The relationship between operational risk and resilience management

Report - July 2025

This paper, which is primarily based on discussions held with the Risk and Resilience Working Group in May 2025, outlines how organisations are linking together, formally or informally, the management of operational risk and operational resilience, leveraging synergies to achieve better risk management outcomes.

The industry has seen a number of resilience-related regulations coming into effect in 2025. Meanwhile, the current external environment is shaped by geopolitical turbulence and a growing reliance on third parties. This is driving recognition of the need to assess and manage operational risk and resilience in tandem. This need is also reflected in ORX’s Strategic vision for operational and non-financial risk. 

Discussions with the ORX Risk & Resilience Working Group to date have highlighted that:

• Generally, operational resilience is seen as the outcome of good and robust risk management
• There is no ‘one-size-fits-all’ approach:
  • Some firms have brought risk and resilience together under a single framework. This brings efficiencies, but also challenges, such as data aggregation
  • Others have maintained separate frameworks, which may lead to siloed working and duplication of effort. In these instances, it is incumbent on relevant stakeholders to bring insights together
• The structures and intersections of the risk and resilience frameworks are influenced by factors including regulatory guidelines, maturity of operational resilience practices and individual operating models

ORX members can log in to read the findings in full and download the report.