The BCI has published its Operational Resilience Report 2026, a survey-based report examining global progress and challenges over the past 12 months.
The report says that operational resilience is now firmly established as a core organizational capability, but warns that organizations still face significant implementation challenges.
Key findings include:
Operational resilience is maturing
Organizations have made substantial progress in establishing governance structures, defining important business services, and aligning programmes with regulatory expectations. 72.5% of respondents said that their organization had an operational resilience programme or project in place.
Operational resilience is regularly embedded in governance structures
Operational resilience is increasingly discussed within formal governance forums, particularly within risk and technology committees. Regular engagement at these levels reflects its growing importance as a strategic and operational priority.
Strategic leadership of operational resilience sits with senior leadership
Overall accountability for operational resilience sits with senior executives. The top three being:
- Chief Executive Officer: 19.8%
- Chief Operating Officer: 12.9%
- Executive Director: 12.9%
In terms of day-to-day operational responsibilities, this sits most often with a business continuity manager (23.8%). Only 15.8% of organizations have a head of resilience and just 11.3% have a dedicated operational resilience manager as the lead operational role.
‘Good practice’ and regulations are driving momentum
The desire to implement resilience good practice is the top driver for implementing operational resilience, with 67.6% of respondents saying that this was a top driver. This was followed by regulatory requirements (63.0%). Frameworks such as DORA (EU) and the UK and Australian supervisory approaches have increased senior-level engagement and helped position operational resilience as a strategic priority.
Key operational resilience practices
Survey respondents were fairly consistent in reporting the main aspects of their operational resilience processes. These are:
- Identifying important business services: 94.2%
- Identifying critical suppliers: 90.6%
- Establishing impact tolerances: 72.2%
- Addressing vulnerabilities to impact tolerances: 70.8%
- Incident reporting strategies: 69.9%
Embedding remains difficult
Respondents reported that a significant challenge was moving from defining frameworks to actually embedding operational resilience into the organization. 52% said that they were struggling with embedding resilience into the organization.
