SYSC 15A, evidenced
The self-assessment: what good looks like
The self-assessment is the document the FCA reads to judge your entire operational resilience programme. This guide covers what the rules require it to contain, what a convincing version of each section looks like, and the currency problem the FCA's 2026 review exposed. The template is free, and if you already have a draft, there is a fixed-fee review that tells you how it reads before a supervisor does.
The document
What the self-assessment is, and who it is really for
Under SYSC 15A.6 of the FCA Handbook, a firm in scope of the operational resilience rules must keep a written self-assessment: how it identified its important business services, the impact tolerances it set and why, the mapping and scenario testing carried out, the vulnerabilities found and what is being done about them. The governing body must approve it, the firm must keep it current, and it must be produced when the FCA asks.
It is not a return. There is no portal and no annual submission. The document sits with the firm until supervision, an authorisation process or an incident brings it out, which is exactly why quality varies so widely: nothing forces the discipline until the moment it is tested.
Transition under the regime closed on 31 March 2025, so the self-assessment should now describe a firm operating within its impact tolerances, with testing evidence behind that claim, rather than a programme still being stood up. For the regime itself, from scope to supervisory expectations, start with the FCA operational resilience guide.
Section by section
What good looks like in each section
Six sections carry the weight of the document. For each, the difference between a version that reassures a supervisor and a version that invites questions.
Important business services inventory
Convincing: The services you identified, with the reasoning behind every inclusion and, just as tellingly, every exclusion. A strong inventory shows the selection was argued over: candidate services considered through the harm lens, named owners against each, and a short note on why borderline cases fell the way they did.
Questionable: A bare list. An inventory with no rationale reads as a form that was filled in, and it invites the supervisor to re-run the exercise for you.
Impact tolerance statements
Convincing: Each service carries a tolerance with a metric and a justification anchored in the point at which harm becomes intolerable. The analysis of who is harmed, how quickly and why the line sits where it does should be visible in the document, not held in someone's head.
Questionable: A time figure with nothing behind it. A number without a harm argument looks like current capability restated, which is precisely what supervisors have been criticising.
Mapping
Convincing: The people, processes, technology, facilities, third parties and data each service depends on, at a depth proportionate to that service's importance. Good mapping surfaces single points of failure and third-party concentration, and it is what makes the vulnerabilities section credible.
Questionable: An architecture diagram relabelled. Mapping that stops at systems, without the people and suppliers, cannot support severe scenario design.
Scenario testing evidence
Convincing: Which severe but plausible scenarios were run, how, what happened, and whether each service stayed within tolerance. A documented breach with a remediation plan attached is worth more than an untested assertion that all is well.
Questionable: A sentence saying testing was performed. If the evidence cannot be produced alongside the claim, the claim does not stand.
Vulnerabilities and remediation
Convincing: A register of the weaknesses that mapping and testing exposed, each with an owner, a plan and visible movement since the previous version of the document. This is the section a supervisor uses to judge whether the programme is alive.
Questionable: A static list carried over unchanged. Vulnerabilities that never close, and never gain new company, suggest nobody is looking.
Board engagement
Convincing: Approval is the minimum. Convincing self-assessments evidence challenge: minutes showing the governing body questioned a tolerance, sent a section back for more work, or funded remediation because of what the document told them.
Questionable: A signature page. Approval without any trace of scrutiny tells the reader the board saw a slide, not the document.
Two of those sections have full guides of their own on this site: setting impact tolerances that survive supervision and scenario testing that is severe, plausible and evidenced.
The 2026 finding
Documents frozen in March 2025
A year after transition closed, in March 2026, the FCA set out what it had observed across the regime. Among the recurring findings: many firms had not updated their self-assessment since March 2025. The document was written to get over the line, approved once, and then left.
A stale self-assessment concedes the argument before the conversation starts, because the rules expect it to move as services, tolerances, third parties and test results move. Date it, version it, and tie its review cycle to your testing programme rather than to an anniversary nobody owns.
The version history is evidence in its own right. A document that changed because a scenario test found something tells a better story than one that has never needed to change.
The self-assessment template, free
The full document structure, section by section, with drafting prompts and an evidence checklist for each part. Built around SYSC 15A for UK firms, and yours without filling anything in.
A second pair of eyes
The self-assessment, reviewed inside the Gap Analysis
If the document exists but nobody outside the firm has ever read it critically, that is the gap we close. Our consultants take your current self-assessment and supporting evidence and read them the way a supervisor would: a desk review against SYSC 15A and current supervisory expectations, a gap letter setting out exactly where the document falls short and what to change, and a board summary your directors can act on at their next meeting.
The review runs inside the Resilience Gap Analysis, £8,990 to £16,780 fixed by scope, and is listed on the pricing page with everything else we sell. The number is public before we know your firm's name.
Reviews often land follow-on work on two fronts, tolerances that need a harm argument behind them and testing that needs more severity. Both exist as their own fixed-fee engagements, so the gap letter maps to specific next steps rather than a vague programme.
Quick answers
Self-assessment questions, answered
What must the operational resilience self-assessment include?
Six things carry it: the important business services you identified and the rationale for the list, the impact tolerance set for each with its justification, the mapping of resources each service depends on, your scenario testing approach and results, the vulnerabilities found with remediation plans and owners, and evidence that the governing body approved the document. SYSC 15A.6 is the FCA rule behind it.
How often should the self-assessment be updated?
The rules require it to be kept up to date rather than refreshed on a fixed interval. In practice that means updating on material change, a new important business service, a revised tolerance, significant test results, a serious incident or a major third-party change, with a full review at least annually. The FCA's March 2026 observations singled out firms whose documents had not moved since March 2025, so the version history is itself evidence.
Who approves the self-assessment?
The governing body, which for most firms means the board. Approval should be minuted, and genuine scrutiny reads far better than a rubber stamp: a board that questioned a tolerance or asked for further testing leaves exactly the trail a supervisor hopes to find. Delegating sign-off to a working group defeats the purpose of the requirement.
Before the FCA asks
Know how your self-assessment reads
Build it properly with the free template, or send us your current version for a fixed-fee desk review that returns a gap letter and a board summary at a published price.