A head of operational resilience runs a bank's programme for keeping its important business services within their impact tolerances: the list of services, the tolerances, the maps of people, processes, technology, facilities and information behind each one, the scenario testing, the remediation of what fails, and the written self-assessment the board must approve. In a UK bank that work answers to two named authorities, the board, which approves the services, the tolerances and the self-assessment, and the senior manager holding the Chief Operations function (SMF24), who holds overall responsibility for implementing the policy and reporting to the board. The head sits between them: preparing every document, checking every map and test result, and making sure that whoever runs a test is never the one who signs it. Botminds' Operational Resilience Management is an agentic solution for that work, in which agents map, time, count and draft while the service owners, the head and the SMF24 confirm, check and accept.
The roles on this page come from the rules; the worked examples come from the solution's fictional sample bank, Corvane Bank UK, and its five resilience people. Regulators' words are quoted and linked where they appear.
Five seats, one breach: what each person in the operational resilience chain signs
Today
Updates a mapping spreadsheet once a year; the map is out of date by the next reorganisation or hosting move.
With agents
Confirms or rejects each change the agents find in the CMDB, supplier register and runbooks, with its source, before the head checks it.
Still theirs: the map of their service, and a proposed tolerance
Today
Runs desk-based tabletops and writes up what the room agreed.
With agents
Runs each test in the year's plan, with every recovery step timed from a test, incident, runbook or contract, and sends the result to a checker.
Still theirs: the scenario design and the test, as maker
Today
Reviews recovery times the room estimated, and hunts for evidence when a supervisor asks.
With agents
Checks each map and result with the evidence open, signs it or returns it with a reason, and prepares the self-assessment.
Still theirs: the check, and the document the board reads
Today
Tracks contracts and exit plans without seeing where each supplier hosts.
With agents
Confirms concentrations the agents trace through suppliers' own suppliers, and owns exit plans and assurance evidence.
Still theirs: every supplier finding and rating
Today
Signs a self-assessment with breaches that have been "in progress" for quarters.
With agents
Accepts each fix with an owner, a date and funding, and takes tolerances and the self-assessment to the board.
Still theirs: acceptance of fixes, and the report to the board
What does a head of operational resilience do?
A head of operational resilience owns the method and the paperwork of compliance with the FCA's SYSC 15A and the PRA's Operational Resilience Part, and checks the work of everyone who feeds it. The job title appears in neither rulebook. The PRA says only that firms "should establish clear accountability and responsibility for the management of operational resilience" and may use "existing committees and roles or establishing new ones if necessary" (PRA SS1/21, paragraph 7.3). Where a bank creates the role, it is because the duties cut across technology, operations, third-party management and risk, and no existing function owns all four.
In practice the duties track the chapter of the FCA Handbook section by section. The head keeps the list of important business services and the case for each one; runs the review of services, tolerances and maps that SYSC 15A requires within a year of the last one (SYSC 15A.2.2R, 15A.2.6R, 15A.4.3R); owns the testing plan; tracks every vulnerability to remediation; and writes the self-assessment. The head is also the person a supervisor calls when a statement in that self-assessment needs explaining.
What the head should not do is the part that looks most like ownership: draw the maps, run the tests and then approve the results. A head who does all three has produced a document nobody has checked. The rest of this page is about where each duty sits instead.
Who is responsible for operational resilience in a UK bank?
Two parties are named in the rules: the board, which approves, and the SMF24, who holds overall responsibility. The FCA's rule is short: the governing body must approve and regularly review the written records SYSC 15A.6 requires (SYSC 15A.7.1R), meaning the self-assessment and the lessons-learned records; the self-assessment guide quotes it. The PRA is more specific. "Boards are specifically required to approve the important business services identified for their firm and the impact tolerances that have been set for each of these," and they must regularly review the scenario analyses behind them (SS1/21, 7.1).
The board does not have to be expert. "While individual board members are not required to be technical experts on operational resilience, the PRA expects boards to ensure that they have the appropriate management information," and collectively enough knowledge "to provide constructive challenge to senior management" (SS1/21, 7.2). That sentence is the head of operational resilience's brief: produce information a board can challenge.
