Skip to content

FRM Exam Part II · Risk Mitigation

Business Continuity and Operational Resilience for FRM Part II

Updated 11 October 2026 · Fact-checked

Business continuity planning keeps critical services running during disruption. Disaster recovery restores IT systems and data. Operational resilience goes wider: a firm identifies critical operations, sets impact tolerances for them, maps what they depend on, and tests whether it can stay within tolerance in severe but plausible scenarios.

Understand Business Continuity and Operational Resilience

Start with the problem. Banks cannot avoid every outage, cyberattack, vendor failure or building loss. So the question changes from "how do we prevent this?" to "how do we keep serving customers and markets when it happens?"

Business continuity planning (BCP) is the broad plan for keeping essential business activities going, or resuming them quickly, after a disruption. It covers people, premises, processes, suppliers and technology. A business impact analysis (BIA) ranks activities by how fast harm builds if they stop.

Disaster recovery (DR) is narrower. It is the technical plan to restore IT systems, applications and data after a failure. DR is one part of BCP. Two numbers drive it. The recovery time objective (RTO) is the longest acceptable time to restore a service. The recovery point objective (RPO) is the longest acceptable period of data loss, measured back from the failure.

Operational resilience is the outcome-focused view used in Basel Committee principles. It is the ability to deliver critical operations through disruption. A firm identifies its critical operations (those whose failure would harm the firm's safety and soundness or the wider financial system), maps the people, technology, data, facilities and third parties each one needs, and sets an impact tolerance: the maximum level of disruption the firm will accept, often expressed as a time limit or volume of lost service.

Then it tests. Scenario testing and stress testing ask whether the firm can stay within tolerance under severe but plausible events, such as a cloud provider outage, a ransomware attack or loss of a data centre. Gaps found in testing feed remediation, governance and board reporting. Note the key shift: BCP is often built around a given event, while resilience assumes disruption will happen and focuses on the service.

Key formulas to remember

RTO (recovery time objective)
RTO ≥ actual time needed to restore the service
Target for restoration time. If tested recovery time exceeds RTO, the plan fails its objective.
RPO (recovery point objective)
Maximum data loss = time between last good backup/replica and the failure; must be ≤ RPO
Backup or replication frequency must be at least as frequent as RPO. Near-zero RPO needs continuous replication.
Impact tolerance test
Time to restore the critical operation ≤ impact tolerance
Tolerance is set from the harm to customers, markets and the firm, not from what IT can achieve. It is normally longer than or equal to the RTO of its supporting systems plus dependencies.
Relationship of terms
Operational resilience ⊃ BCP ⊃ DR
DR sits inside BCP, and BCP is one tool within a resilience framework. Treat this as a conceptual hierarchy.

How to solve Business Continuity and Operational Resilience questions

Use this sequence on any business continuity or resilience question.

  1. 1Identify what the question asks about: a plan (BCP), IT restoration (DR), a service-level outcome (resilience) or testing.
  2. 2Find the critical operation or service involved and who relies on it.
  3. 3Check the metric: RTO is time to restore, RPO is data-loss window, impact tolerance is the maximum acceptable disruption of the service.
  4. 4Compare the numbers. Restore time against RTO or tolerance; backup interval against RPO.
  5. 5Check dependencies: third parties, shared systems, staff, data. The weakest link sets the real recovery time.
  6. 6Ask whether testing was severe but plausible, and whether failures led to remediation and board reporting.
  7. 7Pick the answer that is service-focused and forward-looking; reject options that treat resilience as only backups or only insurance.

Quickest way: Three-check shortcut

When to use it: Use for numerical RTO/RPO items and for definition-style MCQs when time is short.

  1. Label each term: RTO = time, RPO = data, impact tolerance = service harm limit.
  2. For numbers, compare the actual with the target and note which side of the limit it falls on.
  3. For concept options, eliminate any that confuse DR with BCP, or that set tolerance from IT capability alone.

Common mistakes in Business Continuity and Operational Resilience

  • Treating BCP and DR as the same thing

    Both deal with recovery after incidents.

