---
title: [OR] [P2] [S3] [ITo] [C4] Linking Impact Tolerance to Critical Business Services (CBS)
description: [OR] [P2] [S3] [ITo] [C4] Linking Impact Tolerance to Critical Business Services (CBS)
image: https://blog.bcm-institute.org/hubfs/OR%20Setting%20Impact%20Tolerances%20P2%20Morepost/%5BOR%5D%20%5BP2%5D%20%5BS3%5D%20%5BITo%5D%20%5BC4%5D%20Linking%20Impact%20Tolerance%20to%20Critical%20Business%20Services%20(CBS).jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Setting Impact Tolerances: A Practical Guide for Operational Resilience Implementation
# \[OR\] \[P2\] \[S3\] \[ITo\] \[C4\] Linking Impact Tolerance to Critical Business Services (CBS)
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/b130e2d2-651f-4fd6-af68-9a5a85e124da)
Impact tolerance cannot be effectively defined or applied without first identifying the **Critical Business Services (CBS)** that an organisation delivers.
While traditional resilience approaches focus on systems or processes, operational resilience requires a shift toward **services that matter most to customers and stakeholders**.
A Critical Business Service represents an **end-to-end service** whose disruption would cause intolerable harm. Impact tolerance is therefore not set at the system or process level, but at the **service level**, ensuring that resilience efforts are aligned with real-world outcomes.
This chapter explains how impact tolerance is **anchored to CBS**, how services are mapped to customer outcomes, and why an **end-to-end service view** is essential for accurate tolerance setting.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/e5fad794-08a2-4f8b-ba94-5d32e15ba9bc)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) May 7, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/00e8044a-8a62-4f8f-be7c-9c267d8b3dfc)
### \[P2\] \[S3\] Chapter 4
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/b130e2d2-651f-4fd6-af68-9a5a85e124da)
### **Linking Impact Tolerance to Critical Business Services (CBS)**
#### **Introduction**
[![\[OR\] \[P2\] \[S3\] \[ITo\] \[C4\] Linking Impact Tolerance to Critical Business Services (CBS)](https://no-cache.hubspot.com/cta/default/3893111/24ceb290-50c2-4af4-be00-41894f00c7cb.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/24ceb290-50c2-4af4-be00-41894f00c7cb)
Impact tolerance cannot be effectively defined or applied without first identifying the **Critical Business Services (CBS)** that an organisation delivers.
While traditional resilience approaches focus on systems or processes, operational resilience requires a shift toward **services that matter most to customers and stakeholders**.
A Critical Business Service represents an **end-to-end service** whose disruption would cause intolerable harm. Impact tolerance is therefore not set at the system or process level, but at the **service level**, ensuring that resilience efforts are aligned with real-world outcomes.
This chapter explains how impact tolerance is **anchored to CBS**, how services are mapped to customer outcomes, and why an **end-to-end service view** is essential for accurate tolerance setting.
#### **Purpose of the Chapter**
The purpose of this chapter is to demonstrate how **impact tolerance is applied at the service level**, enabling organisations to:
- Identify Critical Business Services (CBS) in line with OR-P2-S1
- Link services directly to **customer and stakeholder outcomes**
- Understand the importance of an **end-to-end service perspective**
- Apply impact tolerance to real-world service examples
- Decompose services into **Sub-CBS** for detailed analysis and measurement
#### **Identifying Critical Business Services (CBS)**
The first step in linking impact tolerance is the identification of **Critical Business Services**, as outlined in **OR-P2-S1: Identify Critical Business Services**.
A CBS is defined as:
An end-to-end service provided to external users where disruption would result in **intolerable harm** to customers, the organisation, or the wider system.
##### **Key Principles for Identifying CBS**
- **Service-oriented, not process-oriented**
- Focused on **external delivery**, not internal operations
- Based on **impact severity**, not operational importance
- Aligned with **regulatory expectations**
##### **Common Mistakes to Avoid**
- Treating systems (e.g., core banking platform) as CBS
- Defining internal processes (e.g., reconciliation) as CBS
- Over-identifying too many services as “critical.”
##### **Outcome**
A **prioritised list of CBS**, forming the foundation for impact tolerance setting.
#### **Mapping CBS to Customer Outcomes**
Once CBS is identified, the next step is to map it to **customer outcomes**. This ensures that impact tolerance reflects **real-world consequences**, rather than internal performance metrics.
