Designing resilient operating models in volatile markets

Three resilience regimes took full effect within six months of each other in 2025 — DORA, the UK's operational resilience rules and APRA's CPS 230. All three demand evidence, not policy documents.

The paper puts numbers on the exposure. ITIC's 2024 survey prices an hour of downtime in banking and financial services above $5 million, and one faulty third-party update in July 2024 disabled 8.5 million devices and stopped banks, airlines and exchanges in the same hour. The part most dependency maps miss sits a layer further back: the fourth parties, where two suppliers that look independent on paper share the same cloud region or data feed and fail together.

The full paper sets out the tolerance-led design loop — name the services, set board-owned tolerances, map dependencies honestly, test to break, invest where the tests fail — and shows how firms that design this way produce supervisory evidence as a by-product of operations rather than an annual scramble. Sources include the three regulators, ITIC and published incident reporting.