Self-Assessment Against UK Rules

Self-assessment against UK rules is a structured review by a UK firm of its own arrangements against the operational resilience regime set by the FCA and PRA policy statements. The firm identifies its important business services, maps them, sets a tolerance for each one, tests its ability to remain within that tolerance under severe but plausible disruption, and records honestly where it falls short. The result should be a dated, owned picture of readiness that the firm can use to improve and can show to a supervisor when asked.

This guide concerns the UK regime only. DORA, the EU digital operational resilience regulation, has its own expectations and its own application date, and it is covered in the companion guide for DORA. Keeping the two assessments separate matters, because a firm that blends them will answer neither regime well. Where a firm operates under both regimes, it needs two assessments, even if some underlying evidence, such as a service map or a test record, serves both.

The UK assessment starts with important business services, identified from the perspective of the users who depend on them. A service is important because its failure would cause harm to users or to the wider system, not because it is technically complex or commercially significant to the firm alone. The firm should be able to explain, in plain terms, why each service on its list is there and why services not on the list are not, because that reasoning is the foundation for everything that follows.

For each important service, the firm sets an impact tolerance: the maximum level of disruption it will tolerate before harm becomes intolerable. The tolerance should be expressed in terms a disruption produces, such as the duration of an outage or the number of users affected, and it should reflect the harm to users rather than the convenience of the firm. The assessment should examine whether each tolerance is still meaningful for the service as it runs today, and whether the firm has evidence about its performance against it.

A tolerance that has never been tested against a severe scenario is an aspiration, not a standard. The assessment should therefore look at the testing that has been done for each service, ask whether the scenarios were severe and plausible, and check whether the results were measured against the tolerance. Where testing shows that the firm would breach its tolerance under a plausible scenario, the assessment should record that plainly and treat it as a priority gap, whether the remedy is a change to the service, to its dependencies, or, with proper reasoning, to the tolerance itself.

Testing is where the UK assessment meets reality, and the assessment should be specific about it. For each important service, it should record what testing has taken place, what scenario was used, which dependencies were exercised, who took part, and what the outcome was against the tolerance, including anything that failed or took longer than expected. A general statement that testing takes place, without those details, is not evidence and should not be recorded as if it were.

Gaps found in the UK self-assessment need the same treatment as gaps found anywhere else: an owner, a date, and a place in the service trail where closure will be evidenced. The action list should be prioritised by harm to users if the service failed, not by ease of closure, and it should distinguish between recording gaps, such as a missing or out-of-date map, and capability gaps, such as a recovery sequence that does not work under test. Each action should be worded so that a later reviewer can tell, from evidence, whether it is done.

The UK assessment should be revisited when a service changes, when a dependency or supplier changes, when testing or an incident reveals something new, and when the FCA or PRA update their expectations. Each revisit should update only the judgements affected, preserving earlier versions so that the firm can show how its position has changed. That history is itself useful evidence, because it shows a firm learning over time rather than presenting a single polished snapshot.

Throughout, the assessment must be labelled as a UK assessment, with DORA material kept in its own assessment where both regimes apply. The two regimes share concepts, and the same map or test record may serve both, but the judgements, the tolerances, and the reporting lines belong to their own regime. A firm that keeps that discipline will be able to answer a supervisor from either regime without reconstructing its reasoning, and that readiness is the practical reward for keeping the assessments apart.