Standard Operating Procedures 51 Enterprise Topics ISO 22301 / ISO 31000 Aligned

Resilience360 Guided Knowledge Base

Enterprise operational workflows, calculation methodologies, governance responsibilities, and step-by-step procedures across the Resilience360 platform suite.

51 topics

Resilience360 Workspace Configuration Registry Org Units / Business Units Risk Categories Likelihood Scales Impact Scales User Manual & Guided Knowledge

Source Intelligence Workspace Risk Signals Register My Submitted Signals Signals for Review

Risk Management Workspace Enterprise Risk Register Remediation Actions (Treatments)

Business Impact Analysis (BIA) Workspace Critical Business Processes BIA Assessment & Target Recovery BIA Registries Overview IT Systems & Databases Facilities & Continuity Worksites Critical Roles & Personnel Vital Records & Documents

Business Continuity Plans Overview BCP Plans Register Recovery Playbooks & Action Steps Continuity Exercises & Drills BCP Invocation Log (Crisis Activation) BCP Templates & Playbook Archetypes Continuity Review & Drill Schedules BCP Exceptions & Overdue Reviews BCP Findings & Corrective Actions Continuity Readiness Dashboard Board Business Continuity Pack

Sustainability & BSP Workspace Sustainability Overview & Targets Sustainability Board Summary Business Sustainability Plans Register Sustainability KPIs Strategic Sustainability Initiatives Sustainability Governance Reviews ESG Strategic Pillars Sustainability Plan Templates Sustainability Settings & Enablement

Executive Dashboards Hub Board Executive Dashboard Dynamic Risk Heatmap BIA & Critical Process Dashboard Remediation Actions Dashboard Source Signals Dashboard Board Exception Log Board Oversight Pack

Resilience Core & Governance Architecture

Foundational configuration, organization units, risk matrices, and likelihood/impact scales.

7 topics

Core Governance HELP_RESILIENCE_ROOT resilience.dashboard

Owner: Chief Risk Officer / Head of Operational Resilience

Resilience360 Workspace

Executive Summary: Central workspace orchestrating enterprise resilience, threat signals, risk registers, BIA continuity, and board assurance.

A. What is this?

The Resilience360 Workspace is the central enterprise orchestration hub that integrates inward threat intelligence, operational risk governance, business impact analysis (BIA), continuity playbooks (BCP), and sustainability tracking across conglomerate operating entities.

B. Why does it matter?

Operating without a unified resilience hub causes fragmented responses, uncoordinated risk tracking, regulatory reporting failures, and blind spots during catastrophic business disruptions.

C. When should it be used?

Use daily for operational risk monitoring, weekly during executive risk reviews, and continuously during major operational disruptions or regulatory examinations.

D. How do I use it? (Step-by-Step Instructions)

Navigate via the top navigation bar to access Source Signals, Risk Register, Business Continuity, Sustainability, or Board Dashboards. Select your entity context to filter records.

E. Who is responsible?

Primary Governance Accountability: Chief Risk Officer / Head of Operational Resilience

F. Practical Enterprise Example

At Blue Holdco Ltd, the Chief Risk Officer opens the workspace to review cross-subsidiary risk postures across Blue Bank, Blue Securities, and Blue Asset Mngt, ensuring all units adhere to group appetite limits.

G. What happens next?

Selecting any functional area opens the dedicated registry or dashboard while maintaining multi-company filtering and audit trail tracking.

H. Common Errors & Precautions

Failing to verify the active company context before analyzing metrics; mixing conglomerate-level appetite thresholds with subsidiary operational limits.

I. Key Fields & Calculations Explained

Active Entity: Determines multi-tenant data partitioning. Module Area: Segregates functional governance domains.

Related Concepts: HELP_RESILIENCE_CONFIG HELP_DASHBOARD_ROOT

Core Governance HELP_RESILIENCE_CONFIG resilience.risk.category

Owner: Resilience System Administrator / Enterprise Risk Lead

Configuration Registry

Executive Summary: Define foundational taxonomies, likelihood/impact scoring grids, and organizational units.

A. What is this?

The Configuration Registry establishes mathematical scales, taxonomies, scoring models, and organizational units that govern all analytical calculations in Resilience360.

B. Why does it matter?

Inconsistent configuration produces skewed risk scores, non-comparable risk heatmaps, and inaccurate executive reporting across subsidiaries.

C. When should it be used?

Set up during initial system implementation, and revisit annually during enterprise risk governance reviews or following major organizational restructurings.

D. How do I use it? (Step-by-Step Instructions)

Define Organization Units first, then establish Risk Categories, Likelihood Scales (1-5), and Impact Scales (1-5). Ensure all scales have clear business descriptions.

E. Who is responsible?

Primary Governance Accountability: Resilience System Administrator / Enterprise Risk Lead

F. Practical Enterprise Example

Blue Group configures 5x5 scoring grids with standard thresholds so that a Score of 25 represents an identical critical threat in Blue Bank as it does in Blue Securities.

G. What happens next?

Configured scales automatically drive probability and severity calculations in all newly created Risk and BIA records.

H. Common Errors & Precautions

Modifying scoring scales on a live database without re-evaluating existing open risks, which can cause score misalignments.

I. Key Fields & Calculations Explained

Scoring Scales: Standardized numerical weights from 1 (Lowest) to 5 (Catastrophic) driving matrix calculations.

Related Concepts: HELP_RESILIENCE_ORG_UNIT HELP_RESILIENCE_RISK_CATEGORY

Core Governance HELP_RESILIENCE_ORG_UNIT resilience.org.unit

Owner: Corporate Governance Manager / Risk Operations Lead

Org Units / Business Units

Executive Summary: Define functional departments, branches, and operational divisions that own risks and processes.

A. What is this?

Organization Units represent departments, subsidiaries, operational functions, and divisions that hold formal risk ownership and continuity responsibilities.

B. Why does it matter?

Clear unit mapping prevents orphaned risks, ambiguous remediation accountability, and ensures departmental leadership owns continuity obligations.

C. When should it be used?

Configure during organizational onboarding, functional realignment, new subsidiary creation, or restructuring of reporting lines.

D. How do I use it? (Step-by-Step Instructions)

Click Create, specify the Unit Name, unique Code (e.g. OPS, IT, FIN), select the Parent Unit for hierarchy, and assign the Primary Unit Owner.

E. Who is responsible?

Primary Governance Accountability: Corporate Governance Manager / Risk Operations Lead

F. Practical Enterprise Example

In Blue Bank, the "Information Technology" (IT) unit is defined under "Executive Management" (EXEC), establishing clear ownership over the Core Banking Application.

G. What happens next?

Org Units become selectable filters and ownership fields across Risk Signals, Risk Cards, BIA Processes, and BCP Playbooks.

H. Common Errors & Precautions

Creating redundant duplicate units rather than using hierarchical parent-child relationships.

I. Key Fields & Calculations Explained

Code: Unique unit identifier per company. Parent Unit: Parent entity in the governance hierarchy.

Related Concepts: HELP_RESILIENCE_CONFIG HELP_RESILIENCE_RISK_ALL

Core Governance HELP_RESILIENCE_RISK_CATEGORY resilience.risk.category

Owner: Enterprise Risk Committee / Risk Methodology Officer

Risk Categories

Executive Summary: Classify enterprise threats across operational, financial, cyber, strategic, and ESG domains.

A. What is this?

Risk Categories define the standardized taxonomy used to classify risks, enable aggregation, and ensure comprehensive risk coverage across the conglomerate.

B. Why does it matter?

Without a consistent taxonomy, the board cannot evaluate risk concentrations or benchmark threat profiles across different subsidiaries.

C. When should it be used?

Maintain and update whenever corporate risk policies evolve, new regulatory taxonomies are introduced, or new business lines are launched.

D. How do I use it? (Step-by-Step Instructions)

Enter category name, code (e.g. CYBER, OPER, REG), description, and optional default risk appetite threshold.

E. Who is responsible?

Primary Governance Accountability: Enterprise Risk Committee / Risk Methodology Officer

F. Practical Enterprise Example

Blue Securities tags trading infrastructure vulnerabilities under "Cybersecurity Risk" (CYBER) and market liquidity shifts under "Market & Liquidity Risk" (MKT).

G. What happens next?

Enables filtered views, category-based pivot charts, and board-level risk concentration heatmaps.

H. Common Errors & Precautions

Creating overly narrow categories that fragment reporting rather than grouping related threat drivers under overarching pillars.

I. Key Fields & Calculations Explained

Category Code: System-wide taxonomy code. Appetite Threshold: Benchmark maximum residual risk tolerance.

Related Concepts: HELP_RESILIENCE_CONFIG HELP_RESILIENCE_RISK_ALL

Core Governance HELP_RESILIENCE_LIKELIHOOD_SCALE resilience.risk.likelihood

Owner: Risk Quant / Head of Enterprise Risk Management

Likelihood Scales

Executive Summary: Define the 1-5 probability scale determining how frequently a risk event is anticipated to occur.

A. What is this?

Likelihood Scales quantify the probability or frequency of a risk event occurring within a specified time horizon, typically ranging from 1 (Rare) to 5 (Almost Certain).

B. Why does it matter?

Standardized probability criteria eliminate subjective guessing and ensure identical mathematical weighting across risk assessments.

C. When should it be used?

Referenced automatically during inherent and residual risk evaluations on every risk register item.

D. How do I use it? (Step-by-Step Instructions)

Configure rating value (1-5), name, probability percentage range, and annual recurrence frequency description.

E. Who is responsible?

Primary Governance Accountability: Risk Quant / Head of Enterprise Risk Management

F. Practical Enterprise Example

At Blue Bank, Likelihood 1 is "Once in 10+ years (<10%)", while Likelihood 5 is "Multiple times per year (>90%)".

G. What happens next?

Directly multiplies by Impact Score to determine Inherent and Residual Risk Scores.

H. Common Errors & Precautions

Assigning likelihood based on past fear rather than empirical control effectiveness and threat frequency.

I. Key Fields & Calculations Explained

Score (1-5): Integer multiplier for matrix calculation. Frequency: Recurrence interval guidance.

Related Concepts: HELP_RESILIENCE_IMPACT_SCALE HELP_RESILIENCE_RISK_ALL

Core Governance HELP_RESILIENCE_IMPACT_SCALE resilience.risk.impact

Owner: Chief Risk Officer / Board Audit Committee

Impact Scales

Executive Summary: Define the 1-5 consequence scale measuring financial, operational, regulatory, and reputational damage.

A. What is this?

Impact Scales quantify the potential severity of a risk event across multiple dimensions: financial loss, operational disruption, regulatory penalties, and reputational harm (1 - Negligible to 5 - Catastrophic).