##### **Why Customer Outcomes Matter**
- Operational resilience is **customer-centric**
- Disruption is measured by **impact on users**, not systems
- Regulatory expectations emphasise **harm prevention**
##### **Examples of Customer Outcomes**
- Ability to access funds
- Completion of financial transactions
- Availability of account information
- Timely processing of payments
##### **Mapping Approach**
| CBS | Customer Outcome |
| --- | --- |
| Deposit Services | Customers can access and manage their funds |
| Payments Services | Customers can transfer money reliably and on time |
This mapping ensures that impact tolerance answers the question:
**“At what point does disruption prevent customers from achieving expected outcomes?”**
#### **Importance of End-to-End Service View**
A Critical Business Service is delivered through a **complex chain of interdependent components**, including:
- People
- Processes
- Technology
- Data
- Third-party providers
Focusing on individual components in isolation can lead to **misleading conclusions** about resilience.
##### **Why End-to-End View is Critical**
- Captures **interdependencies and hidden risks**
- Identifies **single points of failure**
- Reflects **actual customer experience**
- Ensures **accurate impact tolerance thresholds**
##### **Example: Payments Service**
An end-to-end payments service may involve:
- Customer interface (mobile banking app)
- Authentication systems
- Core banking system
- Payment gateway
- External clearing network
- Third-party service providers
A failure in any one component can disrupt the entire service, even if other components are functioning.
**Impact tolerance must therefore be set at the service level—not component level.**
#### **Examples of Critical Business Services**
##### **CBS-1: Deposit and Account Services**
This service enables customers to:
- Open and maintain accounts
- Deposit and withdraw funds
- Access account balances and statements
**Customer Outcomes:**
- Continuous access to funds
- Accurate account information
- Secure transaction processing
**Impact Considerations:**
- Inability to access funds may cause immediate customer harm
- Errors in account balances may lead to loss of trust and regulatory issues
##### **CBS-2: Payments & Funds Transfer Services**
This service enables customers to:
- Transfer funds domestically and internationally
- Make payments to individuals and businesses
- Settle financial obligations
**Customer Outcomes:**
- Timely and accurate payment execution
- Reliability of transaction processing
- Availability during critical periods
**Impact Considerations:**
- Payment delays can disrupt business operations
- Failed transactions may cause financial and reputational damage
- Widespread outages may have **systemic implications**
#### **Service Decomposition into Sub-CBS**
To set impact tolerance effectively, CBS must be broken down into **manageable components**, known as **Sub-CBS**.
##### **Why Decompose Services?**
- Enables **granular analysis of dependencies**
- Supports **accurate mapping of processes and resources**
- Helps identify **specific points of vulnerability**
- Facilitates **detailed impact assessment and scenario testing**
##### **Example: CBS-1 Deposit and Account Services (Sub-CBS)**
| Sub-CBS Code | Sub-CBS |
| --- | --- |
| 1.1 | Customer Onboarding and Account Application |
| 1.2 | Customer Identification and Verification (KYC/CDD) |
| 1.3 | Account Approval and Opening |
| 1.4 | Deposit Transactions Processing |
| 1.5 | Withdrawal and Funds Access Processing |
| 1.6 | Account Servicing and Maintenance |
| 1.7 | Interest, Fees, and Charges Processing |
| 1.8 | Account Reporting and Statements |
##### **Example: CBS-2 Payments Services (Sub-CBS)**
| Sub-CBS Code | Sub-CBS |
| --- | --- |
| 2.1 | Payment Initiation |
| 2.2 | Payment Validation and Authentication |
| 2.3 | Payment Processing and Routing |
| 2.4 | Settlement and Clearing |
| 2.5 | Transaction Confirmation and Notification |
#### **Linking Sub-CBS to Impact Tolerance**
Impact tolerance is typically defined at the **CBS level**, but it must consider the performance of **Sub-CBS components**.
##### **Approach**
1. Define overall impact tolerance for the CBS
2. Analyse how each Sub-CBS contributes to service delivery
3. Identify critical Sub-CBS that:
4. Align recovery and resilience measures accordingly
This ensures that **impact tolerance is both comprehensive and actionable**.
[![Banner \[Summing\] \[OR\] \[E3\] Establish Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/5e80e50f-5e3e-44ea-8c43-16bf42d4f3b5.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/5e80e50f-5e3e-44ea-8c43-16bf42d4f3b5)
Impact tolerance can only be meaningfully defined when anchored to **Critical Business Services**.
By focusing on services rather than systems, organisations ensure that resilience efforts are aligned with **customer outcomes and real-world impact**.
The identification of CBS, mapping to customer outcomes, and adoption of an **end-to-end service view** provide the necessary foundation for setting accurate and defensible impact tolerances.
Through **service decomposition into Sub-CBS**, organisations gain the granularity needed to analyse dependencies, assess vulnerabilities, and design effective resilience strategies.
