Risk Talent · Executive search
Head of operational resilience search is RiskTAE’s retained executive search service for the people who run operational resilience in banks, building societies, insurers, investment firms and payment firms, in the UK and for international clients. A partner owns the search from the written brief to the first day, and every candidate is interviewed on the technical substance of the role before you see a CV.
You meet people who have mapped important business services, set impact tolerances a board has approved and written a self-assessment that stood up to review.
The role
Operational resilience, in the PRA’s rules, is a firm’s ability to remain within its impact tolerance for each important business service through a severe but plausible disruption.
A firm must identify its important business services, the services which, if disrupted, could threaten its safety and soundness or, for systemically important firms, UK financial stability. It must set an impact tolerance for each, the maximum tolerable disruption measured as a length of time, and be able to stay within it. The board approves both and reviews the self-assessment. The head of operational resilience runs that cycle: the map behind each service, the scenario testing, the self-assessment and the board paper.
Who they report to is the first thing we settle in a brief. The PRA expects the Chief Operations function, SMF24, to hold overall responsibility for implementing operational resilience policies and reporting to the board, shared by no more than three people where it is shared at all. So the head either owns the programme in the first line for the chief operating officer, or challenges it from the second line for the chief risk officer, whose function the Risk Control Part requires to be independent from the operational functions. Either works; a firm that has not chosen does not, and candidates at this level ask which it is before they ask about money.
Sources: PRA Rulebook, Operational Resilience Part, chapters 1, 2 and 7, Senior Management Functions Part, rule 3.8, and Risk Control Part, rule 3.4; PRA SS1/21, March 2022, paragraphs 3.1 and 7.4.
Scope
Firms had to be able to remain within their impact tolerances by 31 March 2025, and the PRA said that after that date maintaining operational resilience would be a dynamic activity. The list of services and the tolerances behind them need reviewing as the business changes. We ask candidates which service they would take off their current firm’s list; the answer shows who has thought about the definition.
Testing against severe but plausible scenarios is where a programme is found out. The self-assessment goes to the board, so the head writes for non-executives who will ask what was found and what was fixed. We look for a board paper that changed a decision rather than one that recorded compliance.
A new version of SS2/21, published on 18 March 2026, takes effect on 18 March 2027 following PS7/26 on operational incident and third-party reporting, so your hire builds that reporting in their first year. Where the third-party remit is a role of its own, see our head of third-party risk search.
Sources: PRA SS1/21, March 2022, paragraphs 4.14 and 4.16; PRA Rulebook, Operational Resilience Part, chapter 7; PRA SS2/21, March 2026 version, effective 18 March 2027.
Candidates
Strong candidates come from three places: sitting heads of operational resilience who have run at least one full annual cycle since the March 2025 deadline rather than only the programme that met it; deputies and programme managers in larger firms who have owned the scenario testing or the self-assessment; and people crossing from business continuity, technology, operational risk, consulting or the regulator, who know the standard but have not yet owned the budget.
We test hardest for two things. Whether the person can derive an impact tolerance from first principles, because one borrowed from a peer does not survive the first hard question. And whether they have told a chief operating officer that a service could not stay within tolerance, and what happened next; a head who has never delivered that message has not done the job.
Scale matters too. A head from a large bank has run one part of the programme with a project office behind them; in a smaller firm the same person draws the map, runs the tests, writes the self-assessment and presents it with a team you can count on one hand.
Process
| Stage | What happens | What is different for this role |
|---|---|---|
| Brief | A 30-minute call, then a written brief. | We settle the reporting line, the boundary with SMF24’s statement of responsibilities, and whether the role is a senior management or certification function. |
| Market map | The people who fit, approached in confidence without naming you. | The pool is small and a generic approach gets no reply, so ours describes the mandate, the reporting line and where the programme stands. |
| Technical screen | Each candidate is interviewed on the substance before you see a CV. | By former chief risk officers and heads of risk, former regulators and interim executives: the services, the tolerances, the tests and the board paper. |
| Shortlist | A short list with our written view of each person, then interviews both ways. | We ask that the chief operating officer and the chief risk officer both meet the final two, whichever of them the role reports to. |
| Offer, checks and start | The offer, the checks, and staying close through notice and the first months. | For a certification function, regulatory references cover six years and every relevant former employer, with a four-week reply window that binds all firms, and the PRA expects a criminal records check for non-SMF holders too. For a senior management function the regulator has three months from a complete application. |
Sources: PRA Rulebook, Fitness and Propriety Part, rule 2.7; PRA SS28/15, April 2026, paragraphs 4.19, 6.4 and 6.5; PRA PS12/26, 22 April 2026, paragraph 2.79; FCA Handbook, SUP 10C.10.26G.
Failure points
Sources: PRA Rulebook, Allocation of Responsibilities Part, rules 2.1 to 2.4; PRA SS1/21, March 2022, paragraphs 4.14 and 7.4.
Working with your team
The chief operating officer and the chief risk officer both live with this hire, whichever of them it reports to, so we ask both to agree the brief and meet the shortlist. Where the head challenges from the second line, the chief risk officer owns the hire; our head of operational risk search page explains where the two roles meet.
HR, in-house talent acquisition and RPO teams own the process, the employer brand and the offer; we bring the senior resilience market map and the technical screen, for one role or a whole programme (see our page for talent acquisition teams).
The same firm does advisory, training and the RisKIT models, so a search can be paired with interim advisory cover while the role is empty, or with training for the new head’s team, through Risk Advisory.
FAQ
Usually not. The PRA expects the Chief Operations function, SMF24, to hold overall responsibility for operational resilience policies, and the head normally reports to that person or to the chief risk officer, so the firm assesses fitness and propriety itself. Where someone with no other approval is given overall responsibility for the area under the FCA’s rules, SMF18 can apply, with the regulator’s approval; our interim chief risk officer page explains how a role is covered while that approval is pending.
Yes. Third-party risk is often a role of its own and has its own page. Business continuity and technology resilience leaders are searched for the same way with a different screen; few people are equally strong on impact tolerances and on supplier oversight, so we test each part on its own.
Rarely. Head of operational resilience recruitment at this level is mostly confidential, so the roles are not advertised and we approach people directly. If you are thinking about a move, book a confidential career call, message us on WhatsApp on +44 7537 159269 or email talent@risktae.com. We never put your name forward without your agreement.
One expert firm
Insights
A chief risk officer runs a bank’s independent risk management function. In the UK the role is a regulated senior management function, SMF4, defined as “responsibility for overall management of the risk controls of a firm,...
By Benn Pople · 7 min readA board's guide to hiring a chief risk officer in the UK: the brief, the search, the assessment, SMF4 approval and the first 100 days in post.
RiskTAEIn a UK bank the chair of the risk committee holds a senior management function of their own, SMF10, and needs regulatory approval before taking up the role. The PRA requires a risk committee, and so...
By Benn Pople · 7 min readNext step
A 30-minute call is enough to agree the brief and whether we are the right firm to run the search.
Tell us about the role and a partner will come back to you. Treated in confidence.
Prefer email? talent@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.