UK Regime Lessons from Implementation

Implementation of the UK regime taught firms, in practice, that the hardest work is not producing documents, but making honest judgements about services, harm and vulnerability. Firms that implemented well tended to start from customer journeys, set tolerances by reference to intolerable harm, build maps from operational knowledge, test scenarios that genuinely threatened tolerances, and record gaps plainly in self-assessments with owned actions. Firms that struggled tended to do the reverse: they started from systems or programmes, set tolerances by reference to current capability, built maps from architecture diagrams, tested mild scenarios, and produced self-assessments that described activity without demonstrating service resilience.

Those lessons are general patterns drawn from the implementation experience of the regime, not judgements about any particular firm. They are useful because they recur across different types of firm, and because they point to the same underlying discipline: keep the work tied to a named service and to the harm its disruption would cause. Where that discipline slipped, later elements of the regime, however well resourced, tended to inherit the weakness.

Firms learned that service identification takes longer, and requires more customer knowledge, than a programme timetable often allows. Early lists frequently mirrored internal structures, with services named after departments, systems or business lines, rather than after customer journeys. Correction required input from customer facing teams, complaint data and incident history, which revealed journeys and harm profiles that programme teams had missed. The lesson is to involve people who understand customers from the start, rather than treating identification as a technical exercise to be corrected later.

Firms learned that tolerance setting is a board judgement about harm, and that it resists delegation to a programme team or to a supplier. Early tolerances often described what systems could already achieve, or repeated a service level commitment, rather than describing intolerable harm. Challenge from boards, risk functions and supervisors exposed that anchoring, and forced a return to harm reasoning: which users, harmed in what way, at what point. That return was uncomfortable, because honest tolerances sometimes revealed that services could not yet remain within them under severe scenarios, but that revelation is precisely what the regime is designed to produce.

On mapping, firms learned that architecture diagrams are a starting point, not a map. Real maps emerged from walking services with operators, checking incident history, and tracing supplier dependencies that formal documents had treated as contracts rather than operational links. Single points of failure, informal workarounds and specialist knowledge dependencies surfaced through those walks, and each surfacing improved the map. Firms that treated mapping as a single snapshot, produced for an assessment, found their maps diverging from services within a short period, as change accumulated without map updates.

On governance, firms learned that board engagement cannot be simulated by board papers alone. Boards that could discuss a named service, its tolerance and its test findings, and that challenged programme teams on severity and remediation, drove stronger work than boards that received polished reports without challenge. Self-assessments written for board challenge, in plain language organised by service, proved more useful than self-assessments written as programme reports organised by workstream. Clarity of writing, in this context, is a governance strength, because an assessment that cannot be understood cannot be challenged.

The enduring lesson is that operational resilience, under the UK regime, is a service discipline, not a documentation discipline. Documents matter, because they record judgements, evidence and actions, but they matter only insofar as they describe real services, real harm, real dependencies and real test findings. Firms that kept that discipline, through changes in services, suppliers and personnel, maintained credible accounts. Firms that allowed documents to drift from services found that testing, incidents and supervisory engagement exposed the drift, often at an inconvenient moment.

For a reader encountering the UK regime for the first time, the implementation lessons offer a practical checklist of questions: is the service defined by user harm, is the tolerance set by harm rather than capability, does the map trace operational reality including suppliers and people, was testing severe enough to threaten tolerance, and does the self-assessment record gaps with owned actions? Those questions, applied to any named service, provide a faster judgement of resilience than any general description of a programme. This guide is educational only and draws on general implementation patterns, not on any particular firm.