---
title: [OR] [P2] [S3] [ITo] [C10] Governance, Ownership, and Accountability
description: [OR] [P2] [S3] [ITo] [C10] Governance, Ownership, and Accountability
image: https://blog.bcm-institute.org/hubfs/OR%20Setting%20Impact%20Tolerances%20P2%20Morepost/%5BOR%5D%20%5BP2%5D%20%5BS3%5D%20%5BITo%5D%20%5BC10%5D%20Governance%2c%20Ownership%2c%20and%20Accountability.jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Setting Impact Tolerances: A Practical Guide for Operational Resilience Implementation
# \[OR\] \[P2\] \[S3\] \[ITo\] \[C10\] Governance, Ownership, and Accountability
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/b130e2d2-651f-4fd6-af68-9a5a85e124da)
Impact tolerance is not merely a technical or analytical output—it is a **governance commitment**. It defines the level of disruption an organisation is willing to accept and therefore reflects its **risk appetite, customer obligations, and regulatory responsibilities**.
Without clear governance, ownership, and accountability, impact tolerances risk becoming theoretical targets that are neither enforced nor embedded into decision-making.
Regulators increasingly expect organisations to demonstrate that impact tolerances are **owned, approved, monitored, and regularly reviewed** at the highest levels.
This chapter outlines how governance structures, defined roles, and accountability frameworks ensure that impact tolerance is **operationalised, sustained, and defensible**.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/e5fad794-08a2-4f8b-ba94-5d32e15ba9bc)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) May 8, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/00e8044a-8a62-4f8f-be7c-9c267d8b3dfc)
### \[P2\] \[S3\] Chapter 10
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/b130e2d2-651f-4fd6-af68-9a5a85e124da)
### **Governance, Ownership, and Accountability**
#### **Introduction**
[![\[OR\] \[P2\] \[S3\] \[ITo\] \[C10\] Governance, Ownership, and Accountability](https://no-cache.hubspot.com/cta/default/3893111/de12fefd-b6c6-4156-83a9-5d19ca5bc508.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/de12fefd-b6c6-4156-83a9-5d19ca5bc508)
Impact tolerance is not merely a technical or analytical output—it is a **governance commitment**. It defines the level of disruption an organisation is willing to accept and therefore reflects its **risk appetite, customer obligations, and regulatory responsibilities**.
Without clear governance, ownership, and accountability, impact tolerances risk becoming theoretical targets that are neither enforced nor embedded into decision-making.
Regulators increasingly expect organisations to demonstrate that impact tolerances are **owned, approved, monitored, and regularly reviewed** at the highest levels.
This chapter outlines how governance structures, defined roles, and accountability frameworks ensure that impact tolerance is **operationalised, sustained, and defensible**.
#### **Purpose of the Chapter**
The purpose of this chapter is to:
- Define governance structures for impact tolerance
- Clarify roles and responsibilities across the organisation
- Establish ownership of Critical Business Services (CBS) and Sub-CBS
- Outline approval and review processes
- Highlight documentation and audit requirements
#### **Board and Senior Management Responsibilities**
##### **Role of the Board**
The Board of Directors holds ultimate accountability for operational resilience, including the approval of impact tolerances.
**Key Responsibilities:**
- Approve the organisation’s **operational resilience framework**
- Endorse **impact tolerance thresholds** for critical services
- Ensure alignment with **risk appetite and strategic objectives**
- Oversee management’s implementation of resilience capabilities
- Challenge assumptions and ensure tolerances are **customer-centric and realistic**
The Board must ensure that tolerances reflect not only operational capability but also **customer expectations, regulatory requirements, and systemic responsibilities**.
##### **Role of Senior Management**
Senior Management is responsible for translating Board expectations into operational execution.
**Key Responsibilities:**
- Identify and prioritise **Critical Business Services (CBS)**
- Ensure **impact tolerances are defined, validated, and implemented**
- Allocate resources to maintain operations within tolerance
- Oversee **scenario testing and resilience improvements**
- Establish escalation protocols for **tolerance breaches or near breaches**
Senior Management must ensure that tolerances are not static but are **continuously monitored and refined**.