Where it exists, the Chief Operations Senior Management Function (SMF) 24 should hold overall responsibility for implementing operational resilience policies and reporting to the board.
PRA, Supervisory Statement SS1/21, paragraph 7.4 (March 2022)
What is the SMF24 role, and what does the SMF24 sign?
The SMF24 is the senior manager approved for the Chief Operations function, which the PRA Rulebook defines as "the function of having responsibility for the internal operations and technology of a firm" (PRA Rulebook, Senior Management Functions 3.8). For operational resilience, SS1/21 makes that person the one who implements the policy and reports to the board. The function can be shared, but the PRA does not expect it "to be split among more than three individuals", and a firm with a single senior person over operations and technology should approve only that person.
The role is staying under the closest scrutiny. In its consultation on the second phase of the Senior Managers and Certification Regime review, published on 22 October 2026, the PRA proposes to remove regulatory pre-approval from almost half of the senior manager functions but says: "The PRA therefore proposes to retain pre-approval for Chief Operating Function (SMF24)", citing operational risks "including risks arising from artificial intelligence and cyber incidents" (PRA CP14/26). It is a proposal, with implementation expected in the second half of 2027.
What the SMF24 signs, in a well-run chain, is a decision rather than a document. In Corvane Bank UK's settings, only the SMF24 can accept a remediation item into the plan, with an owner, a date and funding; a change to an impact tolerance is checked by the head and then goes to the SMF24 before the board; and the self-assessment moves from the head, who prepares it, to the SMF24, then the Board Risk Committee and the board. The board's approval is the one the rule requires. The SMF24's sign-off is the bank's own control on what reaches the board.
The SMF24 accepts one fix, with an owner, a date and funding
Impact tolerances: who proposes, who checks, who approves
The board approves impact tolerances; a service owner usually proposes one; the head of operational resilience checks the reasoning; and in many banks the SMF24 signs off before the board sees it. The same pattern, prepare, check, approve, repeats across the chapter, and the table below sets it out section by section, with the approver the rules name and the preparers a bank typically assigns.
Who prepares, checks and approves each part of SYSC 15A in one bank's chain
| Requirement | Prepares | Checks | Approves |
|---|---|---|---|
| Important business services (15A.2.1R) | Head of operational resilience, with business heads | SMF24 | Board (SS1/21, 7.1) |
| Impact tolerances (15A.2.5R) | Service owner proposes, with harm analysis | Head of operational resilience, then SMF24 | Board (SS1/21, 7.1) |
| Mapping (15A.4.1R) | Service owner confirms each change | Head of operational resilience | Published as a new map version |
| Testing plan and scenario tests (15A.5) | Resilience analyst runs each test | Head of operational resilience signs or returns | Plan reviewed by SMF24; results reported to the board |
| Third parties in the map and tests (15A.4.2G, 15A.5.5G) | Third-party risk manager | Head of operational resilience | Remains the firm's responsibility |
| Vulnerabilities and remediation (15A.5.9R, 15A.6.1R(7)) | Item owner proposes options | Head of operational resilience recommends | SMF24 accepts and funds |
| Self-assessment (15A.6.1R) | Head of operational resilience | SMF24, then Board Risk Committee | Board (15A.7.1R) |
The tolerance row is the one most often blurred. A service owner knows the service best and is also the person most likely to want a longer tolerance, because a longer tolerance turns a failed test into a pass. In the sample bank, the owner of "Use online and mobile banking" proposed widening its tolerance from 6 to 8 hours after customer research. The agents' note on the proposal pointed out that the change would absorb the service's slowest tested recovery without any fix. The head checks that argument before the SMF24 and the board decide; what an impact tolerance is, and how it differs from a recovery time, sets out why harm, not test results, should drive the number.
Map, test, check, approve: the chain behind one signature
A board can sign a self-assessment it did not write only if every statement in it was made by one person and checked by another. The chain below follows one breach through Corvane Bank UK, from a supplier notice to the board's agenda, with the agents' steps and the people's steps marked.
