Impact tolerance (UK operational resilience)

Roles that need it

• Operational Risk Analyst
• Cybersecurity GRC Consultant
• Service Delivery Manager (Outsourcing & Shared Services)
• Risk Advisory Consultant

Skills it belongs to

• Operational resilience and ICT risk rules (DORA and equivalents)
• Scenario and sensitivity analysis

Related concepts

• DORA (Digital Operational Resilience Act)DORA, Regulation (EU) 2022/2554, sets uniform rules on ICT risk management, ICT incident reporting, digital resilience testing and ICT third-party risk for almost all EU financial entities. It has applied since 17 January 2025 and also creates EU oversight of critical ICT third-party providers.
• Major ICT-related incident reportingUnder DORA, financial entities must classify ICT-related incidents with common criteria and report major ones to their competent authority in three steps: an initial notification, an intermediate report and a final report with root causes. Reporting of significant cyber threats is voluntary.
• Outsourcing (EBA Guidelines)Outsourcing is an arrangement in which a service provider performs a process, service or activity that the institution would otherwise perform itself. The EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) set governance, risk assessment, contract and register rules, with stricter terms for critical or important functions.

Sources

• Operational resilience, Financial Conduct Authority (external site) accessed 31 Oct 2026

Updated 31 Oct 2026.