Operational Resilience & BCP

Anna AI Powered

Business Continuity Planning • FCA SYSC 15A Compliance • Disaster Recovery

Click to expand ↗

Resilience Health

—

No data yet

Overall composite

60% weighted sections · 40% compliance checklist

Complete

0% of items

Partial

0% of items

Incomplete

0% of items

Completeness Breakdown

—

0 / 84 pts

No data yet

Sections

0/34 points

Compliance Checklist

0/50 points

Completed

0% of sections

In Progress

0% of sections

Not Started

0% of sections

Operational Resilience KPIs

Click any to drill ↗

›

BCP Completeness

0 of 0 points earned

›

Important Business Services

All mapped with impact tolerances

›

Critical Business Functions

of 0 functions rated Critical

›

Open Stress Tests

No open stress tests

Section Status

0 0 0

0 Green 0 Amber 17 Red (incl. not started)

Threat Risk Summary

No data

Risk appetite thresholds: Low ≤7 • Medium ≤14 • High ≥15

Key Dates Schedule

No data

BCP Compliance Checklist

0/25 Met

Critical Business Functions

Identify and classify your business functions by criticality

Business Function	Department	Criticality	Supports Important Business Service (IBS)?	Recovery Time Objective (RTO)	Recovery Point Objective (RPO)	Impact if Disrupted	Actions

Impact Tolerances (SYSC 15A)

Set maximum tolerable disruption levels for each Important Business Service (IBS)

— auto

Important Business Service (IBS)	Consumer Impact	Max Tolerable Duration	Max Data Loss	Impact Tolerance Set	Within Tolerance?	Actions

Resource Dependencies & Mapping

Map people, technology, facilities, information, and third-party dependencies

— auto

Important Business Service (IBS) / Function	People (Key Roles)	Technology	Facilities	Third Parties	Single Point of Failure?	Actions

Financial Impact Assessment

Quantify financial losses from disruption scenarios

Estimated Daily Revenue Impact

Maximum Acceptable Financial Loss

Business Interruption Insurance Cover

Emergency Liquidity Available

Additional Financial Considerations

Critical Records Inventory

Physical/digital records that must be protected and recovered first (master agreements, regulatory licences, IP, customer master data)

Record	Type	Format	Location (primary)	Backup location	Recovery priority	Owner	Actions

Workforce Resilience & Skills Matrix

Firm-wide cross-training register — who can deputise for whom for each critical activity (people-SPOF coverage)

Critical role / activity	Primary holder	Cross-trained deputies	Skill / certification	SPOF risk	Cross-training plan	Actions

Recovery Strategy per IBS

SYSC 15A.4 recovery strategy per Important Business Service — cold/warm/hot site, alt arrangements, manual workaround, activation steps

IBS	Strategy type	Target recovery	Activation steps (summary)	Owner	Last tested	Actions

Threat Register

Identify, assess, and mitigate threats to business continuity

— auto

Threat	Category	Likelihood	Impact	Risk Score	Risk Appetite	Existing Controls	Residual Risk	Owner	Actions

Stress Testing & Scenario Testing

Test resilience against severe but plausible scenarios (SYSC 15A.5)

Risk Category	Stress Test	Date Tested	Result	Actions / Comments	Actions

Self-Assessment (SYSC 15A.6)

Assess ability to remain within impact tolerances and identify vulnerabilities

Governance & Oversight

Board accountability, SM&CR responsibilities, three lines of defence

BCP Programme Owner (Senior Manager)

Board Sponsor

BCP Coordinator

Last Board Review Date

Governance Notes

BCP Maintenance Calendar

Annual programme — scheduled tests / reviews / attestations / training / drills

Activity	Type	Owner	Frequency	Next due	Last completed	Status	Actions

Board Reporting Log

Every BCP / op-resilience report presented to Board / Risk Committee — decisions taken, actions assigned (SM&CR audit trail)

