What an operational resilience framework needs to accomplish
A resilience framework should make clear how the organisation decides which services matter, how much disruption it can tolerate, what resources those services depend upon, and how management knows whether recovery capabilities are credible. It is a decision system rather than a collection of templates. The framework has failed if business teams cannot apply it when products, suppliers or operating models change.
For relevant UK financial-services firms, FCA SYSC 15A and PRA SS1/21 provide the core regulatory expectations. Other organisations can still use these disciplines proportionately without claiming they are formally within those regimes.
The framework components
Scope and rules: identify regulated entities, business activities and obligations, including the boundary with the 2027 reporting regimes. Governance: name the executive sponsor, service owners, risk challengers, reviewers and approving body. Service taxonomy: define client-facing important services and explain exclusions. Tolerance method: connect time-based and non-time-based metrics to consumer harm, market impacts or prudential risks as applicable.
Mapping method: specify how human resources, applications, data, facilities, processes and third parties are captured and kept current. Testing policy: explain scenario selection, exercise types, evidence standards, follow-up and retesting. Remediation: state how vulnerabilities are triaged, assigned and escalated. Communications: define response roles, alternative channels and decision records. Review: set dates and material change triggers.
The control most frameworks miss: change management
Imagine a payments firm introduces a new fraud screening provider. A resilient framework asks which important services use the provider, whether impact tolerances are affected, whether concentration has increased, how fallback works and whether scenario plans should change. If the programme learns about the new supplier only at year-end, the framework is not integrated with business-as-usual decision-making.
Metrics that help rather than decorate
Track the proportion of important services with current maps, coverage of severe-but-plausible testing, vulnerabilities past due, third-party dependencies with validated recovery evidence, communication workarounds exercised and board decisions awaiting action. The definition and data quality behind each measure matter more than presenting an attractive dashboard.
A framework maturity check
Choose one important service and trace its tolerance through dependency records, a realistic exercise and a remediation decision. Where the trail breaks, prioritise that failure. A 40-page policy cannot compensate for undocumented staff concentration or an untested recovery route.
Practical template to use with your team
- Download the annual workplan template — adapt, verify and approve before operational use.
Frequently asked questions
Can a generic template be a resilience framework?
It can provide a starting structure, but the evidence, service definitions, tolerances and tests must be tailored to the firm.
Is an annual update always sufficient?
No. Applicable rules require review at least on the relevant cycle and also when material changes occur.
Should resilience sit under risk, operations or IT?
Different operating models can work if ownership, challenge, decisions and escalation are unambiguous across the organisation.