Insights — Research Paper
Abstract
Operational resilience regulation is frequently implemented as a documentation exercise — impact tolerance statements written, important business services mapped. This paper argues resilience is tested by actual incidents, not documentation, and that the control nobody clearly owns is consistently the one that fails first.
Recommends scenario testing designed to genuinely surprise the institution being tested, rather than testing against scenarios the organisation is already confident it can pass.
Read the full paper for the complete argument, evidence, and recommendations.
Nina Kapoor — Head of Risk & Compliance Advisory