In the next chapter, we will explore the **key components of impact tolerance**, defining the measurable elements used to quantify and operationalise tolerance thresholds.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/05996af2-38e1-4f05-96c6-6f5d6469c9de)
| **C1** | **C2** | **C3** | **C4** | **C5** | **C6** |
| --- | --- | --- | --- | --- | --- |
| [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C1\] Introduction to Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/a2d06a13-c2ac-4e0a-b8ea-c5afcab91844.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a2d06a13-c2ac-4e0a-b8ea-c5afcab91844) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C2\] Regulatory and Standards Landscape](https://no-cache.hubspot.com/cta/default/3893111/04df8f17-629c-458f-af01-67e3da528b63.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/04df8f17-629c-458f-af01-67e3da528b63) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C3\] Understanding Impact Tolerance in Context](https://no-cache.hubspot.com/cta/default/3893111/ea66bac0-7b34-4d56-9c93-c33c8f7964bc.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ea66bac0-7b34-4d56-9c93-c33c8f7964bc) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C4\] Linking Impact Tolerance to Critical Business Services (CBS)](https://no-cache.hubspot.com/cta/default/3893111/24ceb290-50c2-4af4-be00-41894f00c7cb.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/24ceb290-50c2-4af4-be00-41894f00c7cb) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C5\] Key Components of Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/6e9d8a15-c0a3-4e28-b9a4-c2dcc3e2081e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e9d8a15-c0a3-4e28-b9a4-c2dcc3e2081e) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C6\] Methodology for Setting Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/77526e47-fc15-4c7b-bf03-cadd672b40db.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/77526e47-fc15-4c7b-bf03-cadd672b40db) |
| **C7** | **C8** | **C9** | **C10** | **C11** | **C12 ** |
| [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C7\] Impact Tolerance Assessment Framework](https://no-cache.hubspot.com/cta/default/3893111/abf28462-aba4-4970-81be-55cf66dc6147.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/abf28462-aba4-4970-81be-55cf66dc6147) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C8\] Scenario-Based Calibration of Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/23b3a54d-37ce-494b-acb1-33b3cc5e1655.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/23b3a54d-37ce-494b-acb1-33b3cc5e1655) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C9\] Role of Dependency Mapping in Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/d35fd8b0-e936-4ab3-9706-4366bfcb8cbe.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d35fd8b0-e936-4ab3-9706-4366bfcb8cbe) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C10\] Governance, Ownership, and Accountability](https://no-cache.hubspot.com/cta/default/3893111/de12fefd-b6c6-4156-83a9-5d19ca5bc508.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/de12fefd-b6c6-4156-83a9-5d19ca5bc508) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C11\] Integration with Operational Resilience Framework](https://no-cache.hubspot.com/cta/default/3893111/84d3d3c4-0647-4ffd-99b4-a20a12526019.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/84d3d3c4-0647-4ffd-99b4-a20a12526019) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C12\] Testing and Validation of Impact Tolerances](https://no-cache.hubspot.com/cta/default/3893111/9a9cb7eb-1ca3-4790-b39e-f6b0035a1eae.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9a9cb7eb-1ca3-4790-b39e-f6b0035a1eae) |
| **C13** | **C14** | **C15** | **C16** | **C17** | **C18** |
| [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C13\] Monitoring, Metrics, and Continuous Improvement](https://no-cache.hubspot.com/cta/default/3893111/1a32f981-3a16-427a-a63f-5a40ab93ea21.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1a32f981-3a16-427a-a63f-5a40ab93ea21) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C14\] Common Challenges and Pitfalls](https://no-cache.hubspot.com/cta/default/3893111/8831463d-a357-4203-806b-fb31ef71d615.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/8831463d-a357-4203-806b-fb31ef71d615) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C15\] Practical Case Study (Banking Sector Example)](https://no-cache.hubspot.com/cta/default/3893111/fef15761-14c6-4e2b-b157-554cceb33d14.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/fef15761-14c6-4e2b-b157-554cceb33d14) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C16\] Future Trends in Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/b6a701db-167e-4630-88ad-de0d43deb322.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b6a701db-167e-4630-88ad-de0d43deb322) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C17\] Key Takeaways and Call to Action](https://no-cache.hubspot.com/cta/default/3893111/bf49e0c2-33a3-48bc-97d2-eb939aed77bd.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/bf49e0c2-33a3-48bc-97d2-eb939aed77bd) | [![\[OR\] \[P2\] \[S3\] \[ITo\] \[C18\] Back Cover](https://no-cache.hubspot.com/cta/default/3893111/3623335d-0b26-4ee7-afbf-0d431358b390.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3623335d-0b26-4ee7-afbf-0d431358b390) |
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-05-11T07:36:01.999Z",
"datePublished" : "2026-05-07T03:10:36.000Z",
"headline" : "[OR] [P2] [S3] [ITo] [C4] Linking Impact Tolerance to Critical Business Services (CBS)",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-p2-s3-ito-c4-linking-impact-tolerance-to-critical-business-services-cbs",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```