# Operational resilience evidence chain — worked example

**Status:** Illustrative training example, created 11 October 2026. Not an actual client engagement, regulatory submission or assurance report.

## Hypothetical firm

A UK payment institution depends on a third-party payment-processing gateway and a separate cloud authentication platform. The firm's governing body has approved a customer-facing important business service and a firm-specific impact tolerance. No figures are reproduced in this example because tolerance limits must be evidenced and approved by the actual firm.

## Traceability record

| Field | Illustrative entry |
|---|---|
| Important business service | Execute eligible customer payment instructions |
| Harm considered | Delayed or failed payments, affected customer groups, inability to access funds where relevant |
| Tolerance rationale | Determined by the firm from customer-harm evidence, market relevance and governing-body approval |
| Key dependencies | Gateway, authentication, settlement, reconciliation staff, customer communications |
| Severe-but-plausible scenario | Gateway unavailable; authentication degraded; customer volume rising |
| Test method | Facilitated tabletop plus separate validated technical recovery evidence |
| Observation | Team can invoke a workaround, but its throughput and fraud-control capacity are not measured |
| Vulnerability | Recovery of technical gateway is not the same as safe completion and reconciliation of transactions |
| Assigned owner | Example payment operations executive |
| Agreed action | Measure viable workaround capacity and retest the end-to-end service |
| Closure criterion | Evidence that the workaround can be invoked safely at the tested load, reviewed by the firm |
| Board question | What residual exposure remains and which decision/investment is needed? |

## How to use this example

A credible assessment connects harm, tolerances, dependencies, scenario evidence, gaps and decisions. Never substitute invented recovery figures for real measurements. Keep real customer data, supplier contracts, system diagrams and sensitive evidence in approved client-controlled systems—not in a public web checker.