If you hold the SMF24 designation, you already know the headline: you carry personal accountability for operational resilience at your firm. That is not a surprise. What is sometimes less clearly understood is what that accountability means in practice, what a regulator would specifically ask you if they wanted to examine whether you had discharged it, and whether the programme running under your designation would give you credible answers.

This article is written for you. Not for your compliance team, not for your board, and not for the Head of Operational Resilience who runs the programme day to day. For you, personally, as the senior manager in whom the FCA and PRA have placed direct regulatory accountability for one of the most substantive obligations in the post-implementation supervisory environment.

The questions it addresses are the ones that matter at a personal level: what have you actually taken on, what would a supervisor ask you directly, and what does a defensible position look like in 2026?

What the SMF24 Designation Actually Means

The SMF24 designation is one of the prescribed responsibilities under the Senior Managers and Certification Regime. It attaches to the Chief Operations function, and in firms where the role is held, it means that the individual designated as SMF24 bears personal regulatory responsibility for the operational resilience programme.

That personal responsibility is not theoretical. Under the SM and CR framework, the FCA and PRA can take enforcement action against an individual senior manager where there has been a regulatory failing in their area of responsibility and they cannot demonstrate that they took reasonable steps to prevent it. The firm's programme failing is not sufficient to trigger personal action: the question the regulator asks is whether the individual who held accountability did what a reasonable person in that position would have done to ensure the programme met the required standard.

The practical implication is this. When the PRA or FCA is examining a firm's operational resilience programme and finds material weaknesses, the next question is not only about the firm. It is about the person who held the SMF24 designation during the period when those weaknesses were allowed to persist. Were they receiving adequate reporting? Did they understand the gap between the firm's documentation position and its evidence position? Did they take action when they were told the programme was not meeting the standard? Did they tell the board what the programme's actual position was?

These are not hypothetical questions. They are the questions that appear in FCA and PRA supervisory correspondence when individual accountability is under examination, and they are the questions for which the SMF24 needs contemporaneous, evidenced answers.

The Three Dimensions of SMF24 Accountability

Personal accountability under SMF24 operates across three distinct dimensions that, taken together, define what a defensible position actually requires.

Programme oversight. The SMF24 is not expected to run the operational resilience programme personally. They are expected to exercise genuine oversight of it. The regulatory distinction between overseeing a programme and receiving assurance that a programme exists is precisely the distinction the supervisor will probe. Oversight means the SMF24 receives reporting that tells them the programme's current position, not its current activity. It means they ask substantive questions about the areas where the evidence is weakest. It means they escalate findings to the board that reflect the genuine programme position, not the most favourable interpretation of it. An SMF24 who has been receiving activity-based board reporting for two years and has not identified that it does not tell them whether their firm is actually resilient has not been exercising oversight. They have been noting updates.

The self-assessment. Under PRA SS1/21 Chapter 8, the board must approve the firm's written self-assessment. The SMF24's role in that process is to ensure the self-assessment reflects the firm's genuine current position, to brief the board on the material weaknesses it contains, and to secure board approval of a document that honestly describes where the programme stands and what the remediation plan is. An SMF24 who presents a self-assessment that understates the programme's weaknesses to avoid a difficult board conversation has not discharged their responsibility. They have created a document that will be harder to defend under supervisory examination precisely because it was designed to look better than the underlying evidence supports.

Reasonable steps. The "reasonable steps" test is the heart of the SM and CR accountability framework. If a regulatory finding is made against a firm in the SMF24's area of accountability, the question for the individual is whether they took the steps that a reasonable person in that position, with their experience and their access to information, would have taken to prevent the failing. Reasonable steps in the context of operational resilience in 2026 means: receiving adequate evidence-based reporting, ensuring the programme is resourced to produce regulatory-grade evidence, commissioning an independent assessment when the internal position is uncertain, and acting on findings when they are presented. The SMF24 who can demonstrate each of those steps with a contemporaneous evidence trail is in a defensible position. The one who cannot is not.

