SLIDE 10 10
Resilient Not Resilient (Fragile)
- Robust preventative controls to minimise disruption to key
business activities
- Weaker preventative controls resulting in periodic disruption
to key business activities
- Robust detective controls to facilitate early detection of
disruption to key business activities
- Weaker detective controls resulting in delayed detection of
disruption to key business activities
- Robust responsive controls to facilitate rapid recovery of
disrupted business activities
- Weaker responsive controls resulting in delayed recovery of
disrupted to business activities
- Lessons are learnt from failures in a structured manner and
applied to continuously improve the level of resilience
- Lessons are not learnt from failures in a structured manner –
same type of failures re-occur
- Periodic stress testing exercises conducted to evaluate
resilience level under different extreme & plausible scenarios
- Stress tests are not conducted or scenarios are not extreme
- Focus on concentration risks and minimise these were
possible
- Little or no focus on concentration risks
- Recognise that increasing efficiency can reduce the level of
resilience
- Excessive focus on increasing efficiency without adequate
consideration of resilience
- Recognise that adequate capital/reserves should be allocated
for dealing with an extreme crisis
- Believe that allocating emergency capital/reserves is sub-optimal and
attempt to minimise these to meet regulatory requirements
- Balanced focus on value creation and value protection
- Excessive focus on value creation at the cost of value protection
- Recognise that complexity as a key driver of resilience.
Complexity is managed in a structured manner.
- Do not understand the relationship between complexity and
- resilience. No structured approach to manage complexity.
