The operating answer
For firms in scope, operational resilience focuses on important business services and remaining within impact tolerances during severe but plausible disruption. The transition period ended on 31 March 2025. A future improvement plan is not evidence of today’s ability to deliver the service. [FCA]
The workflow below is our editorial synthesis. Regulatory statements link to primary sources. Examples are hypothetical, and applicability requires a firm-specific assessment.
Name the service from the user’s perspective
Start with what a customer or other external user needs to receive. “Make a payment” can be a service; a database or a cloud subscription is a dependency. If the service is defined as an internal system, the analysis may miss customer harm that crosses several systems.
Confirm the firm's scope under the applicable rules and record the reasoning behind the selection of important business services. Keep the boundary clear enough that staff can identify when the service is disrupted. The FCA's resilience material provides the regulatory context. [FCA]
Explain the tolerance, not only the number
An impact tolerance needs a rationale connected to unacceptable harm. Record the assumptions, affected users and relevant operational measures. A recovery-time target for an IT component can inform the analysis but is not automatically the tolerance for the whole service.
Consider the timing of disruption. An outage shortly before a critical payment deadline may have a different consequence from an outage at a quieter time. Use those differences to challenge the service design and the testing schedule rather than smoothing them into an average.
Map the dependencies that can change the result
List people, processes, technology, facilities, information and third parties that support delivery. Identify shared dependencies across important services. A duplicated application is not independent if both copies rely on the same credential store or the same unavailable team.
For third parties, record the actual contractual service, escalation route and evidence available. Outsourcing does not remove the firm's need to understand the dependency. Keep important assumptions and concentration risks visible to the governing body. [FCA]
Write a scenario with consequences
Specify the trigger, duration, affected dependencies and constraints. A severe-but-plausible scenario should test whether the service can continue or recover within the tolerance, not simply demonstrate that a planned exercise can succeed.
Include complications that matter to the service: inaccessible records, absent decision makers, a third party unable to provide an estimate, or a backlog that continues after systems return. Label the scenario as a test. Do not imply that a hypothetical event is an incident that actually occurred.
Measure the end-to-end outcome
Record what users could and could not do, the volume of unfinished work and the time needed to reach an acceptable state. A system being available does not necessarily mean the service has recovered. Staff may still need to reconcile transactions, resolve duplicate instructions and contact affected users.
Keep observations and timestamps from the exercise. Record where the test relied on a manual workaround and whether that workaround would be available under the stated constraints. A workaround supported by one specialist on a quiet afternoon may not scale to a prolonged disruption.
Separate implemented fixes from tested resilience
For each vulnerability, record the change, owner and completion evidence. Then define the retest that will show whether the change addresses the vulnerability. The FCA's published observations are useful for challenging weak mapping and testing assumptions. [FCA]
A remediation plan can be necessary and credible while leaving current exposure. The report should state both facts. Do not relabel an untested change as a proven capability merely because procurement or implementation has finished.
Keep incident reporting as a connected workstream
The FCA has published new operational-incident reporting requirements with a stated commencement date of 18 March 2027. Keep that future change separate from current incident-reporting obligations and the firm's existing notification assessment. [FCA]
Use a decision log for actual incidents: what was known, who assessed it, which obligations were considered and what was reported. The resilience exercise can test the decision process, but it should not pretend that a future reporting form has replaced every present requirement.
| Layer | Question | Evidence |
|---|---|---|
| Service | What does the user need? | Service boundary and harm analysis |
| Tolerance | When does disruption become unacceptable? | Reasoned tolerance and assumptions |
| Dependencies | What can prevent delivery? | Mapping and third-party evidence |
| Scenario | Can the service stay within tolerance? | Test observations, timings and results |
| Remediation | Did the fix work? | Implementation record and retest |
Working checklist
Progress is saved only in this browser when local storage is available. Ticks record your work; they are not a compliance score.
Method, assumptions and limits
We use official sources for regulatory facts and label our suggested workflows as editorial methods. Illustrative examples are hypothetical. The content does not establish the position of any individual firm and is not a prescribed regulator template.
Source review date: 12 November 2026. No automatic monitoring is running. Check the underlying document, applicable entity, activity and jurisdiction before using this material.
Read the full methodologyQuestions, answered.
Is a disaster-recovery test enough?
Not on its own. It can support the assessment, but the service may depend on people, processes, information and third parties beyond the recovered system.
Can a planned fix be reported as a tested capability?
No. State implementation and testing status separately, together with the residual risk.
Are the new incident-reporting requirements already effective?
The FCA source gives 18 March 2027 as commencement. Existing obligations still need their own assessment.
Sources & scope
Primary sources used for this research edition. Document dates and commencement dates are different fields. Recheck the issuing authority before acting.
- FCA: Operational resilienceGuidance · source reviewed 12 November 2026
- FCA: Operational resilience: insights and observations one year onReview · source reviewed 12 November 2026
- FCA: Outsourcing and operational resilienceGuidance · source reviewed 12 November 2026
- FCA: Reporting operational incidentsFuture requirements · source reviewed 12 November 2026