Resilience as a Board Question

Operational resilience is a board question because only the board can set the firm appetite for harm, approve the tolerances for important services, and hold management to account for the evidence that those tolerances can be met. Technical teams can map services and run tests, but the judgement about what harm users should not suffer, and what investment recovery deserves, belongs at the level where strategy and risk are decided.

A mortgage servicing board, for example, cannot delegate away the question of what happens to borrowers if servicing stops. It can ask management to bring a service map, a tolerance with its reasoning, and the results of a recent test, and then challenge whether those materials together show a service that recovers, or merely a plan that reads well.

A board should ask, for each important service, who its users are, what harm a stop would cause them, what the tolerance is, and what evidence shows the service can recover within it. Those questions sound simple, yet they expose gaps quickly, because an answer that cannot name users, harm, and evidence together is not yet an answer.

Boards should also ask about dependencies and concentration, including suppliers on which several services rely, and about what happens when a tolerance is breached. A board that only asks whether a test took place, without asking what the test changed, will receive reassurance without learning.

Boards can be misled by reporting that emphasises activity over outcome, such as the number of plans completed or tests run, without showing whether any important service recovered in user terms. Activity reporting is comforting because it always moves in the right direction, while service outcomes may not.

Boards can also be misled by assurance that stays at programme level. A report that the resilience programme is on track says little about a particular mortgage, payment, or claims service, and a board that accepts programme assurance in place of service evidence has not yet exercised the oversight the regime expects of it.

Good oversight looks like a regular, service by service conversation, in which the board reviews tolerances, challenges scenario results, and tracks owned actions to completion. It also looks like a willingness to hear bad news from testing, because a test that finds a weakness has succeeded, while a test designed to pass has wasted an opportunity to learn.

Oversight also includes the board own understanding. Directors need enough familiarity with the firm services and dependencies to challenge management, and that familiarity is built by reading service materials and asking follow up questions over time, rather than by receiving a single annual briefing.

Management owns the detailed work: mapping services, setting draft tolerances, running tests, and fixing weaknesses. The board owns the judgements and the challenge: approving tolerances, questioning whether evidence is sufficient, and ensuring that resilience is resourced as an ongoing discipline rather than a one off programme.

That division fails when either side drifts. A board that tries to write recovery plans will slow the work and lose sight of judgement, while a management team that sets tolerances without board challenge may set them to suit operational convenience rather than user harm. The productive tension between the two is part of the control.

Imagine a board meeting for one service and ask what papers would be on the table, what questions would be asked, and what decision would be taken. If the meeting would end with a general note of assurance and no decision, the board question has not yet been properly framed.

This guide is educational and does not describe duties for any particular board. It explains why resilience, understood as a question about services, harm, and evidence, naturally reaches the board, and why it cannot be settled below that level alone.