An independent review of what your evidence actually proves
Best fit: an in-scope firm with a self-assessment review, a change in important dependencies, or uncertainty about whether its existing testing evidence can withstand challenge. Agree a specific deliverable: an evidence-and-assumptions register, prioritised remediation ownership and a decision meeting. Number of services and reviewer time must be scoped before a fee is quoted.
An operational resilience gap analysis should not simply ask whether the firm has a policy, service register and testing schedule. It should test whether those documents accurately describe the operating model and whether a board could use them to understand where intolerable disruption is most likely. The most valuable output is a sequence of practical actions prioritised by exposure—not a collection of generic compliance warnings.
Before starting, we confirm which rules apply. FCA SYSC 15A and PRA SS1/21 have defined populations. Firms outside those regimes may still have material outsourcing, systems, continuity and incident-reporting obligations, and should be assessed against the framework that actually applies.
What we ask to review
The evidence request usually includes the important-business-service inventory and selection rationale; tolerance metrics; dependency and supplier maps; testing plans and recent results; vulnerability registers; disruption and near-miss logs; communications playbooks; written self-assessment; and board approvals. Interviews challenge whether document owners agree about the facts.
Sensitive evidence is supplied only through a separately agreed secure process. Do not upload customer data, system diagrams, incident records or confidential supplier contracts through a public enquiry form.
How findings are graded
We distinguish missing evidence from evidence that demonstrates a control gap. A test may have been performed but may never have challenged the worst credible conditions. A mapping inventory may exist but omit specialist staff, physical facilities and supporting data. A board-approved tolerance may be expressed as a round number with no consumer-harm rationale. Each finding should explain the observed fact, relevant rule or expectation, affected service, potential harm, recommended action, owner and expected verification method.
What the client receives
A proposed deliverable pack includes the evidence inventory, gap register, materiality rationale, concise executive readout, sequenced remediation plan and recommendations for additional testing. The diagnostic cannot certify compliance or guarantee supervisory outcomes. It can help the board understand what is known, what has not been tested and where focused investment would improve assurance.
From diagnosis to continuing assurance
Once major gaps are resolved, records still need maintenance. The diagnostic can form a baseline for a 12-month programme, with regular checks that business changes do not quietly invalidate the mapping, testing and evidence that supported the initial view.
Example diagnostic acceptance criteria
The diagnostic should not award a simple ‘green’ to a service merely because a policy, diagram or vendor certificate exists. Each finding should identify a tested assertion, its supporting artefact and the uncertainty that remains.
| Assertion | Evidence a reviewer would expect | Typical diagnostic challenge |
|---|---|---|
| Important service is clearly bounded | Client-facing outcome, services excluded, approval rationale | Is a whole business division incorrectly described as one service? |
| Impact tolerance is defensible | Consumer-harm/market-impact rationale, metric, assumptions | Is the tolerance simply an internal recovery objective? |
| Service is mapped end to end | People, processes, technology, data, facilities, material third parties | Are manual workarounds and fourth-party dependencies absent? |
| A scenario was properly challenged | Design rationale, injects, observed outcomes, independent challenge | Was the exercise too easy to be severe but plausible? |
| Remediation has accountable ownership | Assigned owner, materiality, date, closure or risk acceptance evidence | Are repeat vulnerabilities never tracked to a decision? |
A diagnostic report should state what was not tested and what the reviewer was unable to verify. This matters more than filling an entire spreadsheet with positive scores. Ask for a sample report layout, with confidential information removed, before engaging any provider.
Frequently asked questions
How long does a gap analysis take?
The schedule depends on available evidence, the number of entities and important services, and the accessibility of owners. Timing is fixed in the scoped proposal, not guaranteed generically.
Does a favourable gap report mean we are compliant?
No. It is an evidence-based assessment against an agreed scope, not an FCA/PRA approval, certification or legal opinion.
Can we review one service or supplier?
Yes. Focused work can be more useful than a broad assessment when the organisation already understands its other exposures.