What we solve ·What happens the day this goes down?
Taskforce · Sustain
Can you prove your operation holds up, with evidence and not with confidence?
They no longer ask whether we have controls. They ask whether I can prove it holds.
Your critical functions, your dependencies, your tolerance thresholds and the severe scenarios tested, with the file ready for the supervisor.
Operational resilience readinessSend this page to whoever decides
Use this today, without hiring anyone
How to define a critical function without the exercise ending with everything being critical, which is where most internal attempts fail. Three filters, in this order, run in a two hour session with the business.
- The external customer filter. Is it noticed outside, and how quickly? A function whose outage is only noticed internally is important, but it is not critical in the sense of the framework.
- The substitution filter. Is there a manual or alternative way to sustain it, even a worse one? If there is and it has been tested, it drops a category. If there is and it was never tested, it does not count.
- The threshold filter, and this one gets set by the business, not by technology. How many hours can it be down before the damage is irreversible? If the answer is "none", the conversation has not started yet: nobody tolerates zero, and putting it in writing is what forces a choice.
And a fourth one nobody runs yet: treat your model vendor as one more critical third party. Ask them how much notice they give before a version change and what happens if they do not give it. The answer is usually the most uncomfortable finding of the exercise.
This sounds like you if
- The supervisor asks you to demonstrate resilience: the controls exist, the evidence is not assembled.
- A process the supervisor watches depends today on a model vendor.
- There was an incident and reconstructing it took weeks.
How we solve it
The method, not the promise.
- The critical functions get identified with the business, running the three filters. The list always comes out shorter than the team expected.
- Their dependencies get mapped, model vendor included, with their concentration and their substitution cost.
- Tolerance thresholds get set per function, agreed with whoever answers for the business and not with technology.
- Severe but plausible scenarios get tested, with at least one of model degradation, and what failed gets documented.
- The file gets assembled in the supervisor's format and gets tested by reconstructing a real event chosen by the client.
What you receive
- The inventory of critical functions with their tolerance threshold agreed by the business.
- The third party dependency map, with the model vendor included as a critical third party.
- The logs of the tested scenarios, with what failed.
- The evidence file in the supervisor's format and the prioritized closure plan.
The proof that applies here
- Eight years under regulatory supervision in a high pressure environment, without a single audit finding.
- Resilience leadership in a financial institution regulated in two countries.
- Critical infrastructure sustained through hurricanes and geopolitical events across twelve locations.
Before you hire
The file gets prepared and you get prepared for the conversation with the supervisor; the firm does not hold that conversation in your place and issues no compliance opinion.
In resilience the deliverable is not the document, it is that it survives a question. Whoever writes it spent eight years under regulatory supervision without a single finding, on the side being reviewed. That experience does not get delegated: it gets signed.
How many hours can your most critical function be down before the damage is irreversible, and who agreed that number?
If the problem is a different one
The process already depends on the agent and nobody remembers how it was done by hand.
Agent continuity planning
They are asking me to declare what a machine decides and nobody has the list.
AI regulatory evidence file
The regulator asks why that case was rejected and nobody can reconstruct it.
Automated decision governance