Operational Resilience Programme Structuring
Standing up or maturing your operational resilience programme — identifying important business services, setting impact tolerances, mapping dependencies, and designing scenario testing, delivered directly by the person who does the work, not a delegated-down team. Built to give your board a governance model that holds up to scrutiny.
What to expect:
Mobilisation — scope confirmed and workshops scheduled
Current state review — existing resilience, incident and governance documentation reviewed
IBS identification & impact tolerances — important business services agreed and impact tolerances set
Dependency mapping & scenario testing — dependencies mapped and a severe-but-plausible test plan designed
Governance design — resilience committee structure and operating model defined
Roadmap & reporting — maturity assessment, implementation roadmap and executive readout
Typical duration: 6–8 weeks
What operational resilience requires
The UK's operational resilience regime (FCA PS21/3, PRA SS1/21) required in-scope firms to have this fully embedded by 31 March 2025 — the end of a three-year transition from the rules taking effect in March 2022. That deadline has now passed, which changes the nature of the gap: this is no longer "getting ready," it's "is it actually holding up." The regime requires:
Identification of Important Business Services (IBS) — services that, if disrupted, could cause harm to consumers or market integrity.
Impact tolerances set for each IBS — the maximum tolerable disruption, measured in time, volume, and consumer/market harm, not just a recovery-time target.
Dependency mapping — the people, processes, technology, facilities and third parties each IBS actually depends on.
Scenario testing against severe-but-plausible disruptions, to prove impact tolerances would genuinely be met, not just documented.
Governance and board ownership of the whole programme, including a self-assessment document the board has actually reviewed and challenged.
For EU-scope entities, DORA (Regulation (EU) 2022/2554) requires the equivalent discipline under different terms — a documented ICT risk management framework (Chapter II, Articles 5–16) covering "critical or important functions," business continuity and disaster recovery policies (Article 11), and resilience testing (Chapter IV, Articles 24–27), approved and owned by the management body. The two regimes don't share identical vocabulary, but the underlying build — identify what matters, decide how much disruption you can tolerate, map the dependencies, test it, govern it — is the same shape, and the assessment approach transfers directly either way.
Is this for you?
This service is for firms in one of these situations:
The March 2025 deadline has passed, but the programme lives more on paper than in practice — an IBS register that hasn't been touched since, testing that hasn't been repeated, a self-assessment the board signed off once and hasn't revisited.
A DORA readiness assessment has flagged programme maturity as the real gap, not just article-by-article compliance — a common next step after a DORA Sprint.
The firm is building this for the first time — a newer entrant, a firm growing into scope, or a business line expanding into an area that now counts as an important or critical function.
A board or audit committee wants independent assurance that the resilience programme would actually hold up under scrutiny, not just pass a paper review.
In practice: banks, building societies and specialist lenders, insurers and MGAs, payment and e-money firms, and asset/investment managers — UK PRA/FCA-regulated firms primarily, and EU DORA-scope entities building the equivalent programme.
Frequently asked questions
How long does this take?
Around 6–8 weeks elapsed, across roughly 19.5 person-days of facilitation and design work. It runs longer than a DORA Sprint because it depends on scheduling workshops with business-line stakeholders, not just document review and interviews — the workshops are where the real work happens, and stakeholder time is the honest pace-setter.
We already have IBS and impact tolerances documented. Why would we need this?
Documented and embedded aren't the same thing. If the register hasn't been touched since the original deadline, testing hasn't been repeated, or the board hasn't actually challenged the assumptions behind it, this becomes a maturity review and rebuild rather than a from-scratch exercise — often faster as a result.
Does this replace a DORA Sprint?
No — they're complementary. A DORA Sprint (or equivalent readiness assessment) tells you where the gaps are against the regulation, article by article. This service builds or matures the programme itself. Many clients run a DORA Sprint first, then this.
What's delivered at the end?
An Important Business Services register, impact tolerance statements per IBS, dependency maps across people/process/technology/third-party, a severe-but-plausible scenario test plan, a governance and operating-model design, and a maturity assessment with an implementation roadmap.
Do you run the scenario tests for us?
This engagement designs the test plan — what to test, and how to prove impact tolerances actually hold. Running the tests themselves is a follow-on engagement, since it typically needs live operational involvement beyond a fixed-scope design piece.
What does it cost?
Scoped and quoted after a short call — there's no published price. A single-entity programme is typically around 19.5 days of work, fixed-fee with no open-ended billing. Get in touch and we'll confirm scope and cost together.
