Northbridge Bank: Payment Outage and Impact Tolerance Breach
Northbridge Bank is a UK retail and small-business bank with £42bn of deposits. Its critical payment processing service runs on a single cloud region and is supported by a managed service provider under a contract with a two-hour recovery time objective. In March, a provider configuration error caused a nine-hour outage of card and faster-payment authorization. Customers could not pay suppliers, call-centre queues reached 40 minutes, and the bank later found that its manual fallback had never been tested at full volume. The board's impact tolerance for payment disruption is four hours and 50,000 failed transactions. The regulator has asked for the incident report and evidence that similar severe-but-plausible events are being managed. The CRO wants a candid assessment before the board risk committee meets next week. The bank has no spare in-house data-centre capacity and the provider's SLA credits are capped at £250,000.
1. Assess whether Northbridge has breached its impact tolerance and whether the incident should be treated as a significant operational resilience event. What facts matter most?
Read the worked answer
The tolerance has two limbs: four hours and 50,000 failed transactions. The outage lasted nine hours, so the duration limb is breached. The failed-transaction limb is also likely breached: a nine-hour card and faster-payment outage at a bank with £42bn of deposits would almost certainly exceed 50,000 failed items, even if the exact count still needs reconciliation. The event is significant because it affected critical economic functions, caused customer harm, and exposed an untested fallback. The fact that the provider caused the error does not transfer accountability; Northbridge remains responsible for the service. SLA credits of £250,000 are not a mitigant for customer or regulatory impact. The report should distinguish impact, meaning actual harm, from vulnerability, meaning the untested fallback and single cloud region. A candid assessment should not wait for final transaction counts before escalating.
2. Recommend the three most important remediation actions and explain how each reduces the risk of recurrence. Prioritise by risk reduction per unit of cost.
Read the worked answer
First, engineer and test a genuine multi-region failover, not just backup data. This reduces the probability and duration of a single-region failure; it is expensive but directly addresses the nine-hour outage. Second, run a full-volume manual fallback exercise, including call-centre surge, reconciliation and customer communications. The prior test was not at volume, which is why the fallback failed. Third, establish a third-party concentration and exit plan: map dependencies, set concentration limits, require the provider to disclose sub-processors, and negotiate stronger recovery commitments. Prioritise by risk reduction per unit of cost: failover is high cost but high impact; full-volume testing is low cost and fast; contract changes are medium cost and slow. The bank should also link remediation to impact tolerance and board reporting.
3. The CFO argues that the provider's SLA and £250,000 credit cap adequately transfer the risk. Respond.
Read the worked answer
The CFO is conflating contractual remedies with risk transfer. An SLA credit caps the provider's liability but does not restore payments, compensate affected customers, or protect Northbridge's regulatory position. Operational risk remains with the bank because the critical service is part of its own obligation to customers and the regulator. The £250,000 cap is likely trivial relative to customer harm, remediation cost and reputational damage. Contractual terms should be improved, but they cannot substitute for resilience: multi-region architecture, tested fallback, exit plans and board oversight. Insurance may cover some losses but is not a substitute either. The board should treat the provider as a concentration risk, not an outsourcing transaction. The CRO should present a residual-risk view after all mitigants, and ask whether the bank could remain within tolerance if the provider failed again.