Operational Risk and Business Continuity have become important priorities for companies that cannot afford prolonged disruption. Technology failures, cyber incidents, supplier problems, extreme weather, and human errors can interrupt critical operations. However, smarter companies are changing how they prepare for these events. They are moving beyond static plans and focusing on resilience, testing, accountability, and faster recovery.
The scale of potential disruption is significant. IBM’s 2025 Cost of a Data Breach Report found that the global average cost of a data breach reached $4.44 million. Yet financial loss is only one concern. Extended outages can also affect customers, employees, suppliers, regulatory obligations, and brand reputation.
Smart companies therefore treat resilience as an ongoing management responsibility. They identify important dependencies, test their responses, strengthen weak areas, and review their plans after major changes.
Why Operational Risk and Business Continuity Are Being Reconsidered
Traditional continuity planning often focused on major disasters. Companies prepared recovery documents, assigned emergency contacts, and stored backup information. Those steps still matter, but modern operations create a wider range of threats.
Cloud services, outsourced technology, global suppliers, remote work, and interconnected systems can create new dependencies. A disruption at one provider may affect several business functions at once. Consequently, companies need a broader understanding of how operational risks can spread.
The Basel Committee defines operational risk as the risk of loss resulting from inadequate or failed processes, people, systems, or external events. This definition shows why resilience cannot focus only on physical disasters.
What Smart Companies Are Doing Differently
Forward-looking organizations are changing their approach in several practical ways. They are not simply adding more pages to continuity plans. Instead, they are improving how risks are identified, managed, tested, and reported.
1. They Identify Critical Business Services First
Smart companies begin with services that must remain available or recover quickly. This approach helps leaders understand which activities deserve the greatest protection. Teams can then identify the people, systems, suppliers, facilities, and information supporting each service. This creates a clearer picture of operational dependencies. It also helps management prioritize investment when resources are limited.
2. They Connect Risk Management With Continuity Planning
Risk teams and continuity teams cannot work effectively in isolation. Operational risk assessments can identify vulnerabilities before they become disruptive events. Continuity planning then determines how critical services should respond if those risks materialize. Connecting these activities creates a stronger relationship between prevention, response, and recovery. As a result, companies can make resilience decisions using a broader view of business exposure.
3. They Test Plans Under Realistic Conditions
A continuity plan can appear effective on paper but fail during an actual disruption. Smart companies therefore test their plans using realistic scenarios and clear objectives. Exercises may involve technology outages, supplier failures, cyber incidents, facility loss, or staff shortages. Testing also reveals unclear responsibilities and communication gaps. Companies can then correct weaknesses before a real event exposes them.
4. They Focus on Third-Party Dependencies
External providers can create significant operational exposure. A company may depend on cloud platforms, payment providers, logistics firms, software vendors, manufacturers, or specialist contractors. A disruption at one provider can therefore affect services that appear internally controlled. Smart companies assess critical suppliers based on their importance and recovery capabilities. They also consider alternatives when a single provider creates excessive dependency.
5. They Treat Technology Recovery as a Business Issue
Technology recovery cannot remain solely with the IT department. Business leaders need to understand which systems support critical services and how long those systems can remain unavailable. Recovery priorities should reflect business requirements rather than technical preferences alone. Companies should also test backups and recovery procedures regularly. This creates greater confidence that technology can support continuity when normal operations are interrupted.
A Practical Comparison of Traditional and Modern Approaches
| Traditional approach | Modern approach |
| Focuses heavily on disaster scenarios | Considers a wider range of operational disruptions |
| Relies on documented recovery plans | Combines plans with testing and continuous improvement |
| Treats continuity as a specialist function | Makes resilience a shared management responsibility |
| Reviews suppliers periodically | Prioritizes critical third-party dependencies |
| Focuses on systems recovery | Starts with critical business services |
| Tests plans occasionally | Uses regular exercises and scenario analysis |
Real Examples of Business Resilience
Real-world incidents demonstrate why operational resilience requires more than a written plan. They also show how quickly a technical or external event can affect multiple business functions.
The 2024 CrowdStrike Outage
On July 19, 2024, a faulty software update from CrowdStrike caused widespread Windows system disruptions. Microsoft estimated that approximately 8.5 million Windows devices were affected.
The incident disrupted airlines, healthcare providers, financial services, retailers, and other organizations worldwide.
