Operational resilience software for FCA PS21/3 and SYSC 15A
For operational resilience leaders across UK banks, building societies, and insurers
Map important business services, set and track impact tolerances, test severe but plausible scenarios and keep your self-assessment current from one Drova workspace.
Trusted by operational resilience teams across the UK and beyond
“”
What does PS21/3 ask of you?
PS21/3 is the FCA's policy statement on building operational resilience, set out in the SYSC 15A rules of the FCA Handbook. It asks UK banks, building societies, insurers and other in-scope firms to keep their most important services within set limits through severe but plausible disruption.
- Identify your important business services.
- Set an impact tolerance for each one.
- Map the people, processes, technology, facilities and information behind each service.
- Test that each service can stay within tolerance in severe but plausible scenarios.
- Record it all in a self-assessment that your governing body approves.
The rules have applied since 31 March 2022, and the transition period ended on 31 March 2025. For the detail, read FCA operational resilience, explained, or see where the FCA found self-assessments fall short.
Software for your PS21/3 mapping, testing and self-assessment
Map the people, processes, technology, facilities and third parties behind each important business service, and see where they would fail.
operational resilience
Cover PS21/3 operational resilience in one place
Important business services, impact tolerances, testing and your self-assessment, connected.
- Set up and define important business services in one place
- Recommended scenario test plans built from your mapped services, risks and controls
- Mates, Drova's AI agents, draft service maps and flag weak points
- Export an Operational Resilience Self-Assessment report as PDF, Word or Excel
Scenario testing
Test against severe but plausible scenarios, the way the FCA asks
Built-in scenario planning. Simpler, smarter compliance.
- Run test scenarios for cyber incidents, outages and supplier failure
- Link impacts to the people, processes and systems behind each important business service
- Built-in logic and AI show your progress, ready to share with the Board
Auditable evidence
Map what matters, prove you're protecting it
Clarity and evidence in one structured system.
- Identify important business services and tolerances
- Generate and store tests to show control
- Replace spreadsheets with an auditable plan
- Create a single source of truth
PS21/3 is one regime within Drova’s broader operational resilience software.
Automated reporting
Engage your Board, show accountability
Turn oversight into action with auto-reporting and role clarity.
- Let Boards visualise operational risk, clearly
- Assign roles and responsibilities by requirement
- Scenario testing that drives accountability
- Automated, evidence-backed reporting whenever the Board or the FCA asks
Compliance, tested. Resilience, documented. PS21/3, covered.
