• ✓ Achieve and evidence compliance across DORA, UK OpRes, CPS 230, OSFI E-21, and US SR 20-24
• ✓ Strengthen annual attestation and board-level assurance with independent review
• ✓ Integrate AI governance, third-party risk, and cyber resilience into a unified OpRes framework
• ✓ Reduce operational disruption risk by up to 75% through scenario testing and remediation

AI as a Critical Operational Dependency

Regulators are increasingly treating AI and machine learning models as critical operational assets. The EU AI Act (Regulation (EU) 2024/1689), DORA's ICT risk management requirements, the PRA's model risk management expectations (SS1/23), and the Federal Reserve's SR 11-7 all converge on a single expectation: if your AI fails, you must know who is harmed, how quickly you can recover, and whether the failure was within your defined impact tolerance.

For firms deploying AI in credit decisioning, fraud detection, sanctions screening, claims processing, or customer-facing chatbots, this means AI must be mapped as part of your Important Business Services, subject to scenario testing (including AI-specific failure modes such as model drift, data poisoning, and hallucination), and covered by your annual self-assessment and attestation.

Third-Party & Concentration Risk

The convergence of the UK's Critical Third Parties (CTP) regime, DORA's Critical ICT Third-Party Provider (CTPP) framework, APRA's CPS 230 material service provider requirements, OSFI's Guideline B-10, and the US interagency third-party risk guidance signals a global regulatory consensus: firms must have visibility, control, and exit strategies over the third-party providers that underpin their critical operations.

Cloud concentration risk is a particular area of supervisory focus, with regulators examining systemic dependencies on a small number of hyperscale cloud providers. Firms are expected to map fourth-party dependencies, test substitutability, and evidence contractual exit rights and data portability arrangements.

Cyber Resilience & Threat-Led Testing

DORA's Threat-Led Penetration Testing (TLPT) requirements, the UK's CBEST framework, and emerging cyber resilience expectations from APRA and OSFI are aligning towards a common standard: firms must conduct regular, intelligence-led adversarial testing of their critical functions. This includes testing AI-powered systems for adversarial attack vectors, model manipulation, and data exfiltration pathways.

The intersection of AI and cyber risk is a particularly dynamic area, with AI being both a target of attack and a tool used by threat actors. Regulators expect firms to integrate cyber resilience testing with their operational resilience scenario testing programmes.

Climate, Geopolitical & Pandemic Risk

Operational resilience frameworks are expanding to cover climate-related disruption scenarios, geopolitical instability affecting supply chains and data sovereignty, and pandemic preparedness. The BCBS, PRA, and ECB have all indicated that severe but plausible scenarios should include physical climate events, critical infrastructure failures, and cross-border disruption pathways.

For firms with global operations, this introduces complexity around data localisation requirements, cross-jurisdictional recovery arrangements, and the interplay between operational resilience obligations and sanctions or trade restrictions.

Data Governance, Privacy & Operational Integrity

The intersection of data protection regulation (GDPR, UK Data Protection Act, CCPA, and emerging AI-specific data requirements under the EU AI Act) with operational resilience is becoming a supervisory priority. Firms must ensure that data integrity, availability, and confidentiality are maintained throughout disruption events, and that recovery processes do not compromise data protection obligations. DORA's incident reporting requirements and the UK's CTP regime both include explicit data integrity expectations.

Agentic AI & Autonomous Decision-Making

As firms move towards agentic AI systems that can take autonomous actions (executing trades, approving claims, managing customer interactions without human intervention), the operational resilience implications multiply. Regulators are beginning to ask how firms would recover from an autonomous system that operates outside its intended parameters at scale. This emerging theme requires firms to define AI-specific impact tolerances, implement kill-switch and rollback mechanisms, and ensure human oversight protocols are tested under realistic disruption conditions.

01

Assess & Benchmark

Gap analysis of your current operational resilience posture against applicable regulatory frameworks (DORA, UK OpRes, CPS 230, E-21, SR 20-24) and international standards (BCBS 508, ISO 22301). Maturity scoring and peer benchmarking.

02

Design & Build

Design and implement your integrated operational resilience framework, including IBS identification, impact tolerance calibration, end-to-end mapping (processes, people, technology, third parties, data), and governance structures with clear roles and accountabilities.

