Map the service your customers experience, not merely the systems you own
An important business service (IBS) under the FCA operational resilience framework is framed around a service provided to clients whose disruption could cause intolerable harm or threaten the stability or orderly functioning of the financial system. Identification should therefore begin with customer-facing outcomes. Internal processes are mapped as dependencies, not automatically treated as separate important services.
The FCA’s March 2026 review found that firms had improved their mapping but sometimes concentrated too heavily on technology. The regulator explicitly called for people, processes, facilities, information and relevant third-party resilience to be considered.
A practical mapping workflow
- Define the service and its boundaries, clients, owner and selection rationale.
- Identify activities and decisions that must occur to provide the service, including manual workarounds.
- Trace systems, data inputs, people, physical resources, facilities and suppliers that those activities need.
- Identify shared dependencies and failure combinations, including fourth parties where known.
- Test map completeness against real incidents, operational diagrams and conversations with accountable service owners.
- Record version, evidence source, gaps and the changes that require review.
Example: a cash withdrawal or payment instruction
A high-level map might show customer interface, identity verification, risk checks, payment processing, banking or network connection, reconciliation, complaints and customer communications. But those boxes may conceal common cloud providers, database permissions, access-control dependencies and specialist staff in one office. Mapping must be detailed enough to inform testing, not merely to explain the service to a new employee.
Quality questions
Could the map reveal a single supplier failure affecting multiple services? Does the fallback use a different authentication method? Can the firm’s staff locate necessary information without primary systems? Who validates suppliers’ recovery claims? Can the board see which maps have not been reviewed after a material change?
Use mapping to improve decisions
The practical purpose of mapping is to identify vulnerabilities and choose meaningful tests. A map with hundreds of components but no risk interpretation is less useful than a smaller map showing material dependency concentrations, recovery assumptions and owners. Keep the relationship to impact tolerances visible throughout.
Frequently asked questions
Is an IT system an important business service?
Not usually by itself. The service is framed around the relevant client-facing outcome; technology is commonly a dependency.
How often must mappings be reviewed?
SYSC 15A sets review requirements following material change and, for the applicable assessment, no later than one year.
What is the main use of a service map?
Finding vulnerabilities and selecting tests that reflect the entire service chain, including shared dependencies.