    Fix: DR restores technology and data. BCP covers the whole business, including people, premises and suppliers.

  • Mixing up RTO and RPO

    Both are recovery targets measured in time.

    Fix: RTO is how long until service is back. RPO is how much data, measured in time, you can afford to lose.

  • Setting impact tolerance from what systems can deliver

    Candidates think of tolerance as a technical target.

    Fix: Tolerance reflects harm to customers, market integrity and firm viability. Systems must then be built to meet it.

  • Mapping only internal systems

    Third parties feel outside the firm's control.

    Fix: Map people, processes, technology, data, facilities and third parties. Vendor and cloud dependencies often set the limit.

  • Testing only mild or familiar events

    Simple tests are easy to pass.

    Fix: Use severe but plausible scenarios, test the full service chain, and record failures and remediation.

  • Assuming insurance or a backup site delivers resilience

    Transferring or duplicating risk looks like a complete answer.

    Fix: Insurance pays for loss but does not restore service. Resilience is demonstrated by staying within tolerance.

Worked examples

Example 1

A bank's payments platform has an RPO of 15 minutes and an RTO of 2 hours. Data is replicated to the backup site every 30 minutes. After a failure, the service is restored in 90 minutes. Which statement is correct?

Show the solution
  1. RTO check: restoration took 90 minutes, which is within the 2-hour RTO, so RTO is met.
  2. RPO check: replication every 30 minutes means up to 30 minutes of data could be lost in the worst case.
  3. 30 minutes exceeds the 15-minute RPO, so the design cannot guarantee the RPO.
  4. Fix: replicate at least every 15 minutes, or use continuous replication.

Answer: The RTO is met, but the replication design does not support the 15-minute RPO.

Example 2

A bank sets an impact tolerance of 4 hours for its corporate payment service. In a scenario test, a cloud provider outage means the service is restored after 6 hours. The bank's own IT team restored its systems in 1 hour. What does the test show and what should the bank do?

Show the solution
  1. Impact tolerance applies to the service, so the end-to-end time of 6 hours is what counts.
  2. 6 hours exceeds the 4-hour tolerance by 2 hours, so the bank breached tolerance in this scenario.
  3. The internal 1-hour recovery is not the binding constraint; the third-party dependency is.
  4. Record the vulnerability, then remediate: for example, multi-region failover, an alternative provider, tested exit or manual workarounds, and renegotiated service levels.
  5. Retest and report results to senior management and the board.

Answer: The service breached its 4-hour tolerance by 2 hours because of the cloud dependency. The bank must remediate the third-party weakness and retest.

Exam tips

  • Expect short case items giving RTO, RPO and an actual outcome. Compare each metric separately.
  • When two options differ on BCP versus DR scope, choose the one that places DR inside BCP.
  • Look for the word "critical" and for end-to-end service language; these point to resilience, not just technology recovery.
  • Third-party and cloud concentration is a frequent source of the correct answer in scenario items.
  • Prefer answers that include testing, remediation and board oversight over one-off documentation.

Practice questions from Risk Mitigation

Business Continuity and Operational Resilience: frequently asked questions

What is the difference between business continuity and disaster recovery?

Business continuity covers keeping all essential business activities running or resuming them after disruption. Disaster recovery covers restoring IT systems and data. DR is a component of BCP.

What do RTO and RPO mean?

RTO is the maximum acceptable time to restore a service. RPO is the maximum acceptable data loss, expressed as time since the last recoverable data point. One measures downtime, the other measures lost data.

What is an impact tolerance?

It is the maximum disruption a firm will accept for a critical operation, often stated as a time limit. It is set from the potential harm to customers, markets and the firm. Testing checks whether the firm can stay within it.

How is scenario testing done for operational resilience?

The firm picks severe but plausible scenarios, such as a cyberattack or a third-party outage. It runs them against its mapped critical operations, measures recovery against impact tolerance, and logs gaps. Findings drive remediation and are reported to senior management.