Project + Programme + Third Party + Resilience + Assurance operationalise risk management in specific contexts. (1) Project + Programme Risk Management: systematic application of risk management to projects + programmes per Association for Project Management (APM) Body of Knowledge + PRINCE2 + Managing Successful Programmes (MSP) + risk identification at project inception + ongoing assessment through project lifecycle + project risk register separate from enterprise risk register + escalation procedures + change request impact assessment + post-project review + lessons learned. (2) Third Party + Supply Chain Risk Management (TPRM): risk-based supplier due diligence + tiered classification (critical + significant + moderate + low) + onboarding controls + ongoing monitoring + financial health + cyber security assessment + ESG/sustainability assessment + concentration risk + geopolitical risk + cyber incident response coordination + termination contingency + exit strategy + Operational Resilience for Third Parties + critical third party regulation (DORA + APRA + UK Bank Of England Supervisory Statement SS2/21). (3) Operational Resilience: capability to anticipate + adapt + prevent + recover + continue to operate during disruptions + per UK PRA SS2/21 Operational Resilience + APRA CPS 230 + EU DORA Digital Operational Resilience Act + Hong Kong HKMA Operational Resilience Code + Singapore MAS Technology Risk + India RBI Resilience + setting Impact Tolerances for Important Business Services + scenario testing + investment + governance. (4) Business Continuity Planning (BCP): per ISO 22301 BCMS + ISO 22313 + ISO 22317 BIA + Disaster Recovery (DR) + Crisis Management + Emergency Response + alternate site/processing + work area recovery + Business Impact Analysis (BIA) + RTO/RPO/MTPD + crisis communication + return to BAU. (5) Crisis Management: dedicated crisis management plan + crisis management team + war room + cell phone tree + media training + stakeholder communication + insurance claims + investor relations + government engagement. (6) Assurance Mapping: identification + coordination of all assurance providers across the organisation - 1st Line (operational management assurance) + 2nd Line (Risk + Compliance assurance) + 3rd Line (Internal Audit + External Audit + Regulatory Reviews) + visualisation of coverage + gaps + duplication + integrated assurance plan per IIA Three Lines Model 2020 + IFAC Code of Ethics + ISA International Standards on Auditing + FRC Audit + Assurance Standards. (7) Three Lines of Defence Operationalisation: clear delineation + 1st Line: business management own risk + operate controls + 2nd Line: risk + compliance set framework + monitor + advise + 3rd Line: Internal Audit provide independent assurance. Coordinates with ISO 22301 BCMS + ISO 22317 BIA + APM Body of Knowledge + PRINCE2 + MSP + IIA Three Lines Model 2020 + APRA CPS 230 + UK PRA SS2/21 + EU DORA + DAMA-DMBOK + Operational Resilience emerging frameworks. IRM Project + Third Party + Resilience + Assurance applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.