A transparent engagement rather than an undefined transformation
Operational resilience projects fail when the agreed deliverable is vague. “Improve resilience” can mean an updated policy, a dependency inventory or a year of complex testing. We begin by understanding the firm’s regulatory scope, operational model, evidence maturity and available decision-makers. The proposed statement of work then defines the outputs, workshops, reviewers, timetable, client inputs and exclusions before specialist delivery begins.
1. Scope the need
We ask about the entity’s regulatory status, important business services, existing self-assessment, open vulnerabilities, major supplier dependencies, upcoming supervisory activity and any incident reporting change programme. If a request is primarily for emergency cyber response, litigation support or certification, we say so and direct the scope to the appropriate specialist rather than pretend a continuity review solves it.
2. Agree a deliverable map
Each workstream has a named owner, evidence inputs, a date and clear acceptance criteria. For example, “dependency mapping” might mean a reviewed map for three important services with named primary and alternate suppliers, a recorded completeness assessment and an exceptions list. It should not mean an unlimited mapping exercise hidden behind one line in a proposal.
3. Review documents and interview owners
We compare written claims with reality. The person who owns a service may disagree with the last testing report about recovery capacity. A supplier may offer a different interpretation of an exit option. We document discrepancies and identify which evidence is missing rather than silently choosing the most favourable answer.
4. Exercise, document and challenge
Where testing is included, an experienced facilitator designs scenarios and records decisions, timing, limitations and remediation. Findings are reviewed with accountable client owners. We do not issue a certificate of FCA compliance, and technical tests require explicit authorisation and separate safeguards.
5. Hand over evidence or maintain it on retainer
Some firms need a fixed diagnostic or exercise. Others benefit from regular updates and board-ready governance. The ongoing option is appropriate only when there is sufficient budget and internal ownership to act on identified vulnerabilities. It is not a substitute for firm accountability.
Data handling
Our public contact route requests basic professional details only. Sensitive risk registers, service diagrams, incident data and client information belong in a secure, contractually agreed exchange once the engagement and security controls have been established.
Frequently asked questions
Will you ask for our confidential service maps through the website?
No. First contact is limited to professional qualification details. Confidential documents require a separately agreed secure process.
Who signs off the outcome?
Named client owners and the relevant governing body make the required decisions; specialist reviewers sign off only on the scope of their professional work.
Can a diagnostic turn into a retainer?
Yes if the firm wants continuing support and there is a defined, commercially viable scope.