The Supplier Who Was Not in the Plan
A logistics firm has a mature continuity program: BIAs complete, plans documented, annual exercises, and a board-approved policy. Its largest customer, representing 38% of revenue, depends on a single third-party customs-brokerage platform to clear cross-border shipments. That platform is not mentioned in any continuity plan, was never assessed, and its contract contains no continuity or notification obligations. During a vendor outage last month, the firm learned of the problem from its customer, not the vendor, and had no alternate clearance path for 22 hours. The vendor has since said the outage was a 'routine maintenance overrun'. The procurement team considers vendor continuity a procurement matter, and the continuity manager has no authority over procurement. The next contract renewal is in five months.
1. Where is the failure in the continuity program's scope, and why did a mature program miss it?
Read the worked answer
The failure is one of scope boundary: the program was built around internally owned processes and assets, and never extended to the third parties on which a critical process depends. Customs clearance is a critical function, and the brokerage platform is a single point of failure for 38% of revenue - yet it sits outside the BIA, outside plan documentation, outside exercises, and outside contractual control. That is a concentration risk the program was structurally blind to.
Mature programs miss this for predictable reasons. BIAs typically ask departments about their own functions and systems, and a dependency managed by procurement or a logistics team may never surface as a continuity-relevant asset. Ownership is fragmented: procurement owns the contract, operations owns the relationship, continuity owns the plans, and no one owns the intersection. And the program measured its own completeness - plans written, exercises run - rather than the resilience of the end-to-end service the customer actually buys.
The lesson: program scope must follow critical customer outcomes and their dependency chains, not the organizational chart.
2. What should the continuity manager do in the next five months, given no formal authority over procurement?
Read the worked answer
Use influence and the renewal deadline as leverage rather than fighting a jurisdiction battle. Sequence:
Quantify. Extend the BIA to map the dependency chain for the top customers and document the 22-hour exposure and the 38% revenue concentration. A one-page exposure summary converts an abstract concern into a board-level risk.
Escalate through risk, not turf. Route the finding through the enterprise risk register and to the executive risk owner, framing it as an unmanaged concentration risk rather than a procurement failing. This gives procurement a mandate it can act on.
Build the requirement set. Draft standard continuity clauses - notification timelines, RTO commitments, evidence of testing, right to audit, and alternate-path obligations - and offer them to procurement as a reusable template, positioning the continuity manager as a resource, not an auditor.
Use the renewal. With five months, request that the clauses be tabled in the renewal negotiation, supported by the exposure data.
Interim mitigation. Do not wait for the contract - identify and document a manual or alternate clearance path now, and exercise it, so the 22-hour gap is reduced regardless of negotiation outcome.
Institutionalize. Propose a policy amendment making third-party continuity assessment a required input to renewal for critical suppliers, so the gap does not recur.