More than a year after CPS 230 came into effect, many Boards are receiving significantly more information about operational resilience than they were previously.
Critical operations have been identified, mapped and documented. Board-approved tolerances have been established. Material service providers have been mapped and enhanced oversight has commenced. Business continuity plans have been refreshed and testing programs are underway.
Yet there is a more important question for directors:
Does the information you receive actually enable you to form a view on whether your organisation is operationally resilient?
This is proving challenging. Around two-thirds of risk professionals surveyed cited enhancing monitoring, dashboards and Board reporting as a key challenge in implementing CPS 230.
For many Boards, the answer may therefore be less comfortable than the dashboard suggests.
In our experience, weaknesses in CPS 230 reporting are rarely just a reporting problem. More often, they reveal gaps in the operational resilience capability underneath it: an incomplete view of risks and control weaknesses, critical dependencies and service-provider exposures, or insufficient evidence that critical operations can remain within tolerance.
Changing the format of the Board paper will not fix those problems.
The three questions your reporting should answer
At its simplest, CPS 230 reporting should enable a Board and management to answer three questions.
1. Where are we exposed across our critical operations, are we comfortable with those exposures?
This requires more than reporting incidents and risk ratings. The Board needs a forward-looking view of where critical operations are vulnerable and not simply a record of what has already gone wrong.
Management needs to understand the material risks that could prevent each critical operation from being delivered, identify the controls relied upon to manage those risks, and assess whether those controls are effective.
Together with an understanding of critical dependencies, this provides a forward-looking view of exposure and where resilience may be weakest, what could cause the operation to fail and whether controls and/or management action is adequate.
The important point is that controls should not simply be documented; their effectiveness needs to be assessed. Otherwise, the reported risk position may provide false comfort.
Effective assessment can identify weaknesses before they become incidents, turning reporting from a backward-looking record into a forward-looking view of resilience.
Management should therefore be able to show where material exposures remain, their potential impact, the actions underway and whether those actions are sufficient.
A Board should not have to piece that picture together from separate operational risk, technology, cyber, business continuity and third-party reports.
The critical operation should become the lens through which those exposures are brought together.
2. Where are we exposed through our material service provider network?
This may be the hardest question of all.
Most organisations now have considerably more information about their material service providers (or MSPs) than they did previously. But information is not the same as insight.
The challenge is not simply obtaining more information. Organisations need clear, risk-based expectations for MSP oversight and the capability to turn assurance into a view of exposure.
The management question is simple: what has the oversight and assurance told us about the risk this provider creates?
Has it revealed a material weakness, concentration or downstream dependency, or recovery capability that does not support the organisation’s tolerance?
And does the information reveal something bigger?
Analysis across MSPs may also reveal thematic or concentration exposures that are not obvious when providers are viewed individually.
This is why oversight and obtaining assurance from MSPs is only the beginning. Organisations need the capability to analyse, aggregate and act on what that assurance is telling them.
And critically: What are we doing about it?
3. Can we recover our critical operations within the tolerances the Board has approved?
A Board-approved tolerance is not evidence of resilience.
The critical question is whether the organisation has demonstrated, through credible testing, that it has the capability to remain within that tolerance under severe but plausible disruption.
Traditional business continuity testing has often focused on whether a plan exists and whether particular recovery steps work. Better-practice resilience testing asks a much harder question:
Would the organisation actually be able to deliver the critical operation within tolerance when multiple things go wrong at once?
Better-practice testing should challenge the organisation under severe but plausible conditions, including critical dependencies and material service providers, and demonstrate that it can continue or recover within tolerance.
The focus is capability and tolerance assurance, not simply plan validation.
Your Board reporting should therefore distinguish between documented capability and demonstrated capability.
Where testing identifies a gap, directors should be able to see the exposure created, whether tolerance is at risk and whether remediation is adequate.
Because an organisation can be compliant with CPS 230 on paper and still not be resilient in practice.
Why better dashboards alone won’t solve the problem
There is an understandable temptation to respond to poor CPS 230 reporting by building a new dashboard.
That can help, but only if the information underneath it is reliable.
A useful dashboard depends on the quality of the resilience capability underneath it.
The organisation needs reliable risk and control information, visibility of critical dependencies and service-provider exposures, credible testing, and the capability to analyse and aggregate that information around critical operations.
If those disciplines do not exist, automation simply produces poor information more efficiently.
This is why we advocate designing CPS 230 reporting backwards from the decisions the Board and management need to make.
Start with the decisions the Board needs to make and the confidence it needs to have.
What would directors need to see to form a view on resilience?
Then work backwards.
Do the underlying frameworks and practices produce that information reliably? Can we identify where critical operations are exposed, understand service-provider dependencies, demonstrate recovery within tolerance and prioritise remediation according to risk?
If the answer is no, you have identified the real implementation agenda.
From compliance reporting to resilience intelligence
The next phase of CPS 230 should not be about producing more information for Boards.
It should be about producing better intelligence.
Good reporting should direct Board attention to where resilience is weakest, where exposures are greatest, whether critical operations can remain within tolerance and where management intervention is required.
It should allow directors to see trends rather than snapshots, concentrations rather than individual risks, and interconnected vulnerabilities rather than isolated issues.
Most importantly, it should be forward-looking.
Ultimately, a director should be able to look at CPS 230 reporting and answer:
Where could we fail to deliver an important service to our customers or members? How do we know? What would the impact be? And are we doing enough about it?
If your current reporting cannot answer those questions, resist starting with the dashboard.
Start with the framework and practices underneath it.
Because reporting is ultimately the output of your operational resilience capability. If the output is not giving the Board what it needs, it may be telling you something important about the capability itself.
Blackhall & Pearl Risk Advisory works with Boards and management teams to work backwards from the resilience insight they need, assessing whether the underlying frameworks, practices, testing and reporting provide a reliable view of exposure and a clear basis for action.
If your CPS 230 reporting tells you what has been completed, but not where you remain exposed, that is a useful place to start.
