product shown in purple). 3. Add up the products to give the overall operational resilience assessment score (shown in red). STEP 8 0.842 0.004 0.089 0.053 0.518 0.588 0.882 0.320 0.323 0.991 0.250 0.00 0.075 0.250 0.425 0.241 0.400 0.395 0.087 0.750 0.07 ASSESSMENT SCORE The example assessment score doesn’t say the organisation is 86% operationally resilient. It is measure by which a higher score is almost certainly better than a lower score. But more importantly, it quickly identifies strengths, weaknesses or a lack of knowledge in certain areas. By applying criteria to the assessment it can be represented as a heat map for presentation purposes. Objectives Risk Analysis Implementation Test and Maintenance Tasks Risk Analysis Understand Organisation Vulnerability Assesment Strategy selection Leadership Generic risk control Implementation of risk treatment Activities Strategic Internal BIA Understand BCM Embedded Training Transfer Test Maintenance Operational External Risk Select BCM Culture Suppliers Prevent Incidents Human resources Comms Physical resources BCP NQA, Warwick House, Houghton Hall Park, Houghton Regis, Dunstable, Bedfordshire LU5 5ZX, United Kingdom T: 0800 052 2424 E: info@nqa.com @nqaglobal