An operational resilience self assessment is the written record in which a UK bank sets out, and its board approves, how it complies with the operational resilience rules: which important business services it has identified and why, the impact tolerance for each and why, how it maps and tests them, what testing found, what it learned, which vulnerabilities remain and when they will be fixed, how it will communicate in a disruption, and the methods behind all of it. The FCA's SYSC 15A.6.1R lists those nine records, SYSC 15A.6.2R requires every version to be kept for at least six years, and the PRA's SS1/21 sets matching expectations for banks. The hard part is not the structure; it is the evidence behind each statement, which sits in test reports, incident timelines, maps and contracts that change through the year. Botminds' Operational Resilience Management is an agentic solution that drafts the self-assessment from that evidence and cites every statement, while the head of operational resilience prepares it and the board approves it.
The worked examples come from the solution's fictional sample bank, Corvane Bank UK, and its 2026 self-assessment. The rules and the regulators' findings are quoted and linked.
The nine records SYSC 15A.6.1R requires, and the evidence that makes each one defensible
1
RecordImportant business services, and the justification for each
EvidenceHarm analysis against the SYSC 15A.2.4G factors; the case for services left out
StatementMake a Faster Payment is important because payments are time-critical: the gateway scenario's 6 h 10 m stop on a typical Tuesday delays payments for 268,400 customers.
2
RecordImpact tolerances, and the justification for the level
EvidenceThe harm threshold, the metric, and peak-day volumes
StatementTolerance 4 hours, because after that same-day payments start to fail.
3
RecordThe approach to mapping: resources, vulnerabilities, support for testing
EvidenceMap version, its owner, its confirmation date, the systems compared
StatementMap v14, 135 resources, confirmed by the service owner on Oct 9 and checked.
4
RecordThe testing plan, and a justification for it
EvidenceThe plan, its scenario types, the services each test covers
Statement22 scenarios across 11 services in 2026, chosen from the FCA's list and the bank's own incidents.
5
RecordThe scenario tests run, with assumptions and risks to tolerances
EvidenceSigned results with each step's evidence and its age
StatementGateway ransomware: 6 h 10 m against 4 h; six steps from tests and incidents 5 to 8 months old.
6
RecordLessons learned from tests and real disruptions
EvidenceLessons sections of test and incident reports
StatementKeys are exchanged by hand; a standby with pre-exchanged keys removes the longest step.
7
RecordVulnerabilities, actions taken or planned, and why the completion time
EvidenceRemediation items with owner, date, funding and acceptance
StatementWarm standby gateway by March 31, 2027, owned, funded, accepted by the SMF24 on Oct 22.
8
RecordThe communication strategy, and how it reduces harm
EvidencePlaybooks, channels and their tests
StatementCustomer messages depend on Pellowick Messaging, whose exit plan is overdue and escalated to the SMF24.
9
RecordThe methodologies used for all of the above
EvidenceMethod notes, versioned
StatementRecovery steps older than 12 months are labelled estimates.
What is an operational resilience self assessment?
It is the firm's own written assessment of its compliance with SYSC 15A, made and kept up to date, approved and regularly reviewed by the board. The rule begins: "A firm must make, and keep up to date, a written record of its assessment of its compliance with the requirements in this chapter" (SYSC 15A.6.1R). The PRA's Operational Resilience Part requires the same for banks, and SS1/21 adds that boards "are accountable for and should approve the information provided in these documents" (SS1/21, 8.1).
It is not a questionnaire. The FCA also runs ORQUEST, an "operational resilience self-assessment questionnaire" that firms can complete through their supervisor to describe their capabilities (FCA, operational resilience); the self-assessment under SYSC 15A is the firm's own document, in its own structure, and a supervisor can ask for any version of it. The FCA describes its purpose well: "Your self-assessment should detail your journey to becoming operationally resilient" (FCA, May 2024).
What must the self assessment contain under SYSC 15A.6.1R?
It must contain at least the nine records in the figure above: services and their justification, tolerances and their justification, the mapping approach, the testing plan and its justification, the tests and their assumptions, lessons learned, vulnerabilities with actions and completion times, the communication strategy, and the methodologies. The rule says "including, but not limited to", so a bank can add more; the sample bank adds a section on third parties and a closing statement for the board.
The word that recurs is justification. Four of the nine records ask for a reason, not just a fact: why each service is important, why each tolerance sits where it does, why the testing plan looks as it does, and why each fix will take as long as it will. Those reasons are where supervisors have found self-assessments thin. In 2024 the FCA reported tolerances that varied widely between firms, with little reasoning about the point at which consumer harm becomes intolerable or market integrity is at risk (FCA, May 2024; the impact tolerance definition quotes the finding).
What does the PRA expect in a self assessment?
The PRA expects the same core content, with two differences in emphasis: it wants the self-assessment to stay narrowly on the Operational Resilience Part, and it wants group risks covered. SS1/21 says broader elements such as operational risk management and business continuity planning "should only be referenced where they directly pertain" to the Part (SS1/21, 8.2), which is a useful discipline against forty pages of continuity policy.
