Readiness Without Overclaiming
How to describe readiness honestly: claiming only what tests and incidents have shown, labelling what is untested, and resisting language that outruns the evidence.
The short answer
Readiness without overclaiming means describing a service's resilience only as far as its evidence goes, and saying plainly where the evidence stops. A firm may be ready for the scenarios it has tested, with the dependencies it has exercised, under the conditions it rehearsed, but that is a narrower claim than being ready for disruption in general. Honest language respects that boundary: it names the service, the scenario, and the result, and it labels what has not been tested rather than leaving the reader to assume it has.
Overclaiming is rarely deliberate dishonesty. It usually grows from enthusiasm, from summary language that drops its qualifications, or from the pressure to reassure a board, a customer, or a supervisor. A test passed becomes readiness proven, a plan written becomes recovery assured, and a single successful rehearsal becomes a general capability. Each step feels small, but together they produce a claim the evidence cannot support, and when a real disruption exposes the gap, the damage is greater because the firm had assured itself and others that the gap did not exist.
Where does overclaiming creep in?
Overclaiming creeps in at the point where a specific result is generalised. A recovery sequence that worked for one dependency is described as if it worked for the service as a whole. A test conducted with full staffing and advance notice is described as if it proved readiness for a disruption at any time. A supplier assurance is repeated as if it were the firm's own tested capability. In each case, the original fact may be true, but the claim drawn from it is broader than the fact supports.
How should untested areas be described?
Untested areas should be described as untested, without apology and without euphemism. A dependency that has not been exercised, a scenario that has not been rehearsed, and a recovery step that has never been used in a real event are facts about the firm's position, and stating them plainly allows the firm to prioritise its testing and to give honest assurance about the areas it has covered. A reader who is told what is untested can judge the claim fairly; a reader who is not told will assume coverage that does not exist.
Labelling untested areas also helps the firm itself. A list of untested dependencies and scenarios is a testing plan waiting to be written, ordered by risk to important services. Firms that hide their untested areas from themselves, by using language that implies coverage, lose that plan, and their testing programme drifts toward the scenarios that are easy to pass rather than the dependencies that are risky to leave untested. Honesty about gaps is therefore not just a virtue; it is a practical tool for improving readiness.
What about claims to boards and outsiders?
Claims to a board deserve the same discipline as claims to a supervisor, because the board's decisions depend on them. A board paper that says a service is ready should say ready for what, on the basis of which tests and incidents, and with what still untested. A paper that gives a single overall judgement without that detail may be easier to read, but it leaves the board unable to challenge the judgement or to direct testing toward the gaps that matter most.
How can language be kept honest?
Honest language can be checked by a simple exercise: for each claim about readiness, write down the record that supports it, and read the claim and the record together. If the claim says more than the record shows, rewrite the claim. If the record is a plan rather than a test, say that the firm has a plan, not that it has a proven capability. If the record is a test of one scenario, name the scenario. That exercise takes minutes, and it catches most overclaiming before it reaches a reader.
What culture supports honest claims?
Honest claims are supported by a culture in which reporting a gap is rewarded rather than punished. If service owners fear that admitting an untested dependency will be treated as a personal failure, they will use language that hides it, and the firm's assurance will become fiction. If, by contrast, owners who surface gaps and own the actions to close them are recognised, the firm's records will reflect its true position, and its testing will be directed at real weaknesses.
Senior managers set that culture by how they respond to bad news in assurance papers. A manager who asks, on hearing of a gap, what the fix is and who owns it, encourages honesty. A manager who asks why the gap was reported, or who presses for a more reassuring form of words, encourages concealment. Readiness without overclaiming is therefore not only a writing discipline; it is a leadership discipline, and its test is whether the firm's most candid papers are also its most welcomed.
Primary sources on the record
- Financial Conduct Authority, operational resilience: the UK regime, labelled separately from DORA.
- National Institute of Standards and Technology, Computer Security Resource Center: resilience and security practice, cited as practice, not law.
Legal status: Regime-dependent and labelled in the guide. DORA applies from 17 January 2025. The UK regime has its own policy statements and dates, stated separately where the guide compares regimes. Application position for this topic: DORA: from 17 January 2025. UK: see the UK line for its own dates.