Risk Management for Business Continuity & Operational Resilience Training Course

Supervisors, boards and customers increasingly judge organisations not on whether disruption happens but on how well critical services keep running when it does. Banking supervisors have moved from asking for recovery plans to expecting firms to identify their important business services, set tolerances for disruption and prove through testing that they can stay within them. Similar expectations are spreading to insurers, utilities, payment providers and public bodies, and meeting them requires continuity planning to rest on sound risk analysis rather than templates.

The Risk Management for Business Continuity & Operational Resilience Training Course brings the two disciplines together. Participants begin with the ISO 31000 risk process and the Basel Committee Principles for Operational Resilience, then map important services and their dependencies on people, technology, premises, data and suppliers. They assess threats and vulnerabilities, quantify how the impact of disruption grows over time, set recovery time objectives and impact tolerances, and choose treatment options ranging from redundancy and diversification to insurance and manual workarounds. Later sessions address outsourcing and concentration risk, indicator design, scenario testing and the reporting of residual resilience risk to senior management.

Delivery is workshop based. Participants work through a single case organisation from start to finish, building a risk register, a dependency map and a scenario test plan that they can adapt to their own institution.

Participants completing the programme will be able to:

• Apply the ISO 31000 risk management process to continuity and resilience decisions.
• Identify important business services and map their dependencies on people, systems, sites, data and suppliers.
• Assess threats, vulnerabilities and single points of failure that could interrupt critical operations.
• Conduct a business impact analysis that shows how losses escalate over time.
• Set recovery time objectives, recovery point objectives and impact tolerances that reflect risk appetite.
• Evaluate treatment options against their cost and the residual risk they leave.
• Design severe-but-plausible scenario tests and use the results to close resilience gaps.
• Report resilience risk to boards using key risk indicators and clear escalation thresholds.

The programme is built for professionals who own, assess or challenge continuity and resilience risk, such as:

• Enterprise and operational risk managers
• Business continuity managers and coordinators
• Chief risk officers and heads of resilience
• ICT disaster recovery and information security managers
• Internal auditors reviewing continuity arrangements
• Compliance officers in banks, insurers and payment service providers
• Facilities, operations and supply chain managers
• Risk and resilience staff in utilities, telecoms, health and public agencies

By the final day, each participant holds:

• A resilience risk register linking threats to the services they would disrupt.
• A dependency map for one important business service, including third parties.
• A completed business impact analysis worksheet with time-based loss estimates.
• Draft impact tolerance statements ready for management review.
• A scenario test plan with objectives, injects and success criteria.
• A set of key risk indicators with thresholds and named owners.
• A one-page board report template for residual resilience risk.
• An improvement action list prioritised by the risk reduction each action delivers.

Learning is anchored in one case organisation that participants analyse from risk scoping through to testing. Methods include:

• Concise briefings on ISO 31000, ISO 22301 and supervisory resilience expectations
• Facilitated mapping workshops using dependency and impact worksheets
• Bow-tie and risk scoring exercises in small groups
• A budget-constrained treatment selection challenge
• A timed tabletop scenario with injects and a structured debrief
• Peer review of risk registers and board reports

Delegates who are present for all five days and complete the case organisation exercises, including the risk register and scenario test plan, receive a CPD-accredited Certificate of Completion issued by Vision Reach Global Consultancy.

The certificate lists the course title, dates and delivery mode, making it suitable evidence for continuing professional development records.