How can firms go about identifying important business services?
Applying the definitions
To date the approach to identifying important business services has generally been led by common sense and business knowledge rather than a pre-defined methodology. This includes
- Leveraging pre-existing process/service catalogues.
- Workshops with business owners where business services are identified from experience and business understanding
The regulators’ definitions of important business services refer to an intolerable level of harm* for consumers, risks to the Firm’s safety and soundness and to UK financial stability. In this context, consumers are regarded as those end-users that are the direct consumers of the firm’s services or in other ways dependent upon them. This includes both retail and wholesale market participants.
The threshold to be met is set quite high. Firms should start by identifying all their business services and then shortlist the ones with a severe impact based on these definitions.
Business services are those which deliver a specific outcome or service to an identifiable user who is external to the firm, and are therefore external-facing. Internally focused services, such as those provided by Human Resources and Finance, would typically not be listed as important business services despite playing a key role in supporting a firm’s activities.
In the above example, this External-Facing Service delivers a specific Outcome to an End User.
Firms may be able to leverage a range of existing internal documentation and frameworks when identifying business services including business impact analyses, process maps, product or service taxonomies and other enterprise risk management framework deliverables.
Key considerations to be taken into account
The number of important business services firms should identify will differ. No two firms are expected to have exactly the same list of important business services. However, they will need to document their rationale and be prepared to justify it.
Firms should identify all important business services using the appropriate criteria. Firms may have multiple important business services. A list of six to ten important business services is not uncommon, depending on the firm’s business model.
Based on the FCA and PRA guidance, a firm should consider a range of factors when identifying its important business services including the following:
Firms may rate each business service against each of these factors in order to determine which of their business services would be deemed important.
The PRA’s requirements in PS6/21 excludes small and medium firms from having to assess their potential impact on financial stability when identifying their important business services. This requirement only applies to larger and systemic firms identified as other systemically important institutions and insurers with gross written premiums exceeding £15 billion or technical provisions exceeding £75 billion.
Examples of Important Business Services
The following table provides an indicative and non-exhaustive list of examples of potential important business services for different types of firm.
*Intolerable harm has to be much more severe than harm or inconvenience. The FCA views intolerable harm as an outcome which end users cannot easily recover from, for instance where, post disruption, a firm is unable to put a client back into a correct financial position, or where there have been serious non-financial impacts that cannot be effectively remedied.