The OSFI E-21 deadline has passed, and Canadian banks and credit unions are now inside the supervisory window. The gap between having a business continuity plan and proving it works is the one OSFI will assess against. This piece covers the questions institutions are still asking, what operational resilience requires under regulatory scrutiny, and how to prepare for the September 2027 scenario testing deadline that comes next.

Most organizations identify obvious risks like cyberattacks but are often blindsided by "quiet" threats - hidden dependencies. From the "last-mile" telecom problem to external environmental factors like transit strikes, Scott Wilson explains why looking beyond your own walls is critical for true operational resilience

Most organizations know they have operational gaps, but few know the right questions to ask to find them. In the conclusion of our series, Scott Wilson shares the practical framework for dependency mapping, moving beyond "shelf-ware" documentation to identify the vendors, people, and systems your business genuinely cannot function without