The Portal Outage Nobody Owns
A mid-sized insurer runs its customer portal through four suppliers: a SaaS CRM provider, a payment gateway, a cloud hosting provider, and a systems integrator that maintains the custom middleware. The CRM vendor's contract promises 99.9% availability for its own service, the hosting provider promises 99.95% for infrastructure, and the integrator's contract has no end-to-end availability target. In the last quarter, customers experienced 11 hours of portal downtime. Each supplier's monthly report shows its own SLA met. The middleware release in March changed retry logic, which exposed a payment gateway timeout; the gateway vendor says its API behaved as documented. The insurer's internal operations team coordinates incidents but has no authority over supplier changes. The CIO wants a single supplier scorecard and a clause making one vendor accountable for all outages.
1. Why is the CIO's proposed single scorecard plus one accountable vendor unlikely to fix the problem? Use supplier management principles to explain.
Read the worked answer
The scorecard would aggregate supplier-local metrics, and those metrics are already green because each supplier measures only its own boundary. The failure is cross-supplier: middleware retry logic, gateway timeout behaviour, and hosting latency interact. ITIL supplier management is concerned with value co-creation across the service value chain, not merely contract compliance by isolated vendors. Making one vendor accountable for other suppliers' outages does not give that vendor authority over their changes, so the clause would create disputes rather than control. The insurer lacks an end-to-end service owner and a shared dependency model. A scorecard can inform governance, but it cannot assign accountability for an outcome no single supplier controls. The practical fix is to define the end-to-end service, map supplier dependencies, and establish shared incident and change coordination with clear decision rights.
2. Recommend three governance mechanisms the insurer should put in place, and explain what each would change.
Read the worked answer
First, appoint a service integration owner with authority to convene all four suppliers during major incidents and cross-supplier changes. This creates a single coordination point without pretending one vendor controls the others. Second, create a joint change advisory forum covering middleware, gateway, CRM, and hosting releases; suppliers must disclose changes that affect shared interfaces, and the forum assesses end-to-end risk before release. Third, define an end-to-end availability objective and a shared dependency map, then align contracts so each supplier reports against the outcome and participates in cross-supplier root cause analysis. The scorecard should then include joint metrics such as mean time to restore the full portal and the number of cross-supplier changes without impact assessment. These mechanisms change behaviour from local optimisation to shared accountability, while preserving each supplier's contractual boundaries.