The Supplier Nobody Mapped
A regional health insurer has completed a risk assessment that focused on its own data centers, applications, and staff. During a tabletop exercise, a scenario reveals that the claims adjudication platform depends on a third-party clearinghouse for eligibility verification. That clearinghouse is itself hosted on a cloud provider, and its own upstream dependency is a small software vendor with 40 employees. The insurer has 12,000 provider customers and processes 80,000 claims daily. The exercise facilitator asks: 'What happens if the software vendor is ransomware-hit and is down for three weeks?' The room goes quiet. No one in the room has a contract with that vendor, and no one knows its name. The insurer's own BIA lists claims adjudication RTO at 8 hours.
1. What went wrong in the risk assessment, and how should the BC lead diagnose the dependency gap?
Read the worked answer
The risk assessment was scoped to the organization's own perimeter and stopped at the first tier of suppliers. It treated the supply chain as a contractual relationship rather than as a dependency chain.
Diagnosis:
- Scope failure. The assessment covered owned assets, not the services the organization depends on. A dependency is in scope regardless of who owns it.
- Depth failure. Even where the clearinghouse was known, its upstream (the 40-person software vendor) was not mapped. Concentration and fourth-party risk were invisible.
- Assumption failure. The 8-hour RTO for claims adjudication was calculated without the eligibility verification step. If eligibility cannot be checked, adjudication cannot complete, so the real RTO is bounded by the supplier's recovery, not the insurer's.
How to diagnose:
- Dependency mapping. Walk each critical business process down through applications, infrastructure, suppliers, and fourth parties. Record the chain, not just the first link.
- Concentration analysis. Identify where multiple critical processes converge on one supplier - single points of failure at the supply-chain level.
- Contract inventory. Match supplier contracts to critical processes; a supplier with no contract on file is an unmanaged dependency.
- Question the RTO. Re-derive the 8-hour figure with the dependency included. It is almost certainly unachievable as stated.
Output: A dependency register that names the fourth party, the process it supports, the current recovery assumption, and the evidence (or absence of evidence) behind it.
2. What continuity strategies should the insurer pursue given the three-week outage scenario?
Read the worked answer
A three-week outage of a fourth-party vendor is not a 'recover the supplier' problem; it is a 'operate without the supplier' problem. Strategies must be layered.
Strategy layers:
- Substitute the function, not the vendor. For eligibility verification, identify a manual or alternate path - batch eligibility files, cached eligibility data, a secondary clearinghouse, or direct payer-provider transactions. Pre-agree the fallback with major providers.
- Reduce dependence. Negotiate with the clearinghouse for source-code escrow, data portability, and the right to designate an alternate processor. Push the fourth-party risk back up the chain contractually.
- Build buffers. Retain eligibility data locally with an agreed refresh cycle so adjudication can proceed on cached data for a defined window. Define the tolerance for stale data.
- Segment. Determine which claims can be processed without eligibility verification (e.g., low-value, established providers) and which cannot. Prioritize the former to keep cash flowing.
- Supplier resilience requirements. Add continuity and security requirements to supplier contracts: notification timelines, tested recovery, and audit rights extending to subcontractors.
- Accept and plan. For the residual exposure, document the manual workaround, the staffing it requires, and the financial impact, and route it through risk acceptance.
Test: Re-run the tabletop with the fallback in place to confirm the manual path actually works at 80,000 claims per day - volume is where manual fallbacks break.