One breach through the operational resilience chain: agents propose, people sign
Agent
Mapping agentCompares the CMDB, supplier register and runbooks with the confirmed map each night and proposes nine differences, each with its source.
Never: changes a confirmed map
A person decides
Service OwnerTom Ashworth confirms the alternate gateway now hosts in the same cloud region as the primary; the head checks it and map v14 stands.
Agent
Scenario agentRuns the gateway ransomware scenario with the analyst and times six recovery steps from a failover test, an incident, a runbook and a contract.
Never: signs a result
A person decides
Resilience Analyst, then HeadCallum Reid ran the test, so Imogen Strachan signs the result as checker: 6 h 10 m against a 4-hour tolerance.
Agent
Remediation agentProposes three fixes and re-runs the scenario with each in place, with owners, costs and dates.
Never: accepts an item
A person decides
SMF24Diane Whitlow accepts the warm standby gateway by March 31, 2027, owned and funded; the interim queue starts December 15.
A person decides
Board Risk Committee and boardReceive section 6 of the self-assessment with the breach, the fix, its owner and the SMF24's acceptance, on November 19 and 26.
Two details make the chain hold. The first is that the checker sees the evidence, not a summary of it: when Imogen signs the scenario result, each of the six steps opens the passage of the test report, incident timeline, runbook or contract it was timed from. The second is the reason code. A head who returns a result must say why, from a short list (evidence older than 12 months, a scenario not severe enough), so a pattern of returns becomes something the programme can learn from. How each recovery minute is timed from evidence follows that test step by step.
What does a service owner do in operational resilience?
A service owner answers for one important business service: confirming its map, proposing its tolerance, owning its recovery and response plans and fixing what testing finds. The FCA's 2026 review of self-assessments singled out the map as the place where ownership matters most: "Clear ownership and accountability of mapping data reduce the risk of outdated or inaccurate information, which could compromise resilience planning" (FCA, insights and observations one year on, March 2026).
The same review found mapping "largely focused on technology", and told firms to include "facilities, people, processes, information, and third-party resilience or testing outcomes." Those are exactly the parts a service owner knows and a technology inventory does not: who is certified to work the night shift, which manual workaround exists, which supplier a team phones when a queue stops.
A service owner confirms or rejects each change the agents found
A good service owner also resists the urge to treat the map as a technology diagram. Of the nine differences in the screen above, one is a hosting move, one a software version and one a staffing change: two of the three people certified to run the payments night shift moving to another team. That is a vulnerability no system inventory would report.
What does an operational resilience analyst do?
An operational resilience analyst designs and runs the scenario tests in the year's plan, writes up the results and lessons learned, and keeps the testing evidence in order. The analyst is the maker in most of the programme's maker-checker pairs, which is why the role is usually junior to the head and separate from the service owners whose services it tests.
The analyst's craft has changed since the transition period. The FCA told firms in 2024 that scenario testing should move on from judgement and desk-based exercises to tests that produce measured data (scenario testing, timed from evidence quotes the passage), naming penetration tests, failover tests, simulations and lessons from real incidents (FCA, insights and observations, May 2024). An analyst who once facilitated a tabletop now spends the time finding the measured duration of each recovery step and saying which ones have none. At Corvane Bank UK, Callum Reid's plan holds 22 severe but plausible scenarios across 11 services for 2026; on October 22, 18 were signed and 4 scheduled.
The third-party risk manager's seat: the supplier's breach is the bank's
The third-party risk manager makes sure that suppliers are inside the maps and the tests, because the rules give the bank no defence when a supplier fails. The FCA is blunt: when a supplier behind an important business service breaches the tolerance, the breach is the firm's (FCA, May 2024; quoted in the critical third parties guide). The PRA says the same in SS1/21, paragraph 5.7.
The cost of getting it wrong is on the record. When the FCA and PRA fined TSB £48.65 million in December 2022 for its 2018 IT migration, the findings included its failure to manage the operational risk in outsourcing IT to its critical third-party supplier (FCA press release, 20 December 2022; banks affected by IT outages quotes the finding). At Corvane Bank UK, Kwame Asante holds 38 material third parties; the finding that both payment gateways host in one cloud region was the agents' to trace and his to confirm. Two suppliers on one cloud works through that finding against the UK's new regime for critical third parties.
