2. How is the ORA different from the Technical Resilience Assessment (TRA)?

They're standalone companion assessments sharing one evidence base and one maturity scoring framework. The TRA serves technical teams with detailed findings and remediation; the ORA serves executives, boards and risk committees with decision-ready business insight. Take either on its own, or both — the two reports tell one consistent story to two audiences.

3. What is the Resilience–Growth view?

It's our distinctive two-axis scoring approach. Every finding is scored for capability (0–4 maturity) and for growth impact (▲▲ to ▼▼) — a directional indicator of how it bears on your stated business objectives. This shows you not just where you stand, but where to invest first: the priority quadrant is where low capability meets a material threat to growth.

5. Is the ORA an audit or compliance assessment?

Neither. It's an assessment, not an audit — collaborative and blame-free, built to find improvement, not fault. And its regulatory section is relevance signposting, not a compliance verdict: it shows where findings relate to FCA/PRA and DORA expectations, but confirming a compliance position requires a dedicated readiness assessment, which we offer separately.

7. Who should attend the ORA session?

The people accountable for the critical services and the growth objectives — typically COOs, operations directors, service owners, heads of risk and risk-committee members. Their perspective is what allows findings to be framed against real business goals.

8. Which regulations does the ORA cover?

For UK firms, findings are signposted against the FCA/PRA operational resilience regime (PS21/3 and SS1/21) and the critical third parties regime (PS16/24). Where you have EU exposure, operations, group entities or ICT services to EU financial entities, findings are also mapped to the relevant DORA themes, such as ICT third-party risk, incident detection and resilience testing.

9. Do we need to have done technical assessments or tabletop exercises first?

The ORA stands alone. It's a natural next step if you've run tabletop exercises (they test the day; the ORA measures underlying resilience), and having done the ORA, the TRA is the logical companion for your technical teams — but neither is a prerequisite for the other.

10. What does the final report look like?

A board- and risk-committee-ready document: executive summary and headline position table, findings in business terms (business impact, affected functions, why the board should care, recommended action), a risk heat map, regulatory relevance mapping, a maturity trajectory with a phased 0–12 month roadmap, and areas of strength.

11. How often should we re-assess?

Annually, or sooner after material change — a new critical service, a major platform migration, an acquisition or a significant third-party change. Re-assessment evidences progression up the maturity levels and demonstrates the return on your remediation investment.

12. Is this only for financial services firms?

No. Regulatory expectations are most developed in financial services, which is why the ORA's signposting focuses there — but any organisation with critical services, growth ambitions and dependency risk benefits from a board-level view of its resilience. The methodology, maturity model and Resilience–Growth view apply across sectors.

Operational Resilience Assessment

What Is an Operational Resilience Assessment?

An Operational Resilience Assessment (ORA) measures your organisation's ability to keep critical services running through serious disruption. It translates the findings into the language of the board: Business impact, growth implications and regulatory relevance.

It is an assessment, not an audit. It's collaborative, blame-free and built to inform decisions, not apportion fault. Where technical assessments speak to IT teams, the ORA speaks to the people accountable for the services and the growth objectives: Operational managers, executives, risk committees and boards.

Every finding is presented in plain language, scored on the five-level CM-Alliance Resilience Maturity Model, and uniquely assessed for its bearing on your stated growth objectives through our proprietary Resilience–Growth view.

The result: A decision-ready picture of where your genuine exposures sit, which ones threaten your growth plans, what they mean for regulatory expectations, and a prioritised, costed roadmap suitable for budget and risk-register decisions.

Why Should Your Organisation Conduct an Operational Resilience Assessment?

Boards are increasingly expected to own operational resilience — but most resilience reporting arrives as technical detail the board can't act on, or reassurance it can't verify. The ORA solves both problems. Let's look at the main reasons why organisations commission one.

Book A Discovery Call

Reason #1: Boards need board-level information

The ORA gives executives and risk committees a plain-language view of how resilient critical services really are and where the genuine exposures sit. The insights provided are decision-ready, not jargon-heavy.

