Informd
Please verify you’re human to continue.
Operational Resilience 2026: Board Self-Assessment Pack
FCA PS21/3 | PRA PS6/21 | DORA | Important Business Services | Impact Tolerances
The March 2025 deadline for firms to operate within their Impact Tolerances has passed. Regulators are now in active supervision mode. This pack provides the board self-assessment tool to identify and address any remaining gaps before FCA/PRA scrutiny arrives.
What This Pack Contains
- Board self-assessment tool for Important Business Services and Impact Tolerances
- IBS mapping framework — how to scope, categorise, and document IBS
- Impact Tolerance setting guidance — the FCA/PRA standard and common mistakes
- Scenario testing board report template — the summary the board should receive post-test
- Third-party and supply chain resilience checklist
- DORA comparison — additional requirements for in-scope firms
- Board oversight checklist and 10 board questions
Board Obligations
The board must formally approve and oversee three things:
- The IBS list: The board must approve the list of Important Business Services — services whose disruption would cause intolerable harm to customers or market integrity
- Impact Tolerances: The board must approve the maximum tolerable period and level of disruption for each IBS
- Testing results: The board must receive scenario testing results and satisfy itself that the firm can remain within tolerances in severe but plausible scenarios
Impact Tolerance Setting: Common Mistakes
- Tolerances set too generously: If customers would suffer significant harm before the stated tolerance is reached, the FCA/PRA will challenge it
- Tolerances not tested in practice: A tolerance that has never been stress-tested is not credible
- No differentiation between IBS severity: Payment services may warrant 4-hour tolerances; back-office processing may tolerate 48 hours
- IT focus only: Operational resilience is broader than IT recovery — people, process, data, and communication recovery must all be considered
- Tolerances not board-approved: Regulators expect formal board approval, documented in board minutes
10 Board Questions on Operational Resilience
- Has the board formally approved the current IBS list and associated Impact Tolerances, and when were they last reviewed?
- Have all IBS been tested in the past 12 months against severe but plausible scenarios?
- Are there any IBS where testing has identified that we cannot currently meet our stated Impact Tolerance?
- What is the status of any remediation plans arising from previous scenario tests?
- Have we stress-tested scenarios involving critical third-party failure — and what did those tests show?
- How do we assess the operational resilience of our critical technology vendors?
- Are our Impact Tolerances set at the level of genuine intolerability for customers, or at what we can currently achieve?
- For DORA in-scope firms: How does our DORA ICT risk management framework interact with our operational resilience framework?
- Have we received any FCA or PRA feedback on our operational resilience arrangements, and how have we responded?
- Is the board confident that management information on operational resilience is timely, accurate, and outcome-focused?
This pack is included in the INFORMD Executive Team plan (£299/month) and available as a standalone download. Contact us for enterprise or multi-firm access.