FCA Operational Resilience: A Workforce Skills Checklist for Your Recovery Plans
Your systems and suppliers are probably well documented. But could you say who would step in if the one engineer who knows your payments service was off sick?
The FCA’s operational resilience rules (SYSC 15A) have applied in full since 31st March 2025. Firms in scope now need to show they can keep their important business services within impact tolerances during severe but plausible disruption.
Most firms have put a lot of work into mapping their technology and third parties, which makes sense. However, the FCA’s March 2026 review made it clear that resource mapping has to cover people, processes, facilities, and information all together.
This is often where plans start to wobble. For example, imagine the payments service going down at 2 am while the engineer who built it is on leave, and ask yourself: who would pick up the phone? If the honest answer is still one person, there’s a gap in your recovery plan. The good news is, it’s one that the right training and a bit of planning can close.
At Learning People, we work with firms across the UK on cybersecurity and resilience training, so we’ve pulled together a workforce checklist to help you find those gaps, decide where training will make the biggest difference and gather the evidence to back it up.
This guide looks at the people side of FCA operational resilience. It includes a practical checklist for spotting gaps in staff cover, targeting training and keeping evidence that your team is ready.
Written by
With a continued passion for learning and development, Patrick was motivated to found the Learning People in 2010. He loves being able to empower people with real-world skills and expertise that employers in the tech and project management sectors are actively looking for.
What the FCA’s 2026 Review Said About People
On the people side, the FCA’s March 2026 operational resilience review highlighted gaps in resource mapping, board understanding, and communications testing. It also pushed back on recovery claims that hadn’t been tested against severe enough scenarios. It did, however, give credit to firms that were cutting down how many key staff were based in a single location.
For managers, it really comes down to three questions when it comes to people in FCA operational resilience strategy:
- Do people understand what they’re responsible for?
- Who can step in when they’re not around?
- Have those arrangements actually been tested?
There’s also a reporting change on the way. Under PS26/2, new operational incident reporting requirements across the FCA, PRA, and Bank of England take effect on 18th March 2027. This means your team will need to know the reporting thresholds and who is responsible for submitting each report.
Your workforce checklist for FCA operational resilience
A workforce checklist for FCA operational resilience helps you review staff cover, responsibilities and skills across each important business service; we’ve put one together below. These are practical suggestions based on what we see working, rather than FCA rules on staffing numbers or certifications, so feel free to adapt them to fit your firm.
|
What to check |
Evidence to keep |
|
Each service has a recovery lead and capable cover |
Named responsibilities and cover arrangements on the resource map |
|
Location mapping and tested alternative arrangements |
|
|
Board members understand their resilience responsibilities |
Briefing or training records, with minutes showing questions and decisions |
|
Incident and communications teams have practised their roles |
Test reports recording who did what and where improvements are needed |
|
Security teams have the skills needed for the cyber scenarios being tested |
Skills assessments, relevant qualifications and exercise results |
|
Staff can recognise and report suspicious invoices or login pages |
Role-relevant awareness training and knowledge checks |
|
Lessons from incidents lead to relevant changes and training |
Assigned actions and follow-up records |
We’d suggest starting with the roles where one absence would leave the biggest gap. Naming a deputy is a good first step, but they’ll also need the knowledge, the system access, and a chance to practise taking over before it really matters.
It’s also worth remembering that training records and exercises do different jobs:
- Training records show what people have learned
- Exercises show whether they can apply it to your own recovery procedures
Therefore, it pays to keep evidence of both for security purposes.
What training do you need to close the gap?
The training that will help close each operational resilience gap depends on what that gap is. This could mean cyber certifications for security teams, project management for remediation leads, or role-based awareness training for everyone else.
When we work with businesses to help improve their FCA resilience, we start with the gaps they’ve found through mapping, exercises, and incident reviews, as opposed to going to them with a typical list of training courses.
For cyber teams, it comes down to what each person actually does day to day.
- Someone who analyses threats might suit CompTIA CySA+
- Someone who defends the network might suit EC-Council’s Certified Network Defender (CND)
- Someone who investigates incidents could look at Computer Hacking Forensic Investigator (CHFI).
If one of your team is coordinating a remediation programme across several teams with competing deadlines, PMI’s Project Management Professional (PMP) can give them a clear structure to work from. You can find out more about our project delivery training here.
Security awareness training works best when it reflects people’s everyday jobs. Your finance team might need practice spotting fraudulent invoices or requests to change bank details, while other staff may need help recognising fake login pages and knowing where to report them.
Advice: Put names against every service
Putting a name against each important business service makes it clear who leads recovery and who can provide cover.
Start with the services that lean most heavily on one person, and ask whether a colleague could take over and what training or experience they’d need to do it with confidence.
Build a recovery plan that doesn’t depend on one person
A recovery plan that doesn’t depend on one person starts with knowing exactly who can cover each important business service, and that’s where Learning People can help. We’ll benchmark your team’s skills against the services they support, so you can see where cover is thin before an incident or an FCA review shows it up.
From there, we’ll build a training plan around the gaps you find, whether that means cyber certifications for your security team, project delivery skills for whoever is leading remediation, or awareness training for the wider business.
If you’d like clarity on where your recovery plans rely on individual expertise, book a free consultation with us and we’ll take you through it.
FAQs About FCA Operational Resilience
Find out more about comprehensive workplace training
Read more about workforce upskilling
Certification PathwaysFCA Operational Resilience: A Workforce Skills Checklist for Your Recovery Plans
Your systems and suppliers are probably well documented. But could you say who would step in if the one engineer who knows your payments service was off sick?
Read More
Certification PathwaysITIL 5 for Service-Delivery Teams: Maturing ITSM to De-Risk Your SLAs
What does the new ITIL Version 5 certification mean for a busy service desk? This guide covers the most important changes from Version 4, how they connect to everyday service delivery, and where they could help teams improve SLA performance.
Read More
Certification PathwaysHow Teams Pass Certifications First Time: A Study Plan That Fits Billable Weeks
A second attempt costs far more than a second exam fee. This guide shows how teams that pass first time book the date before study starts, protect study hours in the same system as client work, and use a practice assessment as the go or no-go gate.
Read More
Certification PathwaysAWS vs Azure Certification: Which Fits Your Stack?
AWS certifications last three years, whereas Microsoft's expire every 12 months. For a managed service practice, that renewal calendar matters more than the exam fee. This guide compares the two programmes, matches certifications to the estates you bill against, and shows how to keep your partner status from slipping.
Read More