Card authorisation: impact tolerance versus recovery capability
Northbridge Payments is a 900-person card acquirer processing 2.1 million transactions a day across 14 services. Its board has approved an operational resilience policy that sets one impact tolerance of four hours for every service and labels all 14 as important business services. Card authorisation depends on a mainframe batch cycle that runs every 90 minutes. Customer harm-declined transactions, merchant complaints and regulatory scrutiny-starts at roughly 45 minutes of disruption. The last disaster recovery test restored card authorisation in 5 hours 40 minutes. The COO wants to tighten the recovery time objective to three hours and declare the gap closed. The CRO argues that the impact tolerance itself is wrong and that card authorisation should not be treated like the other 13 services. The board meets in six weeks. The regulator has asked for evidence that impact tolerances are derived from actual harm rather than from technical recovery capability.
1. What impact tolerance should Northbridge set for card authorisation, and how should the board treat the 5-hour 40-minute recovery test result? Explain the reasoning, not just the number.
Read the worked answer
Separate three different things. An impact tolerance is the maximum disruption the firm will tolerate before harm to customers and markets becomes unacceptable. A recovery time objective (RTO) is the internal target for restoring the service. A test result is evidence of current capability.
Derive tolerance from harm. Harm starts at about 45 minutes, so a four-hour tolerance is not credible. The board should commission a harm analysis by customer segment and transaction type to set a tolerance below the harm onset-for example, 30 minutes-with a defined margin for uncertainty. A single four-hour tolerance across all 14 services is also wrong: importance should be based on harm, not on a blanket label.
Treat 5h40 as a capability gap. It does not set the tolerance. It shows the firm cannot currently meet a 30-minute tolerance. The board must approve either a funded remediation plan with interim controls, or a documented risk acceptance if remediation is not feasible. The COO's three-hour RTO may still be far outside tolerance, so it would not close the gap.
Evidence for the regulator. Show the harm methodology, the tolerance decision, the dependency mapping, the gap analysis, and the board minutes recording the decision and residual risk. Do not present a tightened RTO as proof that the service is resilient.
2. The COO proposes to set the RTO at three hours because competitors use that benchmark. Evaluate the proposal and state what evidence you would require before board approval.
Read the worked answer
Benchmarks are context, not evidence. An RTO must be (a) derived from the impact tolerance, (b) achievable with tested capability, and (c) costed. Three hours may still be too slow if harm starts at 45 minutes; it may also be unnecessarily expensive if card authorisation can be rerouted or degraded gracefully.
Require: a service-level dependency map including the mainframe batch cycle, network, third parties and identity; a gap analysis from 5h40 to 3h with interim milestones; a costed options appraisal including batch redesign, active-active processing, manual fallback and merchant communication; a test plan that proves the 3h target under peak volume; and a residual risk statement.
Also require clarity on what 'recovery' means: accepting transactions again is not the same as clearing, settling and reconciling. The board should approve the RTO only if it sits inside the tolerance with a margin, or explicitly accept that it does not. Approving a competitor number without this evidence is governance theatre.
3. The regulator asks for evidence that impact tolerances are set from actual harm. What would a credible evidence pack contain, and what would weaken it?
Read the worked answer
Credible pack: (1) important business service selection criteria and the list, with rationale for why card authorisation is included and why some other services are not; (2) harm analysis by customer, merchant, market and legal/regulatory impact, including thresholds and data sources; (3) tolerance statement with the assumed scenario and duration; (4) dependency and process maps; (5) current recovery capability evidence from tests, including failures; (6) gap and remediation plan with owners, dates and funding; (7) board and committee minutes showing challenge and decision; (8) incident data validating the harm assumptions.
Weakening factors: tolerances copied from IT recovery objectives; a single tolerance for all services; no customer harm data; tests that only prove IT failover; no board challenge; action items open for years; treating a vendor service level as recovery capability; and a narrative that claims resilience without evidence of end-to-end testing. The pack should be short but traceable: each tolerance should link to a harm assumption and a test result.