# Operational Resilience as a Service — illustrative RACI

R = responsible for performing the task; A = accountable for the decision; C = consulted; I = informed. This is a **starting example only**. Each client must adopt a RACI matching its legal entity, senior management framework and governance.

| Activity | Regulated firm's board | Firm's service owner | External resilience adviser | Firm's risk/compliance lead |
|---|---|---|---|---|
| Decide if service is an important business service | A | R | C | C |
| Establish impact tolerance | A | R | C | C |
| Update dependency mapping | I | A | R (agreed scope) | C |
| Design/facilitate exercise | I | A | R (agreed scope) | C |
| Accept material residual risk | A (per governance) | R | C | C |
| Track action closure evidence | I | A | R (administration) | C |
| Approve self-assessment/governance decisions | A | R | C | C |
| Evaluate regulatory incident notifications | I/A where relevant | R/C | C | A/R as appointed |

An external adviser may coordinate, document and challenge the activity but does **not** automatically assume the firm's statutory accountability.

## Contract annex checklist

- Named regulated entity and location of evidence records
- Number of important business services and third-party relationships in scope
- Scheduled advisory days and testing/exercise commitments
- Number of board reports and governance meetings
- Evidence access approvals and information-security restrictions
- Work excluded (legal opinions, certification, incident response, technical remediation)
- Change-control method and cancellation or handover obligations