All regulations & standards
Canada · Regulation & standard

OSFI E-21 scenario testing with simulations

What is OSFI E-21?

OSFI Guideline E-21 on Operational Risk Management and Resilience sets expectations for federally regulated financial institutions in Canada to manage operational risk and build resilience to disruption.

iluminr simulations let teams rehearse the decisions OSFI E-21 cares about against severe-but-plausible scenarios, and keep a record of who decided what, and when. Run them as Microsimulations, full-scale simulations, or facilitated by our team of experts.

Build a 12-month OSFI E-21 programOpen in the catalogue

Simulations mapped to OSFI E-21

Lightning storm over a city, illustrating the Connectivity Down: Severe Weather MicrosimulationThird-Party & TechnologyConnectivity Down: Severe WeatherRespond to severe weather-induced operational disruptions, including widespread internet outages, by verifying role responsibilities and ensuring continuity in communications and operations.Data center servers in the dark, illustrating the Core Platform Outage: Rollback MicrosimulationThird-Party & TechnologyCore Platform Outage: RollbackA critical platform update turns into a live-fire incident as a scheduled patch unexpectedly brings down key systems. Participants must navigate real-time service degradation, mounting customer pressure, and rollback decisions under duress. This Microsimulation tests cross-functional coordination, incident escalation, and communication flow - providing vital validation of operational resilience, rollback protocols, and regulatory compliance readiness.A broken chain, illustrating the Exit Plan: Vendor Insolvency MicrosimulationThird-Party & TechnologyExit Plan: Vendor InsolvencyA critical third-party vendor has filed for insolvency, causing both operational and data losses. Can your team execute the exit plan under pressure?Ripples spreading across dark water, illustrating the Ripple Effect: Fourth-Party Fallout MicrosimulationThird-Party & TechnologyRipple Effect: Fourth-Party FalloutA critical system failure has occurred in your supply chain, creating significant operational impacts. Your third-party vendor experienced a service outage caused by a vulnerability introduced through an undetected AI-driven update in their supplier's systems. This failure has cascaded through your supplier's network, resulting in widespread service disruptions that are now affecting your business operations and customers.Shipping containers at a port, illustrating the Trapped: Vendor Modern Slavery MicrosimulationThird-Party & TechnologyTrapped: Vendor Modern SlaveryNavigate the ethical, legal, and operational challenges posed by a tech supplier embroiled in a modern slavery scandal, focusing on incident assessment and communication strategies.Data center servers in the dark, illustrating the Vendor Outage: System Down MicrosimulationThird-Party & TechnologyVendor Outage: System DownRespond to a critical vendor cyber-attack that has disrupted essential services, focusing on business impact assessment, data review, and immediate contingency actions.Glowing AI brain and doorway in a purple digital space, illustrating the Model Switch: AI Service Outage MicrosimulationAI RiskModel Switch: AI Service OutageAn issue affecting a foundational AI service triggers a wave of questions. Decide what matters, what doesn't and what to do next.

Mapping is indicative. Confirm scope against your own obligations.

Frequently asked questions

What is OSFI E-21?

OSFI Guideline E-21 on Operational Risk Management and Resilience sets expectations for federally regulated financial institutions in Canada to manage operational risk and build resilience to disruption.

How do simulations help with OSFI E-21?

Simulations let teams rehearse the decisions OSFI E-21 cares about against severe-but-plausible scenarios. iluminr keeps a record of who decided what, and when, which you can use as evidence of testing.

Which iluminr simulations map to OSFI E-21?

Simulations mapped to OSFI E-21 include Connectivity Down: Severe Weather, Core Platform Outage: Rollback, Exit Plan: Vendor Insolvency, Ripple Effect: Fourth-Party Fallout, Trapped: Vendor Modern Slavery and Vendor Outage: System Down, among others.

Who should take part?

These simulations are most often run with Third-Party Risk, Operations, Risk and Technology & Security.

Can I build a 12-month OSFI E-21 testing program?

Yes. The iluminr program builder suggests a 12-month plan of simulations for OSFI E-21. You can add or remove scenarios and export the plan as a PDF for your board.

Can we customize these simulations?

Yes. Run any template as is, tailor the roles, plans, critical services and injects to your organization, or build your own from scratch with the iluminr builder.

Is this mapping legal or compliance advice?

No. The mapping between simulations and OSFI E-21 is indicative. Confirm scope against your own obligations.

More in Canada