Operational Resilience: are you investing on the right things ?

Authored by Graham Self, Principal Architect

In physics, we are taught that “every action has an equal and opposite reaction”. A pair of forces that work together but are focused in opposite directions.

Of course Newton’s law is applied to forces, but I think this fundamental principle conditions us to think about the conscious actions we make and the almost inevitable counter reaction that, sometimes unseen, is a direct impact to those actions.

In organisation decision making, these ‘reactions’ aren’t always equal but they are always there. When thinking about an organisation’s relationship between it’s Technology and Business outcomes and their intrinsic lineage, these actions and reactions are fundamental.

Every technology action has a business reaction. Every business action has a technology reaction.

When many organisations think about operational resilience, many still look at this important challenge through a single lens, technology. They:

• assess platform resilience.
• review technology lifecycle risk.
• invest in redundancy, recovery, and controls.
• review their security posture

These are all critical and completely necessary activity. But on their own, not sufficient. They forget the important pair of forces at play and neglect the Business lineage.

Resilience without business context is expensive insurance

When technology resilience is considered in isolation, “criticality” is often defined technically rather than operationally. Without clear lineage to business outcomes, organisations risk:

• Over-investing in technology that supports low-impact services
• Under-investing in technology that underpins high-impact customer or regulatory outcomes
• Missing human and process dependencies entirely when assessing resilience

This is where organisations struggle. Not always because they lack technology expertise, but because they lack the understanding of the lineage (those competing forces) between their technology and the rest of their business.

Operational Resilience is equally a business question

Understanding how technology supports business services through the processes and their people is what turns resilience from an ever increasing technology burden to a prioritised, outcome-driven insight and risk based conversation.

Without this lineage, organisations may risk optimising (potentially the wrong) parts of their estate while misunderstanding the whole. With this lineage, we can see justified impact, not just prevention of failure.

This is where a business architecture mindset plays a vital role. A discipline that:

• Helps the business prioritise its business services
• Exposes what disruption really means for customers, the organisation, regulators or the market
• Translates potential technology failure into genuine business impact and recovery
• Makes dependencies visible and discussable
• Translates technical risk into business impact
• Anchors resilience investment in real outcomes, not assumptions.

Persistent Operational Resilience.

And this brings me back to the analogy.

If every technology action has a business reaction…and every business action has a technology reaction, then operational resilience can’t be a one-time review. These forces are constantly at play within an organisation.

Operational Resilience has to be embedded in the DNA of any organisation, sitting permanently in the space between business intent and technical execution, connected by lineage, grounded in outcomes, and understood in human terms.

Ask yourself the right question:

The question isn’t solely whether your organisation is investing enough in resilience. Its whether you’re investing with intent, context and with a clear understanding of consequence.

Ask yourself, which business services would you defend first? Do your resilience investments reflect that?