FCA and PRA Self-Assessment in the UK

Under the UK regime, a self-assessment is the firm's own account, owned at board level, of how it identifies important business services, sets impact tolerances, maps supporting resources, tests against severe but plausible scenarios, and addresses the gaps that testing and incidents reveal. It is not a marketing document, a programme status report, or a collection of control attestations. It gathers, for each important business service, the tolerance, the map, the test evidence and the remediation actions into a single narrative that a board can challenge and a supervisor can examine. A self-assessment that records only strengths, with no gaps and no actions, is unlikely to be credible, because genuine testing of severe scenarios almost always reveals something that needs to change.

The self-assessment also serves as the point where the regime comes together. Identification, tolerance, mapping and testing each produce material, but without a self-assessment that material remains scattered across teams and documents. The self-assessment forces a judgement: for each service, can the firm say, on the evidence, that it would remain within tolerance under severe but plausible disruption, and if not, what is being done about it? That judgement, with its reasoning and its evidence, is the core of the document.

A self-assessment should describe each important business service, its tolerance, its map in summary, the scenarios tested against it, the results of that testing, and the actions arising from findings. It should also describe the governance around the work: who owns each service, who challenged the tolerances and the scenarios, and how the board engaged with the findings. Where a service would breach tolerance under a tested scenario, that breach should be stated plainly, together with the action planned, its owner and its expected effect. Plain statement of a breach, with a credible plan, is stronger evidence of control than omission of the breach.

Board ownership means the board has engaged with the substance of the assessment, not merely received it. Board members are expected to be able to discuss a named service, its tolerance and its vulnerabilities, and to challenge whether testing was severe enough and whether remediation plans are realistic. That challenge is difficult if the assessment is written in programme language that obscures service outcomes, so clarity of writing is itself a governance matter. An assessment that a board member cannot understand cannot be properly challenged, however thorough the underlying work may have been.

Evidence in a self-assessment should be service specific and traceable. A claim that a service was tested should point to the scenario, the date of the exercise in general terms, the participants, the findings and the actions that followed. A claim that a map is complete should be supported by reference to how the map was built and how it was checked against incidents. A claim that a gap has been closed should be supported by evidence that the fix was itself tested, not merely implemented. General assertions about a strong resilience culture, without service level evidence, do not carry the same weight.

A recurring mistake is to write the self-assessment as a programme report, organised by workstream rather than by service, so that a reader cannot tell, for any given service, whether it would remain within tolerance. Another mistake is to import material from another regime and present it as a UK self-assessment, without translating concepts, tolerances and tests into UK terms. That imported material may be thorough on its own terms, but it answers a different question, and the UK question remains unanswered. The cluster pitfall is therefore acute for self-assessment, because the document is meant to be the definitive UK account.

A reader can judge a self-assessment by asking, for a named service, whether the document states its tolerance, summarises its map, describes testing that was severe enough to matter, records breaches or gaps plainly, and sets out owned actions to address them. The reader can also ask whether the board challenge is visible, whether incident lessons are incorporated, and whether the document has changed since its previous version in ways that reflect new evidence. Where those elements are present, the assessment is at least structured to support judgement. Where they are absent, the assessment may describe activity without demonstrating resilience.

This guide describes the UK self-assessment in general terms for educational purposes. It does not assess any particular firm, and it does not replace the FCA and PRA policy statements for a firm preparing its own assessment. The remaining guides in this cluster address the timetable for the UK regime, comparison with DORA, dual-regulated firms, supervision, lessons from implementation, and the application of the regime to small firms, third parties, incident reporting, testing and governance.