Tier-2 concentration and testable exit

Measuring real concentration

Concentration is not readable from the supplier list. It is readable from the list of their shared dependencies.

Three questions per critical supplier:

1. Where is the service hosted? With whom, in which region?
2. Which subcontractors operate in the chain?
3. Which shared infrastructure — network, identity, certification — is used?

The resulting matrix crosses suppliers against dependencies. A column that fills across several rows is a concentration, even if the suppliers are contractually independent.

In this example, losing region EU-1 affects two suppliers out of three. An organisation that thought it had diversified discovers it has not.

Substitutability

The question is not "are there alternatives?" but "how long until an alternative is operational?"

The real lead time includes:

• Selection and negotiation — rarely under three months for a critical service;
• Data migration, in whatever format the outgoing contract imposes;
• Technical connection and testing;
• Team training;
• The parallel-running period.

For a critical business service, that lead time runs into quarters. Comparing it with the MTPD of the activity concerned immediately sizes the risk: if the MTPD is 48 hours and substitution takes six months, the exit strategy cannot be the answer to an abrupt-failure scenario. A degraded mode is needed.

The testable exit

A credible exit strategy has four verifiable elements:

1. An identified fallback provider, ideally contractually pre-qualified;
2. The data extraction format, documented and — this is the key point — tested;
3. The migration plan, with its steps and estimated durations;
4. The degraded mode applicable during the transition.

Testing element 2 is the easiest to do and the most often neglected: request a complete extraction of your data once a year, and check it is usable by a third party.

That test regularly reveals that the announced format is not the one delivered, that fields are missing, that attachments are not included, or that the volume makes extraction impracticable within the contractual timeframe.

The cost of exit

It must be estimated before signature, and it includes:

• Reversibility fees charged by the outgoing provider;
• The cost of technical migration;
• The cost of parallel running during the transition;
• The cost of lost productivity during the learning curve.

A realistic estimate of that cost often changes the initial negotiation: a provider who knows their client has costed the exit negotiates differently from one who knows their client is captive.