Reason #2: Connects resilience spend to growth

The Resilience–Growth view explicitly links each finding to your stated business objectives. You see which exposures could slow or threaten those goals, and which strengths enable them, so investment is prioritised where it matters most.

Reason #3: Rising regulatory expectations for financial services

With the UK operational resilience regime (FCA PS21/3, PRA SS1/21) now in its ongoing operational phase, firms must continuously update their mapping, testing, and self-assessments. Concurrently, the critical third parties regime (PS16/24) targets concentration risk at the sector level. DORA has been in effect since January 2025 for organisations with EU exposure. The ORA distinctly signposts exactly how your specific findings intersect with these regulatory expectations.

Reason #4: Concentration and third-party risk are key causes of disruption

Dependencies on single platforms, suppliers and shared services are among the most common causes of serious operational disruption. The ORA surfaces these critical dependencies and frames their overall business consequence, before they disrupt your operations. Rather than focusing on dense technical details, the ORA exposes concentration risk by framing single-platform and third-party dependencies in plain business language that clearly defines why the board should care and what action is required.

Reason #5: Defensible basis for the risk register and budget

Findings arrive with a risk heat map, prioritised roadmap, indicative timelines and effort estimates that map directly onto a corporate risk register. This gives the board a defensible basis for prioritisation and spend.

Reason #6: Helps demonstrate progress over time

Re-assessing later evidences your movement up the maturity levels and demonstrates the return on remediation investment — a compelling story for regulators, insurers, customers and investors alike.

Operational Resilience Assessment Board Meeting (1)

How the Operational Resilience Assessment Works

One focused session. Board-ready output.

Scoping conversation. A short call to define the services or domain in scope, capture your stated growth objectives, and confirm participants.
A single facilitated session. One to two hours with your operational managers and board-level owners, i.e. the people accountable for the services and the growth objectives.
Practitioner-led, scenario-based, interactive.
Two-axis scoring. Every finding scored for capability (0–4 maturity) and growth impact (▲▲ to ▼▼), positioned on the Resilience–Growth quadrant.
Your board-ready report. Executive summary, findings in business terms, risk heat map, regulatory relevance signposting, maturity trajectory and a phased 12-month roadmap.
Re-assess to prove progress. Annual re-assessment (or after material change) evidences maturity progression and remediation ROI.

We handle preparation, facilitation and reporting — demand on your team is a single session.

MORE INFO

Regulatory Relevance of an Operational Resilience Assessment in the UK and EU

For UK-authorised financial services firms, the operational resilience framework is set by the FCA (PS21/3, "Building operational resilience") and the PRA (SS1/21). With the transitional period ended in March 2025, firms are now in the ongoing operational phase: mapping, testing and self-assessment must be kept current, and firms are expected to remain within impact tolerances for important business services. Separately, the critical third parties regime (PS16/24) addresses concentration and third-party dependency at sector level.

Where your organisation has EU operations, group entities, or acts as an ICT provider to EU financial entities, the Digital Operational Resilience Act (DORA) — applicable since 17 January 2025 — becomes relevant, spanning ICT risk management, incident reporting, resilience testing, third-party risk and the register of information.

The ORA signposts where your findings relate to these expectations. It is relevance signposting, not a compliance assessment — where a formal position is needed, we offer dedicated FCA/PRA and DORA readiness assessments as separate, deeper engagements.

BOOK A DISCOVERY CALL

Operational Resilience Framework and DORA Compliance Guidelines-1 (1)

The Resilience–Growth View: Not Just Risk — Growth

Most assessments tell you how exposed you are. The ORA goes further: it shows you what each finding means for your growth.

Every finding is scored on two separate axes:

Capability (Maturity): How prepared you are, scored 0–4 on the CM-Alliance Resilience Maturity Model.
Growth impact (Consequence): A directional indicator of how the finding helps or hinders your stated business objectives.

You learn not just where you stand, but where to invest first: The priority quadrant is where low capability meets a material threat to growth, and that's where board attention delivers the greatest return.

