The FCA, PRA and other UK and international regulators have made it clear: when it comes to operational resilience it’s not enough to tick boxes; it’s about protecting customers, market integrity and firm stability. Central to this is defining the point at which disruption becomes unacceptable. That’s where impact tolerances come in.
Time-based tolerances, such as “we can survive a 4-hour outage”, are a critical foundation. Linked directly to important business services they help firms understand the duration of disruption they can withstand before causing intolerable harm. But as the regulatory landscape matures, so too must this approach. Duration alone proves insufficient to capture the depth or cumulative financial toll of severe disruption.
Consider a mid-sized asset manager. Their ICARA identified the risk of their client app going offline due to an external attack. They expect recovery within 8 hours, with a 2-day operational resilience impact tolerance for this service. Yet, as recent events show, disruption can last much longer. Their own stress testing indicates week-long event costing £30m. How would this be funded? What is the organisation’s financial impact tolerance?
That’s where WTW’s proprietary Risk Tolerance Clarified (RTC) solution comes in. RTC is fully customisable, turning your organisation’s financial priorities into clear, quantifiable risk thresholds. Whether focused on maintaining budget, free cash flow, or risk appetite, RTC helps you align with regulatory requirements by defining exactly how much disruption you can afford, before it becomes unacceptable.
It’s about aligning risk management with business performance. RTC empowers risk and treasury teams to speak the same language, whilst using data-driven insights to guide decisions.
Returning to our asset management example and the client-facing app outage: As we analyse their financials, a clearer picture emerges. For the first two days, recovery is the focus, aligning with their 2-day impact tolerance. Despite recovery planning, the event continues. By day 4, costs exceed £19m, making daily expense payments impossible. On day 7, just before the event ends, the total surpasses £28m, a point at which financial deterioration materially impacts their ability to source external financing.
Impact tolerances are expected to evolve beyond duration-based metrics to other variables, including financial thresholds and other operational indicators (e.g., number of affected customers, transaction volumes). While some development is organic, the FCA has noted a variety of firm methods. As best practice solidifies, a greater link between operational resilience, quantified risk scenarios, and financial strength will be required. Firms demonstrating the ability to define, measure, and test financial impact tolerances are better positioned to provide comprehensive and credible operational resilience self-assessments to their boards and the regulator, proving they truly understand and can withstand severe disruption.
We’re keen to hear from others navigating this space. What metrics are you using? How are you determining and testing your tolerances? And critically, how are these quantified insights feeding into your mandatory operational resilience self-assessment?
If you're exploring these questions, or want to, our Operational Risk Solutions team is here to help. Whether you're looking to define financial impact tolerances, quantify stressed scenarios, align ICAAP/ICARA with resilience initiatives, or strengthen your self-assessment, we can support you in turning resilience into measurable value.
WTW hopes you found the general information provided here informative and helpful. The information contained herein is not intended to constitute legal or other professional advice and should not be relied upon in lieu of consultation with your own legal advisors. In the event you would like more information regarding your insurance coverage, please do not hesitate to reach out to us. In North America, WTW offers insurance products through licensed entities, including Willis Towers Watson Northeast, Inc. (in the United States) and Willis Canada Inc. (in Canada).
