Why foreseeable harm and intolerable harm need to be managed together, through an integrated ORM and NFR framework.
Two regulatory concepts, one continuum of harm
The FCA Consumer Duty seeks to avoid foreseeable harm to retail customers, while the operational resilience regime requires firms to identify important business services and set impact tolerances to avoid intolerable harm from disruption. The concepts address different questions and thresholds, but are not separate from the customer’s perspective.
Why staying within impact tolerance is not enough
A firm might restore a disrupted service before breaching its impact tolerance and still have caused foreseeable harm to consumers. Impact tolerance is not a general safe harbour from Consumer Duty responsibilities. This is the central point of the original Nexus of Harm illustration.
Link appetite, risk tolerance and impact tolerance
The original article depicts a continuum of harm connecting risk appetite, risk tolerance and impact tolerance. These concepts should be understood and applied coherently rather than conflated: the tolerable duration of disruption is not identical to the firm’s appetite for customer harm.
Four reasons for an integrated approach
First, break organisational silos between risk, operations and compliance. Second, reduce duplication by using common data, assessment processes and control evidence. Third, enrich severe-but-plausible scenario testing with both foreseeable and intolerable harm outcomes. Fourth, improve the quality and consistency of regulatory compliance and management decisions.
Embed the nexus in ORM and NFR practice
Bring the concepts together in RCSAs, risk appetite statements, incident analysis, impact assessments, customer vulnerability considerations, control assurance and scenario exercises. Use the same service-level evidence to ask both whether an impact tolerance is breached and whether foreseeable harm arises earlier.
Illustrative scenario: disruption without an impact-tolerance breach
A payments disruption is resolved within the impact tolerance for an important business service. Yet some vulnerable customers are unable to make time-sensitive payments and incur avoidable charges or distress. The scenario does not automatically imply an impact-tolerance breach; it still demands an assessment of foreseeable harm, customer outcomes, risk appetite and appropriate mitigation.
Practitioner question: Does scenario testing identify foreseeable harm arising before the intolerable-harm threshold, and who is responsible for addressing it?
Related Academy briefing: March 2027 operational incident and third-party reporting →