Our operational resilience health check is designed to assist FCA/PRA regulated companies in evaluating their self-assessment for the regulator’s operational resilience requirements, helping to ensure that you comply with the regulations and are able to evidence this to the FCA/PRA.
The FCA’s operational resilience key requirements
Rules and guidance came into force in March 2022, by March 2025 relevant regulated entities must have their self-assessments available. The self-assessments must have approved important business services, impact tolerances, mapping of resources and tested such to a level of sophistication to remain within the defined disruption periods.
Mapping important business services
Identify and map all critical business services that must remain operational during disruptions.
Impact tolerances
Establish clear impact tolerances for each critical business service.
Scenario testing
Conduct sufficient scenario testing to ensure business services can remain within impact tolerances during disruptions.
Self-assessment documentation
Maintain comprehensive documentation of the self-assessment process and findings.
Governance and oversight
Ensure robust governance and oversight of operational resilience strategies and activities.
Our process
We have designed a process to assist regulated entities, whether that be from the start if newly in-scope or to review and refine self-assessments where the journey has started. Our operational resilience health check consists of:
Review
Workshops
Gap analysis
3rd party assurance
- Conduct a thorough review of your self-assessment documentation
- Evaluate the completeness and accuracy of the mapping of critical business services
- Assess the appropriateness of the established impact tolerances
- Test scenarios including evidence of findings and lessons learned
- Hold interactive workshops with key stakeholders to address identified gaps
- Facilitate discussions to refine and enhance operational resilience strategies
- Provide training and guidance on best practices and regulatory expectations
- Identify any gaps or weaknesses in your current operational resilience framework
- Provide detailed recommendations for addressing identified gaps
- Provide a final assessment and third-party assurance on the self-assessment requirement
- Confirm that regulatory requirements are met and that the organisation is well-prepared to manage disruptions impacting consumers and the market
