Explanation

Correct Answer: B - Identify important business services and map the dependencies between these services.

Why this is correct:

• UK regulatory requirements for operational resilience emphasize a business service-oriented approach rather than focusing on individual internal processes
• The key regulatory expectation is to identify "important business services" that, if disrupted, could cause harm to consumers or threaten market integrity
• Mapping dependencies between these services helps understand the interconnectedness and potential cascading effects of disruptions
• This approach aligns with the UK regulators' focus on protecting consumers and maintaining financial stability through resilient business services

Why other options are incorrect:

A: While impact tolerances are important, they should be set for important business services, not for each internal process. The regulatory focus is on business services that matter to consumers and markets.

C: VaR calculations and capital reserves are more relevant for capital adequacy requirements under Basel frameworks, not specifically for operational resilience compliance. Operational resilience focuses on continuity of services rather than capital allocation.

D: While having a cross-functional team is beneficial, operational resilience should not be led solely by the IT department. It requires business ownership and should be led by senior management with appropriate governance across all relevant functions.

Key Regulatory Context: UK regulators (PRA and FCA) require firms to:

• Identify their important business services
• Set impact tolerances for these services
• Map resources and dependencies supporting these services
• Conduct scenario testing
• Develop response and recovery plans

The most fundamental first step is identifying important business services and understanding their interdependencies.