B. Why does it matter?

Calibrates consequence severity to enterprise balance sheet capacity, ensuring that critical threats receive immediate executive attention.

C. When should it be used?

Applied when assessing inherent worst-case outcomes and residual consequences after operational controls are applied.

D. How do I use it? (Step-by-Step Instructions)

Set rating value (1-5), monetary threshold bands, regulatory severity definitions, and operational outage thresholds.

E. Who is responsible?

Primary Governance Accountability: Chief Risk Officer / Board Audit Committee

F. Practical Enterprise Example

In Blue Holdco Ltd, Impact 5 (Catastrophic) corresponds to financial losses exceeding $5M, prolonged business outage >24 hours, or license revocation.

G. What happens next?

Multiplies with Likelihood Score to calculate composite risk severity on the 5x5 heatmap.

H. Common Errors & Precautions

Focusing solely on immediate direct financial loss while ignoring regulatory fines and long-term brand destruction.

I. Key Fields & Calculations Explained

Impact Score (1-5): Consequence multiplier. Thresholds: Quantified financial and operational outage boundaries.

Related Concepts: HELP_RESILIENCE_LIKELIHOOD_SCALE HELP_RESILIENCE_RISK_ALL

Core Governance HELP_RESILIENCE_HELP_MENU resilience.help.topic

Owner: All Resilience360 Users & System Trainers

User Manual & Guided Knowledge

Executive Summary: Browse the complete structured knowledge base of business concepts, workflows, calculations, and responsibilities.

A. What is this?

The centralized library of all 51 guided help topics across Resilience360, accessible as a searchable catalog or directly contextually on each screen.

B. Why does it matter?

Fulfills the product doctrine: "Complexity belongs to the system, not the user." Users learn correct governance without external manuals or consultant dependency.

C. When should it be used?

Whenever uncertain about a calculation formula, role responsibility, workflow state transition, or governance requirement.

D. How do I use it? (Step-by-Step Instructions)

Search by keyword, filter by module area, or click "Guide" on any form to open the non-disruptive contextual modal.

E. Who is responsible?

Primary Governance Accountability: All Resilience360 Users & System Trainers

F. Practical Enterprise Example

A newly onboarded Risk Officer reviews the BIA Assessment guide to understand why RTO must always be less than MTD before submitting their first analysis.

G. What happens next?

Users can click "Go to Workspace" from any guide topic to jump directly to the relevant operational register.

H. Common Errors & Precautions

Guessing mathematical thresholds rather than checking the documented formulas in the guide.

I. Key Fields & Calculations Explained

Bound Model: The Odoo model providing automated contextual modal popups.

Related Concepts: HELP_RESILIENCE_ROOT HELP_RESILIENCE_CONFIG

Threat Source Intelligence

Early warning signals, ingestion feeds, triage workflows, and risk conversion.

4 topics

Source Signals HELP_RESILIENCE_SOURCE_ROOT resilience.source.signal

Owner: Risk Triage Officer / Operational Risk Submitter

Source Intelligence Workspace

Executive Summary: Capture bottom-up early warnings, operational disruptions, audit findings, and threat observations before they escalate into major losses.

A. What is this?

The Source Intelligence Workspace is the front-line intake portal for operational signals, threat observations, audit points, and near misses gathered across all staff and systems.

B. Why does it matter?

Major corporate failures are almost always preceded by unheeded operational signals. Formal intake prevents frontline warnings from being dismissed or lost in email.

C. When should it be used?

Use whenever an anomalous event, vendor vulnerability, security observation, audit weakness, or operational discrepancy is detected.

D. How do I use it? (Step-by-Step Instructions)

Submit a new signal with descriptive details, attach supporting evidence, select urgency and reliability, and submit for risk triage.

E. Who is responsible?

Primary Governance Accountability: Risk Triage Officer / Operational Risk Submitter

F. Practical Enterprise Example

A database engineer in Blue Bank notices intermittent API timeout spikes from a core payment gateway and logs a signal before customer transactions fail.

G. What happens next?

Signal enters triage queue where Risk Managers assess, review, and either convert it into a formal Risk or link it to continuity plans.

H. Common Errors & Precautions

Treating signals as trivial helpdesk tickets rather than strategic risk intelligence.

I. Key Fields & Calculations Explained

Source Reliability: High, Medium, or Low based on reporting credibility. Urgency: Immediate, Medium, or Low response requirement.

Related Concepts: HELP_RESILIENCE_SOURCE_SIGNAL HELP_RESILIENCE_RISK_ALL

Source Signals HELP_RESILIENCE_SOURCE_SIGNAL resilience.source.signal

Owner: All Operational Staff (Submitters) / Risk Triage Officers

Risk Signals Register

Executive Summary: Manage and inspect all inbound risk signals across the organization.

A. What is this?

The Risk Signals Register is the comprehensive master inventory of all logged threat signals, early warnings, and operational observations across the enterprise.

B. Why does it matter?

Provides aggregate visibility into emerging operational vulnerabilities across departments, preventing siloed risk retention.

C. When should it be used?

Consult regularly during weekly operational risk reviews to detect recurring signal clusters or unresolved vulnerabilities.

D. How do I use it? (Step-by-Step Instructions)

Filter by state (Submitted, Under Review, Converted), sort by priority or age days, and inspect triage audit notes.

E. Who is responsible?

Primary Governance Accountability: All Operational Staff (Submitters) / Risk Triage Officers

F. Practical Enterprise Example

Blue Securities triage team identifies three independent signals regarding latency in trading data feeds, diagnosing an upstream switch malfunction.

G. What happens next?

Signals are reviewed by the Resilience Manager and converted into formal risk register items or closed with documented rationale.

H. Common Errors & Precautions

Allowing signals to linger in Draft or Submitted status past their due date without formal review.

I. Key Fields & Calculations Explained

Age Days: Days elapsed since reported date. Priority: Derived from reliability, confidence, and urgency.

Related Concepts: HELP_RESILIENCE_SOURCE_SIGNAL_REVIEW HELP_RESILIENCE_RISK_ALL

Source Signals HELP_RESILIENCE_SOURCE_SIGNAL_MY resilience.source.signal

Owner: Individual Contributor / Submitter

My Submitted Signals

Executive Summary: Track the triage, review status, and conversion outcomes of signals you personally submitted.

A. What is this?

A filtered personal view showing all risk signals submitted by the logged-in user, showing real-time governance status and triage feedback.

B. Why does it matter?

Maintains feedback loops with frontline employees, fostering a transparent reporting culture where staff see tangible action taken on their alerts.

C. When should it be used?

Check to monitor review progress, reply to reviewer information requests, or view conversion notes.

D. How do I use it? (Step-by-Step Instructions)

Open the view, check the status badge. If "Info Needed", open the record, provide requested details in the chatter or description, and re-submit.

E. Who is responsible?

Primary Governance Accountability: Individual Contributor / Submitter

F. Practical Enterprise Example

An operations analyst in Blue Asset Mngt monitors their submitted signal on reconciliation delays and sees it accepted and converted into Risk RISK-2026-004.

G. What happens next?

Submitter receives automated chatter notifications when the signal state transitions.

H. Common Errors & Precautions

Failing to respond promptly when the reviewer requests additional information.

I. Key Fields & Calculations Explained

State: draft -> submitted -> under_review -> accepted / info_needed -> converted / rejected / closed.

Related Concepts: HELP_RESILIENCE_SOURCE_SIGNAL

Source Signals HELP_RESILIENCE_SOURCE_SIGNAL_REVIEW resilience.source.signal

Owner: Resilience Manager / Operational Risk Lead

Signals for Review

Executive Summary: Triage queue for Resilience Managers to accept, convert, reject, or request information on inbound threat signals.

A. What is this?

The formal triage inbox displaying all unverified inbound signals requiring managerial evaluation, classification, and conversion decisions.

B. Why does it matter?

Ensures every frontline warning is subjected to prompt risk assessment, preventing ignored threats and ensuring strict compliance with SLAs.

C. When should it be used?

Accessed daily by risk managers to process newly submitted observations within corporate response time limits.

D. How do I use it? (Step-by-Step Instructions)

Click "Under Review" to claim ownership. Evaluate evidence. Click "Accept" if genuine, or "Request Info" if ambiguous. Once accepted, click "Convert Signal" to spawn a Risk.

E. Who is responsible?

Primary Governance Accountability: Resilience Manager / Operational Risk Lead

F. Practical Enterprise Example

The Risk Manager reviews a critical signal on API certificate expiry, accepts it, and clicks Convert to automatically create an enterprise risk card with pre-filled metadata.

G. What happens next?

Converting spawns a new linked `resilience.risk` record, setting the signal to "Converted" with linked reference.

H. Common Errors & Precautions

Rejecting signals without providing mandatory rejection justification notes in the audit log.

I. Key Fields & Calculations Explained

Conversion Ref: Link to the spawned Risk ID. Reviewer: User accountable for the triage decision.

Related Concepts: HELP_RESILIENCE_SOURCE_SIGNAL HELP_RESILIENCE_RISK_ALL

Enterprise Risk Management (ERM)

Risk register, scoring models, appetite thresholds, and remediation action plans.

3 topics

Risk Register HELP_RESILIENCE_RISK_ROOT resilience.risk

Owner: Chief Risk Officer / Risk Managers

Risk Management Workspace

Executive Summary: Oversee enterprise risk registers, inherent vs residual risk matrices, control effectiveness, and mitigation actions.

A. What is this?

The Risk Management Workspace provides complete oversight of the corporate risk register, controls architecture, appetite thresholds, and remediation action plans.

B. Why does it matter?

Protects solvency, operational continuity, and shareholder value by systematically identifying vulnerabilities and mandating verified treatments.

C. When should it be used?

Primary operational interface for risk managers managing risk profiles, control evaluations, and committee reporting.

D. How do I use it? (Step-by-Step Instructions)

Navigate between Risk Register, Controls Register, Remediation Actions, and Key Risk Indicators (KRIs) via submenus.

E. Who is responsible?

Primary Governance Accountability: Chief Risk Officer / Risk Managers

F. Practical Enterprise Example

Blue Bank risk team reviews the entire cybersecurity and payment infrastructure portfolio, ensuring that all high residual risks have active remediation actions assigned.

G. What happens next?

Risk updates flow directly to the Dynamic Heatmap, Board Exception Log, and executive PDF reporting packs.

H. Common Errors & Precautions

Treating the risk register as a static document rather than an active operational workflow.

I. Key Fields & Calculations Explained

Appetite Status: Within Appetite (green), Near Breach (amber), or Breached (red).

