Intolerable Harm Explained

Intolerable harm is the level of harm from a service disruption that a firm decides, in advance, it should not allow its users or the wider market to suffer. An impact tolerance expresses that decision for a particular important service, often in terms of how long users are left without the service and how widely the disruption reaches, so that recovery can be judged against something more concrete than effort.

A salary payment service shows why the judgement cannot be left to the day of the incident. A short delay may cause inconvenience that users can absorb, while a longer stop may leave people unable to pay rent or buy food, and the line between those outcomes is a judgement about users, not a technical setting. Setting the line beforehand lets the firm plan, test, and escalate with a shared understanding of what must not happen.

Harm differs because services differ in urgency, substitutability, and vulnerability of their users. A delayed statement may frustrate, while a delayed payment to a vulnerable customer may cause immediate hardship, and a halted settlement may affect counterparties far beyond the firm direct customers. The same duration of outage can therefore be tolerable for one service and intolerable for another.

That variation is why a tolerance must be set service by service, with attention to who is affected and how. A firm that copies one tolerance across unlike services will either overinvest in a low harm service or underprotect a service whose users have no alternative and little room to absorb a delay.

Setting a tolerance begins with describing the service users and the ways a disruption would hurt them, including financial loss, loss of access to essential money or cover, and knock on effects for other firms or markets. The firm then makes a judgement about the point at which that harm becomes intolerable, and records the reasoning so that it can be challenged and revisited.

The judgement is deliberately uncomfortable, because it forces a firm to say, before anything has gone wrong, what it will prioritise when it cannot restore everything at once. That discomfort is the point. A tolerance that no one had to argue about has probably been set so loosely that it will never bite, and a tolerance that never bites cannot guide recovery.

A breach is not merely a missed target. It signals that users have suffered, or are about to suffer, harm at the level the firm said should not happen, and it should trigger escalation, communication, and a clear decision about recovery order. The firm may need to explain to users what is happening, offer an alternative channel, or prioritise the most harmed users first, rather than simply working through a technical queue.

Afterwards, a breach should change something. The firm should examine whether the tolerance was realistic, whether the recovery sequence was right, whether a dependency failed unexpectedly, and whether the service map missed a step. A breach that produces only a report, with no change to the service, suggests the tolerance was decorative rather than operational.

Judgement often goes wrong when harm is described only from the firm perspective, such as lost revenue or reputational damage, while user harm is treated as secondary. Internal harm matters, but it is not a substitute for asking what a customer, claimant, or counterparty loses, and for how long, when the service stops.

Judgement also goes wrong when it assumes an average user. Users differ in reserves, alternatives, and vulnerability, and a disruption that an average user absorbs may devastate a user with no buffer. A tolerance that considers the more exposed users, rather than only the typical case, is more likely to reflect the harm a disruption actually causes.

For one service, ask whether its tolerance can be stated in plain language that a non technical reader would understand, and whether the reasoning behind it names the users and the harm. Then ask what would happen, in concrete steps, if that tolerance were breached during a disruption.

This guide explains a concept for educational purposes and does not set a tolerance for any firm. Tolerances are firm judgements about their own services and users, made under the regime that applies to them and labelled accordingly.