The OSFI E-21 deadline has passed, and Canadian banks and credit unions are now inside the supervisory window. The gap between having a business continuity plan and proving it works is the one OSFI will assess against. This piece covers the questions institutions are still asking, what operational resilience requires under regulatory scrutiny, and how to prepare for the September 2027 scenario testing deadline that comes next.

Most organizations don't discover gaps in their business continuity planning during a calm review, they find them when a system won't come back online. Scott Wilson explains why true resilience is an ongoing practice of thinking, testing, and honest self-assessment, rather than a one-time project

Most organizations know they have operational gaps, but few know the right questions to ask to find them. In the conclusion of our series, Scott Wilson shares the practical framework for dependency mapping, moving beyond "shelf-ware" documentation to identify the vendors, people, and systems your business genuinely cannot function without