Concentration Risk in a Single Cloud Provider
Arcadia Retail Bank migrated 78% of its critical applications to one cloud provider over three years, driven by cost savings of $6M annually. The vendor risk register lists the provider as 'Tier 1 - critical' with an annual assessment. Last quarter, the provider had two regional outages totaling 14 hours; Arcadia's payment processing was down for 9 of those hours. The regulator's most recent guidance asks firms to identify concentration risk and demonstrate exit or substitution plans for critical third parties. Arcadia's exit plan is a two-paragraph statement saying migration to an alternative provider 'would be evaluated if required.' The board's risk appetite is silent on third-party concentration. The CRO must report to the board next month.
1. Assess Arcadia's concentration risk exposure and explain why the current register treatment understates it.
Read the worked answer
The exposure is severe on three dimensions. Concentration: 78% of critical applications on one provider means a single provider failure is a near-firm-wide operational event - the 9-hour payment outage demonstrates this is not hypothetical. Substitutability: the exit plan is a two-paragraph aspiration with no cost, timeline, data-migration path, or tested alternative, so the practical ability to exit is close to zero. Cumulative dependency: three years of migration has likely embedded provider-specific tooling, making substitution harder over time, not easier.
The register understates this because 'Tier 1' classification captures criticality of the vendor, not concentration of dependence on it. A vendor can be correctly rated critical and still be under-managed if the register does not separately measure: percentage of critical services dependent, substitutability, and time-to-exit. The annual assessment also reviews the vendor in isolation, not the firm's aggregate exposure to it. The two-paragraph exit plan would likely fail the regulator's 'demonstrate' standard.
2. The board's appetite is silent on third-party concentration. What should the CRO recommend, and why is silence itself a risk?
Read the worked answer
The CRO should recommend the board adopt an explicit concentration tolerance - for example, a cap on the percentage of critical applications (or critical processes) that may depend on any single third party, with defined escalation when approaching it. The CRO should also propose a substitutability standard: every Tier 1 vendor must have a documented, costed, and periodically tested exit or substitution plan.
Silence is a risk because absent a stated tolerance, every concentration level is implicitly acceptable, and decisions default to cost optimization. The $6M savings were approved against no concentration limit, so the migration proceeded to 78% without a governance checkpoint. Silence also removes the board's ability to demonstrate oversight to the regulator - 'we had no limit' is not a defensible position when guidance asks firms to identify and manage concentration. The board should set the tolerance, and management should report against it.
3. Design the substance of an exit plan that would satisfy the regulator's expectation to 'demonstrate' a substitution capability, distinguishing what must be true versus what must be documented.
Read the worked answer
A credible plan must show demonstrated capability, not just intent. What must be documented:
- Scope: which critical applications and data are in scope, ranked by criticality.
- Target architecture and alternative provider(s), with contractual or commercial preconditions.
- Cost estimate and funding source for exit.
- Timeline with phases and decision gates.
- Data portability approach and format standards.
- Roles, owners, and governance cadence.
What must be true (and evidenced):
- At least one critical workload has been tested for portability, even partially, with results.
- Data can be exported in a usable format within a defined period - proven, not assumed.
- Contract terms permit exit within a workable window and do not create prohibitive penalties.
- A runbook exists and has been exercised in a tabletop or limited migration.
The regulator's word is 'demonstrate.' A plan that has never been tested is a hypothesis. Recommend a pilot migration of one non-critical-then-critical workload within 12 months to convert documentation into evidence, and report results to the board.