Related disciplines, different primary questions
Business continuity asks how an organisation will sustain or restore critical activities during disruption. Operational resilience, in the UK financial regulatory sense, asks whether important business services can remain within a tolerable disruption threshold, assessed by the harm their failure could cause. An effective continuity management system is an important component of resilience but does not alone demonstrate compliance with an applicable FCA or PRA resilience framework.
Compare the work in practical terms
| Question | Business continuity | Operational resilience |
|---|---|---|
| What is protected? | Priority activities, processes and products | Important business services and their outcomes |
| Key limit | Recovery objectives and interruption impacts | Impact tolerance tied to consumer harm and/or system risks |
| Method | BIA, strategies, BCPs, exercises | IBS selection, impact tolerance, end-to-end mapping, scenarios and self-assessment |
| Ownership | Continuity manager and process owners | Governing body and accountable business, risk and service owners |
| Typical evidence | Plans, recovery objectives, exercise outcomes | Service-level harm rationale, mappings, tests, vulnerabilities and board decisions |
The disciplines overlap. Both benefit from realistic testing, good crisis communications and accurate supplier data. The distinction matters when designing metrics and deciding what a successful test proves.
Example: a payment service appears recovered, but users are still harmed
A company’s payment application comes back online within its two-hour IT recovery target. However, messages have queued, reconciliation is incomplete and affected users cannot access funds until the following day. Meeting the application’s RTO did not establish that the important business service stayed within a consumer-harm impact tolerance. A resilience assessment therefore examines the full service chain, not only the technical restoration step.
Which service should your firm buy?
Buy focused business continuity support if the urgent issue is outdated BIAs, missing departmental plans, training or an unexercised recovery process. Buy a regulatory resilience diagnostic if the urgent issue is defining important services, setting tolerances, showing evidence to the board or validating the programme against FCA/PRA requirements. Consider an ongoing managed programme when both sets of records exist but no one has the capacity to keep them accurate across the year.
The mistake to avoid
Do not relabel an ISO 22301 aligned BCP as “FCA compliant operational resilience” without verifying the statutory perimeter and the additional service-level evidence. Likewise, do not dismiss continuity planning as irrelevant simply because the regulation uses different terminology. The strongest programme connects both.
Frequently asked questions
Can one consultancy do both?
Yes, if the engagement combines appropriate continuity and regulatory expertise and the outputs address each relevant standard.
Is ISO 22301 certification required by SYSC 15A?
The FCA rules do not impose a blanket requirement to obtain ISO 22301 certification.
What should the board focus on?
Whether important services can remain within harm-based tolerances, what the evidence proves and which weaknesses need action.