The 'Medium' Rating for a Critical Provider With a Fictional Recovery Plan
A bank outsources core banking and card authorisation to a single SaaS provider. The last quarter brought three outages totalling nine hours; the worst, 11 hours, exceeded the four-hour recovery time objective. The contract promises 99.5% availability, with service credits capped at 10% of annual fees - $2.4m against $24m of annual fees. The internal business continuity plan still assumes an on-premises failover environment decommissioned 18 months ago. During the last outage staff processed 8,000 payments manually, 1.2m customers saw failed card authorisations, and two reversals were misposted. The second line rates the risk 'medium' because no customer loss has been proven. The regulator has asked for the bank's critical third-party self-assessment next month.
1. Challenge the 'medium' rating with a defensible impact and likelihood assessment.
Read the worked answer
Challenge it on two axes.
Impact. 'No proven customer loss' is the wrong test. Potential impact includes 1.2m customers unable to authorise payments, 8,000 manual payments with two mispostings - an error rate that scales with outage length - breach of outsourcing and operational resilience expectations, and visible reputational damage. For a critical, non-substitutable process this is high, arguably critical.
Likelihood and control effectiveness. Three outages in a quarter and an 11-hour recovery against a four-hour RTO is not a remote tail event; it is the current operating state. The BCP assumes a failover environment decommissioned 18 months ago, so the principal mitigating control does not exist. Residual risk cannot be lower than inherent when the named control is fictional.
Concentration. One provider for core banking and card authorisation with no tested exit creates a cliff-edge dependency: the issue is not only outage frequency but unsubstitutability.
Conclusion: high, probably critical, residual. The 'medium' rating reflects an impact assessment limited to booked losses and a control assessment that credited an untested plan. Re-rate, document the rationale, and report the re-rate to the board rather than quietly adjusting it.
2. Specify the remediation the bank should require, with sequencing and interim risk reduction.
Read the worked answer
Sequence by risk reduction per week of effort.
Now (0-30 days):
- Declare the BCP invalid. Stand up and test a manual workaround with defined capacity, dual control and reconciliation to the general ledger, so misposting risk is controlled.
- Obtain the provider's incident reports and root-cause analysis for all three outages; require a dated remediation plan.
- Pre-notify the regulator in the self-assessment that the RTO is not currently met and the plan is being rebuilt. Disclose rather than be discovered.
Next (30-90 days):
- Renegotiate: enforceable RTO and RPO, audit and testing rights, subcontractor notification, data portability, exit assistance, step-in rights, and materially higher or uncapped service credits. Credits capped at 10% of a $24m fee are economically meaningless against an 11-hour outage.
- Require joint resilience testing including a live failover exercise, with results going to the board.
- Assess a secondary authorisation route, or retained capability for the most critical function; document and test an exit plan.
Governance: maintain a critical third-party register, set limits on dependency concentration, and define KRIs with owners.
3. What should the board be told, and which metrics should it monitor?
Read the worked answer
Board reporting should be short, quantified and forward-looking:
- Dependency: the single provider, which functions are critical, exit time in months, substitutability.
- Service performance: availability against contract, number and duration of outages, RTO breaches, customers affected, service credits received.
- Control status: date and result of the last successful failover test; result of the manual workaround test; open remediation items with owners and dates.
- Risk appetite: a tolerance for critical-function unavailability (for example, no more than X hours per year) with a defined out-of-appetite escalation.
- KRIs with triggers: outage minutes, mean time to restore, P1 incidents, aged remediation actions, contract clauses not yet renegotiated.
- Regulatory position: status of the self-assessment and any commitments made to the regulator.
Close with a single question for the board: are we willing to accept a single-provider dependency on a critical function with an untested recovery capability? If yes, record it as a conscious risk acceptance with a review date; if no, resource the failover or exit work and set a deadline.