Operational resilience: demonstrating resilience in practice

The FCA has published its second-year observations on operational resilience self-assessments, and the message for boards and compliance teams is pointed: the sector has largely got the machinery in place, but too many firms still describe intended responses rather than demonstrating what they can actually deliver during a severe but plausible disruption. Governance, mapping, testing and remediation are described as strong across the market, so supervisory attention is shifting to quality of evidence, realism of impact tolerances and whether stated capabilities survive the loss of shared infrastructure, digital service providers and emerging technologies. For compliance and operational risk functions, this is a signal to re-open the self-assessment with a sceptical eye: test the assumptions behind recovery times, reconcile plan documentation against observed behaviour in exercises and real incidents, and ensure third-party and concentration risk is visible at board level.

Expect supervisors to probe the gap between narrative and demonstrable capability, and to challenge remediation timelines that drift. Firms that invest now in scenario realism, evidence trails and clear executive accountability will be better placed when the FCA next engages, and can use the exercise to reduce genuine exposure to cyber, technology and supplier outages. Those that treat the publication as reassurance risk finding their next assessment judged against a materially higher evidentiary bar.

Action should be prioritised for firms with complex outsourced estates, legacy platforms or heavy reliance on a small number of critical providers.