The FCA's PS21/3 operational resilience rules have been in effect since March 2022, with the final transitional deadline for firms to demonstrate they can remain within impact tolerances having passed in March 2025. Despite this, in our assessment work we still regularly see programmes that satisfy the letter of the rules but not the underlying intent.
The single most common gap is treating 'important business services' as a documentation exercise rather than an operational one. Firms map IBS to systems and people once, file the document, and never touch it again. Real resilience requires that mapping to live inside a system that updates as your technology estate changes — which is exactly what ServiceNow's Business Continuity Management application, tied to a well-maintained CMDB, is designed for.
Impact tolerances are the second recurring weak point. Many firms set a tolerance (e.g. 'four hours of unavailability') without ever testing whether their actual recovery capability meets it. Severe-but-plausible scenario testing needs to be scheduled, evidenced, and — critically — feed back into remediation actions when a gap is found.
Third-party dependencies compound the problem. An important business service is only as resilient as its weakest supporting vendor, so your BCM programme and your TPRM programme cannot operate as separate silos. On ServiceNow, linking vendor risk records directly to the business services they support closes this gap automatically.
Governance and self-assessment reporting to the board is the final piece the FCA scrutinises closely. Board members need a clear, current view of IBS status, tolerance breaches, and remediation progress — not a static annual report. A live ServiceNow dashboard solves this far more credibly than a slide deck.
Our BCM Assessment tool benchmarks your organisation against these exact areas and produces a prioritised remediation roadmap in minutes.
Book a Workflow Review →