Why Setting Impact Tolerances Isn't a Science Experiment, It's a Balancing Act

As the 31 March 2025 deadline approached, many UK financial services firms were already working at pace. But their focus sharpened around setting impact tolerances. With the best intentions (and a fair bit of pressure), there was a rush to lock in the numbers. And for many, that meant tolerances that were just too short.

Why? Because they wanted to do it right. They over-engineered the process. Built detailed data models. Looked for scientific precision to justify every minute and every metric. But in doing so, they lost sight of the bigger picture: how sustainable those tolerances really are, in terms of cost, operational delivery, and what that means for their ability to honour customer commitments over time.

Now reality has kicked in. Staying within a very short tolerance isn't just hard; it's expensive. Firms are certainly talking about this, weighing up the trade-offs, testing alternatives, and trying to find pragmatic solutions. Around the Board table, one question stood out: Should we lock in alternate suppliers contractually for every critical third party? It is a reasonable consideration, and one that highlights the scale of commitment some firms feel might be needed to stay within tolerance. But it also forces a wider discussion about cost, complexity, and long-term viability.

And it is not just the financial cost. The opportunity cost is increasingly coming into focus, especially as firms reflect on the questions raised in their Boardrooms. Resources that could be driving digital transformation, enhancing customer journeys, or strengthening frontline capability may instead be tied up in maintaining overly ambitious tolerances. Time, talent, and budget are being absorbed by contingency plans, manual workarounds, and technical interventions that deliver limited long-term value. For some, this could start to slow progress on innovation roadmaps or shift leadership focus away from core priorities. Resilience matters, but it must remain proportionate, purposeful, and aligned to broader strategic goals.

As a result, some firms are now re-examining the assumptions behind their original tolerances. They often start by questioning whether the timeframes they set were too short. That is a natural place to begin. But as Boards and senior leaders work through this, the conversation becomes more fundamental. What does intolerable harm really mean in terms of customers? What about those in vulnerable circumstances, who may experience harm sooner, more deeply, or less visibly? And critically, what impact does all of this have on our business model? Resilience is supposed to enhance the model by enabling continuity, customer trust, and regulatory confidence. But it also carries the risk of constraining it, especially when tolerances, controls, or assumptions become misaligned with how the business actually operates. This is where firms are beginning to grapple not just with definitions but with design choices that shape both resilience and commercial agility.

This more thoughtful approach is a positive step. However, it also brings complexity and reinforces the need for tolerances that are not only justifiable but genuinely usable in practice.

We are now seeing tolerances that are much longer. Why? Because firms want to stay compliant. If you set the bar high enough, you are less likely to trip over it. But here is the thing. That is not resilience. That is a workaround.

The truth is, neither extreme works. Too short, and you cannot realistically deliver. Too long, and you lose credibility. With your customers, your Board, and your regulator.

This is the reality check moment.

Like any good pendulum, things will swing back to the middle. With experience (and a few bumps along the way), firms will refine and recalibrate. They will start to strike the right balance. Not just between ambition and capability, but between science and judgement. Because you need both. Data can inform your decisions. But judgement keeps it human, commercial, and grounded in the real world.

And just as firms begin to refine their approach to time-based tolerances, another layer is already demanding attention. What if not all customers are affected equally? Many firms are now actively exploring how to move beyond blanket timeframes to tolerances based on volume or percentage of customers impacted, which is a more realistic and outcome-focused view.

At the same time, the challenge of vulnerable customers is no longer theoretical. These customer groups already exist within the service landscape, often making up around 10 percent of the base. For them, harm may occur faster, be harder to detect, and have more lasting consequences. So how do firms factor that into a single, usable tolerance? And how do they balance flexibility with fairness, without over-complicating their response model or diluting accountability?

These are difficult questions, but they reflect a more mature kind of resilience thinking. Less about compliance. More about judgement, prioritisation, and doing right by the people who rely on your services the most.

We are here for that journey. Are you?

Get in touch with our friendly and knowledgeable team today to explore how we can help.

Bryan Hurcombe - Director at DCR Partners.