#### **Three Lines of Defence Model**
The governance of impact tolerance should align with the **Three Lines of Defence (3LoD)** model to ensure effective control, oversight, and assurance.
##### **First Line of Defence – Business and Operations**
**Ownership Role**
- Own and manage CBS and Sub-CBS
- Define and propose impact tolerances
- Ensure operational capability to remain within tolerance
- Execute recovery and continuity measures during disruptions
**Key Accountability:**
Deliver services within defined impact tolerance thresholds
##### **Second Line of Defence – Risk and Compliance**
**Oversight Role**
- Define policies, frameworks, and methodologies
- Review and challenge impact tolerance definitions
- Ensure alignment with **risk appetite and regulatory expectations**
- Monitor adherence and report breaches
**Key Accountability:**
Ensure impact tolerances are appropriate, consistent, and compliant
##### **Third Line of Defence – Internal Audit**
**Assurance Role**
- Independently assess the effectiveness of the impact tolerance framework
- Validate governance, processes, and controls
- Review evidence supporting tolerance setting and testing
- Identify gaps and recommend improvements
**Key Accountability:**
Provide independent assurance that tolerances are robust and effective
#### **Ownership of CBS and Sub-CBS**
Clear ownership is critical to ensuring accountability for impact tolerance.
##### **CBS Ownership**
Each Critical Business Service must have a **designated Service Owner**.
**Responsibilities of CBS Owner:**
- Define service scope and boundaries
- Propose impact tolerance thresholds
- Ensure mapping of dependencies
- Oversee scenario testing and performance monitoring
- Escalate issues and initiate remediation
##### **Sub-CBS Ownership**
Sub-CBS ownership may be distributed across functional areas.
**Responsibilities of Sub-CBS Owners:**
- Manage specific service components
- Provide input on tolerance setting
- Maintain operational capability within defined thresholds
- Support dependency mapping and scenario testing
##### **Supporting Roles**
| Role | Responsibility |
| --- | --- |
| Technology Owner | System availability, recovery capability |
| Operations Owner | Process execution and manual workaround |
| Third-Party Owner | Vendor performance and resilience |
| Risk Owner | Alignment with risk appetite |
| Compliance Owner | Regulatory adherence |
##### **Key Principle**
Every CBS and Sub-CBS must have **clear, named ownership**, with accountability for operating within impact tolerance.
#### **Approval and Review Processes**
Impact tolerance must be formally approved and periodically reviewed.
##### **Approval Process**
A structured approval process ensures that tolerances are:
- **Validated by relevant stakeholders**
- Supported by **evidence and analysis**
- Aligned with **organisational risk appetite**
##### **Typical Approval Workflow**
- **Preparation**
- **Validation**
- **Recommendation**
- **Approval**
##### **Review Process**
Impact tolerances must be reviewed regularly to remain relevant.
**Review Triggers:**
- Major incidents or disruptions
- Scenario testing outcomes
- Changes in business model or services
- Technology or system changes
- New or updated regulatory requirements
- Significant changes in customer expectations
##### **Review Frequency**
- **Annual review** (minimum baseline)
- **Ad-hoc review** triggered by events or changes
#### **Monitoring and Escalation**
Governance must include mechanisms for **ongoing monitoring and escalation**.
##### **Monitoring Requirements**
- Real-time or near real-time tracking of service performance
- Early warning indicators (e.g., backlog, system degradation)
- Threshold monitoring against defined tolerances
##### **Escalation Framework**
| Condition | Action |
| --- | --- |
| Approaching the tolerance limit | Notify management, activate mitigation |
| Near breach | Escalate to senior management |
| Breach | Activate crisis management and regulatory reporting |
##### **Key Principle**
Impact tolerance must be **actively managed**, not passively documented
#### **Documentation Requirements**
Proper documentation is essential for governance, audit, and regulatory compliance.
