Ask a club how quickly it would recover from a serious system failure and the honest answer is usually "as fast as possible." That is not an impact tolerance. It is a hope. The discipline that financial services firms were forced to adopt under the FCA's operational resilience framework requires something much harder: a specific, defensible, board-approved limit for how much disruption each critical service can absorb before the harm becomes unacceptable. This article explains how a football club sets one properly, using the club's own most time-critical services as the test case.

Ask a club's leadership team what the business actually does and the answer, understandably, will be some version of football. Ask which specific services genuinely cannot be allowed to fail, and most boards have never been asked to answer with any precision. The exercise is narrower and more revealing than it first appears, and doing it properly is the essential first step of any genuine operational resilience programme.

Most football clubs have a business continuity plan. Very few have thought about operational resilience, and the distinction is not semantic. A continuity plan tells you what to do after something breaks. Operational resilience asks a harder question: can the club keep delivering the services that matter, throughout the disruption, not just after it. Financial services firms were forced to make this shift five years ago. Football clubs are about to discover why it matters to them too.