When engaging with expert consultants, I value solutions tailored to our requirements, not generic lists. The collaboration with Green Dolphin has been refreshing, their expertise, passion and reliability have enhanced delivery. Addressing challenges pragmatically to find logical ways to mitigate

Overview

We've helped dozens of firms to build and strengthen their operational resilience capability in line with regulatory requirements. 

As digital interdependencies grow spanning cloud, AI, and third-party ecosystems, our clients are shifting from response and recovery to continuous, connected resilience.  The question is no longer “Can we recover?” it’s, “How quickly can we adapt without losing customer trust or operational continuity?”  

Operational resilience scenario testing simulates severe but plausible disruptions (like cyber attacks, major outages, or third-party failures) to test your ability to remain within defined impact tolerances for your important business services, focusing on response and recovery rather than prevention.  Testing identifies vulnerabilities, validates continuity plans, and drives improvements to ensure services continue with minimal harm to customers or markets. 

When should testing take place?

• There is a material change to your business operations, the important business services identified or impact tolerances;
• Following improvements made in response to a previous test; and
• In any event, on a regular basis.

Do you have third and fourth parties involved?  

The regulator is clear that you should approach testing with third parties in the same way as you approach the mapping exercise, working as effectively as possible with third parties to facilitate testing.  This could mean that either you or the third party carries out testing.  You'll need to satisfy yourself, if the third party is going to carry out any testing, of the methodologies, scenarios and considerations of the third party in doing so.  You are ultimately responsible for the quality and accuracy of any testing carried out, be that by themselves or by an external party. 

Regulators also expect firms to demonstrate board-level engagement and scenario testing for severe but plausible cyber events. The FCA has indicated that failure to meet these expectations could lead to enforcement action or supervisory intervention from 2026. 

Approach

We view operational resilience and scenario testing as a maturity journey.  We support you to take a pragmatic approach to testing, focusing on insights from the exercise and not dedicating disproportionate resource to quantify and test every permutation. 

We help you to:

• Prioritise important business services for testing, considering the relative risk they pose to financial stability, customers, safety and soundness. 
• Create a testing plan that includes realistic assumptions and evolves as you learn from previous testing.  The severity of scenarios used for testing could be varied by increasing the number or type of resources unavailable for delivering the important business service, or extending the period for which a particular resource is unavailable.
• Leverage any previous incidents or near misses and existing scenario libraries from other activities such as operational risk, ICAAP, stress testing or business continuity. 

A range of testing approaches can be used, including a combination of:

• Drills - Testing scenarios at an individual asset level to understand roles and responsibilities;
• Desktop exercises and workshops - Walkthroughs of the recovery plans and playbooks, including third and fourth parties (less resource intensive);
• Simulated tests - Involving internal business stakeholders and third parties to test a response and recovery to a severe but plausible scenario;
• Full live testing - Creating a real time disruption within the production (or parallel) environment to test your ability to remain within impact tolerance;
• Historical incidents - Analysing real-life incidents and near misses to assess effectiveness; and
• Existing third party assurance - Relying on previous assurances such as disaster recovery and business continuity already carried out by third parties.

Why choose Green Dolphin

• You're in safe hands: Our senior team have done this before and can combine roles of independent facilitator and trainer to build your capability as we go.  We fully tailor the approach and involve multiple team members to ensure diversity of skills and experience.
• Phycological safety: Scenario testing only works when people feel safe to surface weaknesses.  We create an environment where teams can be honest, challenged, and supported - without fear of blame.
• Improving your capability: We'll leave you stronger with a clear view of vulnerabilities and improvements, better playbooks, clearer roles, and more confident teams that can undertake their own testing in the future.
• Proportionate and commercial: An understanding that budgets are not infinite and therefore our support needs to be proportionate to the risks faced, regulatory expectations and commercial realities.