Related Concepts: HELP_RESILIENCE_RISK_ALL HELP_RESILIENCE_RISK_TREATMENT

Risk Register HELP_RESILIENCE_RISK_ALL resilience.risk

Owner: Risk Owners / Resilience Managers

Enterprise Risk Register

Executive Summary: Detailed risk register profile tracking inherent score, controls, residual score, appetite alignment, and approval workflow.

A. What is this?

The primary risk record containing the threat narrative, drivers, consequences, inherent scoring, control assessments, residual scoring, and approval lifecycle.

B. Why does it matter?

Mandatory for regulatory compliance (Basel, ISO 31000, OSFI) and transparent board oversight of material threats.

C. When should it be used?

Create when a new threat is identified or converted from a signal; update continuously as controls change or reviews occur.

D. How do I use it? (Step-by-Step Instructions)

Define Risk Title, Category, Owner, and Org Unit. Select Inherent Likelihood and Impact. Add Controls. Assess Residual Likelihood and Impact. Submit for Manager Review and Approval.

E. Who is responsible?

Primary Governance Accountability: Risk Owners / Resilience Managers

F. Practical Enterprise Example

Risk RISK-2026-001 "Payment Switch Platform Outage" at Blue Bank: Inherent 5x5=25, mitigated by redundant hot-standby switch to Residual 3x3=9, within appetite.

G. What happens next?

If Residual Score exceeds Risk Appetite, the system flags Appetite Status as "Breached" and raises a Board Exception item.

H. Common Errors & Precautions

Lowering residual scores without verifying that linked controls are tested and effective; failing to assign named individual owners.

I. Key Fields & Calculations Explained

Inherent Score Formula: Likelihood (1-5) × Impact (1-5) = 1 to 25.
Residual Score Formula: Residual Likelihood (1-5) × Residual Impact (1-5) = 1 to 25.
Appetite Status: Evaluated against category appetite threshold.

Related Concepts: HELP_RESILIENCE_RISK_TREATMENT HELP_DASHBOARD_HEATMAP

Risk Register HELP_RESILIENCE_RISK_TREATMENT resilience.risk.treatment

Owner: Treatment Action Owner / Risk Manager

Remediation Actions (Treatments)

Executive Summary: Action items and engineering fixes required to mitigate risks and bring residual exposure within acceptable appetite.

A. What is this?

Formal remediation tasks assigned to named owners with committed completion deadlines to reduce risk severity or close control gaps.

B. Why does it matter?

Identifying risks without executing treatments leaves the enterprise fully exposed. Overdue treatments are prime indicators of governance failure.

C. When should it be used?

Mandatory for any risk operating above corporate risk appetite; recommended for all material risks.

D. How do I use it? (Step-by-Step Instructions)

Click Add Treatment on the Risk Card, specify Action Title, Action Owner, Due Date, and Description. Progress through Assigned, In Progress, to Completed.

E. Who is responsible?

Primary Governance Accountability: Treatment Action Owner / Risk Manager

F. Practical Enterprise Example

Action TRT-001 "Upgrade Primary Database Cluster to HA" assigned to Head of Infrastructure with due date in 30 days to resolve single-point-of-failure risk.

G. What happens next?

System calculates overdue status daily. Overdue actions trigger email notifications and appear on the Board Exception Log.

H. Common Errors & Precautions

Assigning generic shared department accounts rather than named individual users as action owners.

I. Key Fields & Calculations Explained

is_overdue: Computed boolean true if due_date < today and state != completed.
Completion Rate: (Completed Actions / Total Actions) × 100.

Related Concepts: HELP_RESILIENCE_RISK_ALL HELP_DASHBOARD_TREATMENT

Business Impact Analysis (BIA)

Critical process evaluation, RTO, RPO, MTD recovery metrics, and dependencies.

8 topics

BIA & Criticality HELP_RESILIENCE_BIA_ROOT resilience.bia.assessment

Owner: Head of Business Continuity / Operational Resilience Lead

Business Impact Analysis (BIA) Workspace

Executive Summary: Quantify operational recovery requirements, RTO, RPO, and MTD for critical business processes.

A. What is this?

The BIA Workspace is the quantitative engine for evaluating the consequences of operational disruption across critical business services over time.

B. Why does it matter?

Without BIA, IT recovery architectures are designed arbitrarily, resulting in either catastrophic downtime or wasteful over-engineering.

C. When should it be used?

Conduct annually, during major business restructuring, or upon launching new critical customer-facing products.

D. How do I use it? (Step-by-Step Instructions)

Navigate between Business Processes, BIA Assessments, and Critical Registries (Systems, Facilities, Roles, Documents) to maintain business continuity parameters.

E. Who is responsible?

Primary Governance Accountability: Head of Business Continuity / Operational Resilience Lead

F. Practical Enterprise Example

Blue Bank evaluates "Payment Settlement Processing" across financial, legal, customer, and regulatory impact horizons (1h, 4h, 24h, 72h).

G. What happens next?

Approved BIA parameters serve as the binding baseline for creating Business Continuity Plans (BCP) and recovery playbooks.

H. Common Errors & Precautions

Treating BIA as a subjective paperwork exercise without engaging frontline operational leaders who understand actual manual workarounds.

I. Key Fields & Calculations Explained

Criticality: P1 (Urgent, <4h), P2 (High, 4-24h), P3 (Medium, >24h). Recovery Objectives: RTO, RPO, MTD.

Related Concepts: HELP_RESILIENCE_BIA_PROCESS HELP_RESILIENCE_BIA_ASSESSMENT

BIA & Criticality HELP_RESILIENCE_BIA_PROCESS resilience.bia.process

Owner: Business Process Owner / Department Head

Critical Business Processes

Executive Summary: Define and catalog operational workflows, dependencies, and customer delivery chains.

A. What is this?

The Business Process register catalogs end-to-end operational activities (e.g. Wire Transfers, Securities Clearing, Payroll) that create value for customers and regulators.

B. Why does it matter?

Establishes process-level accountability and identifies which services are legally and operationally indispensable during a disaster.

C. When should it be used?

D. How do I use it? (Step-by-Step Instructions)

Enter Process Name, Process Owner, Org Unit, Products Supported, and toggle "Critical Process" if failure causes material customer harm.

E. Who is responsible?

Primary Governance Accountability: Business Process Owner / Department Head

F. Practical Enterprise Example

Blue Securities registers "Order Execution & Matching Engine" under the Trading Operations unit with is_critical_process=True.

G. What happens next?

Critical processes must have an Active BIA Assessment and an Active BCP Plan. Missing either triggers an automatic Board Exception.

H. Common Errors & Precautions

Marking every non-essential process as "Critical", diluting disaster recovery focus from genuinely existential operations.

I. Key Fields & Calculations Explained

is_critical_process: Boolean flag driving regulatory compliance and board exception reporting. Target Recovery Objectives: Defines RTO (Recovery Time Objective), RPO (Recovery Point Objective), and MTD (Maximum Tolerable Downtime) parameters.

Related Concepts: HELP_RESILIENCE_BIA_ASSESSMENT HELP_BCP_PLAN

BIA & Criticality HELP_RESILIENCE_BIA_ASSESSMENT resilience.bia.assessment

Owner: BIA Assessment Owner / Continuity Manager

BIA Assessment & Target Recovery

Executive Summary: Calculate Recovery Time Objective (RTO), Recovery Point Objective (RPO), Maximum Tolerable Downtime (MTD), and manual workarounds.

A. What is this?

A formal quantitative evaluation of disruption impact over time, establishing exact recovery targets and contingency workarounds for a specific process.

B. Why does it matter?

Regulatory compliance requires formal mathematical justification for recovery times. RTO exceeding MTD constitutes an unacceptable operational defect.

C. When should it be used?

Complete when establishing or updating continuity requirements for any critical business process.

D. How do I use it? (Step-by-Step Instructions)

Input RTO (Hours), RPO (Hours), and MTD (Hours). Document required Manual Workarounds and Minimum Recovery Staffing. Submit for Manager Review and Activation.

E. Who is responsible?

Primary Governance Accountability: BIA Assessment Owner / Continuity Manager

F. Practical Enterprise Example

Blue Bank "Core Banking Clearing": RTO = 4.0 Hours, RPO = 1.0 Hour, MTD = 8.0 Hours. Manual workaround specifies offline batch authorization.

G. What happens next?

Upon activation, these targets become binding for BCP playbooks and drill test validation criteria.

H. Common Errors & Precautions

Setting RTO greater than or equal to MTD; failing to document viable manual contingency procedures.

I. Key Fields & Calculations Explained

Cardinal Rule of BIA: RTO MUST BE < MTD.
RTO: Recovery Time Objective / Target Recovery (Target restoration time in hours).
RPO: Recovery Point Objective (Max data loss duration in hours).
MTD: Maximum Tolerable Downtime (Point of irreversible failure in hours).

Related Concepts: HELP_RESILIENCE_BIA_PROCESS HELP_BCP_PLAN

BIA & Criticality HELP_RESILIENCE_BIA_REGISTRIES resilience.bia.system

Owner: Business Continuity Administrator

BIA Registries Overview

Executive Summary: Manage master registries of supporting IT systems, facilities, staff roles, and vital documents.

A. What is this?

The BIA Registries maintain standard catalogs of operational assets required to execute critical business processes during normal and crisis operations.

B. Why does it matter?

Enables dependency mapping, gap analysis, and prevents reliance on unknown single points of failure across technology, facilities, and personnel.

C. When should it be used?

Update whenever core technology stacks are updated, office locations change, or staffing roles are reorganized.

D. How do I use it? (Step-by-Step Instructions)

Manage sub-registries: Systems, Facilities, Staff Roles, and Vital Documents.

E. Who is responsible?

Primary Governance Accountability: Business Continuity Administrator

F. Practical Enterprise Example

Blue Group maintains a unified registry of data centers and cloud clusters shared across Blue Bank and Blue Securities.

G. What happens next?

Registries link into BIA process dependency assessments and BCP recovery resource requirements.

H. Common Errors & Precautions

Allowing decommissioned systems or vacated facilities to remain listed as primary continuity dependencies.

I. Key Fields & Calculations Explained

Asset Code: Unique reference. Active: Operational availability flag.

Related Concepts: HELP_RESILIENCE_BIA_SYSTEM HELP_RESILIENCE_BIA_FACILITY

BIA & Criticality HELP_RESILIENCE_BIA_SYSTEM resilience.bia.system

Owner: Chief Information Officer / Head of IT Infrastructure

IT Systems & Databases

Executive Summary: Catalog applications, databases, cloud platforms, and core IT infrastructure supporting critical processes.

A. What is this?

Inventory of critical software applications, database instances, SaaS providers, and infrastructure clusters supporting business processes.

