Supervisory Examinations Explained

A supervisory examination is a supervisor's structured look at how a firm understands and manages the resilience of its important services. It is not an audit commissioned by the firm, and it is not a test of a single control. The supervisor will typically ask the firm to explain which services matter most, how it mapped them, what tolerance it set, how it tested them, and what it learned from incidents, and will then probe the answers against the evidence. The examination places the firm in the context of the regime that applies to it, so DORA expectations in the EU and FCA and PRA expectations in the UK must be kept distinct.

For the firm, the examination is both a check and a conversation. The supervisor is looking for understanding, not just documentation: does the firm know where its weak points are, does it have a credible plan for them, and does its evidence support what its senior people say? A firm that can answer those questions service by service, with records to point to, will fare better than a firm with a polished general presentation and no trail behind it.

Supervisors tend to start with the service, not with the framework. They ask which services the firm has identified as important, why those services were chosen, and what harm their failure would cause to users. They then ask how the service was mapped, which dependencies were found, and whether any dependency surprised the firm. Those opening questions reveal quickly whether the firm's resilience work is grounded in its actual operations or assembled from generic material.

An examination usually begins with a request for information, giving the firm a chance to assemble its evidence trail for the services concerned. That request is itself a test of producibility: a firm whose trail is already in order can respond by gathering existing records, while a firm whose trail is scattered must reconstruct it under pressure, and the difference is visible. The supervisor may then meet the firm's staff, including senior managers and the people who would act in a disruption, to test whether the written account matches operational understanding.

Meetings matter because they reveal handovers and ownership. A supervisor may ask a service owner to explain a tolerance without notes, or ask the second person on a rota how they would find the recovery sequence. Those are not trick questions; they are the questions a disruption will ask, and a firm that can answer them in a meeting is more likely to answer them in a real event. The firm should prepare its people by making sure they genuinely understand the service, rather than by rehearsing answers they do not believe.

Good preparation is the ordinary work of the cluster, done steadily rather than in a rush. Keep the trail for each important service current, with its map, tolerance, test records, incident reviews, and owned follow-up actions easy to find together. Review the trail as a stranger would before the examination, and fix the gaps that a stranger would notice: missing dates, unclear owners, test records that do not reference the tolerance, and incident reviews without actions.

Findings from an examination should be treated as supervisory expectations to be addressed, not as criticism to be debated away. The firm should first make sure it understands each finding precisely: which service it concerns, what evidence the supervisor examined, and what change is expected. Where a finding is unclear, asking for clarification promptly is better than guessing and fixing the wrong thing, and the clarification itself should be recorded.

The central pitfall is preparation as performance: a special pack, written for the examination, that describes arrangements more favourably than the evidence supports. Supervisors are accustomed to such packs, and they test them against records, interviews, and incident history. When the pack and the trail disagree, the firm loses credibility on every other claim it makes, including claims that are true.

A subtler pitfall is treating the examination as the purpose of resilience work, so that effort surges before a visit and fades afterwards. That pattern produces a firm that is ready for the visit and unready for the disruption, which is the failure this cluster warns against throughout. The remedy is to keep the trail current as a matter of routine, so that an examination request is a moment to gather what already exists, not a reason to create what should have existed all along.