Trace every material resilience conclusion to an identifiable record
Our proposed evidence method begins with the business service rather than the document. Each important-business-service record has an owner and approved rationale. Each impact tolerance has a harm basis. Each material dependency has a source and currency date. Each scenario has an observed result and limitations. Each material vulnerability has an accountable action owner. The governing body receives a concise decision pack linked to the underlying evidence.
The purpose is not to generate as many policies as possible. It is to make important claims testable.
The evidence chain
Claim: “Customers can complete an important payment service within the agreed tolerance during a supplier outage.” Support: defined service, tolerance metric, dependency mapping, fallback process, scenario design, test result and remediation status. Challenge: did the test include peak demand and the failure of shared authentication? Decision: does the board have sufficient confidence, and what must be fixed?
An evidence register should store the artefact owner, date, version, relevant regulated entity, affected important service, reviewer, open issues and next review trigger. Confidential documents need access control and retention rules proportionate to their sensitivity. This public site does not store that evidence.
A practical review rubric
We distinguish four states: not evidenced, where the claim has no accessible support; documented only, where it rests on a plan or supplier assurance; tested with limitations, where an exercise offers partial information; and evidenced through suitable testing and review, where the important assumptions have been meaningfully challenged. These are internal working categories, not FCA-issued ratings or compliance certifications.
Continuity of review
Important services and impact tolerances must be reassessed on the applicable regulatory timetable and after material change; mapping and scenario plans should respond to changing resources and risks. The governance process should identify changes to suppliers, cloud infrastructure, customer flows, key personnel and incident history that invalidate earlier assumptions.
Expert sign-off and limitations
Automation may compare document versions, extract action owners or prepare draft summaries. It should not silently pronounce regulatory compliance, write fabricated exercise outcomes or approve evidence it has not observed. A named competent reviewer challenges the substantive findings before they are used in a board pack. The client retains regulatory ownership and final decisions.
What this gives buyers
An evidence chain makes audits, supervisory questions and internal transitions easier to manage because the organisation can identify the source of each material conclusion. It also makes unresolved uncertainty visible—a more honest and commercially valuable outcome than guaranteeing a clean report.
Frequently asked questions
Is your evidence score an official FCA rating?
No. It is a working assessment method used to identify record quality and remaining questions.
Can AI review confidential evidence?
Only within agreed data-handling arrangements and with relevant expert review; this public site does not accept confidential uploads.
Who is ultimately accountable?
The regulated organisation and its governing body retain their applicable statutory responsibilities.
Reproduce and challenge the evidence method
We publish our nine-record regulatory evidence tracker with source links, source-check date and downloadable machine-readable data. It is original comparative organisation of public primary sources, not undisclosed client data or proprietary supervisory statistics.
A separate fully labelled fictional payment outage provides inputs, times, queue calculations, example evidence owners and a board decision log. It shows where numerical measures can aid scrutiny while also showing why numerical results alone cannot constitute a regulatory impact-tolerance assessment.
We will not claim this educational material substitutes for qualified reviewer approval of a real regulated organisation’s legal scope, work or compliance status.