Impacttoleranceexplained

An impact tolerance turns "stay resilient" into a line you can test against. Without one, nobody can say whether a service came through a disruption well enough.

Sets requirements for what sits behind the service. Once the tolerance is set, you can set requirements for the people, processes, technology, facilities and information behind the service, such as recovery time objectives, so the service can stay within it (PRA SS1/21).

Meets the rules. UK rules require an impact tolerance for each important business service, and APRA's CPS 230 asks for tolerance levels for each critical operation. The section below sets out each regime.

Makes testing mean something. A scenario test checks one thing: whether the service stayed inside its tolerance. That gives "severe but plausible" a clear pass or fail.

Find the point at which any more disruption to the service would cause intolerable harm, and express it as a maximum length of time. Add a volume or value measure where time alone misses the harm.

1. Start from each important business service. Every important business service needs at least one impact tolerance.
2. Assume the disruption has happened. Leave out what might cause it and how likely it is. The tolerance is about how much harm you can bear, not how often things go wrong.
3. Find the point of intolerable harm. Ask how long the service could be down before clients, the market or the firm would suffer harm you cannot accept. In the PRA's example, if five days out would put UK financial stability at risk, the tolerance sits within those five days.
4. Choose the metrics. A time measure is required, such as "not disrupted beyond 24 hours" or "back by the end of the day". Add a volume or value measure, such as the share of payments delayed, where it helps (PRA SS1/21).
5. Check the busiest times. The tolerance has to hold at peak times of the day and year, not only on an average day.
6. Record the reasoning. Write down why each tolerance sits where it does. In the UK it goes into the written self-assessment that your governing body approves.

Test each tolerance against severe but plausible scenarios, watch how close real incidents come to it, and review it at least once a year or after any material change (SYSC 15A.2.6R).

1. Watch for early warnings. Track the measures that show a service drifting towards its tolerance, such as a backlog building or a supplier missing its service levels.
2. Test against scenarios. Check that each service can stay within tolerance when something serious goes wrong. See scenario testing, explained.
3. Record every breach. Note any incident that took a service past its tolerance, what caused it and what you are changing.
4. Review at least once a year. Revisit each tolerance when services, clients or rules change, and in any case within a year of the last review.

Important business service. A service a firm provides to clients that could cause them intolerable harm if disrupted. Every impact tolerance belongs to one. See important business services, explained.

Tolerance level. APRA's term under CPS 230, set for maximum downtime, maximum data loss and minimum service levels.

Maximum tolerable period of disruption. The business continuity planning term for the point past which disruption becomes unacceptable. It is close to an impact tolerance but is judged from the organisation's side rather than the client's. See business continuity planning.

Recovery time objective. The target time to restore a service. It should sit inside the impact tolerance. See RTO and RPO, explained.