Operational Resilience in Financial Services: Why Single-Event Planning Is No Longer Enough

Most operational resilience planning in financial services is still built around a single scenario: one incident, one response, one recovery. A cyber attack. A supplier failure. A systems outage.

The problem is that disruption rarely arrives that neatly.

In practice, organisations face overlapping incidents, cascading failures, and compounding pressures that stretch across services, teams and third parties simultaneously. The question regulators are increasingly asking is not whether you can recover from a single event, but whether your organisation is designed to operate through sustained, concurrent disruption.

If your resilience planning still revolves around isolated scenarios, it is likely leaving significant gaps.

What is single-event planning and why is it a problem?

Single-event planning is a resilience approach built around responding to one defined incident at a time. It typically involves scenario-specific playbooks, predefined escalation paths, and recovery objectives tied to individual disruptions.

This approach made sense when disruption was occasional and largely predictable. It is less effective in an environment where:

• Cyber attacks trigger regulatory investigations while simultaneously exposing third-party vulnerabilities
• A supplier outage affects multiple important business services at once, each with different impact tolerances
• Geopolitical instability, technology failures and workforce disruption land within the same quarter

Cyber attacks consistently rank as the most cited risk to the UK financial system in regulatory surveys. But cyber rarely arrives alone. It compounds with operational, reputational and regulatory pressures in ways that single-scenario planning does not account for.

What do UK regulators expect from operational resilience in financial services?

The PRA's Supervisory Statement SS1/21 and the FCA's PS21/3 set out clear expectations that financial services organisations must be able to remain within impact tolerances for their important business services during severe but plausible scenarios. The March 2025 compliance deadline has passed, and regulatory attention has shifted from whether organisations have documented their frameworks to whether those frameworks actually work under pressure.

The critical phrase in the regulation is "severe but plausible." Regulators are not asking whether you can handle a textbook incident. They are asking whether your organisation can continue delivering its most critical services when multiple things go wrong at once, for longer than expected, with fewer resources than planned.
For building societies, mid-tier banks and insurers, this creates a specific challenge. Leaner teams, tighter budgets and complex legacy systems mean that the capacity to absorb concurrent disruption is often thinner than it appears on paper.

Why does compound disruption expose more gaps than single events?

Compound disruption, where multiple incidents or pressures occur simultaneously or in rapid succession, exposes weaknesses that single-event testing simply cannot reach.

The most common gaps it reveals include:

• Decision-making under sustained pressure: Leadership teams that perform well in a two-hour tabletop exercise may struggle when decisions need to be made continuously over days or weeks, with incomplete information and competing priorities.
• Resource allocation across concurrent incidents: When two or three important business services are under pressure at the same time, organisations discover that their recovery plans assumed dedicated resources for each, not shared ones.
• Third-party dependency chains: A single supplier failure is manageable. The same supplier failing while another critical vendor is mid-migration, while your internal IT team is already stretched by an unrelated issue, is a fundamentally different challenge.
• Communication fatigue: Stakeholder communication plans designed for one incident become unsustainable when multiple messages need to go to regulators, boards, customers and staff simultaneously.

Industry research consistently shows that cyber disruption, IT and telecoms outages, and supply chain interruption rank among the most frequently experienced threats, with organisations increasingly reporting multiple concurrent incidents rather than isolated events. The frequency and overlap of these disruptions is increasing, yet most resilience frameworks have not evolved to match.

What does adaptive resilience look like in practice?

Moving from single-event planning to adaptive resilience means shifting the focus from individual scenario response to organisational capability. Rather than asking "can we recover from this specific incident?", adaptive organisations ask "can we continue operating through whatever combination of disruption lands?"

In practical terms, this involves:

• Stress-testing for compounding scenarios, not just isolated ones: Exercises should simulate overlapping incidents that test resource allocation, decision-making authority and communication across multiple fronts simultaneously.
• Building decision-making capability, not just crisis processes: The difference between a reactive and an adaptive organisation often comes down to whether leadership teams can make good decisions under sustained pressure without a playbook telling them exactly what to do.
• Extending resilience thinking beyond your own walls: Third-party dependencies are where disruption enters most unpredictably. Understanding your full dependency architecture, not just your supplier list, is essential.
• Connecting resilience to how the organisation actually operates: Resilience that sits in a framework document but is not embedded in day-to-day decision-making, governance and risk management will not hold under real pressure.

How can organisations assess whether their resilience planning is still anchored to single-event thinking? 

There are several practical questions that can quickly surface whether your resilience planning is still anchored to single-event thinking:

• When was the last time you ran an exercise that involved more than one concurrent disruption?
• Do your recovery plans assume dedicated resources, or do they account for those resources being stretched across multiple incidents?
• Can your leadership team articulate who decides what, and how, when three things go wrong at once?
• Does your third-party oversight extend to understanding what happens when your critical supplier's critical supplier fails?
• Has your board seen a realistic picture of how the organisation would perform under sustained, compounding pressure, or only under clean, single-scenario conditions?

If the answer to most of these is no, the gap between documented resilience and real-world capability is likely wider than it looks.

What is the Minimum Viable Company (MVC) and why does it matter for resilience?

The Minimum Viable Company, or MVC, is a concept that helps organisations define what must keep functioning, no matter what. It identifies the core services, capabilities and resources that the organisation cannot operate without, and stress-tests whether those can be maintained under extreme, sustained disruption.

MVC thinking is particularly valuable because it forces organisations to move beyond service-level recovery planning and think about organisational viability as a whole. It asks: if everything that could go wrong did go wrong at once, what is the absolute minimum this organisation needs to protect to survive and continue serving its customers or members?

This is not a theoretical exercise. For building societies, it connects directly to member obligations and regulatory expectations. For mid-tier banks and insurers, it provides a framework for prioritisation when resources are constrained and multiple services are under pressure simultaneously.

What should financial services organisations do next to move beyond single-event planning?

The shift from single-event planning to adaptive resilience is not a one-off project. It is a sustained change in how resilience is understood, governed and practised across the organisation.

A practical starting point is to:

• Audit your current exercises: If every exercise you run involves one scenario with a clean resolution, you are not testing your real capability. Introduce compounding scenarios that test sustained decision-making and resource allocation.
• Review your MVC: Define what must survive, and stress-test whether your current plans genuinely protect it under concurrent disruption, not just isolated incidents.
• Assess your third-party exposure realistically: Map the dependency chains that matter most and understand what happens when multiple links in those chains come under pressure at the same time.
• Build leadership capability, not just response processes: Invest in developing decision-making under sustained pressure as a core organisational competency, not something that is only practised during an annual tabletop.

Operational resilience is no longer about whether you can respond to a single event. It is about whether your organisation is designed to operate through whatever combination of disruption the environment delivers. The organisations that are genuinely ahead of the curve are the ones that stopped planning for incidents and started building for a world where disruption is constant.

Ready to move beyond single-event planning?

If your resilience framework hasn't been tested against compounding, concurrent disruption, the gaps may be wider than they look. We work with building societies, mid-tier banks and insurers to build the adaptive capability that holds when multiple things go wrong at once.

Get in touch to talk about where your organisation stands and what to do next.