How to Prepare a Credible Operational Resilience Self-Assessment

The self-assessment is the single document supervisors use to judge whether your firm has genuinely operationalised resilience or merely written it down. By March 2025, firms were expected to remain within impact tolerances for all important business services under severe but plausible scenarios. If your self-assessment cannot show that, in evidence, with named vulnerabilities and a credible remediation path, you have a problem worth surfacing now rather than at the next supervisory meeting.

Start with the important business services, and defend the list

Supervisors routinely challenge the IBS list itself. Firms that bundle too broadly ("payments") lose the ability to test meaningfully. Firms that fragment too finely create a self-assessment no one can govern. The test is whether disruption to the service would cause intolerable harm to consumers or threaten market integrity, firm safety and soundness, or financial stability. Document why each service is in or out, who challenged the list, and what changed between iterations. If your IBS list has not moved in two cycles, that is itself a flag.

Make mapping specific enough to be useful

Mapping is where most self-assessments quietly fail. A diagram showing "core banking platform, third party X, colleagues" is not mapping. Good mapping identifies the specific people, processes, technology, facilities, information and third parties required to deliver the service, with concentration points and single points of failure named. Fourth party dependencies matter: if your critical SaaS provider relies on a single cloud region, that is your exposure, not theirs. Where mapping is incomplete, say so explicitly and show the plan to close the gap.

Test scenarios that could actually happen to you

The weakest self-assessments recycle generic scenarios: cyber attack, pandemic, third party outage. The strongest start from the firm's own mapping and ask: what combination of failures would breach this tolerance? That might be a ransomware event during a quarter end, loss of a specific data centre during a migration, or a key third party failing simultaneously with a market stress. Scenarios should be severe but plausible, which means grounded in real precedent, firm-specific exposures and current threat intelligence. Document who challenged severity, what was rejected and why.

Evidence the tolerance test, do not just assert it

For each important business service, the self-assessment should show: the impact tolerance, the scenarios tested, the method (tabletop, simulation, live invocation), the results including time to recover, what failed, and the identified vulnerabilities. If you remained within tolerance, show the evidence. If you did not, show the gap, the remediation, the funding and the interim risk acceptance. Supervisors are more comfortable with honest gaps and credible plans than with uniformly green ratings that collapse under questioning.

Treat vulnerabilities as a board matter

The vulnerabilities section is often the most lightly governed. It should name the vulnerability, the services affected, the remediation, the owner, the cost, the deadline and the interim controls. Where remediation extends beyond a reasonable period, the board should have explicitly accepted that risk with reasoning recorded. Dates that have slipped twice without challenge are a governance failure, not a delivery failure.

What good looks like

A credible self-assessment reads as if the firm has lived the regime, not drafted it. It shows iteration: scenarios have changed, mapping has deepened, tolerances have been revisited, vulnerabilities have closed and new ones have emerged. It is signed off by a board that has seen the underlying evidence, not just the summary. And it treats the PRA and FCA as legitimate challengers whose questions improve the firm's resilience, not as an audience to be managed.

Your next action: pick one important business service and ask whether the evidence behind its tolerance assertion would hold up under an hour of supervisory questioning. If not, that is where the work starts.

Frequently Asked Questions

How detailed should third party mapping be?

Deep enough to identify concentration risk and single points of failure, including fourth parties where they are material. If a provider sits on infrastructure you cannot see into, record the limitation and the compensating controls.

What severity of scenario is enough?

Severe but plausible means worse than anything you have experienced but grounded in real precedent for firms like yours. If your worst scenario is milder than publicly reported incidents in your sector, expect challenge.

Can we stay within tolerance by assertion if we have not fully tested?

No. Untested assertions are the single most common supervisory finding. Where full testing is not yet possible, say so, explain the proxy evidence, and show the plan to close the gap.

Who should own the self-assessment?

Accountability sits with the SMF holder for operational resilience, but the board owns approval. Drafting is typically coordinated by a central resilience function with input from service owners, technology, third party management and risk.

How often should it be refreshed?

At least annually, and after any material change: new service, significant third party change, major incident, or revised threat assessment. A static self-assessment is a red flag.