Resilience is Proven When Something Goes Wrong — Not When Everything is Working.

When services are operating normally, resilience can be difficult to judge.

Dashboards may be green. Service levels may be achieved. Recovery plans may be documented and tested. Governance may be in place. From the outside, the organisation can appear well prepared.

But resilience is not ultimately demonstrated by what happens when everything is working.

It is demonstrated by what happens when something goes wrong.

A significant incident, supplier failure, cyber event, technology outage or unexpected operational disruption tests much more than a recovery plan. It tests whether the organisation can understand what is happening, make effective decisions under pressure and coordinate the people, processes, technology and suppliers needed to protect or restore critical services.

Resilience Is More Than Recovery

Organisations understandably invest significant effort in business continuity, disaster recovery and incident management. These are important capabilities, but genuine operational resilience reaches further.

A service may have technically recovered while the organisation around it struggled to respond.

Ownership may have been unclear. Dependencies may not have been fully understood. Information may have been fragmented. Decisions may have taken too long. Suppliers may have responded differently from expected. Communication between operational teams and leadership may have broken down.

Each weakness may appear relatively small during normal operation. Under pressure, they can combine quickly.

That is why resilience should be considered across the whole service environment, rather than simply through individual technologies, processes or recovery plans.

Understand What Really Matters

A useful starting point is understanding which services genuinely matter to the organisation and its customers.

What would happen if the service became unavailable? How quickly would the impact become unacceptable? What people, technology, suppliers, information and processes does the service depend upon? And does the organisation actually understand those dependencies?

This creates the context needed to assess resilience proportionately.

Not every service requires the same level of protection, investment or recovery capability. The objective is not maximum resilience everywhere. It is appropriate resilience where it matters most.

Assess the Evidence

Plans and policies provide useful evidence, but they do not provide the whole answer.

The stronger question is whether the organisation can demonstrate that its arrangements work in practice.

Incident history, service performance, recovery exercises, supplier performance, recurring problems, change outcomes and operational management information can all provide evidence of how resilient the environment really is.

Sometimes that evidence confirms leadership's view.

Sometimes it reveals a different picture.

That distinction matters because assumptions about resilience can become embedded over time, particularly when they have not recently been tested by significant disruption.

Challenge the Assumptions

Independent challenge can help organisations test whether the resilience they believe they have is supported by the evidence.

Are critical dependencies genuinely understood?

Would decision-making remain effective during a prolonged disruption?

Are responsibilities clear across internal teams and suppliers?

Do recovery arrangements reflect the service as it operates today?

And, importantly, have previous incidents exposed weaknesses that remain unresolved?

These are not questions designed to find fault. They are designed to identify where attention can make the greatest difference.

Resilience Should Create Confidence

The objective of resilience is not simply to produce more controls, documentation or recovery plans.

It is to give leadership confidence that the organisation understands its critical services, knows where its vulnerabilities lie and can respond effectively when disruption occurs.

That confidence should come from evidence rather than assumption.

Because the real measure of resilience is not how well an organisation operates on its best day.

It is how well it responds on one of its worst.

Understand. Assess. Challenge.