Operational resilience must move beyond compliance to survival

Operational resilience is no longer a compliance box-tick – it is survival. 

That was the message from Søren Agergaard Andersen, who urged the industry to stop treating resilience as a siloed exercise and instead weave it into the DNA of business operations.

“Resilience must be integrated into procurement, change management, and third-party governance. It cannot be left on the margins of risk or compliance,” Andersen, Chief Risk and Compliance Officer at Copenhagen Infrastructure Partners, told delegates.

For infrastructure investors, this demand is magnified. Unlike centralized banks, their projects are dispersed, autonomous, and uneven in maturity. 

“Each project must be operationally resilient on its own terms, while still feeding into the broader fund’s performance,” he added.

Andersen pointed to evolving regulatory expectations such as the UK PRA’s 2025 requirements and the EU’s DORA framework. 

While global systemically important institutions have had years to adjust, others face a sharper learning curve. Proportionality, he stressed, is essential. “Resilience should be scaled to risk profile, not applied with a blunt instrument.”

Despite progress, integration across many firms remains patchy. Fragmented policies and weak cross-functional alignment continue to dilute resilience efforts. 

Andersen called for a design-first mindset: embedding resilience in vendor onboarding, technology change, and strategy. “We need to move from retrofitting resilience to building it upfront,” he said.

Geopolitical shocks, supply chain fragility, cloud dependency, and AI concentration risks only heighten the urgency.