(Note: Growth impact is a directional prioritisation aid tied to your own stated objectives, not a financial forecast, valuation or quantified revenue prediction.)

What You Receive from an Operational Resilience Assessment

A plain-language executive summary

How resilient your critical services are and where the genuine exposures sit.

A risk heat map

Likelihood vs business impact, mapping directly onto your corporate risk register.

The Resilience–Growth view

Every finding positioned by capability and by its directional bearing on your growth objectives.

Regulatory relevance signposting

Where findings relate to FCA/PRA operational resilience expectations (PS21/3, SS1/21, PS16/24) and, where relevant, EU DORA.

A maturity trajectory and phased roadmap

Current vs 12-month target maturity per scenario, sequenced by priority and effort.

A technical companion option

The Technical Resilience Assessment gives your IT teams the detailed findings and remediation behind the same evidence base.

What Does The Assessment Cover?

The exact scope is agreed during a short scoping conversation. The ORA can focus on a critical business service, operational domain, technology-enabled service, regulatory exposure, growth objective or resilience programme.

Typical areas covered include:

- Critical business services and the technology that supports them
- Important operational dependencies
- Platform, supplier and concentration risks
- Business impact of severe disruption
- Growth objectives affected by resilience gaps
- Executive ownership and accountability
- Service continuity and recovery assumptions
- Risk-register relevance
- Operational resilience maturity
- Regulatory relevance, where applicable
- Roadmap for improvement and reassessment

When Should You Complete an Operational Resilience Assessment?

An ORA is valuable when leadership needs a clear, business-facing view of resilience. Good triggers include:

- Before a board or risk committee review
- When launching a new critical digital service
- When entering a new regulated market
- After a major outage, cyber incident or near miss
- During operational resilience programme delivery
- When critical services depend on a small number of suppliers or platforms
- When technology risk needs to be translated into business risk
- Before major investment in resilience, continuity or recovery capability
- After completing a Technical Resilience Assessment
- When you need to evidence progress against resilience maturity

Key Benefits of our Operational Resilience Assessment

Book a Scoping Call

Board-ready clarity from day one

Give senior leaders a clear, plain-language view of resilience capability, business impact and priority actions. No translation needed between IT and the boardroom.

Investment prioritised against growth

See which exposures threaten your product launches, market expansion or customer growth, and fund those first.

Regulatory confidence

Clear signposting of where findings relate to UK and EU operational resilience expectations.

Concentration risk exposed

Single-platform and third-party dependencies framed in business consequence, not technical detail.

Risk-register ready

Heat map, priorities, owners and timelines that drop straight into governance processes.

Minimal disruption

The actual Operational Resilience Assessment is one focused session of 1–2 hours; we do the rest.

A measurable maturity journey

A defensible baseline today, a realistic 12-month target and re-assessment to prove the progress.

Confidence, not fear

Document the resilience capabilities that enable business performance and should be protected as the organisation grows.

Life After Tabletops — Where the Operational Resilience Assessment Fits

Tabletop exercises test how your organisation responds on the day. The ORA measures your underlying operational resilience — and frames it against your growth objectives and regulatory expectations. If your board has seen exercise reports and asked "so how resilient are we, really — and what should we spend on it?", the ORA is the answer.

Who Should Take Part?

The ORA engages your operational managers and board-level owners — the people accountable for the critical services and for the growth objectives.

Recommended participants include:
- Chief Operating Officer
- Chief Risk Officer
- Chief Information Officer
- Chief Information Security Officer
- Business service owners
- Operational resilience leads
- Business continuity leads
- Technology risk leaders
- Compliance or regulatory affairs representatives
- Third-party risk owners
- Board or risk committee representatives where appropriate

For the detailed technical picture behind the same findings, pair the ORA with its companion, the Technical Resilience Assessment (TRA), which engages your technical and IT leads.

The ORA works best when operational, technical and executive perspectives are represented. The goal is to connect how services operate in practice with the decisions senior leaders need to make about resilience, growth and risk.