B. Why does it matter?

Ensures IT disaster recovery (DR) plans align directly with business process RTO and RPO requirements.

C. When should it be used?

Add new applications when deployed into production; link to BIA assessments during annual reviews.

D. How do I use it? (Step-by-Step Instructions)

Enter System Code (e.g. SYS-PAY-01), System Name, Vendor/Internal Owner, and Description.

E. Who is responsible?

Primary Governance Accountability: Chief Information Officer / Head of IT Infrastructure

F. Practical Enterprise Example

Blue Bank registers "Switch-Gateway-V2" as a critical IT system linked to the Payment Processing BIA.

G. What happens next?

Enables IT outage impact modeling when infrastructure disruptions occur.

H. Common Errors & Precautions

Omitting shadow IT or unmonitored third-party SaaS dependencies.

I. Key Fields & Calculations Explained

System Code: Unique IT asset identifier.

Related Concepts: HELP_RESILIENCE_BIA_REGISTRIES

BIA & Criticality HELP_RESILIENCE_BIA_FACILITY resilience.bia.facility

Owner: Head of Corporate Real Estate & Facilities

Facilities & Continuity Worksites

Executive Summary: Catalog physical premises, data centers, branch offices, and secondary recovery worksites.

A. What is this?

Registry of physical operating premises, regional branch offices, data center facilities, and designated emergency recovery sites.

B. Why does it matter?

Ensures physical site loss (fire, flood, power failure) has pre-planned relocation options and seat capacity.

C. When should it be used?

Configure corporate real estate locations and alternate disaster recovery sites.

D. How do I use it? (Step-by-Step Instructions)

Enter Facility Code, Name, Physical Address, and capacity specifications.

E. Who is responsible?

Primary Governance Accountability: Head of Corporate Real Estate & Facilities

F. Practical Enterprise Example

Blue Securities designates "Secondary DR Facility - London West" as the backup site if City Headquarters loses power.

G. What happens next?

Referenced in BCP playbooks as designated assembly points and recovery worksites.

H. Common Errors & Precautions

Assuming 100% remote work capacity without verifying network bandwidth or regulatory physical presence rules.

I. Key Fields & Calculations Explained

Facility Code: Premise reference code.

Related Concepts: HELP_RESILIENCE_BIA_REGISTRIES

BIA & Criticality HELP_RESILIENCE_BIA_ROLE resilience.bia.role

Owner: Human Resources / Operations Resilience Lead

Critical Roles & Personnel

Executive Summary: Define critical job roles, technical skills, and minimum staffing required to operate during disruption.

A. What is this?

Catalog of specialized operational and technical job roles required to execute critical processes during emergency staffing conditions.

B. Why does it matter?

Prevents single-person dependencies (key-person risk) and identifies cross-training requirements.

C. When should it be used?

Maintain during workforce planning and organizational restructuring.

D. How do I use it? (Step-by-Step Instructions)

Enter Role Code (e.g. ROLE-SW-ENG), Role Name, and mandatory skill credentials.

E. Who is responsible?

Primary Governance Accountability: Human Resources / Operations Resilience Lead

F. Practical Enterprise Example

Blue Bank defines "Lead Payment Switch Operator" requiring specialized cryptographic key authorization credentials.

G. What happens next?

Used to calculate minimum recovery staffing and crisis call-tree rosters.

H. Common Errors & Precautions

Assigning a single individual to multiple mutually exclusive emergency response roles.

I. Key Fields & Calculations Explained

Role Code: Functional competency identifier.

Related Concepts: HELP_RESILIENCE_BIA_REGISTRIES HELP_BCP_STEP

BIA & Criticality HELP_RESILIENCE_BIA_DOCUMENT resilience.bia.document

Owner: Corporate Secretary / Records Management Officer

Vital Records & Documents

Executive Summary: Catalog legal contracts, cryptographic keys, regulatory licenses, and vital procedure documents.

A. What is this?

Inventory of irreplaceable legal records, banking licenses, vendor contracts, architecture schematics, and procedural documentation.

B. Why does it matter?

Ensures legal and operational survival if primary digital document repositories are compromised or encrypted by ransomware.

C. When should it be used?

Catalog vital records required for legal, regulatory, or operational reconstruction.

D. How do I use it? (Step-by-Step Instructions)

Enter Document Code, Title, Storage Location (including offline/air-gapped copy), and Custodian.

E. Who is responsible?

Primary Governance Accountability: Corporate Secretary / Records Management Officer

F. Practical Enterprise Example

Blue Holdco Ltd registers the "Master Banking License & Clearing Charter" with an offline backup in secure escrow.

G. What happens next?

Referenced in BCP playbooks as required inputs for manual settlement and regulatory notifications.

H. Common Errors & Precautions

Keeping digital backups in the same cloud tenant or network domain as the production files.

I. Key Fields & Calculations Explained

Document Code: Vital record tracking ID.

Related Concepts: HELP_RESILIENCE_BIA_REGISTRIES

Business Continuity Planning (BCP)

Continuity plans, recovery playbooks, tabletop drills, crisis invocation, and audit findings.

11 topics

BCP Playbooks HELP_BCP_ROOT resilience.bcp.plan

Owner: Head of Business Continuity / Incident Commander

Business Continuity Plans Overview

Executive Summary: Design recovery strategies and playbook steps to restore critical business processes during disruptive incidents.

A. What is this?

The BCP Module provides end-to-end management of continuity playbooks, emergency call trees, crisis resource allocations, regular exercise testing, and live operational activations.

B. Why does it matter?

Without pre-tested continuity procedures, crisis response is chaotic, leading to extended recovery times, missed RTOs, catastrophic data loss, and severe regulatory sanctions.

C. When should it be used?

Use continuously to maintain playbooks, schedule periodic testing drills, and activate immediately upon any operational disruption.

D. How do I use it? (Step-by-Step Instructions)

Build BCP plans mapped directly to critical BIA processes, define sequential recovery action steps, assign crisis roles, and validate through scheduled exercises.

E. Who is responsible?

Primary Governance Accountability: Head of Business Continuity / Incident Commander

F. Practical Enterprise Example

Blue Bank maintains an active BCP playbook for the "Core Payment Clearing" process, pre-assigning backup infrastructure and crisis roles to respond if the primary switch goes down.

G. What happens next?

Active plans are ready for live invocation or tabletop drills. Invocations track real-world recovery duration against BIA targets.

H. Common Errors & Precautions

Developing BCP plans in isolation without linking them to approved BIA assessment targets (RTO/RPO).

I. Key Fields & Calculations Explained

Plan Lifecycle: Draft -> Under Review -> Approved -> Active -> Invoked / Retired.

Related Concepts: HELP_BCP_PLAN HELP_BCP_STEP HELP_BCP_INVOCATION

BCP Playbooks HELP_BCP_PLAN resilience.bcp.plan

Owner: BCP Plan Owner / Business Continuity Manager

BCP Plans Register

Executive Summary: Manage individual business continuity playbooks linked to critical processes, containing recovery steps and contacts.

A. What is this?

The BCP Plan record is the master operational recovery playbook governing how a specific critical business process will be restored within its target RTO.

B. Why does it matter?

Version-controlled playbooks guarantee operational teams execute the latest approved, audited procedures rather than obsolete guidelines.

C. When should it be used?

Create for each critical process identified in the BIA; update annually or immediately following significant IT or operational architecture changes.

D. How do I use it? (Step-by-Step Instructions)

Link to Business Process and Active BIA Assessment. Populate Recovery Steps, Crisis Contacts, and Required Resources. Submit for review, approval, and activation.

E. Who is responsible?

Primary Governance Accountability: BCP Plan Owner / Business Continuity Manager

F. Practical Enterprise Example

BCP-PLAN-2026-001 "Payment Gateway Continuity Playbook" at Blue Bank: mapped to Payment Processing, RTO 4.0h, version 1.1 active.

G. What happens next?

Activating a new plan version automatically retires and archives the previous version, preserving a complete audit trail.

H. Common Errors & Precautions

Creating plans without linking them to an active BIA assessment; failing to update next review dates.

I. Key Fields & Calculations Explained

Version: Major.Minor version tracking (e.g. 1.0 to 1.1).
is_current_version: Boolean indicating the single live authorized playbook.

Related Concepts: HELP_BCP_ROOT HELP_BCP_STEP HELP_RESILIENCE_BIA_ASSESSMENT

BCP Playbooks HELP_BCP_STEP resilience.bcp.recovery.step

Owner: Step Owner / Operational Specialist

Recovery Playbooks & Action Steps

Executive Summary: Define chronological action tasks to restore operations, including owners, targets and external dependencies.

A. What is this?

Chronologically sequenced tasks and technical actions that crisis teams must execute step-by-step during a system outage or site evacuation.

B. Why does it matter?

In high-stress emergency situations, ambiguous instructions cause confusion, conflicting actions, and fatal recovery delays.

C. When should it be used?

Draft during playbook creation; execute in order during live invocations or simulation drills.

D. How do I use it? (Step-by-Step Instructions)

Specify Sequence (10, 20, 30), Step Name, Detailed Instructions, Responsible Role, Target Duration in Minutes, and Dependency Type.

E. Who is responsible?

Primary Governance Accountability: Step Owner / Operational Specialist

F. Practical Enterprise Example

Step 10: "Sever compromised database link", Step 20: "Initiate secondary DR cluster sync", Step 30: "Verify cryptographic certificate handshake".

G. What happens next?

Step durations are summed to verify that total playbook duration does not exceed the target process RTO.

H. Common Errors & Precautions

Listing tasks without specifying exact operational dependencies or assigning steps to vague group titles.

I. Key Fields & Calculations Explained

Target Duration (Mins): Expected execution time.
Dependency Type: System, Vendor, Facility, Role, or Preceding Step.

Related Concepts: HELP_BCP_PLAN HELP_BCP_INVOCATION

BCP Playbooks HELP_BCP_TEST resilience.bcp.test

Owner: Exercise Facilitator / Continuity Testing Lead

Continuity Exercises & Drills

Executive Summary: Log tabletop simulations, disaster recovery drills, and failover exercises to prove operational readiness.

A. What is this?

Structured validation exercises (Tabletop, Component Failover, Full Simulation) designed to test continuity playbooks under realistic disruption scenarios.

B. Why does it matter?

An untested plan is merely a theory. Regulators mandate periodic validation, and real crises routinely expose unmapped dependencies.

C. When should it be used?

Execute according to the annual testing schedule (at least semi-annually for critical Tier 1 banking processes).

D. How do I use it? (Step-by-Step Instructions)

Schedule exercise date, define disruption scenario, document participating roles, record actual recovery duration, and evaluate whether RTO was met.

