7 Operational Resilience Gaps Boards Now Expect Answers On
The framework is in place and the deadline has passed. The question has moved on from whether you have documented it to whether you could show it holds under pressure.
- The framework is live and the transitional period ended in March 2025. What boards and regulators now ask is not whether it is documented, but whether it describes what would actually happen.
- The seven gaps below are where documentation and reality most commonly diverge in mid-market financial services. Closing them takes operational change, not a better framework.
- The position worth holding is not “we have the framework”. It is “the framework matches how we actually operate, and we can show it”.
The transitional period ended in March 2025. The framework is live, the bar is set, and the interesting question is no longer what needs documenting. It is what you could actually demonstrate.
For most mid-market firms the honest answer is uncomfortable. The documentation is there. Important business services are defined. Impact tolerances are set and approved. The third-party register exists. Scenario testing has been run. None of that is in doubt.
What is in doubt is whether the documented framework describes what would really happen — and whether the firm could withstand the kind of severe but plausible event the whole thing was designed for.
That is the gap boards and audit committees now ask about. Compliance can be documented. Resilience is operational. The seven below are where the two most commonly come apart, and closing them takes operational change rather than a better-written framework.
The important business services were picked on revenue, not on harm
The regulator asks firms to identify services whose disruption would cause intolerable harm — to consumers, to market integrity, to the firm’s own safety and soundness.
The mid-market default is to start from revenue. The services that earn most, and are most visible commercially, make the list first. Whether the services that would actually harm customers most are on it is a separate question, and often nobody asked it.
So the firm protects what matters commercially while the regulator scrutinises what matters to customers. When the two lists diverge, the resilience investment does not address the questions being asked, which is an expensive way to be compliant. The fix is to define the list through customer harm first and layer commercial importance on afterwards. The framework was built around the first lens.
The impact tolerances have never been tested properly
The tolerances are documented. Maximum tolerable disruption for each service, approved by the board, submitted to the regulator. The framework is complete.
What is rarely complete is any test of whether those numbers hold under realistic stress. Recovery times assume the infrastructure performs as specified. Communications plans assume the right people are available. The manual fallback assumes people can absorb incident volumes by hand.
In real incidents those assumptions are routinely wrong. The board sees the documented number. The IT director knows the real one. They are different, and the difference is what evidence-based scrutiny is designed to surface. The fix is testing built to stress the assumptions rather than to validate the paperwork — run it, measure what actually happens, record the gap, then fix it.
You know your suppliers, but not your suppliers’ suppliers
The third-party register exists. Critical suppliers are documented, contracts are in place, assessments happen periodically.
What rarely exists in the mid-market is visibility past that. The cloud provider’s own sub-processors. The payments provider’s downstream dependencies. The identity checking vendor’s data sources. Your resilience depends on the whole chain, and the map usually stops one link in.
The cost is a concentration risk you cannot see. Several of your suppliers may all sit on the same infrastructure underneath. One failure there hits you in three places at once, while your framework treats them as three independent risks. The fix is to map further down and watch for concentration at each level. That is governance work, not procurement work, and it usually falls between the two.
The questions have changed. The firms that built the capability before anyone asked are the ones answering confidently.
Scenario testing produces plans, not changes
The exercise happens. The team gathers, the scenario is described, the response is rehearsed, the lessons are logged, the report goes to the board and compliance records that testing took place.
What rarely happens next is anything structural. The gaps found in testing get documented. The work that would actually close them rarely gets commissioned. Run the same scenario a year later and the same gaps appear.
That is the difference between resilience as an exercise and resilience as a capability. An exercise produces a plan; only investment changes what the business can actually do. The fix is to treat every test as a discovery process with a funded action list, named owners and dates — and for the board to review progress on those rather than confirming the exercise happened.
Resilience reports to risk, so it produces documents rather than change
The resilience function is staffed and competent. It produces frameworks, registers, scenario plans and board papers. It is well run and credible.
The structural question is who it reports to. In most mid-market firms it sits inside risk or compliance, and is treated as a discipline of regulatory risk. The outputs reflect that: documentation-led, framework-led, facing outwards towards the regulator.