How does the board oversee operational resilience?
The board oversees operational resilience by approving the services, the tolerances and the self-assessment, and by judging which tested failures it is prepared to accept. The PRA expects firms to test scenarios in which they expect to exceed a tolerance, and says "Boards and senior management will need to judge whether failing to remain within the impact tolerance in specific scenarios is acceptable and be able to explain their reasoning to supervisors" (SS1/21, 6.12). That is the board's real decision, and it can only be made from a document that says plainly where the bank would fail.
The FCA's review of self-assessments in March 2026 listed where boards' oversight falls short. The contrast below sets those findings against what a chain with separate makers and checkers leaves behind.
Where board oversight of operational resilience breaks, and what a clean chain records instead
What the FCA found in 2026 self-assessments: "Unclear board engagement, approval processes, and document review trails."
What a separated chain leaves on the record: Each version of the self-assessment with who prepared, checked and approved it, and when.
What the FCA found in 2026 self-assessments: Some firms had no recorded remediation actions, owners or target dates.
What a separated chain leaves on the record: Every item accepted by the SMF24 with an owner, a date and funding, and escalated when overdue.
What the FCA found in 2026 self-assessments: Little sign that the second or third line had any input into the self-assessment.
What a separated chain leaves on the record: Internal audit exports the evidence pack itself; the head's returns carry reason codes.
What the FCA found in 2026 self-assessments: "Uncertainty about board/senior manager understanding of operational resilience responsibilities and commitment to action/investment."
What a separated chain leaves on the record: A section on each breach the board must accept or fund, with the option costs side by side.
The self-assessment is where that record reaches the board. In the sample bank the 2026 draft has ten sections, every statement cited, and the approval chain printed beside it: prepared by the head, then the SMF24, the Board Risk Committee on November 19 and the board on November 26. What the self-assessment must contain sets out the nine records SYSC 15A requires and the evidence behind each.
The self-assessment with its approval chain beside it
To see the whole chain on one service, from the map to the board, start from Operational Resilience Management.
Questions people ask
Is the head of operational resilience a regulated role?
No. Neither the FCA's SYSC 15A nor the PRA's SS1/21 creates the title; the PRA lets firms use "existing committees and roles or establishing new ones". The regulated role is the SMF24, the Chief Operations function, which SS1/21 makes responsible for implementing operational resilience policies and reporting to the board.
Can the SMF24 be the head of operational resilience?
The rules do not forbid it, but it weakens the chain: the person who prepares the self-assessment and checks every result would also be the senior manager signing it off. Keeping the two apart preserves a second pair of eyes before the board. The PRA allows the SMF24 function itself to be split, but not among more than three people.
Who signs the operational resilience self assessment?
The board, or governing body, approves it under SYSC 15A.7.1R, and SS1/21 makes boards accountable for the information in these documents and expects them to approve it. In practice the head prepares it and the SMF24 signs it off before a board committee reviews it.
What does an operational resilience manager do day to day?
Mostly evidence work: chasing service owners for map changes, collecting test and incident evidence for recovery times, tracking remediation items and answering reviewers. In the sample bank's estimate, those tasks take about 30 working days of each annual self-assessment cycle by hand, against about 3 days reviewing a cited draft; the estimate is the solution's own arithmetic for 11 services, kept modest.
Does a US bank need a head of operational resilience?
No US rule requires one. The interagency sound practices in Federal Reserve SR 20-24 are directed to banks with $250 billion or more in assets, or $100 billion with $75 billion in certain activity, and describe governance, scenario analysis and third-party risk rather than a title. Who leads the work is the bank's own choice.
How does the board challenge operational resilience without being expert?
By asking for management information that shows where the bank would fail: the scenarios that breach a tolerance, the fix for each, its owner and its cost. The PRA expects boards to have that information and enough collective knowledge "to provide constructive challenge to senior management."