Operational resilience has become an increasingly important priority for financial services firms. For those within the scope of the FCA and PRA operational resilience regimes, specific requirements are designed to ensure that important business services can continue through severe but plausible disruption. Yet organisations can still fall into a reactive approach, addressing weaknesses only after disruption occurs.
The problem with reactive risk management is that, by its nature, it comes too late. By the time a disruption occurs, the damage may already have been done. Customers may have been unable to access services, transactions may have failed, and the firm’s reputation may have suffered. The costs can be significant, both financially and in terms of customer trust.
For firms subject to the FCA’s operational resilience rules, a reactive approach can also make it more difficult to meet regulatory requirements. Firms must identify their important business services, set impact tolerances, and carry out mapping and scenario testing. Since 31 March 2025, firms within scope have been required to be able to remain within their impact tolerances for each important business service during severe but plausible disruption.
The FCA’s March 2026 review of operational resilience self-assessments reinforces this point. The FCA highlighted the importance of regularly reviewing important business services and impact tolerances, carrying out sufficiently challenging scenario testing, and using the results to identify vulnerabilities and drive remediation. Operational resilience should therefore be treated as an ongoing process rather than an exercise undertaken only when disruption occurs.
The human element is another important consideration. When firms are constantly firefighting, it can create a culture of stress and burnout. Employees may feel that they are always playing catch-up rather than proactively managing the risks they face. Over time, this can contribute to lower morale, higher turnover and, ultimately, a less resilient organisation.
Operational resilience therefore requires more than preparation. Firms need to understand the resources and dependencies supporting their important business services, test severe but plausible scenarios, identify vulnerabilities, and take action to address them. Lessons from testing and real-world incidents should then feed back into future assessments, helping firms continuously strengthen their resilience.
How Complyport Can Help
Moving from reactive risk management to a more proactive approach requires clear processes, accountability and visibility across the organisation.
ComplyPortal, Complyport’s cloud-based Compliance Management System, can help firms manage operational resilience activities in a more structured and consistent way. Customisable workflows can support the review of important business services, impact tolerances, scenario testing and identified vulnerabilities. Tasks, owners and deadlines can be assigned to remediation actions, with follow-up activity tracked through to completion.
Policies, testing records, assessments and supporting evidence can also be maintained within the platform’s document management system, creating a clearer audit trail of resilience activity. This makes it easier for compliance teams and senior management to monitor progress, maintain oversight and evidence the decisions and actions taken.
By bringing workflows, responsibilities, documentation and evidence together in one place, ComplyPortal can help firms take a more organised and proactive approach to operational resilience.
Ready to strengthen your approach to operational resilience?
Discover how ComplyPortal can help you manage compliance activities, responsibilities and evidence more effectively.
Discover ComplyPortal Platform