03

Test & Validate

Design and facilitate severe but plausible scenario testing, including cyber disruption, third-party failure, AI-specific failure modes, climate events, and pandemic scenarios. Validate recovery capabilities against impact tolerances. Support TLPT and CBEST requirements.

04

Report & Attest

Produce board-ready self-assessment reports, regulator-aligned documentation, and independent assurance opinions. Support annual attestation cycles for PRA/FCA, DORA, CPS 230, and cross-jurisdictional requirements.

05

Monitor & Evolve

Embed continuous monitoring, horizon scanning for regulatory change, and iterative improvement into your resilience lifecycle. Integrate AI-enabled monitoring tools, early warning systems, and predictive analytics to move from reactive to proactive resilience.

Step 1

Review Important Business Services

Update your IBS register annually to reflect changes in operations, outsourcing, technology, and AI deployments. Ensure new critical services (including AI-driven services) are captured and mapped.

Step 2

Validate Impact Tolerances

Re-confirm whether your impact tolerances remain realistic and calibrated, based on the past year's disruptions, near-misses, testing outcomes, and changes in your risk profile or operating model.

Step 3

Conduct Scenario Testing

Execute annual resilience tests across severe but plausible scenarios, including cyber disruption, third-party failure, AI model failure, climate events, and operational errors. Evidence your ability to remain within tolerances.

Step 4

Board Approval of Self-Assessment

Prepare a board-ready resilience self-assessment report that consolidates evidence, testing outcomes, remediation progress, and residual risks. The board must sign off and be prepared to stand behind this assessment with regulators.

Step 5

Independent Assurance

Boards are expected to underpin their annual attestation with independent review — whether through internal audit or external assurance providers such as T3. We provide independent validation of your framework design, testing adequacy, evidence quality, and overall resilience maturity.

Multi-Jurisdictional Expertise

We operate across UK, EU, US, Canada, Australia, and APAC regulatory frameworks, providing a single consistent methodology that covers your global obligations.

AI & Technology Risk Integration

We are one of the few operational resilience consultancies that integrates AI risk governance (EU AI Act, ISO 42001, NIST AI RMF) directly into the operational resilience framework.

Independent Assurance

Board-ready, regulator-aligned assurance reports designed for FCA/PRA, DORA, CPS 230, and global supervisors. We provide the independent challenge your board needs.

Practical Delivery

We do not produce shelf-ware. Our deliverables are designed to be operationalised, tested, and defended with regulators. We embed resilience into your annual planning cycle.

C-Suite & Board

Risk & Compliance Teams

Financial Services

Insurance

Technology & Cloud Providers

Asset & Wealth Managers

Market Infrastructures

Healthcare & Critical Services

Annual OpRes Attestation for a Tier 1 Bank

CHALLENGE:

A major international bank required independent assurance over its first post-transition annual self-assessment under the PRA/FCA operational resilience framework, with cross-border alignment to DORA requirements for its EU-regulated entities.

APPROACH:

T3 conducted an end-to-end review of the bank's IBS register, impact tolerance calibration, mapping completeness (including AI-dependent services), scenario testing programme, and board governance. We produced a gap analysis with regulatory-aligned findings and a remediation roadmap with clear owners and timelines.

RESULTS:

Board signed off the annual attestation with confidence. Three material gaps were identified and remediated prior to regulatory engagement. AI-dependent services were formally integrated into the resilience framework for the first time.

DORA Compliance Programme for an EU Asset Manager

CHALLENGE:

A mid-size EU asset management firm needed to achieve full DORA compliance by the January 2025 application date, including establishing an ICT risk management framework, incident reporting procedures, third-party register of information, and digital operational resilience testing programme.

APPROACH:

T3 delivered a 16-week DORA implementation programme covering all five pillars: ICT risk management, incident management, resilience testing, third-party oversight, and information sharing. We aligned the firm's existing ISO 27001 and BCP frameworks with DORA's specific requirements, reducing duplication and implementation cost.

RESULTS:

Full DORA compliance achieved ahead of the application date. Third-party register of information submitted to the national competent authority. Board reporting framework established for annual ICT risk management review cycle.

OpRes Framework Design & Implementation

End-to-end framework build or integration into existing risk management programmes. IBS identification, impact tolerance setting, mapping, and governance design.

Annual OpRes Attestation Support

Board-ready self-assessment reports, evidence packs, and attestation documentation for PRA/FCA, DORA, CPS 230, and cross-jurisdictional requirements.

