Operational resilience is no longer only about business continuity plans, disaster recovery sites or crisis manuals. Organisations fail when critical services are interrupted, technology dependencies break, data integrity is compromised, vendors underperform, insiders exploit control gaps, or outsourced partners quietly prioritise larger or higher-paying clients.
This book presents operational resilience as a practical governance, fraud-risk and risk-assessment discipline for boards, senior executives, risk professionals, internal auditors, compliance teams, technology leaders and regulators. It explains why resilience must move beyond documentation and become a tested organisational capability: the ability to continue delivering important services through disruption, fraud, cyber compromise, third-party failure and operational stress.
The book examines the core building blocks of a resilient organisation, including governance and accountability, critical operations, impact tolerances, dependency mapping, scenario testing, technology resilience, cyber resilience, data integrity, crisis communication, recovery planning, assurance, KRIs and continuous monitoring. It also focuses on the risks often hidden inside business continuity and resilience frameworks: vendor concentration, outsourcing dependency, supply-chain compromise, insider threat, collusion, weak data quality, poor escalation and the failure to prioritise key resilience requirements until after an incident occurs.
A particular emphasis is placed on third-party and vendor resilience. Modern organisations depend on cloud providers, SaaS platforms, processors, logistics partners, consultants and specialised service vendors. These relationships create efficiency, but also hidden exposure. A vendor may have strong documentation but weak execution. A control may exist on paper but fail during stress. Sub-vendors may remain outside effective oversight. A trusted insider or collusive external party may exploit gaps that traditional continuity planning never considered.
Too often, boards are assured that “strong agreements are in place” while the real questions remain unanswered: Have supply-chain controls been tested? Can critical vendors perform under stress? Will the organisation receive priority during a crisis? Are KRIs strong enough to detect emerging failure, fraud or integrity risk before impact? Does assurance test operational reality, or only contractual comfort?
Drawing on regulatory developments and practical examples across financial services, technology, aviation, healthcare, supply chains and outsourced operations, this book challenges organisations to look beyond policies and agreements. Operational resilience is not merely about surviving disruption. It is about protecting trust when systems, people, vendors and controls are tested.