Operational Resilience Body of Knowledge (OR BoK) Series
Set Impact Tolerance
This blog explains the purpose and importance of Setting Impact Tolerance as Stage 3 of the Implement phase of the Operational Resilience (OR) Planning Methodology.
It guides organisations in establishing the maximum level of disruption that each Critical Business Service (CBS) can tolerate before causing unacceptable harm to customers, the organisation, the financial system, or other stakeholders.
The blog describes how impact tolerances are defined by measurable criteria, including maximum tolerable downtime, service degradation, transaction backlogs, customer impact, regulatory obligations, and financial consequences.
It also explains the role of senior management and governance in approving these tolerances and using them to guide resilience investments and operational decision-making.
For Operational Resilience practitioners and OR course participants, the blog provides a comprehensive explanation of why impact tolerance is a fundamental element of operational resilience, ensuring that resilience strategies, dependency mapping, and scenario testing align with clearly defined thresholds for maintaining critical business services during severe yet plausible disruptions.
Element
|
Description
|
|
Purpose
|
- To identify and prioritise the Critical Business Services (CBS) that, if disrupted, would cause intolerable harm to clients, stakeholders, or the wider financial/market system.
- This forms the foundation of the Implement Phase of Operational Resilience.
|
| Objectives |
- Establish a clear definition and scope of CBS within the organisation.
- Assess services against potential impacts on customers, regulatory obligations, and systemic stability.
- Develop a prioritised list of CBS for further resilience planning (mapping, tolerances, testing).
- Create a structured, validated inventory of CBS for ongoing resilience management.
|
|
Inputs
|
- Organisational strategy, mission, and risk appetite.
- Regulatory requirements (e.g., MAS, FCA, BNM).
- Business Impact Analysis (BIA) results
- Process maps, operating models, and service catalogues.
- Stakeholder knowledge (business leaders, SMEs, risk and compliance officers).
- Existing documentation of critical operations and dependencies.
|
|
Activities
|
- Define CBS scope and criteria based on regulatory and business impact considerations.
- Conduct a Business Services Impact Analysis (BSIA) to determine customer, financial, reputational, and regulatory consequences of disruption.
- Identify dependencies: people, processes, technology, facilities, third parties.
- Engage stakeholders across departments to validate service criticality.
- Prioritise services using a structured assessment methodology.
- Document CBS in a centralised inventory (service description, dependencies, tolerances, obligations).
- Validate and periodically review CBS to ensure continued relevance.
|
|
Outputs
|
- Approved Critical Business Services Register (inventory).
- Service prioritisation framework/matrix.
- Documented CBS criteria and rationale.
- Stakeholder-validated CBS list.
- Management sign-off for CBS scope.
|
|
Linkages
|
Upstream:
- Phase 1 (Plan) — governance structures, scoping, stakeholder engagement.
Downstream:
- P2-S2: Mapping Processes & Resources — CBS dependencies are mapped.
- P2-S3: Setting Impact Tolerances — tolerances are established per CBS.
- P2-S4: Scenario Testing — CBS used as basis for testing severe but plausible disruptions.
- P2-S5: Lessons Learned & Improvements — CBS inventory updated from findings.
- Cross-reference: BCMBoK BIA stage for alignment with existing BCM practices.
|
"Implement" Phase of OR Planning Methodology
| Identify Critical Business Services |
Map Inter-connections and Inter-dependencies |
Set Impact Tolerance
|
Conduct Scenario Testing |
Improve Lesson Learned |
|
|
|
|
|
|
|
|
| Operational Resilience Body of Knowledge - Implement |
| BoK 6 S1 |
BoK 7 S2 |
BoK 8 S3 |
BoK 9 S4 |
BoK 10 S5 |
|
|
|
|
|
|
More Information About Operational Resilience OR-5000 [BL-OR-5] or OR-300 [BL-OR-3] Course
To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.
|
|
|
|
|
|
|
|
If you have any questions, click to contact us.
|
|
|
|
|
|