Independent Assurance & Audit

Independent review and validation of your operational resilience framework, testing programme, and evidence quality. Designed to underpin board attestation and satisfy supervisory expectations.

Scenario Testing & TLPT

Custom scenario design, test execution playbooks, facilitated exercises, and gap analysis reports. Covering cyber, third-party, AI failure, climate, and pandemic scenarios. TLPT and CBEST support.

Third-Party Resilience Assessment

Criticality heatmaps, governance benchmarking, concentration risk analysis, vendor resilience scorecards, and exit strategy validation. Aligned to DORA CTPP, UK CTP, CPS 230, and B-10 requirements.

AI & OpRes Integration

Embed AI governance into your operational resilience framework. AI-specific impact tolerances, failure mode testing, model risk integration, and alignment with EU AI Act, NIST AI RMF, and ISO 42001.

DORA Compliance Programme

Full DORA implementation across all five pillars: ICT risk management, incident reporting, digital operational resilience testing, third-party oversight, and information sharing arrangements.

OpRes Maturity Assessment

Gap analysis and maturity scoring against applicable frameworks and peer benchmarks. Remediation roadmap with prioritised actions, owners, and timelines.

Business Continuity & Crisis Management

BCP review, crisis management framework design, tabletop exercises, and integration with your operational resilience programme. ISO 22301 alignment and certification support.

What is operational resilience?

Operational resilience is the ability of firms and the financial system to prevent, adapt to, respond to, recover from, and learn from operational disruptions. It goes beyond traditional business continuity by focusing on the continuity of critical services to customers and markets, rather than the recovery of individual systems or processes. Regulators across the UK (PRA/FCA), EU (DORA), Australia (APRA CPS 230), Canada (OSFI E-21), and the US (SR 20-24) have all established specific operational resilience requirements.

What is an annual OpRes attestation?

An annual OpRes attestation is your formal yearly confirmation — typically requiring board or senior management sign-off — that your operational resilience framework is in place, tested, and supported by evidence. It consolidates your Important Business Services register, impact tolerances, mapping, scenario testing results, and remediation actions into a defensible statement for internal governance and regulatory engagement.

Do we need an independent OpRes assurance review?

Most regulated firms benefit from independent assurance because it provides independent challenge and strengthens the credibility of your annual attestation with regulators. If your firm has material changes (new services, suppliers, technology, or AI deployments), inconsistent evidence across teams, or is preparing for supervisory engagement, an independent review reduces risk by identifying gaps before they become regulatory findings.

How does AI affect operational resilience?

AI systems are increasingly embedded in critical business services, from credit decisioning and fraud detection to customer interactions and sanctions screening. Regulators now expect firms to treat AI as a critical operational dependency, subject to the same mapping, testing, and governance requirements as any other critical process or technology. AI-specific failure modes — including model drift, data poisoning, hallucination, and adversarial attacks — should be incorporated into your scenario testing programme and annual self-assessment.

What is DORA and who does it apply to?

The Digital Operational Resilience Act (DORA) is an EU regulation (Regulation (EU) 2022/2554) that establishes a comprehensive ICT risk management framework for financial entities. It applies to banks, insurers, investment firms, payment institutions, crypto-asset service providers, and critical ICT third-party providers operating within the EU. DORA has been fully applicable since 17 January 2025 and requires annual ICT risk management reviews, incident reporting, digital operational resilience testing, and third-party oversight.

What frameworks does T3 align to?

T3's operational resilience methodology aligns to all major regulatory frameworks and international standards, including PRA SS1/21 and FCA PS21/3 (UK), DORA and ESA technical standards (EU), APRA CPS 230 (Australia), OSFI E-21, B-10, and B-13 (Canada), SR 20-24 and interagency guidance (US), BCBS 508 and 509 (Basel Committee), FSB and IOSCO guidance, ISO 22301 (Business Continuity), ISO 27001 (Information Security), and ISO 42001 (AI Management Systems).

How can T3 help with operational resilience?

T3 provides end-to-end operational resilience consulting and assurance, from initial gap analysis and framework design through to annual attestation support and independent assurance. We specialise in multi-jurisdictional alignment (covering UK, EU, US, Canada, and Australia requirements in a single consistent methodology), AI and technology risk integration, scenario testing and TLPT, third-party resilience, and board-ready reporting. Whether you need a full framework build, annual assurance, or targeted support on emerging themes like AI operational risk, T3 has the expertise to deliver.