What does that take? Let's reframe the core components of operational risk – people, process, and technology – using a resilience lens.15 People are resilient when they are ready and able to adapt to change by adjusting priorities, replanning, and refocusing activities and resources. Resilient staff work with shared purpose across organizational siloes, operate effectively in environments of uncertainty and ambiguity, and are empowered to develop creative and innovative solutions. Processes are resilient when they are robust to changing internal and external conditions, including issues with suppliers, inputs, processing, outputs, and customers. Resilient processes provide clear signals of their operating state, have the right level of automation, and continue to function under stress. Technology systems are resilient when they are flexible, robust, and able to be recovered rapidly. And then the overall organization is resilient when these three components – people, process, and technology – work together effectively. Resilient processes and technology should support the ability of the staff to successfully manage in normal times and during disruptions. What are some concrete steps to strengthen resilience? In terms of processes, an important first step is to identify the processes that are critical to achieving organizational objectives. Gains are often found through simplification and automation of manual processes, especially when combined with performance metrics and risk metrics that provide real-time measures of process health.16 For technology, modernizing technology and software development processes can be a key area of focus.
2 See, for example, the concepts of Safety I and Safety II in Eric Hollnagel, Jorg Leonhard, Tony Licu, and Steven Shorrock, 2015, "From Safety I to Safety II: A Whitepaper,"  Eurocontrol. 3 Scott D. Sagan, The Limits of Safety: Organizations, Accidents, and Nuclear Weapons, 1993, Princeton University Press. 4 Basel Committee on Banking Supervision, "Principles for Operational Resilience,” March 2021. Joshua Rosenberg, "Thrive in any Environment: Strengthening Resilience  through Risk Management," November 2019. 5 Quote Investigator, “Culture Eats Strategy for Breakfast,” May 2017. 6 Financial Stability Board, “Guidance on Supervisory Interaction with Financial Institutions on Risk Culture: A Framework for Assessing Risk Culture,” 2014. The Institute of  Risk Management, “Risk Culture Resources for Practitioners,” 2012. 7 These are adapted from safety culture concepts in, 1997, Ashgate Publishing. See also, GAIN Working Group E, "A Roadmap to a Just Culture: Enhancing the Safety  Environment," September 2004. 8 Risks highlighted include information and cyber security risks, physical and psychological health risks, technology risks and dependencies. See, Consultative Group on Risk  Management, Bank for International Settlements Representative Office of the Americas, “Business Continuity Planning at Central Banks During and After the Pandemic,” April 2022. 9 Chair Jerome H. Powell, “Coronavirus and CARES Act,” Federal Reserve Board of Governors, June 2020. 10 Federal Reserve Bank of New York Economic Policy Review, Special Issue: Policy Actions in Response to the COVID-19 Pandemic, June 2022. 11 Daleep Singh, “The Fed’s Emergency Facilities: Usage, Impact, and Early Lessons,” July 2020.