[OR] [P2] [S3] [ITo] [C4] Linking Impact Tolerance to Critical Business Services (CBS)

[P2] [S3] Chapter 4

Linking Impact Tolerance to Critical Business Services (CBS)

Introduction

Impact tolerance cannot be effectively defined or applied without first identifying the Critical Business Services (CBS) that an organisation delivers.

While traditional resilience approaches focus on systems or processes, operational resilience requires a shift toward services that matter most to customers and stakeholders.

A Critical Business Service represents an end-to-end service whose disruption would cause intolerable harm. Impact tolerance is therefore not set at the system or process level, but at the service level, ensuring that resilience efforts are aligned with real-world outcomes.

This chapter explains how impact tolerance is anchored to CBS, how services are mapped to customer outcomes, and why an end-to-end service view is essential for accurate tolerance setting.

Purpose of the Chapter

The purpose of this chapter is to demonstrate how impact tolerance is applied at the service level, enabling organisations to:

• Identify Critical Business Services (CBS) in line with OR-P2-S1
• Link services directly to customer and stakeholder outcomes
• Understand the importance of an end-to-end service perspective
• Apply impact tolerance to real-world service examples
• Decompose services into Sub-CBS for detailed analysis and measurement

Identifying Critical Business Services (CBS)

The first step in linking impact tolerance is the identification of Critical Business Services, as outlined in OR-P2-S1: Identify Critical Business Services.

A CBS is defined as:

An end-to-end service provided to external users where disruption would result in intolerable harm to customers, the organisation, or the wider system.

Key Principles for Identifying CBS

• Service-oriented, not process-oriented
• Focused on external delivery, not internal operations
• Based on impact severity, not operational importance
• Aligned with regulatory expectations

Common Mistakes to Avoid

• Treating systems (e.g., core banking platform) as CBS
• Defining internal processes (e.g., reconciliation) as CBS
• Over-identifying too many services as “critical.”

Outcome

A prioritised list of CBS, forming the foundation for impact tolerance setting.

Mapping CBS to Customer Outcomes

Once CBS is identified, the next step is to map it to customer outcomes. This ensures that impact tolerance reflects real-world consequences, rather than internal performance metrics.

Why Customer Outcomes Matter

• Operational resilience is customer-centric
• Disruption is measured by impact on users, not systems
• Regulatory expectations emphasise harm prevention

Examples of Customer Outcomes

• Ability to access funds
• Completion of financial transactions
• Availability of account information
• Timely processing of payments

Mapping Approach

This mapping ensures that impact tolerance answers the question:

“At what point does disruption prevent customers from achieving expected outcomes?”

Importance of End-to-End Service View

A Critical Business Service is delivered through a complex chain of interdependent components, including:

• People
• Processes
• Technology
• Data
• Third-party providers

Focusing on individual components in isolation can lead to misleading conclusions about resilience.

Why End-to-End View is Critical

• Captures interdependencies and hidden risks
• Identifies single points of failure
• Reflects actual customer experience
• Ensures accurate impact tolerance thresholds

Example: Payments Service

An end-to-end payments service may involve:

• Customer interface (mobile banking app)
• Authentication systems
• Core banking system
• Payment gateway
• External clearing network
• Third-party service providers

A failure in any one component can disrupt the entire service, even if other components are functioning.

Impact tolerance must therefore be set at the service level—not component level.

Examples of Critical Business Services

CBS-1: Deposit and Account Services

This service enables customers to:

• Open and maintain accounts
• Deposit and withdraw funds
• Access account balances and statements

Customer Outcomes:

• Continuous access to funds
• Accurate account information
• Secure transaction processing

Impact Considerations:

• Inability to access funds may cause immediate customer harm
• Errors in account balances may lead to loss of trust and regulatory issues

CBS-2: Payments & Funds Transfer Services

This service enables customers to:

• Transfer funds domestically and internationally
• Make payments to individuals and businesses
• Settle financial obligations

Customer Outcomes:

• Timely and accurate payment execution
• Reliability of transaction processing
• Availability during critical periods

Impact Considerations:

• Payment delays can disrupt business operations
• Failed transactions may cause financial and reputational damage
• Widespread outages may have systemic implications

Service Decomposition into Sub-CBS

To set impact tolerance effectively, CBS must be broken down into manageable components, known as Sub-CBS.

Why Decompose Services?

• Enables granular analysis of dependencies
• Supports accurate mapping of processes and resources
• Helps identify specific points of vulnerability
• Facilitates detailed impact assessment and scenario testing

Example: CBS-1 Deposit and Account Services (Sub-CBS)

Example: CBS-2 Payments Services (Sub-CBS)

Linking Sub-CBS to Impact Tolerance

Impact tolerance is typically defined at the CBS level, but it must consider the performance of Sub-CBS components.

Approach

1. Define overall impact tolerance for the CBS
2. Analyse how each Sub-CBS contributes to service delivery
3. Identify critical Sub-CBS that:
• Drive service continuity
• Represent single points of failure
4. Align recovery and resilience measures accordingly

This ensures that impact tolerance is both comprehensive and actionable.

Impact tolerance can only be meaningfully defined when anchored to Critical Business Services.

By focusing on services rather than systems, organisations ensure that resilience efforts are aligned with customer outcomes and real-world impact.

The identification of CBS, mapping to customer outcomes, and adoption of an end-to-end service view provide the necessary foundation for setting accurate and defensible impact tolerances.

Through service decomposition into Sub-CBS, organisations gain the granularity needed to analyse dependencies, assess vulnerabilities, and design effective resilience strategies.

In the next chapter, we will explore the key components of impact tolerance, defining the measurable elements used to quantify and operationalise tolerance thresholds.