2 minute read
We recently hosted a webinar focused on exercising resilience tolerances to meet regulatory standards. Bringing together 60+ risk and resilience professionals from across the UK, Europe, India, and Australia to tackle one of the most challenging areas in operational resilience right now, non-time-based tolerances, and how to actually test them. Here is what stood out.
The UK and Australia are heading in the same direction
Both frameworks require firms to identify important business services, set tolerances, manage third party dependencies, and conduct scenario-based testing. The key difference is that Australia mandates a commitment to minimum service level tolerances. But the FCA’s 2024 Preparedness Assessment made clear that UK expectations are heading the same way as time alone does not capture intolerable harm.
Most minimum service level statements are not good enough
Battleground’s benchmarking study of 130+ minimum service level statements found the overwhelming majority were unworkable and/or entirely focused on internal systems rather than customer outcomes. What set apart the good from the poor was a clear, customer-focused description of what a customer could actually expect during a disruption. That shift from a technology lens to a customer lens is where most organisations struggle.
Testing is where it all comes together
Every real incident shares four characteristics: surprise, ambiguity, rapidly changing facts, and time pressure.The best way to prepare is to simulate them regularly. Best practice ensures ownership is clear, that exercises cut across business lines, business continuity can escalate into crisis, board involvement is clear, and critical third parties are involved. But build complexity gradually as people involved need to grow into their roles so we suggest you start simple and build maturity over time.
Book an obligation free meeting with Battleground and let’s talk about strengthening your exercising program for a more resilient organisation.
