UK Regime and Governance Expectations

Governance under the UK regime means that the board and senior management own the firm's operational resilience account: they understand the important business services, they own the impact tolerances, they challenge whether mapping and testing are honest and severe enough, and they ensure that gaps found through testing and incidents are addressed with owned actions. Governance is not satisfied by receiving a resilience report, by delegating the work to a programme team, or by noting a self-assessment without discussion. It is satisfied when board members can discuss a named service, its tolerance, its weakest dependency and its test findings in plain terms, and can explain what decision they took in response to a gap.

That ownership matters because tolerances and risk acceptance decisions involve judgements about harm to users and risk to market integrity. Those judgements cannot properly be made by a programme team alone, and they cannot be outsourced to a supplier, a group function or an adviser. A board that has not engaged with those judgements has not governed the regime, even if extensive work has been carried out beneath it. The self-assessment is the document in which board ownership should be visible, through challenge, decisions and follow-up, rather than through signatures alone.

A board should understand, for each important business service, who uses the service, what harm disruption would cause, what tolerance has been set and why, what the service depends on, and what testing has shown about whether the service would remain within tolerance. That understanding does not require board members to master technical detail, but it does require them to grasp service outcomes in plain language. Board papers that present service outcomes clearly, organised by service rather than by programme workstream, help build that understanding. Papers that present activity in general terms, without service outcomes, hinder it.

Effective challenge involves questioning tolerances, scenarios, maps and findings, rather than accepting them as presented. A board member might ask whether a tolerance reflects intolerable harm or current capability, whether a scenario was severe enough to threaten tolerance, whether a map includes supplier and people dependencies, or whether a remediation action will actually be tested after implementation. Those questions, asked consistently, improve the underlying work, because programme teams anticipate challenge and prepare service evidence rather than general assurances.

Accountability should be allocated so that each important business service has a named owner, each tolerance has a board level owner, each map has a maintainer, each scenario test has an owner for its findings, and each remediation action has a named owner with a means of evidencing completion. That allocation should be visible in the self-assessment and in board papers, so that a gap can be traced to a person and a decision, rather than to a team in general. Accountability that is shared by everyone, without a named owner, tends to be owned by no one when a gap needs to be closed.

Reporting that supports governance presents service outcomes, test findings, incident lessons and remediation progress by service, in plain language, with trends over time. A board report that shows, for a named service, its tolerance position, its latest test findings, its incident lessons and its open actions gives the board something to challenge and decide upon. A report that shows programme milestones, without service outcomes, gives the board activity to note, but little to govern. The difference is not merely presentational; it determines whether governance can actually influence resilience.

Common governance mistakes include delegating tolerance decisions without board challenge, receiving self-assessments without discussion, organising board papers by workstream rather than by service, and treating supplier or group assurances as substitutes for service understanding. Another mistake is to merge governance across regimes, so that a board discussion about DORA is presented as UK governance, or vice versa, without addressing UK services and tolerances specifically. Keeping UK governance discussions focused on UK services, tolerances, maps, tests and self-assessment, even where operational capability is shared, protects the clarity of board accountability.

This guide describes UK governance expectations in general educational terms. It does not assess any particular board or firm, and it does not replace FCA and PRA policy statements or supervisory guidance. The guides on self-assessment, scenario testing, mapping and tolerances in this cluster provide the service level material that governance is expected to own, challenge and act upon.