Standing up or maturing your operational resilience programme — identifying important business services, setting impact tolerances, mapping dependencies, and designing scenario testing, delivered directly by the person who does the work, not a delegated-down team. Built to give your board a governance model that holds up to scrutiny.
What to expect:
Mobilisation — scope confirmed and workshops scheduled
Current state review — existing resilience, incident and governance documentation reviewed
IBS identification & impact tolerances — important business services agreed and impact tolerances set
Dependency mapping & scenario testing — dependencies mapped and a severe-but-plausible test plan designed
Governance design — resilience committee structure and operating model defined
Roadmap & reporting — maturity assessment, implementation roadmap and executive readout
Typical duration: 6–8 weeks
What operational resilience requires
The UK's operational resilience regime (FCA PS21/3, PRA SS1/21) required in-scope firms to have this fully embedded by 31 March 2025 — the end of a three-year transition from the rules taking effect in March 2022. That deadline has now passed, which changes the nature of the gap: this is no longer "getting ready," it's "is it actually holding up." The regime requires:
Identification of Important Business Services (IBS) — services that, if disrupted, could cause harm to consumers or market integrity.
Impact tolerances set for each IBS — the maximum tolerable disruption, measured in time, volume, and consumer/market harm, not just a recovery-time target.
Dependency mapping — the people, processes, technology, facilities and third parties each IBS actually depends on.
Scenario testing against severe-but-plausible disruptions, to prove impact tolerances would genuinely be met, not just documented.
Governance and board ownership of the whole programme, including a self-assessment document the board has actually reviewed and challenged.
For EU-scope entities, DORA (Regulation (EU) 2022/2554) requires the equivalent discipline under different terms — a documented ICT risk management framework (Chapter II, Articles 5–16) covering "critical or important functions," business continuity and disaster recovery policies (Article 11), and resilience testing (Chapter IV, Articles 24–27), approved and owned by the management body. The two regimes don't share identical vocabulary, but the underlying build — identify what matters, decide how much disruption you can tolerate, map the dependencies, test it, govern it — is the same shape, and the assessment approach transfers directly either way.
Is this for you?
This service is for firms in one of these situations:
The March 2025 deadline has passed, but the programme lives more on paper than in practice — an IBS register that hasn't been touched since, testing that hasn't been repeated, a self-assessment the board signed off once and hasn't revisited.
A DORA readiness assessment has flagged programme maturity as the real gap, not just article-by-article compliance — a common next step after a DORA Sprint.
The firm is building this for the first time — a newer entrant, a firm growing into scope, or a business line expanding into an area that now counts as an important or critical function.
A board or audit committee wants independent assurance that the resilience programme would actually hold up under scrutiny, not just pass a paper review.
In practice: banks, building societies and specialist lenders, insurers and MGAs, payment and e-money firms, and asset/investment managers — UK PRA/FCA-regulated firms primarily, and EU DORA-scope entities building the equivalent programme.
Frequently asked questions
How long does this take?
Around 6–8 weeks elapsed, across roughly 19.5 person-days of facilitation and design work. It runs longer than a DORA Sprint because it depends on scheduling workshops with business-line stakeholders, not just document review and interviews — the workshops are where the real work happens, and stakeholder time is the honest pace-setter.
We already have IBS and impact tolerances documented. Why would we need this?
Documented and embedded aren't the same thing. If the register hasn't been touched since the original deadline, testing hasn't been repeated, or the board hasn't actually challenged the assumptions behind it, this becomes a maturity review and rebuild rather than a from-scratch exercise — often faster as a result.
Does this replace a DORA Sprint?
No — they're complementary. A DORA Sprint (or equivalent readiness assessment) tells you where the gaps are against the regulation, article by article. This service builds or matures the programme itself. Many clients run a DORA Sprint first, then this.
What's delivered at the end?
An Important Business Services register, impact tolerance statements per IBS, dependency maps across people/process/technology/third-party, a severe-but-plausible scenario test plan, a governance and operating-model design, and a maturity assessment with an implementation roadmap.
Do you run the scenario tests for us?
This engagement designs the test plan — what to test, and how to prove impact tolerances actually hold. Running the tests themselves is a follow-on engagement, since it typically needs live operational involvement beyond a fixed-scope design piece.
What does it cost?
Scoped and quoted after a short call — there's no published price. A single-entity programme is typically around 19.5 days of work, fixed-fee with no open-ended billing. Get in touch and we'll confirm scope and cost together.