The event highlighted the importance of technology dependencies and recovery capabilities. It also showed why organizations need tested workarounds when critical digital services become unavailable.
Maersk and the 2017 NotPetya Attack
The 2017 NotPetya cyberattack caused severe disruption to Maersk’s global operations. The company later reported that the incident affected its IT infrastructure across multiple locations.
Maersk estimated the financial impact at between $250 million and $300 million. The incident became a major example of how a cyber event can affect physical logistics and global supply chains.
The case demonstrates why cyber resilience belongs within wider continuity planning. Technology disruption can quickly become an operational disruption when business processes depend heavily on connected systems.
Why Recovery Time Alone Is Not Enough
Recovery speed remains important, but smart companies also examine recovery quality. Restoring a system quickly does not guarantee that employees can serve customers effectively.
For example, a company may recover its ordering platform while a critical supplier remains unavailable. Another business may restore its database but lack enough trained employees to resume normal operations.
Therefore, continuity planning should consider people, processes, technology, facilities, suppliers, information, and communications together. This broader approach provides a more realistic view of operational resilience.
Myths vs. Facts About Operational Risk and Business Continuity
Myth: A Business Continuity Plan Prevents Disruption
Fact: A continuity plan cannot prevent every disruption. Its purpose is to help organizations respond effectively and recover critical activities within defined priorities.
Myth: Business Continuity Is Mainly an IT Responsibility
Fact: Technology is important, but continuity covers much more than systems. People, suppliers, facilities, processes, communications, and decision-making also require preparation.
Myth: Annual Testing Is Enough
Fact: Annual exercises can be useful, but major operational changes may create new risks sooner. Companies should review plans whenever important systems, suppliers, processes, or organizational structures change.
Myth: More Documentation Means Better Preparedness
Fact: Detailed documents do not guarantee effective response. Clear responsibilities, practical procedures, accessible information, and tested recovery actions matter more during a disruption.
How Companies Can Strengthen Operational Risk and Business Continuity
Effective resilience starts with understanding what the business cannot afford to lose. Leaders should identify critical services and determine which resources support them.
Next, companies should assess the risks affecting those services. This assessment should include internal failures, external events, cyber threats, suppliers, technology dependencies, and workforce challenges.
After identifying major vulnerabilities, management should prioritize improvements. Not every process requires the same level of protection. Critical services should receive greater attention based on their business impact.
Testing should then become part of normal management activity. Scenario exercises can reveal weaknesses that routine operations may hide.
Finally, companies should capture lessons from every test and real incident. Plans should change when evidence shows that existing controls are insufficient.
FAQ: Operational Risk and Business Continuity
How Often Should Business Continuity Plans Be Reviewed?
Companies should review plans regularly and after significant operational changes. New technology, suppliers, facilities, regulations, or business services can change existing risk exposure.
Who Should Own Business Continuity?
Senior management should provide accountability, while operational, technology, risk, security, finance, and other teams contribute according to their responsibilities. Effective continuity requires cross-functional ownership.
Should Every Business Process Have the Same Recovery Priority?
No. Critical services should receive priority based on their business impact and recovery requirements. This approach helps organizations allocate resources where disruption would cause the greatest harm.
What Makes a Continuity Exercise Useful?
A useful exercise has a realistic scenario, clear objectives, defined participants, and measurable outcomes. Teams should document weaknesses and assign actions after each exercise.
What Should Companies Do After a Major Incident?
Organizations should conduct a structured review after significant incidents. They should identify what worked, what failed, and which changes can reduce similar exposure.
5 Core Insights for Stronger Operational Resilience
1. Start With Critical Services
Companies should identify the services that customers, regulators, employees, or partners depend on most. This creates a practical basis for prioritizing resilience investments.
2. Map Dependencies Before Disruption Occurs
Organizations should understand how people, systems, suppliers, facilities, and information support critical services. Dependency mapping can reveal single points of failure that deserve attention.
3. Test Recovery Under Pressure
Companies should use realistic scenarios that challenge normal assumptions. Testing can expose gaps in communication, authority, technology recovery, staffing, and supplier alternatives.
4. Strengthen Third-Party Resilience
Critical suppliers should receive greater scrutiny because external failures can quickly become internal disruptions. Organizations should assess recovery capabilities and consider alternatives where appropriate.
5. Turn Lessons Into Permanent Improvements
Every exercise and real incident should produce actionable lessons. Management should assign owners, set deadlines, and verify that corrective actions have been completed.
