Operational resilience - Q1 2022

Important business services

Identification of all their important business services in line with the regulatory definitions using judgment and based on factors such as financial impact and consumer base.

Mapping

Identified and documented the people, processes, technology, facilities and information underpinning important business services, and set resilience requirements for key resources. At this stage, firms will only need to have carried out mapping to a degree necessary to accurately identify their important business services.

Impact tolerances

Impact tolerances are set for each important business service. Dual-regulated firms require two impact tolerances for each important business service to address FCA and PRA objectives. Impact tolerances must be expressed using a time-based metric and any suitable additional metrics.

Scenario testing

A strategy by which to test their ability to remain within the set impact tolerances for each Important Business Service in the event of severe but plausible scenarios arising. At this stage, firms will only need to have carried out scenario testing to the degree necessary to accurately identify their important business services and to enable them to identify any vulnerabilities in their operational resilience.

Outsourcing

Dual-Regulated firms need to be able to evidence compliance with the PRA’s rules on outsourcing policies, pre-outsourcing actions, outsourcing agreements, business continuity and exit plans.

Self-assessment document

A self-assessment document showing how the firm meets operational resilience requirements. A firm’s Board or equivalent management body must approve this self-assessment and it should be available to the regulator upon request from 31 March 2022.

Transitional Period

The end of the implementation period also signals the start of the transitional period which runs until 31 March 2025. During this period firms will need to:

• Review Important Business Services and Mapping annually or in the event of a material change to the business or operating market
• Continue to conduct scenario testing using a variety of severe but plausible scenarios across all Important Business Services to ensure the firm can remain within Impact Tolerances
• Strengthen systems, strategies, and processes to remediate any identified vulnerabilities and operate within Impact Tolerances as soon as practicable and before 31 March 2025
• Review and regularly update the Self Assessment document