A useful self-assessment must help the board decide
The operational resilience self-assessment is not a marketing brochure or an unchallenged collection of “green” ratings. It is the board’s written view of what the firm has identified, tested and remediated, including where uncertainty and residual vulnerability remain. For firms within FCA SYSC 15A, a defensible record enables the governing body to review the firm’s approach and make informed decisions on resources and risk acceptance.
The FCA’s March 2026 publication makes an important distinction: a self-assessment does not need to contain every supporting document, but it must be sufficiently clear and traceable for the board to understand, challenge and prioritise.
Suggested document structure
1. Scope and accountability
State which entities, regulated activities and business services the review covers. Identify the governing body, accountable executives, review date, preparers and approval record. Explain any exclusions instead of hiding them in a footnote.
2. Important business services and impact tolerances
List each service, explain why it was identified and document the relevant harm thresholds. Separate client-harm and market-integrity considerations where they differ. Record how peak demand, vulnerable customers and scenario evidence influenced the metrics.
3. Dependency mapping and supplier exposure
Show the methodology, version date and completeness of mappings for staff, processes, technologies, facilities, information and third parties. Highlight shared dependencies that can fail together. Note where the firm relies on supplier statements not yet verified by testing.
4. Scenario testing and recovery evidence
Summarise severe-but-plausible scenarios, what was observed, which tolerances were examined and what uncertainties remain. A test outcome must not be presented as stronger than its evidence. A tabletop with untested fallbacks cannot prove that an alternate processing channel will work at peak capacity.
5. Vulnerabilities, communications and remediation
Maintain a table linking each material weakness to affected services, interim workarounds, target dates, owners, risk acceptance and closure evidence. Explain how internal and external communications were exercised when primary channels failed.
6. Board decisions and next cycle
Record challenge, actions approved, resources committed, material unresolved issues and the next planned reviews or tests. The evidence index should make it easy to trace every material board statement back to source material.
Common weaknesses to address before approval
A self-assessment may be extensive but still omit the reasons for choosing harm thresholds; use a technology-only dependency map; fail to explain why testing scenarios were severe enough; record no vulnerabilities without persuasive evidence; or lack board decisions and dates. These are not formatting faults. They undermine the board’s ability to understand actual resilience.
Start with a free evidence review
Our on-site self-check helps you identify missing evidence categories. It is deliberately not an automated compliance certificate. Use the results to prepare questions for your internal owners or to scope an independent diagnostic with a qualified practitioner.
Example board self-assessment structure
A strong self-assessment is a decision document with links to supporting evidence, not a folder of attachments. A practical section order is: (1) regulatory perimeter and scope; (2) important services and tolerance rationale; (3) key mapping changes; (4) tests and real incidents; (5) material vulnerabilities and responsible owners; (6) action funding and next review triggers; and (7) questions and approvals required from the board.
| Board question | The answer needs to show |
|---|---|
| Which important services are least resilient? | A service-level position informed by actual tests and realistic harm metrics |
| What has materially changed? | Versioned changes to services, dependency maps, suppliers and risk exposure |
| Where did tests fail or rely on simulation? | Explicit exceptions, assumptions and limitations |
| Which exposures are accepted rather than fixed? | Decision maker, rationale, duration and review trigger |
| What investment or action is requested? | Owner, cost/effort where known, impact and proposed date |
The written record should summarise enough for effective board challenge while preserving traceability to logs, tests and risk decisions. The FCA’s 27 March 2026 findings particularly emphasise ownership, non-technology dependencies, effective scenario testing and board oversight.
Practical template to use with your team
- Download the board evidence matrix — adapt, verify and approve before operational use.
Frequently asked questions
Does the FCA approve individual self-assessments?
The firm is responsible for its documentation and approval process. Do not assume a self-assessment is endorsed by the regulator.
Does the self-assessment need every underlying artefact?
The FCA says not necessarily, provided the board is given clear enough information to understand, challenge and decide. Supporting evidence must remain available.
Can a free checklist prove compliance?
No. It can surface possible evidence gaps, but regulatory scope and the adequacy of evidence require qualified review.