Organisational resilience is the ability of an organisation to anticipate, prepare for, respond to and adapt to disruption — whatever form that disruption takes — while continuing to deliver on its objectives. It isn’t a single plan or document. It’s a combination of capabilities working together: business continuity, crisis management, information security, supply chain resilience and the culture and leadership that hold them up under pressure.

Because disruptions rarely respect the boundaries organisations draw around them. A cyber incident can quickly become a continuity problem. A supplier failure can escalate into a crisis. A data breach can be an information security, privacy and reputational issue all at once. Organisations that manage these areas in isolation often find gaps appear exactly where the disciplines should meet. A joined-up approach means the people responsible for continuity, crisis response, information security and supplier risk are working from the same picture, not five different ones.

There’s no single test, but a useful starting point is asking a few honest questions: Do we know which activities are truly critical, and why? Would the right people know what to do in the first hour of a serious incident? Have our plans been tested against a realistic scenario, or only written and filed? Do continuity, crisis management, information security and supply chain risk connect to each other, or sit in separate silos? Organisations that struggle to answer these confidently usually have real gaps — not because they haven’t done any of the work, but because the work hasn’t been joined up or tested.

No. Larger and regulated organisations (particularly in financial services, where operational resilience is now a specific regulatory expectation) often have more formal requirements, but the underlying need is the same for organisations of any size: understand what matters most, know how you’d respond if it were disrupted, and make sure the people involved are prepared rather than improvising. For smaller organisations, this can — and should — be lightweight and proportionate rather than a scaled-down version of a large enterprise framework.

Organisational resilience refers to an organisation’s overall ability to absorb disruption and keep pursuing its objectives — culture, leadership and strategic adaptability included. Operational resilience is used more narrowly, usually to describe whether key processes and services keep functioning during an incident. Both are useful lenses, and which term your organisation uses often comes down to sector — “operational resilience” has become the more common phrase in financial services, where it’s now a specific regulatory expectation.

Not entirely — organisational resilience is formally a distinct concept, defined in its own international standard rather than sitting inside the business continuity standard. But in practice, we’re more sceptical of the distinction than the marketing around “resilience” often suggests. Business continuity, done properly, already covers most of what gets sold as something new: understanding what your stakeholders actually need, planning around realistic recovery timescales, and building genuine capability to withstand disruption — not just a document that sits in a folder. The confusion tends to grow when a related term, “operational resilience,” gets introduced without a clear, agreed definition, particularly in regulated sectors. We’ve seen this lead organisations to run two overlapping programmes — one labelled business continuity, one labelled operational resilience — duplicating effort and creating more siloed thinking, not less. Our view is straightforward: a genuinely well-run continuity programme is already delivering resilience, whatever you choose to call it. Renaming it, or splitting it into a second parallel workstream, rarely adds real capability. It just adds cost.