A 12-month operating programme with defined ownership
A resilience framework can become stale almost immediately after approval: people change roles, suppliers alter sub-contracting arrangements, new products create dependencies and an exercise identifies a weakness nobody has the capacity to close. An agreed Operational Resilience as a Service contract makes that upkeep a defined recurring commitment. Instead of buying another review each time a risk changes, the firm agrees a calendar, deliverables, named internal counterparts and a specialist review process.
The recurring engagement is not a promise to take over statutory duties. The firm’s governing body approves important services, tolerances and self-assessment, while designated owners retain decisions and information accuracy. The external team manages the timetable, maintains agreed working records, coordinates workshops and documents the findings for those decision-makers.
An engagement should be defined before it is sold
- First 90 days: confirm the legal-entity perimeter, important-service inventory, source evidence and action owners; agree a bounded first exercise and decision pack.
- Recurring deliverables: a monthly change and vulnerability review, quarterly governance material, and an agreed annual testing programme—not unrestricted incident support.
- Client control: keep evidence in the firm’s approved environment, with decisions and statutory accountability retained by the firm’s governance team.
For a first conversation, the number of in-scope entities, important services, material suppliers and proposed exercise participants is more useful than sharing confidential records. Compare indicative scope and fee drivers or prepare a non-confidential scope enquiry.
What a monthly service would include
An operating meeting reviews changes to customer services, outsourced activities and technology. Owners confirm changes to the service map, vulnerabilities are updated with due dates, and emerging regulatory developments are triaged for relevance. The output is a small action pack: what changed, which important service may be affected, what evidence supports it and who is accountable for next steps.
Quarterly cycles consolidate governance material and check overdue remediation. Annual cycles address review and testing obligations, but the precise cadence must be set against the firm’s rules, risks and material changes; it cannot be replaced with a universal one-size-fits-all calendar.
A practical year-one sequence
- Baseline: confirm regulatory perimeter, service inventory, evidence owners, tolerances, maps and existing scenario results.
- Challenge: identify missing dependencies, optimistic assumptions and material supplier concentrations.
- Test: design and facilitate agreed severe-but-plausible exercises; record what was observed, not merely what participants expected.
- Remediate: allocate actions, collect proof of closure and escalate items whose residual risk remains outside appetite.
- Govern: prepare the written review and board pack with traceable links to underlying artefacts.
- Repeat: rerun focused work when a material business or supplier change renders earlier evidence unreliable.
The client-side information we need
A programme relies on access to willing service owners, supplier contacts, incident records and appropriate testing participants. The retainer can provide structure and specialist capacity, but it cannot manufacture evidence that exists only in business systems or validate recovery arrangements that a provider has not been allowed to examine.
Scope boundaries: what is and is not included
We would specify the number of important business services, regulated entities, critical suppliers, annual exercises, board reports and specialist delivery days in the statement of work. Live systems testing, penetration testing, certification, 24/7 incident response, legal opinions and unlimited supplier investigations would be separately agreed with qualified parties. Unplanned remediation programmes are estimated before commencement.
What the board actually receives
A useful quarterly pack should show service-level tolerance exposure; tests completed and deferred; the most material vulnerabilities and their age; supplier dependencies and exit readiness; changes since the last review; upcoming regulatory deadlines; and decisions requested from the board. Every significant statement should point to an evidence record or acknowledge uncertainty. A clean dashboard with no exceptions is not assurance if the underlying testing was too easy.
The monthly evidence pack: five standing outputs
Rather than promising unlimited advisory access, a retained service can be defined around records that decision-makers can audit:
| Output | Minimum information | Review owner |
|---|---|---|
| Service change log | Service changed, date, reason, affected tolerance, evidence link | Important-service owner |
| Dependency exception list | Changed supplier/system/person/process, potential point of failure, next action | Business and technology owners |
| Vulnerability register | Severity, impacted service, accountable owner, due date, residual risk, closure test | Risk and service owners |
| Testing and exercise log | Scenario purpose, assumptions, timed observations, limits of test, outstanding actions | Exercise lead |
| Governance decision log | Management challenge, options, explicit decision, accountable sign-off | Firm’s governance body |
These deliverables should remain within the client’s controlled evidence environment where practical. A supplier can maintain a working index without routinely ingesting complete incident records, customer records or commercially sensitive supplier contracts into third-party AI tools.
Contract boundaries that prevent a profitable retainer becoming an open-ended project
A statement of work should state the number of legal entities, important services, material suppliers, exercise days, senior review hours and board reports included. It should name who provides evidence and who signs it off. Extraordinary incident response, large technical recovery tests and substantial remediation projects should require a separate change request, agreed safety precautions and specialist resources.
For a firm with a relatively small service inventory, the work may be concentrated in a small number of workshops per quarter. A firm with high-volume payments and concentrated outsourced processing may need more frequent controls and a different fee. Price by evidenced effort and consequence, not by the count of generated documents.
Where specialist oversight is indispensable
Human reviewers must challenge the selection of important services, the definition of intolerable harm, the severity of scenarios, tolerance breaches and the quality of remediation. Automation can format minutes, reconcile change logs, maintain reminders and assemble traceable board packs. It should never turn incomplete source records into a claim that a service has passed a resilience test.
Practical template to use with your team
- Download the service programme RACI example — adapt, verify and approve before operational use.
- Download the illustrative evidence chain — adapt, verify and approve before operational use.
Frequently asked questions
Is an annual retainer mandatory under FCA rules?
No. The rules require applicable firms to meet their obligations, not to buy an external retained service. The retainer is one way to resource continuing work.
Can we retain only supplier reviews or testing?
Yes, a scoped workstream may be more proportionate than a full managed programme. The statement of work should define outputs and interfaces.
What happens if we breach an impact tolerance?
The firm activates its incident processes, assesses regulatory notification obligations and makes accountable decisions. A consultancy can support analysis and documentation under an agreed engagement.
Illustrative first 90 days: a defined start rather than an undefined transformation
Days 1–30 — establish the perimeter. Agree regulated entity, internal owner, evidence-access rules, existing important-business-service inventory, tolerances and mapping sources. Provide a dated exceptions and assumptions register rather than a generic maturity score.
Days 31–60 — challenge what exists. With the client’s specialists, sample dependencies beyond IT, review supplier concentration and failed workaround assumptions, and propose severe-but-plausible exercises sized to contractual scope. Separate real measured evidence from management expectation.
Days 61–90 — test and govern. Facilitate only safe, agreed exercises, record actual limits, assign vulnerabilities and assemble the first decision-ready governance pack. A meaningful outcome is a traceable list of decisions and owners, not a manufactured ‘compliant’ stamp.
This is a proposed engagement sequence, not a promise that unconfirmed personnel or resources have been retained. The actual number of entities, services, hours, workshops, tests, turnaround and approvals will be agreed by qualified specialists and the client before signing.
Inspect what a contract and a test should contain
- Illustrative managed resilience statement-of-work scope — explicit inclusion, exclusion, acceptance and handover prompts.
- Worked fictional payments-provider outage — dependency map, queue arithmetic and board action chain.
- UK 2026–2027 source-led regulatory tracker — identify where obligations differ by firm category.