FCA and PRA self-assessment requirements, side by side
| Topic | FCA, SYSC 15A.6.1R | PRA, SS1/21 paragraph 8.3 |
|---|---|---|
| Services | Services identified and the justification | List them and state why each was identified |
| Tolerances | Tolerances and the justification for the level | Specify each and why it was set; dual-regulated firms set a PRA and an FCA tolerance |
| Mapping | Approach, and how it identifies vulnerabilities and supports testing | How resources and the relationships between them were captured |
| Testing | Plan and its justification; tests with scenario assumptions | Strategy, scenarios used, test types, and the scenarios that breach a tolerance |
| Lessons | Any lessons learned exercise | Lessons from testing or practical experience, and actions taken |
| Vulnerabilities | Actions taken or planned, with justifications for completion time | Every effort to remediate; large firms expected to act promptly |
| Group | Not listed | Risks from elsewhere in the group |
| Communications | Strategy and how it reduces harm | Covered in chapter 4 (communication strategies) |
| Retention and approval | Each version kept at least 6 years; board approves (15A.6.2R, 15A.7.1R) | Board approves and regularly reviews (7.1, 8.1) |
The PRA's version is also explicit about the uncomfortable list: firms should "specify the scenarios under which firms could not remain within their impact tolerances." A self-assessment with no such scenario is not reassuring to a supervisor; it suggests the tests were not severe enough. How severe a scenario should be, and how to time it, is a guide of its own.
How long must the self assessment be kept, and how often is it updated?
Every version must be kept for at least six years, and the document must be kept up to date rather than written once a year. The retention rule is short: "A firm must retain each version of the records referred to in SYSC 15A.6.1R for at least 6 years and, on request, provide these to the FCA" (SYSC 15A.6.2R). Note "each version": a bank that overwrites its draft as the year goes on has lost the record of what the board was told and when.
On frequency, the underlying assessments have hard dates. Services, tolerances and maps must be reviewed after any material change and "in any event, no later than 1 year after it last carried out the relevant assessment" (SYSC 15A.2.2R, 15A.2.6R, 15A.4.3R), and the FCA expects changes "clearly identified in your self-assessment, along with any rationale" (FCA, May 2024). The annual review gives a natural date for a full version, but a new version is due whenever a service, tolerance or map changes materially.
The self-assessment in four numbers from the rules
9
records SYSC 15A.6.1R requires, at a minimum
6years
each version must be kept (SYSC 15A.6.2R)
1year
longest gap between reviews of services, tolerances and maps
2025
31 March: end of the transition period for staying within tolerance
Who approves the self assessment?
The board approves it. "A firm must ensure that its governing body approves and regularly reviews the written records required under SYSC 15A.6" (SYSC 15A.7.1R). Before it reaches the board, a bank usually routes it through the head of operational resilience, who prepares it, the SMF24, who holds overall responsibility for operational resilience under SS1/21, and a board risk committee. Who prepares, checks and approves each part sets the chain out role by role.
What the board needs from the document is decisions, not volume. The FCA's 2026 review: "Firms do not usually include every piece of evidence in the self-assessment document, provided the information they include is clear enough for the board to understand and decide what to prioritise and invest in" (FCA, March 2026). The evidence should sit behind the document, one step away, so that a board member or supervisor who asks for it gets it the same day.
What does the FCA look for in a self assessment?
The FCA looks for reasoning it can follow and evidence that the reasoning was tested. Its March 2026 review of firms' annual self-assessments, a year after the transition ended, listed both good practice and gaps. The gaps are the more useful list, because each is a sentence a reviewer can test a draft against.
What the FCA flagged in 2026 self-assessments, and the test to run on your own draft
| FCA finding (March 2026) | The test on your draft |
|---|---|
| "Some firms state in self-assessments that there's no scenario that they wouldn't be able to recover from, but don't include evidence of having tested this using sufficiently severe scenarios." | Does the draft name at least one scenario that breaches a tolerance, and the test that showed it? |
| "When firms report few or no outstanding vulnerabilities, and there is a lack of information or evidence on mapping, testing, and vulnerability management … it makes it difficult to check whether they've identified vulnerabilities properly." | Does every vulnerability statement point to the map or test that found it? |
| "Not establishing distinct impact tolerances for market integrity and consumer harm." | Does each tolerance say whose harm it measures? |
| "Limited evidence that communications strategies are tested as part of scenario exercises" | Is there a dated test of the communication plan? |
| "Some firms lack recorded remediation actions, owners, or target completion dates." | Does every open item have an owner, a date and an acceptance? |
| "Little or no evidence of input from second or third line of defence in self-assessment." | Who in risk and audit reviewed this version, and when? |
The good-practice list in the same review points the other way: methodologies and rationale stated, maps drawn from several data sources, testing outcomes "integrated into remediation planning", and a confidence rating on each test result. A draft that carries a confidence on each recovery time and a source on each statement answers most of the list by construction.