What a PRA or FCA Supervisor Would Ask You Directly

Supervisory interviews with SMF24 holders are not examinations of regulatory knowledge. Supervisors do not ask what SS1/21 requires. They ask whether the person they are interviewing has been exercising genuine accountability for the programme that operates in their name.

The questions that appear most consistently in supervisory engagement with SMF24 holders on operational resilience are the following. Consider whether you have evidenced answers to each.

  • When were you last shown the firm's current impact tolerance status per Important Business Service, and what did the evidence say about whether those tolerances have been validated through testing?

  • What did the most recent scenario testing exercise find, and what remediation has been completed since?

  • Have you seen evidence that the firm's supplier exit plans have been tested under stressed conditions, or only confirmation that plans exist?

  • If the PRA were to review your firm's operational resilience evidence tomorrow, what would they find, and how do you know that?

  • What independent assessment of the programme have you received in the past 12 months that was not produced by the team responsible for running it?

These questions are designed to determine whether the SMF24 has been actively governing the programme or passively receiving assurance about it. The difference between those two positions is the difference between a defensible accountability position and an exposed one.

 

The Accountability Gap That Most SMF24 Holders Do Not See

The most common accountability vulnerability for SMF24 holders in 2026 is not ignorance of the regulatory framework. Most SMF24 holders are experienced practitioners who understand what operational resilience requires at a conceptual level. The vulnerability is the gap between the conceptual understanding and the evidenced position.

The SMF24 who believes their firm is compliant based on internal assurances from the team that built the programme is in a different position to the SMF24 who has received an independent, evidence-based assessment of the programme's current state and has acted on the findings. The first person is relying on the judgement of the people whose work they are accountable for overseeing. The second person has discharged the oversight obligation in a way that would withstand examination.

This gap is not visible from inside the programme. The team running the programme has an inherent interest in presenting its work in a favourable light, not from dishonesty but from the entirely natural tendency of people to emphasise what is working and to manage the framing of what is not. The SMF24 who relies entirely on that framing for their view of the programme's position has not exercised independent oversight. They have accepted the programme team's own assessment of the programme team's work.

Independent assessment means commissioning a review that is conducted by practitioners who did not build the framework, who apply the supervisory lens rather than the programme team's lens, and who report findings to the SMF24 directly and without editorial control by the people whose work is being assessed.

What a Defensible Position Looks Like

A defensible SMF24 position on operational resilience in 2026 has three practical components.

The first is current-state knowledge. The SMF24 should be able to describe, with reference to recent, independently verified evidence, the firm's current impact tolerance status per IBS, the outcome of the most recent scenario testing, the status of the supplier exit capability, and the open items on the vulnerability register. This knowledge must come from reporting designed to inform genuine oversight, not from a board update designed to confirm that the programme is on track.

The second is the independent evidence trail. The SMF24 should be able to point to at least one structured, independent assessment of the programme's current position in the preceding 12 months, conducted by practitioners who are not the internal programme team. This is the "reasonable steps" evidence: it demonstrates that the person with accountability sought an external view of the programme's standard rather than relying solely on the internal team's own assessment.

The third is the action record. Where independent assessment has identified weaknesses, the SMF24 should have an evidenced record of having acted on those findings: escalating to the board, commissioning remediation, and monitoring closure. The action record is the most important personal liability management tool available to an SMF24 because it demonstrates that they knew about the gap and addressed it, rather than knowing about it and not acting.

FourthLine's Diagnostic Assessment is designed specifically to provide the independent evidence trail that the SMF24's accountability position requires. It is conducted by senior practitioners who are not the firm's internal team, it applies the same lens a PRA or FCA supervisor would apply, and it reports directly to the SMF24 with findings that are specific, evidenced, and actionable. It is the starting point for any SMF24 who wants an honest view of where their programme stands before a regulator provides their own.