Operational Resilience for Small Firms

For a small firm, operational resilience means the same discipline on a smaller scale: name the few services that matter most to users, understand what harm a stop would cause, map the dependencies those services really rely on, and test whether they can recover. Scale changes how the work is done, not whether it matters, because users of a small firm service suffer harm just as users of a large firm service do.

A small payment firm illustrates the point. It may have a handful of staff, one core supplier, and a single channel, so a supplier outage or the absence of a key person can stop the whole service at once. Resilience for that firm is less about elaborate governance and more about knowing, in advance, who decides, what the alternative is, and how users will be told.

Small firms often carry concentrated risk. A single supplier may support the main service and its backup, a single person may hold the knowledge of how recovery works, and a single channel may be the only way users can reach the firm. Those concentrations are understandable given limited resources, but they mean a single failure can have firm wide consequences.

Small firms also face a proportionality trap. Copying a large firm framework can consume the very time and attention needed to protect services, while doing nothing leaves the firm unready. The proportionate path is to keep the discipline and drop the decoration: fewer services, clearer ownership, and tests that fit the firm size.

Prioritisation starts by naming the services whose loss would hurt users most, and by being honest about how few those services may be. A small firm that names everything as important has named nothing, and its limited effort will spread too thinly to protect any service well.

Once the important services are named, the firm should map each one briefly, set a harm tolerance in plain language, and identify the dependencies that matter most, especially suppliers and key people. That short list becomes the work plan, and everything else can wait until those services are understood and tested.

Suppliers are often the service for a small firm, in the sense that the firm service runs on a supplier platform or channel. The firm still owns the service in the eyes of its users, even though it does not run the underlying technology, so it needs to understand what the supplier will and will not do during a disruption, and how it will communicate.

That understanding should be written down and tested, not assumed from a contract summary. A conversation with the supplier about recovery order, communication, and exit or alternative arrangements is worth more than a clause that no one has read since signing, especially where the supplier serves many small firms at once.

Testing for a small firm can be a tabletop discussion, a walkthrough of a scenario with the people who would act, or a limited live test of an alternative channel. The form matters less than the question it answers: if this service stopped, who would do what, in which order, and what would users experience while they waited?

Small tests run often, with actions owned and followed up, will teach a small firm more than a single elaborate exercise. The record of those tests, kept with the service, becomes the evidence that the firm understands its service and has improved it, which is the substance behind any larger reporting.

For one important service, ask who owns it, who covers that owner, which supplier it depends on, and what users would be told if it stopped. If any answer depends on one person or one supplier with no alternative, that concentration is the resilience question for a small firm.

This guide is educational and does not set expectations for any particular small firm, whose duties depend on the regime that applies to it. It argues that proportionality means fitting the discipline to the firm, not abandoning the discipline because the firm is small.