Date	Report type	Audience	Period	Decisions	Minutes ref	Actions

External Event Learnings

Industry / regulator / vendor incidents triggering BCP review — Dear-CEO letters, AWS/Azure outages, vendor breaches, ICO monthly cyber bulletins

Date	Source	Event	Relevance	BCP review triggered?	Owner	Actions

Crisis Management Team

Key personnel with 24/7 contact details and deputies

— auto

Name	Role / Title	CMT Role	Office Phone	Mobile	Personal Email	Deputy	Actions

Emergency Contacts Directory

External services, suppliers, insurers, and emergency contacts

Service / Category	Provider / Company	Contact Name	Telephone	Email	Reference / Policy No.	Actions

IT Disaster Recovery

Critical systems, backup procedures, and recovery plans

— auto

Critical Systems Register

System	Vendor	Hosting	Recovery Time Objective (RTO)	Recovery Point Objective (RPO)	Backup Frequency	Failover Type	Last Disaster Recovery (DR) Test	Result	Actions

Data Backup & Recovery

Primary Backup Location

Secondary Backup Location

Backup Verification Procedure

IT Support Provider (24/7)

Communications Plan

Internal/external communication strategy during disruption

Notification Channels (Priority Order)

1. Staff SMS System

2. Email Distribution List

3. Teams Emergency Channel

FCA Notification

FCA Firm Contact Centre

FCA Notification Threshold

Client Communication Templates

Template: Service Disruption Notice

Template: Resolution Notice

Facilities & Alternative Working

Office details, assembly points, alternative sites, remote working

Primary Premises

Address

Capacity

Landlord Contact

Fire Assembly Points

Primary Assembly Point

Secondary Assembly Point

Alternative Working Arrangements

Alternative Office Site

Activation Time for Alt Site

Remote Working Capability

Remote Working Tested?

Insurance Details

Business interruption, cyber, professional indemnity, and property cover

Insurance Type	Insurer	Policy Number	Cover Level	Excess	Expiry Date	Broker	Actions

Third-Party & Supplier Dependencies

Critical supplier register + your assessment of each supplier's resilience controls. Auto-derivation was removed — large suppliers (Barclays, AWS) won't share their BCP, so a BCP-received metric mis-graded the section. Use the toggle when you're satisfied the supplier's reputation, regulatory status and disclosures give sufficient assurance.

Supplier	Service Provided	Criticality	BCP Received?	BCP Adequate?	Alternative Supplier	Contract Expiry	Actions

Immediate Response Procedure

Step-by-step checklist for first 24 hours of an incident

— auto

Recovery Box Contents

Essential items maintained offsite for disaster recovery

— auto

Recovery Box Location

Last Reviewed

Communications Templates Library

Pre-drafted statements ready to send at 03:00 — holding statement, customer impact notice, FCA notification, press release, staff comms

Template name	Audience	Channel	Approver required	Last reviewed	Owner	Actions

Notification & Escalation Matrix

Who-notifies-whom-when by severity tier — internal escalation, external comms, regulator notification thresholds (SYSC 15A.7)

Trigger / severity	Notify whom	Within (timeframe)	Channel	Escalate to (if no response)	Notes	Actions

Alternate Workspace Register

DR site, work-from-home capacity, third-party recovery centres (Sungard / Regus emergency seats) — capacity, setup time, activation procedure per site

Site / type	Address	Capacity (seats)	Setup time	Activation owner	Last tested	Contract status	Actions

Active Incidents

Live incidents with running FCA 4-hour notification countdown

Closed Incidents

Historical incidents with debrief notes and lessons learned. Use the filter bar to narrow the list.

Select report format

Anna

Hi, I'm Anna!

Operational Resilience & BCP

Critical Systems Register

Data Backup & Recovery

Notification Channels (Priority Order)

FCA Notification

Client Communication Templates

Primary Premises

Fire Assembly Points

Alternative Working Arrangements