E. Who is responsible?

Primary Governance Accountability: Exercise Facilitator / Continuity Testing Lead

F. Practical Enterprise Example

Blue Securities conducts a simulated trading exchange link blackout; actual recovery time is 45 minutes against a 60-minute RTO (Result: Success).

G. What happens next?

Gaps identified during the exercise spawn BCP Findings and Corrective Action items.

H. Common Errors & Precautions

Marking a test as "Passed" when the target RTO was exceeded; failing to attach attendance sheets and technical log evidence.

I. Key Fields & Calculations Explained

RTO Met: Computed boolean true if actual_recovery_time <= Target RTO.
Result: Success, Minor Issues, Failed, Inconclusive.

Related Concepts: HELP_BCP_PLAN HELP_BCP_FINDINGS

BCP Playbooks HELP_BCP_INVOCATION resilience.bcp.invocation

Owner: Crisis Commander / Incident Lead / Resilience Manager

BCP Invocation Log (Crisis Activation)

Executive Summary: Official emergency activation record tracking incident severity, outage duration, recovery velocity, and RTO adherence.

A. What is this?

The formal corporate audit log tracking emergency activation of a continuity plan during a real disruption, recording timestamps, severity, and resolution.

B. Why does it matter?

Provides legal and regulatory evidence of corporate incident response, tracking whether customer services were restored within statutory RTO bounds.

C. When should it be used?

Create immediately when declaring a disaster, emergency failover, or severe operational disruption.

D. How do I use it? (Step-by-Step Instructions)

Select BCP Plan, select Severity (Minor, Major, Critical), document Reason. When resolved, input Actual Recovery Time (Hours) and mandatory Lessons Learned before requesting closure.

E. Who is responsible?

Primary Governance Accountability: Crisis Commander / Incident Lead / Resilience Manager

F. Practical Enterprise Example

Blue Bank activates BCP-PLAN-2026-001 during a regional fiber cable cut; traffic reroutes successfully with total outage of 2.5 hours (RTO Met = True).

G. What happens next?

Closing an invocation requires Resilience Manager approval, verification of Actual Recovery Time, and documented Lessons Learned.

H. Common Errors & Precautions

Closing an invocation without logging actual recovery duration or attempting closure with unresolved corrective findings.

I. Key Fields & Calculations Explained

RTO Met Formula (Actual vs RTO): actual_recovery_time <= Target RTO / BIA rto_hours.
Closure Rules: Requires Actual Recovery Time > 0, Lessons Learned narrative, and zero open findings (unless Manager Override is justified).

Related Concepts: HELP_BCP_PLAN HELP_BCP_STEP HELP_DASHBOARD_EXCEPTIONS

BCP Playbooks HELP_BCP_TEMPLATE resilience.bcp.template

Owner: Enterprise Continuity Architect

BCP Templates & Playbook Archetypes

Executive Summary: Reusable business continuity templates accelerating standard plan creation across business units.

A. What is this?

Standardized playbook templates containing pre-built recovery steps, role profiles, and resource checklists for common disruption types (Ransomware, Power Failure, Vendor Insolvency).

B. Why does it matter?

Enforces architectural consistency and prevents individual departments from reinventing baseline continuity procedures.

C. When should it be used?

Use as a baseline when generating new BCP plans for operating units.

D. How do I use it? (Step-by-Step Instructions)

Select an archetype template (e.g. Cyber Ransomware Response) and click "Create Plan from Template".

E. Who is responsible?

Primary Governance Accountability: Enterprise Continuity Architect

F. Practical Enterprise Example

Blue Group provides a standardized "Branch Physical Evacuation" template deployed across all retail banking branches.

G. What happens next?

Creates a draft BCP pre-populated with standard steps, ready for unit-specific customization.

H. Common Errors & Precautions

Using templates without tailoring contact names and system credentials to the specific operational unit.

I. Key Fields & Calculations Explained

Archetype: Standardized scenario structure.

Related Concepts: HELP_BCP_PLAN

BCP Playbooks HELP_BCP_CALENDAR resilience.bcp.plan

Owner: Continuity Planning Coordinator

Continuity Review & Drill Schedules

Executive Summary: Calendar interface visualizing scheduled continuity exercises, tabletop simulations, and annual plan review deadlines.

A. What is this?

An interactive calendar schedule visualizing upcoming BCP review dates, scheduled tabletop exercises, and annual regulatory drills.

B. Why does it matter?

Prevents exercise clustering, ensures operational departments are not overwhelmed by overlapping drills, and maintains continuous compliance.

C. When should it be used?

Consult monthly when planning upcoming resilience validation drills.

D. How do I use it? (Step-by-Step Instructions)

Filter by Month, Week, or Day. Drag and drop review events to reschedule. Click any event to open the underlying plan or test record.

E. Who is responsible?

Primary Governance Accountability: Continuity Planning Coordinator

F. Practical Enterprise Example

The continuity coordinator staggers Blue Bank tests across Q1 (Payments), Q2 (Mortgages), and Q3 (Treasury) to balance operational workloads.

G. What happens next?

Reminders are automatically sent to plan owners 30 days prior to their next review date.

H. Common Errors & Precautions

Scheduling critical exercises during peak corporate accounting or regulatory reporting freeze windows.

I. Key Fields & Calculations Explained

next_review_date: Annual mandatory review deadline.

Related Concepts: HELP_BCP_PLAN HELP_BCP_TEST

BCP Playbooks HELP_BCP_EXCEPTIONS resilience.bcp.plan

Owner: Resilience Manager / Internal Audit

BCP Exceptions & Overdue Reviews

Executive Summary: Automated surveillance register flagging unapproved plans, expired reviews, and missing continuity coverage.

A. What is this?

An automated surveillance view that highlights BCP compliance defects: plans past their next review date, plans stuck in Draft, or critical processes lacking BCPs.

B. Why does it matter?

Audit findings consistently penalize organizations for out-of-date BCPs. Proactive monitoring resolves gaps before regulatory scrutiny.

C. When should it be used?

Review weekly to identify expiring playbooks before they become audit exceptions.

D. How do I use it? (Step-by-Step Instructions)

Open view, filter by overdue reviews, and contact assigned plan owners to initiate the annual re-certification workflow.

E. Who is responsible?

Primary Governance Accountability: Resilience Manager / Internal Audit

F. Practical Enterprise Example

Audit team notes 1 BCP plan with next_review_date 15 days in the past; clicking the record opens the plan to initiate revision.

G. What happens next?

Exceptions escalate to the Board Exception Log if remaining unresolved beyond 30 days.

H. Common Errors & Precautions

Ignoring draft plans that were started but never submitted for formal managerial approval.

I. Key Fields & Calculations Explained

Filter Rule: next_review_date < today OR state == draft.

Related Concepts: HELP_BCP_PLAN HELP_DASHBOARD_EXCEPTIONS

BCP Playbooks HELP_BCP_FINDINGS resilience.bcp.finding

Owner: Remediation Action Owner / Quality Assurance Lead

BCP Findings & Corrective Actions

Executive Summary: Track and resolve deficiencies, missing dependencies, and procedural gaps uncovered during continuity tests or live incidents.

A. What is this?

Deficiencies, communication failures, configuration errors, and dependency gaps documented during continuity tests or live activations.

B. Why does it matter?

Testing without remediating discovered weaknesses provides a false sense of security and leaves vulnerabilities unaddressed.

C. When should it be used?

Log immediately following any exercise debrief or post-incident review.

D. How do I use it? (Step-by-Step Instructions)

Enter Finding Title, Description, Root Cause, Severity (Low, Medium, High, Critical), assign an Owner, and set a committed Due Date.

E. Who is responsible?

Primary Governance Accountability: Remediation Action Owner / Quality Assurance Lead

F. Practical Enterprise Example

During a failover drill, secondary switch credentials failed to authenticate; Finding FND-002 is assigned to Security Engineering to automate credential rotation.

G. What happens next?

Open findings block formal closure of the parent Invocation unless an explicit managerial override is authorized.

H. Common Errors & Precautions

Closing findings without attaching technical validation evidence proving the defect was permanently resolved.

I. Key Fields & Calculations Explained

Resolution Status: Open -> In Remediation -> Verified -> Closed.

Related Concepts: HELP_BCP_TEST HELP_BCP_INVOCATION

BCP Playbooks HELP_BCP_DASHBOARD resilience.bcp.plan

Owner: Chief Operating Officer / Head of Continuity

Continuity Readiness Dashboard

Executive Summary: Executive visual dashboard displaying BCP coverage ratios, testing currency, and invocation performance metrics.

A. What is this?

High-level visual analytics displaying enterprise business continuity readiness, plan review currency, exercise completion rates, and historical invocation recovery velocity.

B. Why does it matter?

Provides executives and board members with an immediate, objective benchmark of whether the organization can withstand catastrophic disruption.

C. When should it be used?

Review monthly during operational risk committee meetings and quarterly before board presentations.

D. How do I use it? (Step-by-Step Instructions)

Inspect BCP Coverage % (Target 100%), Testing Currency (Drills completed within last 12 months), and Average Recovery Duration.

E. Who is responsible?

Primary Governance Accountability: Chief Operating Officer / Head of Continuity

F. Practical Enterprise Example

Blue Holdco monitors across its subsidiaries: Blue Bank (100% coverage), Blue Securities (100% coverage), Blue Asset Mngt (100% coverage).

G. What happens next?

Identified gaps trigger automated corrective action assignments to department heads.

H. Common Errors & Precautions

Focusing solely on plan documentation counts rather than verified exercise test pass rates.

I. Key Fields & Calculations Explained

Readiness Index: Weighted composite of Plan Coverage (40%), Test Currency (30%), and Overdue Findings (30%).

Related Concepts: HELP_BCP_ROOT HELP_DASHBOARD_BOARD

BCP Playbooks HELP_BCP_BOARD_PACK resilience.bcp.plan

Owner: Corporate Secretary / Chief Risk Officer

Board Business Continuity Pack

Executive Summary: Executive board reporting module compiling business continuity assurance, invocation history, and drill results.

A. What is this?

Formal board reporting documentation summarizing business continuity governance, annual drill exercise outcomes, live invocation statistics, and regulatory compliance postures.

B. Why does it matter?

Satisfies regulatory obligations (e.g. PRA SS1/21, DORA, OSFI E-21) requiring board-level sign-off on operational continuity readiness.

C. When should it be used?

Assemble and present annually to the Board of Directors and quarterly to the Board Risk Committee.

D. How do I use it? (Step-by-Step Instructions)

Export the standardized BCP Executive Pack containing executive summary, tier-1 process coverage, drill performance audit, and material findings.

