Eight Core Principles for building and managing resilience, summarised in ADVOX’s own words.
The Resilience Framework is published by the Business Continuity Institute (BCI). Edition 1.0 appeared in 2024. It was prepared by a panel of experts convened by the BCI, and it speaks mainly to the people at the top of an organisation, such as the board, the executive team or the owner of a small business.
It does not tell an organisation which tools or plans to buy. Instead it sets out eight principles that, taken together, describe what a resilient organisation does, and a cycle that shows how to put them to work. The BCI intends it to suit any organisation, whatever its size, sector or location, and it describes the framework as a living document that will be reviewed every year.
This page is ADVOX’s own summary. For the exact wording, read the original document.
The Business Continuity Institute (BCI), the membership body for business continuity and resilience professionals.
Edition 1.0, 2024.
Part One sets out the Core Principles. Part Two shows how to use them in a cycle.
Each is a baseline for how an organisation develops and manages resilience.
Strategic guidance, not a checklist. Each organisation chooses its own strategies and solutions.
Meant for any organisation, and for focused programmes such as cyber, supply chain, climate or operational resilience.
The copy below is the BCI’s Edition 1.0 PDF. The BCI also describes the framework on its own website, where it says a free PDF is offered to its members.
The framework starts from a simple premise: resilience is what all of an organisation’s protective work is ultimately for. It is described as the ability to deliver outcomes through uncertainty, disruption and change. An organisation is never fully resilient. It can only be more or less resilient, depending on the choices it makes.
Risk management, business continuity, security and similar fields each add value. The framework, drawing on ISO 22316, makes the point that on their own they do not secure resilience.
Resilience also matters when things are uncertain or changing, for example through new regulation, market shifts, mergers or a change of leadership.
The framework lists the gains it sees: adaptability, keeping going when others cannot, better risk decisions, financial stability, smoother handling of regulation and a reputation for reliability.
Together these describe the essentials. The framework’s view is that if any one is missing, the organisation is less resilient than it could be.
Resilience is a strategic matter. The senior leaders decide who takes the lead and how the rest of the leadership oversees, measures and challenges the programme.
Leaders say why resilience matters to the organisation, what it should achieve and what results they expect, then review these as things change.
Start from a full picture of the organisation, its setting and the resilience it already has, so effort builds on what exists.
Know what you need to be resilient against. Risk understanding sets the priorities, strategies and decisions.
Join resilience up across teams and with outside partners, so that silos fall away and effort is not duplicated.
Each organisation needs clear strategies, and practical solutions that fit its own needs and surroundings.
Adapting is a skill led from the top. It is used day to day and when an incident forces a change of course.
Resilience is never a one-off project. It is a loop of reviewing, assessing, learning and improving.
The detail behind the principles is where a lot of the practical value sits. These are the points ADVOX finds most useful.
Responsibility sits with the whole top team and the board, not one person. Leaders also shape culture, so how seriously they treat resilience tends to set how seriously everyone else does. The framework notes that in some sectors, financial services in particular, regulators already expect senior leaders to own operational resilience.
These three link in a chain. Purpose says why, objectives give the route, and outcomes are what gets measured. Leaders also hold the budget and the authority to make them real.
Every organisation has some resilience already, even without a formal programme, for example through health and safety, financial control or quality management. Outside factors such as social, environmental and economic conditions, and external requirements, matter as well.
The framework adds resilience appetite beside risk appetite. A high appetite for resilience means a low tolerance for disruption and more investment. It also warns that being over-resilient is a risk of its own, because it costs money and agility.
Not every disruption can be predicted. Looking at the impact of a process stopping, for instance through a business impact analysis, prepares an organisation whatever the cause turns out to be.
Shared goals, mixed skills, open communication, trust and clear roles all help. The framework also asks organisations to look outward to suppliers, customers and regulators, since resilience is shared across a wider network.
A good strategy ties back to the organisation’s vision, sets measurable goals and backs them with resources. The practical solutions fall into four kinds: defence and prevention, absorbing disruption, response, and recovery. Building resilience in at the design stage is encouraged.
Resilience does not always mean going back to how things were. Sometimes the right answer is a new normal, and that call belongs to top management.
The framework separates testing, which checks systems and technology, from exercising, which tries out people, plans and decisions. It also covers after action reviews and gap analysis as ways to learn and improve.
The second part arranges the eight principles into a cycle that an organisation of any size can use to start or to improve a resilience programme. The BCI shows it as a diagram. In words, it works like this.
Top leadership sits in the middle and stays involved throughout. It sets and reviews the purpose, objectives and outcomes.
Build a clear picture of the organisation, its stakeholders and supply chains, and the resilience already in place.
Work out the risks faced, what disruption would cost, and how much the organisation can accept.
Organise or reorganise so resilience work is joined up, with silos removed and teams able to work together.
Put in place the strategies and solutions that suit this organisation, guided by what the earlier phase found.
The capacity to adapt, and the habit of assessing, reviewing, learning and improving, surround the whole cycle and feed it.
The framework is deliberately not prescriptive. It gives a common foundation, and each organisation chooses its own way to build on it.
ADVOX is an independent adviser and is not part of the BCI. The framework gives a useful way of thinking, and several areas of ADVOX’s work touch the same ground. The support is advisory, and your own leadership keeps ownership of its resilience decisions.
Tracing the people, processes, technology and suppliers behind each important service.
A five-stage view of how mature a business continuity programme is, a helpful companion when you take stock of the current state.
Business continuity and operational resilience consulting for organisations across the GCC.
Scenario exercises that test people, plans and decisions, in the spirit of the learning cycle above.
An independent view of a management system against the international continuity standard.
A plain-language guide to the subject, if you are new to it.
We aim to reply to your enquiry within 2 hours.
This page is ADVOX’s own summary of the Business Continuity Institute’s The Resilience Framework: Edition 1.0 (2024), written in ADVOX’s own words. The framework, its Core Principles and the Resilience Framework Cycle are copyright of the BCI. ADVOX is not affiliated with or endorsed by the BCI. Source: BCI, The Resilience Framework. Copyright in the sources named above belongs to their owners.