What are the key elements of a business continuity plan and how does it relate to operational resilience?

Business Continuity Planning (BCP) is the process of preparing for, responding to, and recovering from disruptive events that could prevent a firm from performing its critical business functions. Post-2020, regulators have expanded BCP into a broader concept called 'operational resilience.'

Core BCP Components:

1. Business Impact Analysis (BIA)

• Identifies critical business services and functions
• Determines Maximum Tolerable Downtime (MTD) for each function
• Establishes Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)
• Maps dependencies (systems, personnel, third parties, data)

1. Risk Assessment

• Identifies threats: natural disasters, cyber attacks, pandemics, infrastructure failures, vendor outages
• Assesses likelihood and potential impact of each threat
• Prioritizes scenarios for detailed planning

1. Recovery Strategies

• Alternate processing sites (hot, warm, cold sites)
• Data backup and restoration procedures
• Workforce relocation or remote work capabilities
• Communication plans (internal and external)
• Vendor contingency arrangements

1. Plan Documentation and Maintenance

• Written procedures for each critical function
• Contact lists, escalation matrices, decision trees
• Regular updates (at least annually and after significant changes)

1. Testing and Exercises

• Tabletop exercises (walk-through discussions)
• Functional tests (testing specific recovery procedures)
• Full-scale simulations (end-to-end recovery testing)
• Testing frequency: at least annually for critical functions

From BCP to Operational Resilience:

Traditional BCP focuses on recovering FROM disruptions — getting back to normal after an event. Operational resilience focuses on operating THROUGH disruptions — maintaining critical services even during stress.

Regulatory Expectations (Key Jurisdictions):

• UK PRA/FCA: Important Business Services must have defined impact tolerances and be able to remain within them during severe but plausible scenarios
• US (OCC/Fed/FDIC): Sound practices for operational resilience, emphasis on third-party risk and cyber resilience
• Basel Committee: Principles for Operational Resilience (2021) — seven principles covering governance, risk management, BCP, dependencies, and testing

Exam Tip: FRM II tests the difference between traditional BCP (recovery-focused) and operational resilience (continuity-focused), and the key components like BIA, RTO/RPO, and testing requirements.

Study operational resilience frameworks in our FRM Part II materials.