And ultimately, where we identify that firms have taken an approach which is not consistent with the aims of the policy, then we will certainly let those firms know. Findings on impact tolerances On impact tolerances it’s clear from our work that, whilst progress has again been made, firms have found this more challenging than identifying IBS. This is in part due to the complexity of defining tolerances for the different regulatory objectives of customer harm or market integrity 3/6  BIS central bankers' speeches  versus safety and soundness, and – for the largest firms – financial stability. For example, we have seen that several of the IBS that have been submitted by firms were accompanied by an impact tolerance for customer harm or market integrity but did not include one for safety & soundness, and an even higher number did not include one for financial stability. These are gaps which we expect firms to fill as a matter of priority. We also noted that the granularity with which firms defined their IBS impacted the tolerances they then defined.
ii) Impact Tolerances The second is the requirement for firms to set impact tolerances for their IBS. Here, we expect firms to assume that disruption to IBS will occur and then set clearly defined time-based metrics, and well defined thresholds, at which the disruption would threaten regulatory objectives. iii) Mapping and Testing The third area is, following the identification of IBS and setting impact tolerances, we expect firms to perform mapping and testing so they are able to demonstrate their ability to stay within their impact tolerances. Firms’ testing strategies should incorporate the risks and vulnerabilities they will face in severe but plausible scenarios and then demonstrate how they will remediate any disruption in a timely manner. The experience gained from this testing can then inform how firms monitor risks to their operational resilience and increase the maturity of their overall processes. Policy interactions For the recent March 2022 deadline, firms had to meet the first two of these elements, namely identifying the IBS and setting impact tolerances. Looking ahead to the next key deadline, which is in 2025, firms will have to prove that they are able to remain within the impact tolerances that they have set out, and this is where the assurance gained from high quality testing will be key. I would also like to highlight the interaction of these expectations with the PRA’s outsourcing and third party risk management policy2, which was published at the same time as the policy on Op Res.