How Regulators Test Resilience

Regulators test resilience by examining whether a firm can show, for its important services, what would happen under disruption and what would restore those services before harm becomes intolerable. Supervisors therefore look beyond policies to service maps, tolerances with reasoning, scenario and incident evidence, and records of changes made as a result.

A lending service under review illustrates the approach. A supervisor might ask who owns the service, which suppliers and data it depends on, what tolerance has been set and why, what the last scenario revealed, and which actions remain open. A firm that can answer those questions for that service, with documents that agree with each other, will fare very differently from a firm whose answers live in separate programmes.

Supervisors often begin with the firm own account of its important services and their tolerances, because that account reveals how the firm thinks about harm. A list of services without users, harm reasoning, or tolerances suggests the firm has not yet made the judgements the regime expects, while a shorter list with clear reasoning suggests it has.

Supervisors then test consistency. Does the service map match the tolerance, does the scenario match the map, and do the actions from the last test appear as completed changes rather than open items carried forward unchanged? Inconsistency across those materials is itself a finding, because it shows the discipline is not yet joined up.

Testing is examined for realism and for learning, not merely for occurrence. A supervisor may ask why a particular scenario was chosen, whether it was severe enough to stress the service, whether it followed from the service map, and what changed afterwards. Threat-led penetration testing under DORA, where it applies, is examined in a similar way, with attention to whether findings were read back into service recovery.

A test that passed easily, or that produced no actions, invites scepticism rather than praise, because a genuine test of a complex service should usually surface something worth fixing. Supervisors are often more interested in how a firm responded to a weakness than in whether a weakness existed.

Third parties attract close attention because many important services depend on suppliers, and a failure in a shared supplier can affect several services at once. Supervisors ask how the firm understands its critical suppliers, what recovery and communication arrangements exist, and whether the firm can still serve users if a supplier is unavailable.

Under DORA, third party ICT risk has its own framework, with registers, risk assessments, and oversight arrangements that supervisors examine. Under the UK regime, supervisors similarly examine how firms manage outsourcing and third party dependencies for important services. In both cases, the question returns to the service: what happens to users if this supplier stops?

Findings lead to change through owned actions with follow up, and supervisors often return to earlier findings to check whether they were closed in substance or merely closed on paper. A firm that can show a chain from finding to change to retest gives supervisors a reason to trust its next account, while a firm with repeated findings on the same service gives them a reason to dig deeper.

That dynamic rewards honesty in testing and in reporting. A firm that surfaces weaknesses itself, fixes them, and can show the fix working, demonstrates the discipline that resilience regimes aim to encourage, whereas a firm that hides weaknesses until a supervisor finds them has to explain both the weakness and the silence.

For one service, assemble the materials a supervisor might request: the map, the tolerance and its reasoning, the last scenario or incident record, and the actions that followed. Read them as a stranger would, and note where they disagree or where an action has no owner.

This guide is educational and does not describe the supervisory approach of any particular authority in full. It explains the logic behind resilience supervision: services, harm, evidence, and follow up, examined together rather than as separate documents.