How do you set a disruption tolerance that is not just a description of what you already do?

A disruption tolerance states how long an organisation can be without a critical function before the harm becomes unacceptable. It is a board judgement about survival, and in principle it should be reached without reference to what recovery currently achieves.

In practice it usually is not, and there is now Swiss evidence of the scale of the problem.

The evidence

FINMA surveyed 267 institutions on operational resilience. The average number of identified critical functions was 3.5 and the highest count was 36. Disruption tolerances ranged from one hour to over a year, with a median of 48 hours and the middle half of responses falling between 24 and 72 hours (FINMA, 2025).

The spread is the finding. These are comparable institutions performing comparable critical functions, and a range covering four orders of magnitude is not measuring how long each business can survive without a function. Something else is being measured.

The clustering points to what. A median of exactly 48 hours, with the bulk of responses between 24 and 72, is what you would expect if tolerances were tracking conventional recovery time objectives rather than business harm. Someone asked the technology owner how long recovery takes, was told 48 hours, and wrote 48 hours into the tolerance. The number is accurate and entirely circular.

Why the circularity matters

A tolerance set to current capability produces no gap, and the gap is the entire purpose of the exercise.

When a tolerance is derived independently from business harm, it will usually differ from what the organisation can currently deliver. That difference is uncomfortable, and it is also the only thing that converts a resilience programme into a funded investment case. It gives a board a specific, quantified shortfall to decide about, rather than an assurance that everything is within appetite.

A tolerance that produces no gap is comfortable, passes review, and changes nothing. The Basel operational resilience principles expect institutions to test under a range of severe but plausible scenarios (Basel Committee on Banking Supervision, 2021), and the purpose of doing so is to discover where capability falls short. A tolerance calibrated to capability guarantees that it never will.

The strongest objection

Setting a tolerance without reference to capability produces a number the organisation has no prospect of meeting, which is demotivating and arguably dishonest. A one-hour tolerance on a function that currently takes three days to restore is not a target. It is an admission of failure, repeated monthly in a dashboard, and it invites the business to disengage from the whole exercise.

There is a fairer version of the same concern. Business harm is genuinely difficult to quantify for many functions, particularly where the damage is reputational or regulatory rather than financial. Where the honest answer is that nobody knows, anchoring to something observable is at least defensible.

The answer to it

The demotivation objection confuses the tolerance with the plan. A tolerance is a statement about harm, not a commitment to performance. The response to a large gap is not to hide it by moving the tolerance; it is to record the gap, decide whether to close it, and document the decision if the answer is no. Accepted risk, recorded and approved, is a legitimate outcome. A tolerance quietly adjusted to match capability is not.

The quantification objection is real and is answered by ranges and by scenario rather than by anchoring. Where harm cannot be estimated precisely, it can usually be bounded by asking what happens at one day, one week and one month, which produces a defensible band without pretending to a precision nobody has.

The test to apply

Take any tolerance you own and ask when it was last breached in a test.

If the answer is never, it was almost certainly written to describe the current state rather than to challenge it. This applies well beyond continuity. A recovery time, a service level, a response window or a budget that has never been missed was set by observing what already happens and writing that down.

The second question is sharper. When the tolerance was last revised, did it move closer to the business need or closer to what recovery achieved that year? The direction of travel tells you which exercise the institution thinks it is performing.

References

Basel Committee on Banking Supervision (2021) Principles for operational resilience. Basel: Bank for International Settlements.

FINMA (2025) Guidance 05/2025: operational resilience. Bern: Swiss Financial Market Supervisory Authority.