##### **Key Documents**
| Document | Purpose |
| --- | --- |
| CBS Register | List of all critical services |
| Impact Tolerance Register | Documented tolerances for each CBS/Sub-CBS |
| Dependency Maps | Supporting resource and interconnection data |
| Scenario Testing Reports | Evidence of tolerance validation |
| Governance Records | Approval and review documentation |
| Incident Reports | Evidence of actual performance vs tolerance |
##### **Documentation Principles**
- Clear and structured
- Evidence-based
- Consistently updated
- Accessible for audit and regulatory review
#### **Audit and Assurance Requirements**
Regulators expect organisations to demonstrate that impact tolerance is **not only defined but also effectively implemented**.
##### **Internal Audit Focus Areas**
- Governance structure and accountability
- Accuracy and completeness of CBS identification
- Validity of impact tolerance definitions
- Evidence supporting tolerance thresholds
- Effectiveness of scenario testing
- Monitoring and escalation processes
##### **Regulatory Expectations**
Supervisors may assess:
- Whether tolerances are **realistic and defensible**
- Whether governance oversight is **effective**
- Whether organisations can demonstrate **compliance under stress scenarios**
- Whether remediation actions are tracked and completed
#### **Integration with Operational Resilience Lifecycle**
Governance and accountability span the entire lifecycle:
| Lifecycle Stage | Governance Role |
| --- | --- |
| Plan | Define policies, roles, and risk appetite |
| Implement | Assign ownership and set tolerances |
| Test | Oversee scenario testing and validation |
| Improve | Review outcomes and approve remediation |
#### **Common Challenges**
| Challenge | Description |
| --- | --- |
| Unclear ownership | Lack of clear accountability for CBS |
| Siloed governance | Disconnect between business, technology, and risk |
| Weak challenge function | Limited oversight from the second line |
| Infrequent reviews | Tolerances become outdated |
| Poor documentation | Insufficient evidence for audit or regulators |
#### **Best Practices**
- Establish **clear ownership at the CBS and Sub-CBS levels**
- Ensure **active Board and Senior Management engagement**
- Embed impact tolerance into the **risk appetite framework**
- Align governance with the **Three Lines of Defence**
- Implement **continuous monitoring and escalation mechanisms**
- Maintain **robust documentation and audit trails**
- Conduct **regular reviews and updates**
#### [![Banner \[Summing\] \[OR\] \[E3\] Establish Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/5e80e50f-5e3e-44ea-8c43-16bf42d4f3b5.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/5e80e50f-5e3e-44ea-8c43-16bf42d4f3b5)
Governance, ownership, and accountability are the pillars that transform impact tolerance from a defined threshold into a **managed and enforceable discipline**. Clear roles, structured approval processes, and robust oversight ensure that tolerances are not only defined but actively monitored, challenged, and improved.
By aligning governance with the Three Lines of Defence and embedding accountability at all levels—from the Board to operational teams—organisations can ensure that their impact tolerance framework is both **credible and sustainable**.
