[OR] [P2] [S3] [ITo] [C6] Methodology for Setting Impact Tolerance

[P2] [S3] Chapter 6

Methodology for Setting Impact Tolerance

Introduction

Setting impact tolerance is one of the most important implementation activities in operational resilience.

It translates the organisation’s resilience ambition into measurable thresholds that define how much disruption to a Critical Business Service (CBS) can be tolerated before customer harm, regulatory breach, financial loss, reputational damage, or systemic impact becomes unacceptable.

Unlike traditional recovery metrics, impact tolerance is not set only by technology teams, business continuity teams, or operational risk teams. It requires a service-wide view that includes business owners, process owners, technology teams, cyber teams, third-party managers, compliance, risk, and senior management.

This chapter provides a practical step-by-step methodology for setting impact tolerances in a structured, repeatable, and evidence-based manner.

Purpose of the Chapter

The purpose of this chapter is to provide a practical methodology that enables organisations to:

• Identify the relevant CBS and Sub-CBS for tolerance setting
• Understand dependencies and resources supporting service delivery
• Define the impact dimensions that matter most
• Assess how the disruption severity increases over time
• Establish maximum tolerable thresholds
• Validate and approve tolerances through governance
• Refine tolerances iteratively as the organisation matures

Step 1: Identify CBS and Sub-CBS

The starting point for setting impact tolerance is the identification of Critical Business Services and their supporting Sub-CBS.

A CBS represents an end-to-end service that delivers value to customers, markets, regulators, or other key stakeholders. A Sub-CBS breaks the service into more specific service components that can be assessed and measured.

For example, a bank may define:

Impact tolerance should be set at the level where disruption can be meaningfully measured. In many cases, this means setting tolerances at both the CBS and Sub-CBS levels.

Step 2: Map Dependencies and Resources

Once the CBS and Sub-CBS have been identified, the organisation must map the dependencies and resources required to deliver each service.

This step links directly to OR-P2-S2: Map Processes and Resources, where organisations identify the people, processes, technology, third parties, facilities, data, and interconnections that support critical service delivery.

A practical mapping table may include:

Dependency mapping is essential because impact tolerance cannot be set realistically without understanding what enables the CBS to operate.

Step 3: Identify Impact Dimensions

The next step is to define the dimensions of impact that will be assessed during disruption.

Common impact dimensions include:

These dimensions should be tailored to the organisation’s business model, sector, jurisdiction, and customer base.

For financial institutions, customer harm and systemic impact are especially important because regulators expect impact tolerances to reflect more than internal recovery capability.

Step 4: Define Disruption Scenarios

Impact tolerance must be assessed against realistic and challenging disruption scenarios.

These scenarios should be severe but plausible, meaning they are demanding enough to test the resilience of the service but still credible given the organisation’s operating environment.

Examples include:

The purpose of defining scenarios is not to set different tolerances for every possible incident. Instead, scenarios help the organisation understand how quickly harm escalates and whether existing capabilities can keep disruption within acceptable limits.

Step 5: Assess Impact Severity Over Time

Impact tolerance is time-sensitive. A disruption that is tolerable for 30 minutes may become unacceptable after four hours or one business day.

Organisations should assess how the impact severity changes over time.

A typical assessment may use time bands such as:

For each time band, the organisation should assess impact across the agreed dimensions. This helps identify the point at which disruption becomes unacceptable.

Step 6: Determine Maximum Tolerable Thresholds

The maximum tolerable threshold defines the point beyond which the disruption is no longer acceptable.

Impact tolerances may be expressed using one or more measurable criteria, such as:

A strong impact tolerance statement combines measurable thresholds with service context.

Example:

“Payments and Funds Transfer Services must be restored or maintained to a minimum of 80% processing capacity within four hours, with no more than 5,000 delayed customer transactions and no breach of regulatory reporting obligations.”

This statement is more useful than a simple recovery time because it reflects customer impact, operational capacity, and regulatory consequences.

Step 7: Validate with Stakeholders

Impact tolerances must be validated with stakeholders who understand the service, its dependencies, and its consequences.

Key stakeholders include:

Validation should test whether the tolerance is:

• Realistic
• Measurable
• Defensible
• Aligned to risk appetite
• Supported by current capability
• Acceptable from a customer and regulatory perspective

Step 8: Obtain Governance Approval

Once validated, impact tolerances should be submitted for governance approval.

This ensures that tolerances are formally recognised, owned, and embedded into the organisation’s resilience framework.

Approval should include:

Governance approval turns impact tolerance from an analytical output into an organisational commitment.

Integration with BCM Institute’s Plan → Implement Lifecycle

The methodology for setting impact tolerance should be integrated into BCM Institute’s broader operational resilience lifecycle.

Within the operational resilience implementation phase, setting impact tolerance sits after CBS identification and dependency mapping, and before scenario testing.

This sequence is important:

1. Identify what is critical
2. Map what supports it
3. Define how much disruption is tolerable
4. Test whether the organisation can remain within tolerance
5. Improve where gaps are identified

Iterative Refinement Approach

Impact tolerance setting should not be treated as a one-time exercise. It must be refined as the organisation’s services, systems, risks, customers, and regulatory expectations evolve.

Tolerances should be reviewed when there are:

• New or changed CBS
• Major technology changes
• New third-party arrangements
• Regulatory changes
• Lessons from incidents or exercises
• Significant changes in transaction volumes or customer expectations
• Mergers, acquisitions, outsourcing, or cloud migration

A mature organisation improves its tolerance over time by using:

Practical Output: Impact Tolerance Methodology Summary

A structured methodology is essential for setting meaningful impact tolerances. Without a disciplined approach, tolerances may become arbitrary, unrealistic, or disconnected from actual service delivery capability.

The methodology outlined in this chapter begins with Critical Business Services, moves through dependency mapping and impact assessment, and concludes with validated and approved tolerance statements. It ensures that impact tolerances are not merely compliance artefacts but practical thresholds that guide resilience investment, scenario testing, incident response, and management decision-making.

Ultimately, impact tolerance setting is an iterative capability. As the organisation’s risk environment changes, its tolerances must be reviewed, challenged, and refined to ensure that critical services remain resilient under severe but plausible disruption.

C1	C2	C3	C4	C5	C6
C7	C8	C9	C10	C11	C12
C13	C14	C15	C16	C17	C18

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.