Critical, important, ordinary

The criticality test

A supplier is critical if its unavailability prevents the organisation from delivering a prioritised product or service within the timeframes set by the BIA.

That test mentions neither value, nor tenure, nor supplier size. Three examples show it:

• A cleaning contractor at €900,000 a year: important by volume, not critical. Its absence is inconvenient for two weeks.
• A payroll software vendor at €40,000 a year: critical. Its unavailability stops payroll, whose MTPD is 48 hours.
• A sole accredited testing laboratory for a regulatory control at €15,000 a year: critical. Without it, production cannot be released.

The second and third cases systematically escape spend-based arrangements — and they are the ones that cause disruptions.

Three-tier segmentation

In most organisations the critical tier represents between 3% and 8% of supplier count. Concentrating effort on those 5% produces more resilience than sending a questionnaire to everybody.

Residual responsibility

Outsourcing an activity transfers its execution. It transfers neither regulatory responsibility, nor contractual responsibility to the client, nor reputational responsibility.

The principle is explicit in the EBA guidelines, in DORA and in the UK operational resilience regime. It has a practical consequence: the continuity plan must cover the provider-failure scenario, not merely lean on the provider's own plan.

Tier 2

The question to put to every critical supplier is simple, and rarely asked: "who do you rely on to deliver this service?"

The answers regularly reveal:

• Two apparently independent suppliers hosted with the same cloud provider, in the same region;
• A provider whose activity rests on a single offshore subcontractor;
• A vendor whose support service depends on a partner currently being acquired.

That information is only obtained if the contract requires it or the relationship allows you to ask. It belongs in the map on the same footing as internal dependencies.