E. Who is responsible?

Primary Governance Accountability: Corporate Secretary / Chief Risk Officer

F. Practical Enterprise Example

The CRO of Blue Holdco Ltd presents the annual Board Continuity Pack, evidencing 100% critical process coverage and zero unresolved test findings.

G. What happens next?

The pack is formally endorsed by the Board and filed in the corporate minutes repository for regulatory inspection.

H. Common Errors & Precautions

Presenting raw technical test logs rather than synthesized business impact and RTO adherence metrics.

I. Key Fields & Calculations Explained

Assurance Level: Full Assurance (100% tested, 0 overdue), Qualified Assurance, or Unassured.

Related Concepts: HELP_DASHBOARD_PACK HELP_BCP_ROOT

Business Sustainability Planning (BSP)

Decarbonization roadmaps, ESG pillars, KPIs, initiatives, governance reviews, and board summaries.

10 topics

Sustainability / BSP HELP_BSP_ROOT resilience.bsp.plan

Owner: Chief Sustainability Officer / ESG Governance Committee

Sustainability & BSP Workspace

Executive Summary: Govern multi-entity Business Sustainability Plans (BSP), ESG strategic commitments, climate transition initiatives, and board assurance.

A. What is this?

The Business Sustainability Planning (BSP) Workspace coordinates long-term corporate viability, ESG commitments, decarbonization roadmaps, and sustainability metrics across conglomerate holding companies and autonomous operating subsidiaries.

B. Why does it matter?

Modern enterprise resilience requires both short-term crisis survival (BCP) and long-term strategic viability (BSP). Regulators and investors require audited evidence of climate transition planning.

C. When should it be used?

Use continuously to monitor ESG KPI trajectories, manage capital allocation for transition initiatives, and conduct quarterly governance reviews.

D. How do I use it? (Step-by-Step Instructions)

Navigate across Overview, Board Summary, Sustainability Plans, KPIs, Strategic Initiatives, and Governance Reviews. Filter by entity context to evaluate subsidiary progress.

E. Who is responsible?

Primary Governance Accountability: Chief Sustainability Officer / ESG Governance Committee

F. Practical Enterprise Example

Blue Holdco Ltd governs a unified 2026-2030 corporate sustainability strategy while delegating distinct operational targets to Blue Bank (sustainable lending) and Blue Securities (green bonds).

G. What happens next?

Active plan metrics automatically populate the executive Overview cards and the Board Governance Summary.

H. Common Errors & Precautions

Treating sustainability as a PR marketing exercise without integrating quantitative KPIs into operational risk management.

I. Key Fields & Calculations Explained

Multi-Company Scope: Holding level consolidation alongside subsidiary-specific execution.

Related Concepts: HELP_BSP_OVERVIEW HELP_BSP_PLAN HELP_BSP_BOARD_SUMMARY

Sustainability / BSP HELP_BSP_OVERVIEW resilience.bsp.plan

Owner: Sustainability Operations Lead / Executive Committee

Sustainability Overview & Targets

Executive Summary: Visual executive overview cards showing active sustainability plans, health ratings, appetite alignment, and KPI metrics across companies.

A. What is this?

An executive card-based visual overview presenting active sustainability plans across permitted conglomerate companies, displaying plan health, appetite alignment, and key progress metrics.

B. Why does it matter?

Provides senior executives and board members with an instant comparative benchmark of sustainability health across all operating subsidiaries.

C. When should it be used?

Consult regularly during executive leadership reviews and board sustainability updates.

D. How do I use it? (Step-by-Step Instructions)

Inspect plan cards. Check the Health State badge (Healthy, Watch, Critical), Risk Appetite Alignment badge, and KPI counts. Click any card to drill down into the detailed plan.

E. Who is responsible?

Primary Governance Accountability: Sustainability Operations Lead / Executive Committee

F. Practical Enterprise Example

At Blue Group, the Overview displays 5 company cards: Blue Holdco Ltd (Healthy), Blue Bank (Healthy), Blue Securities (Watch), Blue Asset Mngt (Healthy), and Blue Group (Healthy).

G. What happens next?

Cards with "Watch" or "Critical" health ratings prompt immediate managerial deep-dive into lagging KPIs or overdue initiatives.

H. Common Errors & Precautions

Reviewing only holding company figures without examining individual subsidiary performance.

I. Key Fields & Calculations Explained

Plan Health Formula:
- Healthy (green): All active KPIs >= 90% achievement, zero overdue initiatives, risk appetite aligned.
- Watch (amber): KPIs between 70% and 90%, or appetite is watchlist.
- Critical (red): Any KPI < 70%, overdue initiatives > 30 days, or risk appetite breached.

Related Concepts: HELP_BSP_ROOT HELP_BSP_PLAN HELP_BSP_BOARD_SUMMARY

Sustainability / BSP HELP_BSP_BOARD_SUMMARY resilience.bsp.plan

Owner: Board Sustainability Committee / CRO / Company Secretary

Sustainability Board Summary

Executive Summary: Executive board reporting view with governance ratings, committee next actions, commentary, and native export capabilities.

A. What is this?

A dedicated board-level governance view presenting qualitative executive commentary, committee directives, risk appetite alignment, and formal assurance ratings.

B. Why does it matter?

Bridges the gap between raw quantitative ESG data and strategic board governance, satisfying regulatory corporate reporting requirements (e.g. CSRD, ISSB, SEC).

C. When should it be used?

Used directly during quarterly Board Sustainability Committee sessions.

D. How do I use it? (Step-by-Step Instructions)

Review Executive Commentary, Committee Directives, and Next Action commitments. Update governance notes and record formal committee endorsements.

E. Who is responsible?

Primary Governance Accountability: Board Sustainability Committee / CRO / Company Secretary

F. Practical Enterprise Example

The Board Committee reviews Blue Bank's decarbonization progress, notes the 94% achievement on Scope 2 emissions, and endorses the 2027 solar transition capital allocation.

G. What happens next?

Committee decisions are permanently logged and linked to subsequent quarterly review milestones.

H. Common Errors & Precautions

Failing to document specific committee action directives for lagging sustainability initiatives.

I. Key Fields & Calculations Explained

Assurance Posture: High Assurance, Moderate Assurance, or Under Review.
Committee Directive: Formal board mandate for executive management.

Related Concepts: HELP_BSP_ROOT HELP_BSP_OVERVIEW

Sustainability / BSP HELP_BSP_PLAN resilience.bsp.plan

Owner: Sustainability Plan Owner / Chief Sustainability Officer

Business Sustainability Plans Register

Executive Summary: Manage long-term multi-year corporate sustainability plans, strategic targets, and decarbonization agendas.

A. What is this?

The master strategic sustainability roadmap defining the multi-year targets, ESG pillars, executive oversight, and transition budget for a corporate operating entity.

B. Why does it matter?

Translates high-level corporate ESG pledges into auditable operational commitments with assigned owners and measurable milestones.

C. When should it be used?

Formulate during strategic planning cycles (e.g. 5-year plans); update continually as KPIs are measured and reviews completed.

D. How do I use it? (Step-by-Step Instructions)

Specify Plan Title, Operating Entity, Org Unit, Plan Period, and Target Metrics. Attach linked KPIs and Strategic Initiatives. Advance from Draft to Approved, Active, and Under Monitoring.

E. Who is responsible?

Primary Governance Accountability: Sustainability Plan Owner / Chief Sustainability Officer

F. Practical Enterprise Example

Plan "Blue Bank 2026-2030 Sustainable Banking Strategy": Active state, managing $12M capital budget across 6 core ESG indicators.

G. What happens next?

Periodic governance reviews track progress and record board endorsement decisions.

H. Common Errors & Precautions

Leaving plans in Draft status while initiatives are actively being funded; failing to assign named individual owners.

I. Key Fields & Calculations Explained

Plan Health Score & Status: Composite Health status (Healthy, Watch, Critical) evaluated from KPI Health and Initiative Completion %.
Lifecycle: Draft -> Submitted -> Under Review -> Approved -> Active -> Under Monitoring -> Closed / Retired.

Related Concepts: HELP_BSP_KPI HELP_BSP_INITIATIVE HELP_BSP_REVIEW

Sustainability / BSP HELP_BSP_KPI resilience.bsp.kpi

Owner: KPI Custodian / Environmental Data Analyst

Sustainability KPIs

Executive Summary: Track quantitative and qualitative ESG targets, baseline values, actual measurements, and achievement percentages.

A. What is this?

Granular performance indicators measuring environmental impact (e.g. Scope 1/2 GHG emissions), social responsibility (workforce diversity), and corporate governance metrics.

B. Why does it matter?

Provides mathematically auditable proof of sustainability progress, preventing greenwashing and satisfying external auditor verification.

C. When should it be used?

Record measurement updates according to defined frequency (Monthly, Quarterly, Annually).

D. How do I use it? (Step-by-Step Instructions)

Define KPI Title, Target Value, Baseline Value, Unit of Measure, Measurement Frequency, and Target Direction (Increasing vs Decreasing). Log actual values.

E. Who is responsible?

Primary Governance Accountability: KPI Custodian / Environmental Data Analyst

F. Practical Enterprise Example

Blue Securities tracks "Data Center PUE (Power Usage Effectiveness)": Baseline 1.65, Target 1.25, Current Actual 1.28 (Achievement 95%).

G. What happens next?

Achievement % is calculated automatically and feeds the parent plan health status.

H. Common Errors & Precautions

Inverting target direction formulas (e.g. treating emissions reduction as an increasing target).

I. Key Fields & Calculations Explained

KPI Achievement % Formulas: Evaluates Current Value against Baseline Value and Target Value.
- Increasing Targets: ((Current Value - Baseline Value) / (Target Value - Baseline Value)) × 100.
- Decreasing Targets: ((Baseline Value - Current Value) / (Baseline Value - Target Value)) × 100.
is_overdue: True if next_measurement_date < today.

Related Concepts: HELP_BSP_PLAN HELP_BSP_OVERVIEW

Sustainability / BSP HELP_BSP_INITIATIVE resilience.bsp.initiative

Owner: Initiative Project Manager / Engineering Lead

Strategic Sustainability Initiatives

Executive Summary: Manage strategic decarbonization, adaptation, transition projects, and capital execution schedules.

A. What is this?

Specific capital and operational transformation projects designed to deliver the sustainability improvements measured by KPIs (e.g. Solar Microgrid Installation, Fleet Electrification).

B. Why does it matter?

KPIs represent targets; initiatives represent the funded actions required to actually hit those targets.

C. When should it be used?

Initiate when funding or launching capital transition projects linked to the sustainability plan.

D. How do I use it? (Step-by-Step Instructions)

Specify Title, Strategic Pillar, Owner, Budget, Start Date, Target Completion Date, and track progress through Draft, Approved, In Progress, to Completed.

