OperationalResilience.help
The Continuity Desk - important services, kept running
Home / Line 20 - Evidence, audit and readiness / Guide

Readiness Without Overclaiming

How to describe readiness honestly: claiming only what tests and incidents have shown, labelling what is untested, and resisting language that outruns the evidence.

Published 26 October 2026Checked against the regulation text on 26 October 2026Regime-dependent: EU under DORA, UK under FCA/PRA, labelled in the guide

The short answer

Readiness without overclaiming means describing a service's resilience only as far as its evidence goes, and saying plainly where the evidence stops. A firm may be ready for the scenarios it has tested, with the dependencies it has exercised, under the conditions it rehearsed, but that is a narrower claim than being ready for disruption in general. Honest language respects that boundary: it names the service, the scenario, and the result, and it labels what has not been tested rather than leaving the reader to assume it has.

Overclaiming is rarely deliberate dishonesty. It usually grows from enthusiasm, from summary language that drops its qualifications, or from the pressure to reassure a board, a customer, or a supervisor. A test passed becomes readiness proven, a plan written becomes recovery assured, and a single successful rehearsal becomes a general capability. Each step feels small, but together they produce a claim the evidence cannot support, and when a real disruption exposes the gap, the damage is greater because the firm had assured itself and others that the gap did not exist.

Where does overclaiming creep in?

Overclaiming creeps in at the point where a specific result is generalised. A recovery sequence that worked for one dependency is described as if it worked for the service as a whole. A test conducted with full staffing and advance notice is described as if it proved readiness for a disruption at any time. A supplier assurance is repeated as if it were the firm's own tested capability. In each case, the original fact may be true, but the claim drawn from it is broader than the fact supports.

How should untested areas be described?

Untested areas should be described as untested, without apology and without euphemism. A dependency that has not been exercised, a scenario that has not been rehearsed, and a recovery step that has never been used in a real event are facts about the firm's position, and stating them plainly allows the firm to prioritise its testing and to give honest assurance about the areas it has covered. A reader who is told what is untested can judge the claim fairly; a reader who is not told will assume coverage that does not exist.

Labelling untested areas also helps the firm itself. A list of untested dependencies and scenarios is a testing plan waiting to be written, ordered by risk to important services. Firms that hide their untested areas from themselves, by using language that implies coverage, lose that plan, and their testing programme drifts toward the scenarios that are easy to pass rather than the dependencies that are risky to leave untested. Honesty about gaps is therefore not just a virtue; it is a practical tool for improving readiness.

What about claims to boards and outsiders?

Claims to a board deserve the same discipline as claims to a supervisor, because the board's decisions depend on them. A board paper that says a service is ready should say ready for what, on the basis of which tests and incidents, and with what still untested. A paper that gives a single overall judgement without that detail may be easier to read, but it leaves the board unable to challenge the judgement or to direct testing toward the gaps that matter most.

How can language be kept honest?

Honest language can be checked by a simple exercise: for each claim about readiness, write down the record that supports it, and read the claim and the record together. If the claim says more than the record shows, rewrite the claim. If the record is a plan rather than a test, say that the firm has a plan, not that it has a proven capability. If the record is a test of one scenario, name the scenario. That exercise takes minutes, and it catches most overclaiming before it reaches a reader.

What culture supports honest claims?

Honest claims are supported by a culture in which reporting a gap is rewarded rather than punished. If service owners fear that admitting an untested dependency will be treated as a personal failure, they will use language that hides it, and the firm's assurance will become fiction. If, by contrast, owners who surface gaps and own the actions to close them are recognised, the firm's records will reflect its true position, and its testing will be directed at real weaknesses.

Senior managers set that culture by how they respond to bad news in assurance papers. A manager who asks, on hearing of a gap, what the fix is and who owns it, encourages honesty. A manager who asks why the gap was reported, or who presses for a more reassuring form of words, encourages concealment. Readiness without overclaiming is therefore not only a writing discipline; it is a leadership discipline, and its test is whether the firm's most candid papers are also its most welcomed.

Primary sources on the record

Legal status: Regime-dependent and labelled in the guide. DORA applies from 17 January 2025. The UK regime has its own policy statements and dates, stated separately where the guide compares regimes. Application position for this topic: DORA: from 17 January 2025. UK: see the UK line for its own dates.

Follow the service map

Line 20 - Evidence, audit and readiness Evidence Audit Examinations and Readiness How evidence, audit and examination fit together for one service, so a claim about resilience can be checked by an auditor, a supervisor, or a board without a scramble. Line 20 - Evidence, audit and readiness Evidence for Board Assurance What a board needs to judge resilience assurance: service-level evidence, gaps stated plainly, and a clear distinction between assertion and observed performance. Line 20 - Evidence, audit and readiness Evidence Retention and Access How long resilience evidence should be kept, in what form, and who should be able to find it, so the trail survives staff changes and can be produced without a scramble.