FCA Operational Resilience Thematic — 2026
FCAIn progressDeadline 22 Jul 2026 · -38 days left
Approved
3
In review
3
Draft
2
Evidence requested
1
Not started
1
Questions
| # | Question | Owner | Evidence | Status | |
|---|---|---|---|---|---|
| 1.1 | Describe how the firm has identified its Important Business Services and the rationale used. | PSPriya Shah | 4 | Approved | |
| 1.2 | How does the firm set impact tolerances for each Important Business Service, and how were these approved? | MAMarcus Allen | 6 | In review | |
| 1.3 | Provide evidence of severe but plausible scenario testing carried out in the last 12 months. | SLSophie Lindqvist | 3 | Draft | |
| 2.1 | How is the firm assured that material third parties can support its impact tolerances? | MAMarcus Allen | 1 | Evidence requested | |
| 2.2 | Describe the firm’s approach to substitutability for critical third parties. | MAMarcus Allen | 0 | Draft | |
| 3.1 | How are lessons from operational incidents incorporated into the resilience framework? | ITInès Tremblay | 5 | In review | |
| 3.2 | Describe vulnerability management for ICT assets supporting Important Business Services. | ITInès Tremblay | 7 | Approved | |
| 4.1 | How does senior management oversee operational resilience risk? | PSPriya Shah | 3 | Approved | |
| 4.2 | Describe the role of internal audit in providing independent assurance over resilience. | unassigned | 0 | New | |
| 5.1 | Provide the firm’s most recent self-assessment under SS1/21 and a summary of remediation actions. | DODaniel Okafor | 2 | In review |
Engagement scope
Regulator: FCA
Owner: Daniel Okafor