E. Who is responsible?

Primary Governance Accountability: Initiative Project Manager / Engineering Lead

F. Practical Enterprise Example

Blue Bank commissions "Solar Microgrid Installation Phase 1" ($2.5M capital budget) to achieve 100% renewable power for headquarters.

G. What happens next?

Project completion milestone updates the related renewable energy KPI measurement value.

H. Common Errors & Precautions

Tracking initiatives without linking them to specific quantified KPIs in the sustainability plan.

I. Key Fields & Calculations Explained

Delivery Lifecycle: Draft -> Approved -> In Progress -> Completed -> Closed.

Related Concepts: HELP_BSP_PLAN HELP_BSP_KPI

Sustainability / BSP HELP_BSP_REVIEW resilience.bsp.review

Owner: Review Chair / Corporate Secretary / ESG Lead

Sustainability Governance Reviews

Executive Summary: Record formal committee reviews, board endorsements, revision requirements, and governance decisions.

A. What is this?

The formal corporate governance record capturing periodic evaluations, committee decisions, endorsement votes, and corrective directives for sustainability plans.

B. Why does it matter?

Provides legally defensible evidence of board oversight, proving that directors actively review sustainability progress and hold executives accountable.

C. When should it be used?

Conduct at every scheduled quarterly or annual committee review session.

D. How do I use it? (Step-by-Step Instructions)

Record Review Date, Reviewer, Review Type (Quarterly, Annual, Ad-hoc), Decision (Endorsed, Revisions Required, Deferred, Escalated), and Next Review Date.

E. Who is responsible?

Primary Governance Accountability: Review Chair / Corporate Secretary / ESG Lead

F. Practical Enterprise Example

The Blue Holdco Sustainability Committee endorses the Q3 2026 performance review with zero required revisions, noting strong progress on green asset allocation.

G. What happens next?

Endorsements update the parent plan's last review date and set the calendar schedule for the next review cycle.

H. Common Errors & Precautions

Failing to log formal decisions or neglecting to set a committed next review date.

I. Key Fields & Calculations Explained

Decisions: Endorsed, Revisions Required, Deferred, Escalated, Noted.

Related Concepts: HELP_BSP_PLAN HELP_BSP_BOARD_SUMMARY

Sustainability / BSP HELP_BSP_PILLAR resilience.bsp.pillar

Owner: ESG Methodology Officer

ESG Strategic Pillars

Executive Summary: Classify sustainability plans, KPIs, and initiatives across Environmental, Social, and Governance pillars.

A. What is this?

The taxonomy framework categorizing sustainability activities into core ESG domains: Environmental (Climate, Energy, Water), Social (Labor, Community, DEI), and Governance (Ethics, Transparency, Anti-Bribery).

B. Why does it matter?

Standardizes reporting across global standards (GRI, SASB, TCFD) and ensures balanced allocation across all three ESG dimensions.

C. When should it be used?

Maintain and configure during initial system setup and annual taxonomy alignments.

D. How do I use it? (Step-by-Step Instructions)

Manage standard pillars: Environmental Stewardship, Social Responsibility, and Governance Integrity.

E. Who is responsible?

Primary Governance Accountability: ESG Methodology Officer

F. Practical Enterprise Example

Blue Group maps Scope 1 emissions under "Environmental", fair workplace wages under "Social", and board diversity under "Governance".

G. What happens next?

Pillars enable aggregated cross-company reporting broken down by ESG category.

H. Common Errors & Precautions

Focusing exclusively on environmental carbon targets while neglecting social and governance obligations.

I. Key Fields & Calculations Explained

Pillar Code: Standardized ESG taxonomy code.

Related Concepts: HELP_BSP_ROOT HELP_BSP_PLAN

Sustainability / BSP HELP_BSP_TEMPLATE resilience.bsp.template

Owner: Enterprise Sustainability Architect

Sustainability Plan Templates

Executive Summary: Pre-built sustainability strategy templates accelerating standardized plan deployment across subsidiaries.

A. What is this?

Archetype templates containing standard ESG targets, pre-configured KPIs, and best-practice transition initiatives tailored for financial, banking, and conglomerate sectors.

B. Why does it matter?

Enables holding companies to roll out consistent sustainability frameworks across new or acquired operating subsidiaries rapidly.

C. When should it be used?

Use when onboarding a new operating company or establishing a new multi-year strategic cycle.

D. How do I use it? (Step-by-Step Instructions)

Select an archetype (e.g. Commercial Banking Net-Zero Roadmap) and instantiate a new subsidiary plan.

E. Who is responsible?

Primary Governance Accountability: Enterprise Sustainability Architect

F. Practical Enterprise Example

Blue Holdco deploys the "Financial Institution ESG Blueprint" to initialize the sustainability plan for newly acquired Blue Asset Mngt Ltd.

G. What happens next?

Generates an editable draft plan with pre-linked standard KPIs and initiatives.

H. Common Errors & Precautions

Failing to customize target quantitative thresholds to the subsidiary's specific operational scale.

I. Key Fields & Calculations Explained

Template Archetype: Sector-specific configuration baseline.

Related Concepts: HELP_BSP_PLAN

Sustainability / BSP HELP_BSP_ROLES res.config.settings

Owner: Resilience Administrator

Sustainability Settings & Enablement

Executive Summary: Configure sustainability platform settings, multi-company consolidation parameters, and feature enablement.

A. What is this?

System administration panel governing the global activation of sustainability features (`sustainability_enabled`), multi-company consolidation flags, and reporting thresholds.

B. Why does it matter?

Ensures commercial control and allows organizations to enable or restrict sustainability modules according to their licensing entitlement.

C. When should it be used?

Configure during initial installation or when activating the sustainability capability for newly onboarded subsidiaries.

D. How do I use it? (Step-by-Step Instructions)

Navigate to Settings -> Resilience360 -> Sustainability. Ensure `sustainability_enabled` is checked.

E. Who is responsible?

Primary Governance Accountability: Resilience Administrator

F. Practical Enterprise Example

The administrator confirms `sustainability_enabled=True`, activating the Sustainability menu and Overview cards across Blue Group companies.

G. What happens next?

Unlocks full BSP menu hierarchies, security access groups, and automated health calculations.

H. Common Errors & Precautions

Disabling the feature flag on an active database, which hides navigation menus from operational staff.

I. Key Fields & Calculations Explained

sustainability_enabled: Boolean platform entitlement feature flag.

Related Concepts: HELP_BSP_ROOT

Executive Dashboards & Board Reporting

Executive command center, heatmaps, exception logs, board packs, and director inquiry guidance.

8 topics

Board Dashboards HELP_DASHBOARD_ROOT resilience.dashboard

Owner: Board of Directors / Chief Executive Officer / CRO

Executive Dashboards Hub

Executive Summary: Executive visual reporting hub presenting aggregated risk heatmaps, BIA posture, and board exception summaries.

A. What is this?

The Executive Dashboards Hub is the senior leadership visualization suite combining cross-entity risk intelligence, operational continuity postures, and board-level exception tracking.

B. Why does it matter?

Directors cannot review thousands of raw register entries. Executive dashboards distill complex resilience parameters into decisive governance metrics.

C. When should it be used?

Reviewed during monthly Board Risk Committee sessions, quarterly audit updates, and regulatory oversight meetings.

D. How do I use it? (Step-by-Step Instructions)

Select specialized dashboard views: Board Overview, Risk Heatmap, BIA Criticality, Remediation Actions, Source Signals, or Board Exceptions.

E. Who is responsible?

Primary Governance Accountability: Board of Directors / Chief Executive Officer / CRO

F. Practical Enterprise Example

At the quarterly board meeting of Blue Holdco Ltd, directors toggle between consolidated group risk postures and individual subsidiary heatmaps for Blue Bank and Blue Securities.

G. What happens next?

Metrics inform board resource allocations, capital reserve decisions, and risk appetite adjustments.

H. Common Errors & Precautions

Failing to investigate underlying exceptions when high-level dashboard summaries display amber or red warnings.

I. Key Fields & Calculations Explained

Dashboard Type: Board, Heatmap, BIA, Treatment, Signal, Exceptions, Board Pack.

Related Concepts: HELP_DASHBOARD_BOARD HELP_DASHBOARD_HEATMAP HELP_DASHBOARD_EXCEPTIONS

Board Dashboards HELP_DASHBOARD_BOARD resilience.dashboard

Owner: Board Risk Committee / CEO / CRO

Board Executive Dashboard

Executive Summary: High-level KPI scorecard displaying total risks, appetite breaches, overdue treatments, and critical process health.

A. What is this?

A consolidated executive scorecard showing top-level resilience KPIs, appetite breach counts, critical BIA statistics, and overdue action counts.

B. Why does it matter?

Provides immediate enterprise visibility into whether operational resilience is operating within approved board boundaries.

C. When should it be used?

Consult at every board meeting and executive committee session.

D. How do I use it? (Step-by-Step Instructions)

Review KPI summary cards: Total Open Risks, Risks Above Appetite, Overdue Treatments, Unconverted Signals, and BIA Processes Missing BCP.

E. Who is responsible?

Primary Governance Accountability: Board Risk Committee / CEO / CRO

F. Practical Enterprise Example

The CEO notes that "Risks Above Appetite" decreased from 5 to 1 following the commissioning of the redundant payment switch cluster.

G. What happens next?

Directors can click through any KPI to inspect the underlying granular records or board exception items.

H. Common Errors & Precautions

Focusing only on raw risk counts rather than the severity of appetite breaches and overdue remediation actions.

I. Key Fields & Calculations Explained

Appetite Breach KPI: Count of active risks where residual score exceeds category risk appetite.

Related Concepts: HELP_DASHBOARD_EXCEPTIONS HELP_DASHBOARD_HEATMAP

Board Dashboards HELP_DASHBOARD_HEATMAP resilience.dashboard

Owner: Chief Risk Officer / Enterprise Risk Committee

Dynamic Risk Heatmap

Executive Summary: Interactive 5x5 matrix mapping Likelihood versus Impact for inherent and residual risk profiles.

A. What is this?

A dynamic 5x5 visual matrix that maps enterprise risks across Likelihood (1-5) and Impact (1-5), illustrating risk density across Low (green), Medium (yellow), High (amber), and Critical (red) bands.

B. Why does it matter?

Clearly demonstrates the tangible risk reduction achieved by controls by contrasting Inherent versus Residual risk positions.

C. When should it be used?

Use during executive risk committee debates and board presentations to illustrate exposure clusters.

D. How do I use it? (Step-by-Step Instructions)

Toggle between Inherent Heatmap and Residual Heatmap. Hover over or click on any matrix cell to inspect specific risks located in that quadrant.

