The board paper on operational resilience was submitted with the quarterly risk pack. It ran to fourteen pages. It covered platform dependencies, vendor arrangements, BCP frameworks, and regulatory obligations. The board noted it. No questions were asked. The budget allocation was unchanged. The CRO knew what the paper needed to say. The problem was that it was written for a risk committee, not a board.
Boards and risk committees are different audiences with different information needs. Risk committees operate at the level of operational detail: process controls, vendor performance, compliance frameworks, incident logs. Boards operate at the level of risk appetite, regulatory exposure, and strategic direction. A paper that serves a risk committee well lands differently with a board.
CPS 230, in force since 1 July 2025, requires boards to maintain active oversight of operational risk - not delegate it entirely to a risk committee. Active oversight implies engagement, not noting. A board paper on operational resilience that generates no discussion is, under that standard, a governance gap as well as a missed opportunity.
The papers that get noted describe operational resilience in operational terms: platforms, vendor arrangements, BCP test outcomes, SLA compliance. These are accurate. They are also the language of IT housekeeping, and boards respond to that frame accordingly.
There is the board paper that gets operational resilience noted. And there is the board paper that gets operational resilience funded. The difference is not what is in the paper. It is how the paper frames what is in it.
Boards respond to the frame that connects operational resilience to what they are already responsible for: regulatory exposure, policyholder consequences, competitive position. A single change of framing - from "our BCP is up to date" to "here is our regulatory exposure if APRA examines our third-party arrangements and finds them inadequate" - produces a categorically different board discussion.
Three dimensions connect operational resilience to board-level concerns.
The first is regulatory defensibility. CPS 230 requires genuine alternative arrangements for critical operations. In New Zealand, RBNZ governance requirements are moving in the same direction. A board that understands what "inadequate" means in an APRA or RBNZ examination context is a board that engages with operational resilience as a strategic risk, not a technical obligation.
The second is customer continuity. Policyholders who experience disruptions to their claims or servicing do not distinguish between the carrier's failure and their BPO's failure. The board bears responsibility for the customer outcome either way. Framed as a customer retention and reputational question, operational resilience reaches a different part of the board conversation.
The third is competitive position. The carriers who have invested in operational resilience ahead of requirement are positioned to benefit when disruption happens to others. Boards understand competitive dynamics. Resilience as competitive position - rather than regulatory obligation - completes the frame.
Four structural choices determine whether a board paper generates engagement.
First, the opening sentence should state the strategic risk, not the operational inventory. "Our primary BPO carries all critical life insurance servicing. This arrangement is our most significant concentration risk." That is a board-level opening.
Second, the body should move from risk to current posture to what investment delivers - in board-legible terms. Not "our BCP was tested in Q2" but "our alternative arrangement can carry regulated volume from day one of activation."
Third, the evidence should include regulatory citations (CPS 230, RBNZ expectations), an industry reference point (what disruption costs a carrier that was not prepared), and a measurable risk reduction statement.
Fourth, close with a risk appetite question for the board to answer, not a recommendation to note. A paper that ends with a question generates a response. A paper that ends with a recommendation to note invites noting.
ISSI operates as a warm second source on the platforms ANZ carriers already run. Because platform fluency already exists, there is no ramp period before load can be carried. ISO 22301-class business continuity credentials and audit-passed operations provide the demonstrable evidence - not just the plan - that makes a board-level resilience narrative credible. If the board paper on operational resilience needs a different frame, it is worth thirty minutes.
Sources: APRA CPS 230 Operational Risk Management (effective 1 July 2025); APRA Quarterly Life Insurance Performance Statistics (2025); APRA Quarterly Insurance Performance Statistics (September 2025); IMARC Group Australia BPO Market Report (2025)