What that placement does not produce is operational change. The function describes how things work; it cannot redesign them. The operations director, who could, receives the reports rather than owning the design. Where this is done well, resilience reports to operations and compliance is one of its outputs rather than its purpose. It is a small organisational change with very different consequences.
Recognising the gap between the framework and the operation is the first step.
A free Executive AI Opportunity Assessment. Forty-five minutes, online, with your leadership team. We arrive with a model of how firms in your sector make money and where AI has moved those numbers — and you tell us where it is wrong.
Book a free assessmentThe recovery times do not match what the platforms can actually do
A recovery time objective exists for each important business service. Signed off by the board, sitting in the framework, submitted to the regulator.
It is rarely tested under conditions that would validate it. In real incidents, and in exercises that simulate them honestly, actual recovery takes materially longer. The dependencies the number assumed are not the ones that exist. The coordination overhead the number assumed away turns out to dominate.
The board sees the documented figure. The IT director knows the real one. It rarely gets escalated unless an incident forces it. The fix is to test against realistic conditions and then either invest to close the gap or restate the number honestly. The first costs money and the second costs some awkwardness in a board meeting. Most firms have done neither, which is the more expensive option of the three.
Found during assessment and design. The cost is thinking time.
Found in an exercise. Remediation plus the cost of testing it again.
Found the hard way. The loss, the customer impact, and emergency work at emergency prices.
Found by someone else. Remediation, attestation, and a conversation you cannot control.
These multiples come from Barry Boehm’s work on software engineering economics, first published in 1981, which measured the cost of fixing a defect at successive stages of development. It did not measure resilience gaps, so this is an analogy rather than a finding. It holds because the mechanism is the same: the later you find it, the more has been built on top of it. The exact numbers are not the point. The shape of the curve is.
Three questions worth answering honestly
- For your most critical service, when did you last test recovery to the documented time under realistic conditions? If the honest answer is “we walked through it on paper”, the number is theoretical.
- Could you produce today a full dependency map, past your own suppliers to theirs, for your two highest-risk services? If not, there is concentration risk you cannot currently see.
- In the last twelve months, has a documented gap led to an actual operational change — not just an updated plan? If not, you have documentation rather than resilience.
The spend is treated as compliance cost when it could be winning work
The regulatory expectations are real and so is the cost of meeting them. Most mid-market firms frame the spend defensively: what we have to do to satisfy the regulator and avoid trouble. It sits in the accounts as a cost line and is managed like one.
That framing misses something. Being demonstrably resilient is increasingly worth money. Corporate customers ask for evidence during procurement. Investors ask about it in diligence. Consumers notice which firms have had visible outages and which have not.
The same spend, framed and designed differently, returns differently. A firm that can evidence this in front of a procurement committee wins work that a firm which cannot will lose. The fix is not more money — it is deciding, before the money is committed, that it should buy two things rather than one.
What this means
None of these seven are framework failures. The framework is in place, the documentation is thorough, the deadlines were met. What is missing is the operational change that makes the framework describe reality, and the commercial thinking that makes the spend return more than compliance.
The urgency comes from a shift in what gets asked. A few years ago, having the framework was enough. Now the question is whether it matches the operation. Before long it will be whether you have made the investment work commercially, and firms that build early will be answering from a position the late ones cannot quickly reach.
The economics are not close. The same gap costs a fraction to close at design as it does when someone else finds it. Every stage compounds.
Which is the argument we make everywhere, in a sector where the consequences arrive faster. Change the work before you change the technology — and where AI is now being added into these same operations, the question of what would actually happen under stress is worth settling before the technology speeds everything up.
Could you demonstrate it, or only document it?
Forty-five minutes with your leadership team, online, at no cost. We bring a working model of how firms in your sector make money and where AI has moved those numbers. You tell us where it is wrong. Then we tell you what we think — including “don’t invest”, if that is the honest answer.
Book a free assessment45 minutes · online · no cost · nothing to prepare
Continue reading
12 AI Readiness Gaps Boards Are Beginning to Question
The gaps boards now expect leadership teams to have an answer for.
For financial services8 Commercial Weaknesses Quietly Slowing Fintech Growth
Why technology scales faster than the commercial discipline around it.
For finance directors7 Governance Failures Quietly Undermining AI Returns
Why the return on AI spend is rarely defensible when someone checks properly.