Short answer
By focusing on the small number of suppliers that could stop an essential service, rather than on how many questionnaires have been completed. A board should know which suppliers those are, where several services depend on the same provider, and what the bank would actually do if one of them failed.
Questions for the board
- Which suppliers support our most important services, including their own key subcontractors?
- Where are we concentrated on a single provider, such as one cloud or payments platform?
- What evidence do we hold beyond the supplier's own assurance, such as testing, audit rights or joint exercises?
- Do we have a workable exit or substitution plan, and has it been tested?
What good oversight looks like
- Supplier risk reported by service and dependency, not by supplier count.
- Critical suppliers included in incident and recovery exercises.
- Clear ownership: a named senior manager for each critical relationship.
Professor Buck Rogers' view
A completed questionnaire tells you a supplier can fill in a form. It does not tell you what happens to your customers when that supplier goes dark.
Former CISO at the Bank of England and creator of the CBEST framework.