An unsourced statement and a sourced one
The difference between a self-assessment that survives a supervisor's question and one that does not is usually a single sentence's worth of detail. The pair below is the same finding about the same service, written two ways.
The same self-assessment statement, unsourced and sourced
As it is often written: Make a Faster Payment can be recovered within tolerance following a supplier outage.
As a defensible self-assessment writes it: In scenario SCN-2026-18, ransomware at the primary gateway supplier, the service recovers in 6 h 10 m against a 4-hour tolerance: outside by 2 h 10 m. Signed by the head of operational resilience on Oct 22.
As it is often written: Based on workshop discussion with the service team.
As a defensible self-assessment writes it: Six steps timed from failover test FT-2026-05-14, incident INC-2026-0217, runbook RB-PAY-07 v6 and the supplier contract; all evidence 5 to 8 months old.
As it is often written: Customer impact is expected to be limited.
As a defensible self-assessment writes it: Replaying the payments hub on Tuesday Oct 13: 312,000 payments worth £48.6m delayed, for 268,400 customers, 4,870 with a support need.
As it is often written: Remediation is in progress.
As a defensible self-assessment writes it: REM-2026-031, warm standby gateway, owner Owen Pryce, by March 31, 2027, funded; accepted by the SMF24 on Oct 22. Interim priority queue from Dec 15.
What evidence supports an operational resilience self assessment?
Each statement should rest on a document that existed before the statement was written: a map version with its owner and date, a signed test result, an incident timeline, a runbook version, a contract clause, a remediation item with its acceptance. The useful rule is that every number in the self-assessment has exactly one source, and that source can be opened.
Evidence also has an age. A recovery time taken from a failover test two years ago describes a system that may no longer exist. The sample bank's rule is that evidence older than 12 months is flagged and a step without recent evidence is labelled an estimate, so a board reading "6 h 10 m" knows whether those minutes were measured. The evidence for that result is below: six steps, sources between 5 and 8 months old, and the failover test report open beside them.
The evidence behind every minute of one statement
How an evidence-first draft is assembled, section by section
A self-assessment that cites everything is easier to produce than one that cites nothing, if it is drafted from the evidence rather than from last year's document. In the solution, the Self-assessment agent drafts each section from what has been confirmed, signed and accepted: map versions, signed scenario results, accepted remediation items, supplier findings. It cites every statement and flags a section when its evidence changes. It never approves, and it will not describe a service as resilient without a signed result.
The sample bank's 2026 draft shows how that behaves on the day. When the SMF24 accepted the gateway fix on October 22, section 6 updated with the item, its owner, its date and the acceptance; section 4 gained the newly signed result; section 7 had added the cloud concentration on October 16. A panel lists what changed since the last draft, so the SMF24 and the board committee read the differences, and each version is kept.
The 2026 self-assessment, drafted section by section with every line cited
The time saved is real but secondary. The solution's own estimate for the sample bank is about 30 working days to assemble and write the document by hand against about 3 to review the cited draft; that is arithmetic for 11 services, not a measured result. The larger gain is the one the FCA's list rewards: every statement can be challenged and answered. What each agent may and may never do sets out the limits behind the draft; to see it built from your own evidence, start from Operational Resilience Management.
Questions people ask
Is there an official operational resilience self assessment template?
The FCA points firms to the Handbook for the minimum contents: the nine records in SYSC 15A.6.1R. The PRA's SS1/21 paragraph 8.3 lists what a bank's self-assessment should set out. Within those, the structure is the firm's own; the sample bank uses one section per record, plus third parties and a statement for the board.
Is the self assessment the same as the FCA's ORQUEST questionnaire?
No. ORQUEST is an FCA questionnaire a firm can complete through its supervisor to describe its operational resilience capabilities. The self-assessment is the firm's own written record under SYSC 15A.6.1R, approved by its board and kept, every version, for at least six years.
Do you send the self assessment to the FCA or PRA?
Not routinely. SYSC 15A.6.2R requires firms to keep each version and provide it "on request"; supervisors ask for it, and the FCA's 2024 and 2026 observations were based on self-assessments it reviewed. A bank should assume any version can be requested.
How long should an operational resilience self assessment be?
There is no length rule. The FCA's 2026 review says firms do not usually include every piece of evidence, as long as the document is clear enough for the board to decide what to prioritise and fund. A short document with every statement sourced serves better than a long one built from policy text.
Does the self assessment have to show breaches?
It has to show the vulnerabilities that threaten tolerances and the actions planned (SYSC 15A.6.1R(7)), and the PRA expects the scenarios in which the firm could not stay within tolerance. The FCA has criticised self-assessments claiming no scenario would breach a tolerance without evidence of severe enough testing.
Who writes the operational resilience self assessment?
Usually the head of operational resilience, drawing on service owners, the resilience analysts, the third-party risk manager and finance for remediation costs. The rules require only that the board approve it; the FCA's 2026 review also looks for second and third line input.