Ultimately, strong governance enables organisations to demonstrate to regulators, customers, and stakeholders that they are not only prepared for disruption but are capable of managing it within clearly defined and accountable limits.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/05996af2-38e1-4f05-96c6-6f5d6469c9de)
| **C1** | **C2** | **C3** | **C4** | **C5** | **C6** |
| --- | --- | --- | --- | --- | --- |
| [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C1\] Introduction to Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/a2d06a13-c2ac-4e0a-b8ea-c5afcab91844.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a2d06a13-c2ac-4e0a-b8ea-c5afcab91844) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C2\] Regulatory and Standards Landscape](https://no-cache.hubspot.com/cta/default/3893111/04df8f17-629c-458f-af01-67e3da528b63.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/04df8f17-629c-458f-af01-67e3da528b63) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C3\] Understanding Impact Tolerance in Context](https://no-cache.hubspot.com/cta/default/3893111/ea66bac0-7b34-4d56-9c93-c33c8f7964bc.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ea66bac0-7b34-4d56-9c93-c33c8f7964bc) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C4\] Linking Impact Tolerance to Critical Business Services (CBS)](https://no-cache.hubspot.com/cta/default/3893111/24ceb290-50c2-4af4-be00-41894f00c7cb.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/24ceb290-50c2-4af4-be00-41894f00c7cb) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C5\] Key Components of Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/6e9d8a15-c0a3-4e28-b9a4-c2dcc3e2081e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e9d8a15-c0a3-4e28-b9a4-c2dcc3e2081e) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C6\] Methodology for Setting Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/77526e47-fc15-4c7b-bf03-cadd672b40db.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/77526e47-fc15-4c7b-bf03-cadd672b40db) |
| **C7** | **C8** | **C9** | **C10** | **C11** | **C12 ** |
| [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C7\] Impact Tolerance Assessment Framework](https://no-cache.hubspot.com/cta/default/3893111/abf28462-aba4-4970-81be-55cf66dc6147.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/abf28462-aba4-4970-81be-55cf66dc6147) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C8\] Scenario-Based Calibration of Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/23b3a54d-37ce-494b-acb1-33b3cc5e1655.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/23b3a54d-37ce-494b-acb1-33b3cc5e1655) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C9\] Role of Dependency Mapping in Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/d35fd8b0-e936-4ab3-9706-4366bfcb8cbe.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d35fd8b0-e936-4ab3-9706-4366bfcb8cbe) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C10\] Governance, Ownership, and Accountability](https://no-cache.hubspot.com/cta/default/3893111/de12fefd-b6c6-4156-83a9-5d19ca5bc508.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/de12fefd-b6c6-4156-83a9-5d19ca5bc508) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C11\] Integration with Operational Resilience Framework](https://no-cache.hubspot.com/cta/default/3893111/84d3d3c4-0647-4ffd-99b4-a20a12526019.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/84d3d3c4-0647-4ffd-99b4-a20a12526019) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C12\] Testing and Validation of Impact Tolerances](https://no-cache.hubspot.com/cta/default/3893111/9a9cb7eb-1ca3-4790-b39e-f6b0035a1eae.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9a9cb7eb-1ca3-4790-b39e-f6b0035a1eae) |
| **C13** | **C14** | **C15** | **C16** | **C17** | **C18** |
| [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C13\] Monitoring, Metrics, and Continuous Improvement](https://no-cache.hubspot.com/cta/default/3893111/1a32f981-3a16-427a-a63f-5a40ab93ea21.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1a32f981-3a16-427a-a63f-5a40ab93ea21) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C14\] Common Challenges and Pitfalls](https://no-cache.hubspot.com/cta/default/3893111/8831463d-a357-4203-806b-fb31ef71d615.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/8831463d-a357-4203-806b-fb31ef71d615) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C15\] Practical Case Study (Banking Sector Example)](https://no-cache.hubspot.com/cta/default/3893111/fef15761-14c6-4e2b-b157-554cceb33d14.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/fef15761-14c6-4e2b-b157-554cceb33d14) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C16\] Future Trends in Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/b6a701db-167e-4630-88ad-de0d43deb322.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b6a701db-167e-4630-88ad-de0d43deb322) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C17\] Key Takeaways and Call to Action](https://no-cache.hubspot.com/cta/default/3893111/bf49e0c2-33a3-48bc-97d2-eb939aed77bd.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/bf49e0c2-33a3-48bc-97d2-eb939aed77bd) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C18\] Back Cover](https://no-cache.hubspot.com/cta/default/3893111/3623335d-0b26-4ee7-afbf-0d431358b390.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3623335d-0b26-4ee7-afbf-0d431358b390) |
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-05-11T07:39:18.633Z",
"datePublished" : "2026-05-08T09:52:55.000Z",
"headline" : "[OR] [P2] [S3] [ITo] [C10] Governance, Ownership, and Accountability",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-p2-s3-ito-c10-governance-ownership-and-accountability",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```