A critical supplier can fail outside your legal entity while the disruption and customer harm remain yours to manage. The real test is whether an important business service can remain within its impact tolerance when a dependency fails.
The original uses incidents involving Bloomberg, payment infrastructure and cloud providers to illustrate why external dependencies can become operational resilience vulnerabilities. It argues that outsourcing does not remove accountability for service outcomes.
1. Identify who is critical
Map important business services end to end, including third parties, fourth parties and intra-group dependencies. Test criticality through substitutability, concentration, tight integration and the speed at which customers could suffer harm.
2. Design for disruption, not perfection
Use impact tolerances to inform recovery and continuity arrangements. Consider graceful degradation, portable data and interfaces, and separation of failure domains so that a single event does not disable people, technology, processes and information together.
3. Make alternative provision usable
Multiple suppliers only help if the firm can switch in time. Options include active-active provision, a prepared active-passive backup, controlled manual fallbacks and portability by design. Each option needs realistic switching and reconciliation tests.
4. Build and exercise contingency playbooks
Set explicit activation triggers, decision rights and deputies, detailed switching and rollback runbooks, pre-approved risk controls, communication plans and auditable proving exercises. An untested plan is not evidence of resilience.
5. Align contracts and oversight with resilience
Secure appropriate incident notification, information and audit rights, data portability, exit and transition support, and meaningful indicators such as failover readiness, latency variation and backlog growth. Report dependency exposures through an important-business-service lens.
Five questions for executives
- Which important business services would exceed impact tolerance if a major provider failed today?
- How long has it actually taken to restore a safe service using a tested alternative?
- Can we access and transfer essential data without improvising?
- Where do supplier, geography, technology or team concentrations create single points of failure?
- When did we last test the arrangements with operations, customers and control functions?
How this relates to JADEtc Academy’s 3 Os of TPRM
Additional Academy commentary, October 2026; not part of the original 2025 article. The principles extend across On-Boarding (initial materiality, criticality, risk assessment and contractual design), OnGoing (monitoring, testing and refreshing materiality and residual risk), and Off-Boarding (tested transition, exit and portability). The assessment of materiality and risk must be maintained throughout the lifecycle.
For firms in scope of the UK’s March 2027 operational incident and material third-party reporting requirements, this reinforces the need for dependable information on service dependencies, escalation and material third-party arrangements. Read our separate regulatory briefing →
Original publication
Dr Jimi M.V. Hinchliffe, “It’s only a Third Party” Is Not a Defence when you suffer a Disruption: Identifying Critical Providers and Designing for Resilience, LinkedIn, 14 October 2025. Read the full article ↗