16 weeks from instruction.
Chetwood Bank is a UK challenger bank authorised and regulated by the Prudential Regulation Authority and the Financial Conduct Authority. Operating a digital-first lending model, the bank serves retail customers across a focused range of product lines. As a dual-regulated firm, Chetwood is subject to the full scope of the PRA operational resilience framework as set out in SS1/21, and the FCA's corresponding requirements under SYSC 15A. The March 2022 implementation deadline established the programme foundation; the March 2025 deadline required firms to demonstrate that they could remain within their impact tolerances not merely that a framework existed. Chetwood had established its Important Business Services, set impact tolerances, and produced the foundational artefacts required for programme compliance. The bank recognised, however, that the programme needed to mature beyond documentation. The PRA's post-March 2025 expectations are unambiguous: firms must conduct regular, evidence-generating scenario testing against severe but plausible disruption scenarios and must be able to demonstrate recovery capability against defined impact tolerances. The bank had not yet conducted a full structured scenario testing cycle that met this evidencing standard. The bank's operational resilience team identified that without tested evidence of IBS resilience, the programme carried supervisory risk. The team required external specialist support to design and execute a credible scenario testing programme — one that would produce regulatory-grade findings, identify genuine vulnerabilities, and support the board and senior management in discharging their obligations under SS1/21. FourthLine was engaged to deliver that programme.
Two severe-but-plausible scenario scripts developed and approved, covering cyber-driven technology failure and a critical supplier disruption event.
Structured tabletop exercises facilitated with business service owners, ICT leads, operational resilience team, and executive risk owners.
Prioritised register of resilience gaps identified through testing, ranked by impact tolerance risk and allocated remediation ownership.
Full written findings report for each exercise. Tolerance position assessed, lessons learned captured, and remediation actions with
owners and dates.
Prioritised roadmap identifying immediate actions and longer-horizon investments required to maintain IBS resilience.
The engagement produced a structural improvement the bank had not previously had: tested, documented evidence of its ability and its current limitations in delivering Important Business Services through severe disruption. The scenario testing cycle identified genuine vulnerabilities, including gaps in documented incident response procedures and unproven manual workarounds within its third-party supply chain. Those findings, and the remediation actions they generated, represented real improvements to the bank's operational resilience position rather than a confirmation of existing documentation.
A structured 4–6 week assessment of your Banking firm's operational resilience position against PRA and FCA requirements. Fixed fee: £15k–£25k. Board-ready gap report delivered within 6 weeks