Hours
Time
Express tolerances in minutes or hours for clarity.
Impacttoleranceexplained
Define acceptable disruption levels.
Learn how to set impact tolerances, measure potential harm to customers and operations, and comply with regulatory expectations for critical services.
What is impact tolerance?
Impact tolerance is the maximum level of disruption a critical service can withstand before causing intolerable harm to customers, markets, or the organisation.
Harm
Focus
Consider customer outcomes, safety, and regulatory impact.
Check
Cadence
Update tolerances alongside service reviews.
Why it matters
Why impact tolerances guide resilience decisions
Clarifies priorities. Teams know exactly when to escalate or invest in redundancy because the allowable disruption level is written down.
Supports compliance. UK rules require an impact tolerance for each important business service, and APRA's CPS 230 asks for tolerance levels for each critical operation.
Improves testing. Scenarios focus on the limits that matter most, giving leadership confidence that “severe but plausible” really means something.
Steps
How to set impact tolerances
- Identify harm Define what unacceptable harm looks like (financial, operational, customer).
- Set thresholds Agree on maximum disruption time, volume, or service degradation.
- Validate Review thresholds with stakeholders, risk appetite, and regulators if needed.
Cadence
How to monitor and review tolerances
- Track KRIs Use leading indicators to signal when tolerances may be approached and highlight risks early.
- Scenario test Validate that tolerances hold under severe events so leadership trusts the numbers.
- Report breaches Escalate immediately if tolerances are exceeded, recording impact and remediation.
- Refresh annually Update tolerances when services, customers, or regulations change so they stay relevant.
Impact tolerance quick wins
Build a template
Document service name, tolerance metric, rationale, and owner.
Link to appetite
Ensure tolerances align with risk appetite statements.
Publish summaries
Share tolerances with leadership and response teams.
Impact tolerance glossary snapshot
Impact tolerance glossary snapshot
Impact tolerance. Maximum disruption allowed before intolerable harm occurs.
Maximum tolerable period of disruption. The business continuity planning term for the point past which disruption becomes unacceptable. It is close to an impact tolerance but is judged from the organisation's side rather than the client's.
Customer harm. Negative outcomes for customers, markets, or the organisation if tolerances are breached.
FAQs
Impact tolerance FAQs
How do we pick the right metric?
Use minutes/hours for time, % transactions impacted, or qualitative descriptors tied to customer outcomes.
Who approves tolerances?
Service owners propose them; risk committees and boards approve them, especially in regulated industries.
How granular should tolerances be?
Set at least one for each important business service. Supporting and internal services do not get tolerances of their own; they are covered by mapping and testing the services that depend on them.
Do tolerances replace SLAs?
No. An SLA sets the level of service expected in normal operation. An impact tolerance sets the limit of disruption a service must not pass once something has gone wrong.
Drova RunReady keeps tolerances, service maps, and test results together for easy reporting.
Ready to document impact tolerances?
GRC 101 hub
Explore related topics
Operational resilience hub
Understand how tolerances fit into the broader programme.
Important business services
Define services before setting tolerances.
Scenario testing
Test tolerances under severe events.
Business continuity
Ensure plans can meet the tolerances set.
Financial services resilience
See regulatory expectations for tolerances.
DORA overview
Digital Operational Resilience Act requirements include tolerances.