E. Who is responsible?

Primary Governance Accountability: Chief Risk Officer / Enterprise Risk Committee

F. Practical Enterprise Example

Blue Bank shows Risk RISK-2026-001 moving from the top-right red cell (5x5, Inherent) to the central yellow cell (3x3, Residual) following control verification.

G. What happens next?

Risks remaining in the top-right red quadrant (Score >= 15) automatically trigger mandatory board reporting.

H. Common Errors & Precautions

Ignoring risks in the high-impact/low-likelihood quadrant (tail risks, black swans) that can cause catastrophic insolvency.

I. Key Fields & Calculations Explained

5x5 Matrix: 25 discrete cells calculated as Likelihood × Impact. Critical threshold >= 15.

Related Concepts: HELP_RESILIENCE_RISK_ALL HELP_DASHBOARD_BOARD

Board Dashboards HELP_DASHBOARD_BIA resilience.dashboard

Owner: Head of Business Continuity / Operational Risk Manager

BIA & Critical Process Dashboard

Executive Summary: Visual analytics tracking critical process recovery objectives, RTO distributions, and BCP coverage gaps.

A. What is this?

A dedicated operational dashboard tracking process criticality distribution, RTO time bands, and identifying critical processes that lack approved BCP plans.

B. Why does it matter?

Regulators (e.g. PRA, OCC, MAS) penalize financial institutions that operate critical customer journeys without validated continuity coverage.

C. When should it be used?

Review quarterly to verify that 100% of critical operational processes are backed by active BCP playbooks.

D. How do I use it? (Step-by-Step Instructions)

Inspect RTO distribution bars (<4h, 4-8h, 8-24h, >24h) and review the BCP Coverage Gap list.

E. Who is responsible?

Primary Governance Accountability: Head of Business Continuity / Operational Risk Manager

F. Practical Enterprise Example

Blue Securities verifies that all 6 critical trading processes have active BCPs, maintaining zero coverage gaps prior to regulatory audit.

G. What happens next?

Identified gaps can be resolved immediately by clicking to generate a new BCP draft from the process record.

H. Common Errors & Precautions

Relying on outdated BIA assessments older than 12 months.

I. Key Fields & Calculations Explained

Coverage Ratio: (Processes with Active BCP / Total Critical Processes) × 100.

Related Concepts: HELP_RESILIENCE_BIA_ASSESSMENT HELP_BCP_PLAN

Board Dashboards HELP_DASHBOARD_TREATMENT resilience.dashboard

Owner: Head of Project Management / Risk Remediation Lead

Remediation Actions Dashboard

Executive Summary: Track remediation action delivery velocity, aging, owner distribution, and overdue resolution rates.

A. What is this?

Analytics dashboard monitoring the status, velocity, overdue aging, and departmental distribution of all active risk treatment plans.

B. Why does it matter?

Action drift—allowing remediation commitments to lapse—is the most common cause of avoidable operational incidents and regulatory enforcement actions.

C. When should it be used?

Used during weekly operational standups and monthly executive risk management committee meetings.

D. How do I use it? (Step-by-Step Instructions)

Review delivery funnel: Draft -> Assigned -> In Progress -> Completed. Inspect the Overdue Actions aging table.

E. Who is responsible?

Primary Governance Accountability: Head of Project Management / Risk Remediation Lead

F. Practical Enterprise Example

The COO notices 3 overdue treatments in the IT Infrastructure unit and reallocates engineering resources to complete firewall patching before quarter-end.

G. What happens next?

Completed actions prompt risk owners to perform a re-assessment of residual risk scores.

H. Common Errors & Precautions

Allowing action due dates to be pushed back repeatedly without executive risk committee approval.

I. Key Fields & Calculations Explained

Overdue Rate: (Overdue Treatments / Total Active Treatments) × 100.

Related Concepts: HELP_RESILIENCE_RISK_TREATMENT HELP_DASHBOARD_EXCEPTIONS

Board Dashboards HELP_DASHBOARD_SIGNAL resilience.dashboard

Owner: Risk Triage Lead / Operational Risk Manager

Source Signals Dashboard

Executive Summary: Monitor threat signal intake volume, triage speed, conversion ratios, and source reliability distributions.

A. What is this?

Visual analytics tracking inbound risk signal volume, conversion rates into formal risks, average triage turnaround days, and source type distributions.

B. Why does it matter?

Monitors whether the organization has a healthy, responsive reporting culture or if operational warnings are bottlenecked in triage.

C. When should it be used?

Review monthly to assess organizational reporting engagement across subsidiaries and business units.

D. How do I use it? (Step-by-Step Instructions)

Inspect Intake Trend charts, Triage Velocity (Days to Review), and Conversion Ratios (Signals converted to Risks).

E. Who is responsible?

Primary Governance Accountability: Risk Triage Lead / Operational Risk Manager

F. Practical Enterprise Example

Blue Asset Mngt observes a 40% increase in submitted signals following risk training, demonstrating enhanced employee vigilance.

G. What happens next?

Unconverted signals older than 14 days trigger triage escalation alerts.

H. Common Errors & Precautions

Interpreting a high signal count as negative; high signal intake reflects proactive risk discovery before losses occur.

I. Key Fields & Calculations Explained

Conversion Ratio: (Converted Signals / Total Submitted Signals) × 100.

Related Concepts: HELP_RESILIENCE_SOURCE_ROOT HELP_RESILIENCE_SOURCE_SIGNAL

Board Dashboards HELP_DASHBOARD_EXCEPTIONS resilience.board.exception

Owner: Board of Directors / Audit Committee / CEO

Board Exception Log

Executive Summary: Automated log of material governance anomalies, appetite breaches, overdue treatments, and recommended director questions.

A. What is this?

An automated surveillance register that synthesizes material governance anomalies across all modules into prioritized exception cards with recommended director questions.

B. Why does it matter?

Empowers non-executive directors and board committee chairs to challenge executive management with precise, data-backed oversight questions.

C. When should it be used?

Primary agenda driver for Board Risk and Audit Committee quarterly meetings.

D. How do I use it? (Step-by-Step Instructions)

Click "Refresh Exceptions" to recalculate. Review Critical and High items. Click any exception to open the source record or copy the recommended board question.

E. Who is responsible?

Primary Governance Accountability: Board of Directors / Audit Committee / CEO

F. Practical Enterprise Example

Director on Blue Bank board asks: "Why has Treatment TRT-004 for the core payment switch exceeded its committed due date by 14 days?"

G. What happens next?

Exceptions remain active until the underlying operational issue (e.g. treatment completed, risk re-evaluated) is resolved in the source register.

H. Common Errors & Precautions

Attempting to manually delete exception items rather than resolving the root operational defect in the source module.

I. Key Fields & Calculations Explained

Severity Sort: Critical (40), High (30), Medium (20), Low (10).
Recommended Director Question: Pre-formulated executive inquiry for committee use.

Related Concepts: HELP_DASHBOARD_BOARD HELP_RESILIENCE_RISK_ALL

Board Dashboards HELP_DASHBOARD_PACK resilience.dashboard

Owner: Company Secretary / Chief Risk Officer

Board Oversight Pack

Executive Summary: Comprehensive board reporting view consolidating executive summaries, risk registers, BIA posture, and exception logs.

A. What is this?

The consolidated board reporting assembly consolidating executive commentary, appetite breach logs, top 10 material risks, BIA coverage, and exception registers into a unified pack.

B. Why does it matter?

Eliminates hundreds of hours of manual PowerPoint preparation while ensuring complete data integrity directly from operational registers.

C. When should it be used?

Generate 7 days prior to scheduled Board Risk Committee and Board of Directors meetings.

D. How do I use it? (Step-by-Step Instructions)

Select company context, review synthesized sections, verify commentary notes, and print or export the official PDF board pack.

E. Who is responsible?

Primary Governance Accountability: Company Secretary / Chief Risk Officer

F. Practical Enterprise Example

The Corporate Secretary exports the Q3 2026 Blue Holdco Board Resilience Pack directly from Resilience360 for distribution to directors.

G. What happens next?

Becomes the permanent legal audit evidence satisfying corporate governance standards.

H. Common Errors & Precautions

Exporting the pack before running "Refresh Exceptions" across operating entities.

I. Key Fields & Calculations Explained

Consolidated Pack: Native multi-section executive governance document.

Related Concepts: HELP_DASHBOARD_BOARD HELP_DASHBOARD_EXCEPTIONS

Resilience360 Guided Knowledge Base

Table of Contents

Core Governance 7

Source Signals 4

Risk Register 3

BIA & Criticality 8

BCP Playbooks 11

Sustainability / BSP 10

Board Dashboards 8

No matching topics found

Resilience Core & Governance Architecture

Resilience360 Workspace

A. What is this?

B. Why does it matter?

C. When should it be used?

D. How do I use it? (Step-by-Step Instructions)

E. Who is responsible?

F. Practical Enterprise Example

G. What happens next?

H. Common Errors & Precautions

I. Key Fields & Calculations Explained

Configuration Registry

A. What is this?

B. Why does it matter?

C. When should it be used?

D. How do I use it? (Step-by-Step Instructions)

E. Who is responsible?

F. Practical Enterprise Example

G. What happens next?

H. Common Errors & Precautions

I. Key Fields & Calculations Explained

Org Units / Business Units

A. What is this?

B. Why does it matter?

C. When should it be used?

D. How do I use it? (Step-by-Step Instructions)

E. Who is responsible?

F. Practical Enterprise Example

G. What happens next?

H. Common Errors & Precautions

I. Key Fields & Calculations Explained

Risk Categories

A. What is this?

B. Why does it matter?

C. When should it be used?

D. How do I use it? (Step-by-Step Instructions)

E. Who is responsible?

F. Practical Enterprise Example

G. What happens next?

H. Common Errors & Precautions

I. Key Fields & Calculations Explained

Likelihood Scales

A. What is this?

B. Why does it matter?

C. When should it be used?

D. How do I use it? (Step-by-Step Instructions)

E. Who is responsible?

F. Practical Enterprise Example

G. What happens next?

H. Common Errors & Precautions

I. Key Fields & Calculations Explained

Impact Scales

A. What is this?

B. Why does it matter?

C. When should it be used?

D. How do I use it? (Step-by-Step Instructions)

E. Who is responsible?

F. Practical Enterprise Example

G. What happens next?

H. Common Errors & Precautions

I. Key Fields & Calculations Explained

User Manual & Guided Knowledge

A. What is this?

B. Why does it matter?

C. When should it be used?

D. How do I use it? (Step-by-Step Instructions)

E. Who is responsible?

F. Practical Enterprise Example

G. What happens next?

H. Common Errors & Precautions