Structuring a PS21/3 Operational Resilience Self-Assessment That Evidences Impact Tolerance Testing
A practical guide to building an Operational Resilience self-assessment that credibly evidences impact tolerance testing to the FCA and PRA. After reading, you will know how to structure the document, sequence the evidence, and surface the vulnerabilities supervisors expect to see acknowledged.
The March 2025 deadline has passed, and supervisors are no longer interested in whether you have mapped your important business services. They want to see whether your impact tolerance testing is real, whether you have found vulnerabilities, and whether you are fixing them on a credible timeline. The self-assessment is where that story either holds together or falls apart.
Anchor the document in decisions, not description
The most common failure is a self-assessment that reads like a policy manual. Supervisors already know what PS21/3 requires. What they want to see is how your firm has applied it: which important business services were identified and why, which were deprioritised and why, how impact tolerances were set, and what testing revealed.
Structure the document so that every section answers a decision question. For each important business service, the reader should be able to trace: what it is, who depends on it, what the impact tolerance is, how it was tested, where the firm cannot currently stay within tolerance, and what is being done about it.
Get the impact tolerance logic right
Impact tolerances are not risk appetites. They are the point at which disruption would cause intolerable harm to consumers, market integrity, or safety and soundness. The two regulators approach this differently: the FCA focuses on consumer harm and market integrity, the PRA on safety and soundness and financial stability. Dual-regulated firms must set tolerances that satisfy both lenses, and the self-assessment should show you have thought about each explicitly.
Where firms get this wrong: setting tolerances at the level of what the firm can currently achieve, rather than the level of harm that would be intolerable. If your tolerance is 24 hours and you can recover in 22, that is not evidence of resilience, it is evidence of a tolerance set to flatter the current state. Supervisors read these.
Testing: severe but plausible, and documented
The scenarios used must be severe but plausible, and the self-assessment should explain why each scenario qualifies. Cyber, third party failure, data integrity loss, and concentrated infrastructure failure are table stakes. Scenarios involving a single point of failure in a critical third party, simultaneous disruption across multiple services, and prolonged recovery periods are where credible testing happens.
For each scenario, document: the assumptions, who was involved, what systems and people were tested, what broke, what did not, and what the firm concluded. Tabletop exercises alone will not satisfy supervisors for mature firms. Expect to show live failover, substitution of third parties, or operation under degraded conditions.
Name the vulnerabilities
This is where good self-assessments separate themselves. If your document identifies no vulnerabilities, or identifies only minor ones already resolved, it will not be believed. Firms running critical services on legacy infrastructure, concentrated on a single cloud region, or dependent on a small number of key individuals should say so, and show the remediation plan with dates, owners, and investment committed.
The PRA and FCA have both signalled that they expect firms to be in a position of compliance by March 2025, meaning able to remain within impact tolerances. If you are not there yet for every service, say which ones, by when, and what the interim mitigations are.
Board ownership must be visible
The self-assessment is a board document. Minutes should show the board challenging the identification of important business services, the calibration of tolerances, the realism of scenarios, and the credibility of remediation. If the board has simply approved what management presented, that will show. Record the questions asked and the changes made.
What to do next
Before the next submission cycle, ask three questions: would an experienced supervisor believe our scenarios are severe enough, do our remediation timelines match the materiality of the vulnerabilities, and has the board left fingerprints on the document. If any answer is uncertain, that is where to focus.
Frequently Asked Questions
How often should the self-assessment be updated?
At least annually, and after any material change to important business services, third party arrangements, or following significant incidents. The regulators expect the document to be live, not a point-in-time artefact.
What level of detail should the self-assessment contain on third parties?
Enough to show you understand concentration, substitutability, and exit. Name the critical third parties, describe the dependency, and explain how you would operate if they failed. Generic statements about vendor management will not suffice.
Should we disclose vulnerabilities we have not yet resolved?
Yes. Supervisors prefer a candid self-assessment with a credible remediation plan to one claiming full compliance. Undisclosed vulnerabilities discovered during supervisory review are far more damaging than disclosed ones being worked on.
How do we handle services that are important to the FCA but not the PRA, or vice versa?
Identify them separately and apply the relevant lens. A payments service may be FCA-critical for consumer harm reasons without being PRA-critical for safety and soundness. The self-assessment should make the regulatory basis for each tolerance explicit.
What does good board challenge look like in the minutes?
Specific questions on tolerance calibration, scenario severity, and remediation pace, followed by evidence that management responses changed the document. Approval without recorded discussion is a red flag.
Frequently asked questions
How often should the self-assessment be updated?
At least annually, and after any material change to important business services, third party arrangements, or following significant incidents. The regulators expect the document to be live, not a point-in-time artefact.
What level of detail should the self-assessment contain on third parties?
Enough to show you understand concentration, substitutability, and exit. Name the critical third parties, describe the dependency, and explain how you would operate if they failed. Generic statements about vendor management will not suffice.
Should we disclose vulnerabilities we have not yet resolved?
Yes. Supervisors prefer a candid self-assessment with a credible remediation plan to one claiming full compliance. Undisclosed vulnerabilities discovered during supervisory review are far more damaging than disclosed ones being worked on.
How do we handle services that are important to the FCA but not the PRA, or vice versa?
Identify them separately and apply the relevant lens. A payments service may be FCA-critical for consumer harm reasons without being PRA-critical for safety and soundness. The self-assessment should make the regulatory basis for each tolerance explicit.
What does good board challenge look like in the minutes?
Specific questions on tolerance calibration, scenario severity, and remediation pace, followed by evidence that management responses changed the document. Approval without recorded discussion is a red flag.
Related guides
How to Structure an MLRO Annual Report That Evidences Effective Financial Crime Controls
A practical guide to building an MLRO annual report that gives the board and the FCA genuine assurance on financial crime controls. After reading, you will know how to structure the document, what evidence to include, and where most reports fall short.
Structuring an ICAAP Under SS31/15 That Evidences Robust Stress Testing
A practical guide to building an ICAAP document under PRA SS31/15 where stress testing is genuinely integrated, credible, and proportionate. Readers will understand how to structure the narrative, calibration, and board engagement so Pillar 2A outcomes reflect the firm's actual risk profile rather than supervisory concern about weak analysis.
How to Prepare a Credible FCA Threshold Conditions Attestation Under Supervisory Pressure
This guide sets out how to prepare an attestation on compliance with the FCA's Threshold Conditions when supervisors have raised concerns. It explains what credible looks like, where attestations commonly fall short, and how to sequence board, executive, and evidence work so the submission holds up.
How to Prepare a Credible Operational Resilience Self-Assessment
This guide sets out what a credible Operational Resilience self-assessment looks like under the PRA and FCA regimes, with particular focus on evidencing impact tolerance testing. After reading it, you will know how to structure the document, where boards usually fall short, and what supervisors expect to see when they challenge your mapping, scenarios and vulnerabilities.
How to Structure a Credible RAF Public Disclosure to the Bank of England
This guide sets out how major UK firms should structure their Resolvability Assessment Framework public disclosure so it demonstrates genuine capability rather than procedural compliance. After reading, you will know how to sequence the document, where Bank of England scrutiny concentrates, and how to handle shortcomings with credibility intact.
Where internal confidence may exceed external evidence
Polar Insight helps leadership teams test critical assumptions against stakeholder, market, regulatory, and operational reality before risk compounds.
Explore Stakeholder Proximity