Operational resilience: how to set and test impact tolerances

The concept of impact tolerances was introduced by the UK financial services regulators in 2018 within their discussion paper on ‘Building operational resilience in financial services’. Since the publication of the paper we have seen that many firms have started to shift their thinking in line with the principles. This is often because supervisory authorities are already calling upon them to do so, but increasingly firms recognise the commercial imperative for action.

The questions we hear asked the most around board and management tables relate to impact tolerances. What are they? How do they relate to risk appetite? How do you set them? How do you test them?

To that end, we have produced a short guide, in line with regulatory thinking, to demystify the concept of impact tolerances, and to set out how a firm could define them and test their ability to remain within them.

It is important to keep this simple. There is a danger that otherwise this becomes a distraction from the collective aim: for a firm to continue to carry out its mission in the face of disruption, regardless of its source.

The paper includes:

• A 5-step model for setting and testing impact tolerances
• A worked example to illustrate the model
• Some specific examples for financial services firms
• A comparison of risk appetite and impact tolerance fundamentals