they will face in severe but plausible scenarios and then demonstrate how they will remediate any disruption in a timely manner. the experience gained from this testing can then inform how firms monitor risks to their operational resilience and increase the maturity of their overall processes. policy interactions for the recent march 2022 deadline, firms had to meet the first two of these elements, namely identifying the ibs and setting impact tolerances. looking ahead to the next key deadline, which is in 2025, firms will have to prove that they are able to remain within the impact tolerances that they have set out, and this is where the assurance gained from high quality testing will be key. i would also like to highlight the interaction of these expectations with the pra ’ s outsourcing and third party risk management policy2, which was published at the same time as the policy on op res. my former colleague lyndon nelson gave a speech last year3 setting out how the approaches in the two policies complement each other. in his remarks he very clearly stressed that whilst firms can outsource services, their boards and senior management cannot outsource their ultimate accountability and responsibility for their resilience. our op res policy further emphasises this point. the identification of ibs, determining the maximum tolerable level of disruption to those services and taking measures so that firms can remain within those tolerances under severe but plausible scenarios, means firms and their boards need to assess in detail the dependencies that they have on other parties. 2. our initial supervisory assessment of firms ’ progress having provided a brief summary of the policy, i wanted to share some initial feedback on the progress that uk banks and building societies ( firms ) have made in meeting our expectations. we are still at a relatively early stage in our analysis and engagement with firms, with it being less than a month since we have received the initial responses from firms. so i want to emphasise that this initial feedback will be preliminary, and we won ’ t at this stage be able to say what “ best in class ” looks like for each aspect of the policy. however, there are some important 2 / 6 bis central bankers'speeches themes that are already emerging from our review of the board - approved lists of ibs and impact tolerances which we received. findings on important business services identification on ibs, our current view is that firms have generally made positive progress against our expectations for identifying these services. this is good to see and reflects well on the

david bailey : operational resilience - next steps on the prudential regulation authority ‘ s supervisory roadmap speech ( virtual ) by mr david bailey, executive director for international banks supervision of the bank of england, at the uk finance webinar “ operational resilience : beyond ", 28 april 2022. * * * introduction good morning everyone and i ’ d like to thank my colleagues at uk finance for inviting me to speak today, the first opportunity i have had to speak at a uk finance event since i took up my post as executive director for uk deposit takers supervision at the prudential regulation authority ( pra ) last september. given that, i ’ m going to focus on one of our highest supervisory priorities at the moment, operational resilience ( op res ). it is a particularly timely moment to be discussing the topic as it has been just over 12 months since our op res policy was published. since then firms have been on a journey towards the end of march deadline that recently passed to identify their important business services ( ibs ), set impact tolerances, and start mapping and testing to ensure they can remain within those impact tolerances. from our initial discussion paper in july 2018, through the follow up to our consultation paper in december 20191, and the close and collaborative work on implementation last year, i ’ d like to thank uk finance and its members for their open engagement on this policy. at the pra we have found this two way dialogue valuable in guiding the development of the op res policy, and in that spirit, my remarks today aim to keep you informed on the next steps on our op res roadmap. the need to focus on this topic has never been more pressing. since our original discussion paper : the covid pandemic ; the ongoing shift of services to the cloud ; and, more recently, the terrible events in ukraine have all brought fresh challenges to the overall operational resilience of the sector. this has included the need to shift to remote working at short notice, address the risk posed by dependencies on services and third party providers ( including those located in highly disrupted areas of the world ), and highlighted an increasing need to focus on cyber resilience. the good news is that the sector has, to date, shown itself to be resilient in the face of these challenges. however, while clear progress has been made, there is still distance to travel to a point where firms across the sector