From the guide
Supplier risk and operational resilience: beyond the assessment
A satisfactory supplier rating can coexist with a service that has little room for disruption. For a bank board, the useful starting point is the customer outcome: what stops, how quickly it matters and which options remain available.
The questions a board should ask
Which important service depends on this supplier, and how quickly would failure cause material degradation? Ask management to connect the assessment to the service's impact tolerance, the intervention available and the person authorised to act. Then challenge the dependencies behind the contracted provider.
The evidence to request
- A service and dependency map showing material concentration and unverified assumptions.
- Evidence that a fallback is usable, including activation time, capacity and reconciliation needs.
- Clear supplier warning signals, escalation routes and authority to start a workaround.
A practical scenario
Illustrative scenario from the guide
A payment-screening supplier reports a cyber incident while its service remains available. Peak volumes are approaching, and an alternative route takes about 90 minutes to activate. Switching has costs; waiting may close the option. What evidence would trigger a decision?
Buck's interpretation
The guide's central distinction is between assurance about a supplier and assurance about the service. A sound response neither disconnects solely because an alert exists nor waits passively for certainty. It establishes exposure, prepares options and records the decision trigger, owner and trade-offs while action is still possible.
The full guide includes all three board questions, the structured ten-minute discussion, a response checklist and a practical follow-up record.
Download the full guide