Third-party and outsourcing risk · RiskAtoms Academy

Know these first

L2.2.05: Operational risk

By the end you will be able to

1Describe the third-party lifecycle: planning, due diligence, contract, monitoring and exit.
2Measure concentration on a supplier, by spend and by the important business services it sits under.
3Test a supplier outage against each service's impact tolerance, with and without workarounds.
4Explain exit plans (stressed and non-stressed) and the UK critical third parties regime, and why the firm stays responsible.

Why it matters

RiskAtoms Bank spends £90m a year on five key suppliers. £38m of it goes to one cloud provider, Cirrovane, which hosts four of its five important business services. If Cirrovane's region went down for two days, the bank could switch mobile banking to another region, but not payments. And the plan for leaving Cirrovane altogether has never been tested.

Core explanation

You can hand over the service, not the risk

Illustrative dataRiskAtoms Bank plc's operational risk book

The same £67bn bank as Modules 3.5 and 3.6, reporting at 31 December 2025: ten years of internal loss events above £10,000 (2016 to 2025), an RCSA, ten key risk indicators, seven workshop scenarios, five important business services and five suppliers. Every event, person, supplier and figure is made up for teaching and seeded so it never changes; none is any bank's data. Every lesson in Module 3.7 uses this book, so the figures agree.

The book's third-party category holds 57 losses: £7.13m gross, of which £2.34m (33%) was recovered, leaving £4.78m net. The largest is Paxtorn's nine-hour card processing outage in 2022.

Third-party risk covers every supplier; outsourcing is the part where a supplier does work the bank would otherwise do itself. Regulators care most about material outsourcing: the services whose failure would hurt customers or the bank's safety. The PRA's supervisory statement SS2/21 is plain that responsibility cannot be outsourced: the board and senior managers stay accountable whoever does the work. Losses from suppliers land mostly in business disruption and system failures (L2.2.05: Operational risk).

The supplier register

Supplier	Service	Spend	Share	Critical	Important services	Exit plan tested
Cirrovane Cloud	Public cloud hosting (two regions)	£38m	42%	Yes	4 of 5	No
Quillmoor Systems	Core banking software and support	£22m	24%	Yes	4 of 5	No
Paxtorn Processing	Card authorisation and processing	£15m	17%	Yes	1 of 5	Yes
Velmarra Payments	Gateway to the payment schemes	£6m	7%	Yes	2 of 5	Yes
Wrenhallow Telecom	Networks and contact-centre telephony	£9m	10%	No	1 of 5	Yes
Total		£90m	100%

Concentration has two faces. By spend, Cirrovane is 42%. By dependence, Cirrovane and Quillmoor each sit under 4 of the 5 important business services, and they are the two whose exit plans are untested (Cirrovane Cloud and Quillmoor Systems). The map below is the one operational resilience asks for (L3.7.15: Operational resilience): which services depend on which supplier.

Service	Tolerance	Cirrovane	Quillmoor	Paxtorn	Velmarra	Wrenhallow
IBS1 Retail payments out (Faster Payments)	24 h	●	●	·	●	·
IBS2 Access to accounts (app and online banking)	24 h	●	●	·	·	·
IBS3 Card payments and cash withdrawals	12 h	·	●	●	·	·
IBS4 High-value payments for business customers (CHAPS)	4 h	●	·	·	●	·
IBS5 Mortgage payments and redemptions	72 h	●	●	·	·	●
Services		4	4	1	2	1

The lifecycle

ExploreA supplier, from first idea to exit

Click each stage to see what the bank does there.

Plan

Decide whether the service is material: would its failure hurt customers or breach an impact tolerance? Material arrangements get the full treatment below and go on the register the regulator can ask for. Check what the bank already depends on the same supplier for.

Sort itWhen does the bank do it?

Sort each step in managing a new payments supplier into its stage.

Read the supplier's last three years of accounts and its own disaster recovery test results.
Agree that the bank and the PRA may audit the supplier's premises and records.
Review monthly availability against the 99.95% promised, and the supplier's incident reports.
Keep a copy of the bank's data in a usable format outside the supplier, and name a back-up provider.
Require the supplier to tell the bank before it hands any of the work to its own subcontractors.

The RCSA rates the cloud outage risk (R04) at 10 inherent and 5 residual, Medium: due diligence works, but the failover and exit plan control (C08) is only partly effective. The card processor risk (R05) falls from 9 to 6, because card stand-in authorisation (C10) works (L3.7.04: Controls: design, testing and assurance).

Illustrative dataLesson extraAn exit plan for Cirrovane

What the PRA's SS2/21 (Chapter 10) expects an exit plan to cover, against where RiskAtoms Bank's Cirrovane plan stands. The plan's status is made up for teaching.

SS2/21 expects	Cirrovane plan today
Both a stressed exit (failure or insolvency) and a non-stressed exit (commercial or strategic)	Both written
Viable forms of stressed exit: bring in-house, or move to a back-up provider	Back-up provider named for hosting; no contract
Temporary measures to keep important business services going	Second region for digital banking only
Indicators that would trigger an exit	Not defined
Objectives: what a successful exit looks like	Defined
Testing, stressed exits in particular, as soon as practicable and after go-live	Never tested

The formal version

Concentration. Two simple measures for supplier $j$ : its share of spend and its share of important business services.

\text{spend share}_j = \frac{\text{spend}_j}{\sum_k \text{spend}_k}, \qquad \text{service share}_j = \frac{\#\{s : s \text{ depends on } j\}}{\#\{s\}}

A supplier outage. If supplier $j$ is down for $h$ hours, a service $s$ that depends on it is disrupted for $h$ hours, or for the time $w_s$ its workaround takes if it has one. It breaches when that exceeds its impact tolerance $T_s$ :

d_s = \min(h,\, w_s), \qquad \text{breach} \iff d_s > T_s

The longest outage of supplier $j$ the bank can absorb is the shortest tolerance among the services with no workaround:

h_j^{\max} = \min\{\,T_s : s \text{ depends on } j,\ \text{no workaround}\,\}

A workaround removes a service from that minimum. That is why one control (failover for payments) can move the answer from hours to days.

Try it

Start with Cirrovane down for two days. Find the shortest outage that breaches something, then switch on the failover planned under A05. Then try Velmarra, which has no workaround at all, Quillmoor, where card stand-in is the only workaround and covers card payments alone, and Paxtorn, whose card services keep going on stand-in.

Try itTake a supplier down

Supplier

Outage length48 h

Payments on the second cloud region

Cirrovane Cloud: public cloud hosting (two regions). £38m a year, 42% of third-party spend; critical; exit plan not tested.

IBS1 Retail payments out (Faster Payments)breached by 24 h
Down 48 h; tolerance 24 h (the line).
IBS2 Access to accounts (app and online banking)within, 22 h to spare
Down 2 h (workaround); tolerance 24 h (the line).
IBS4 High-value payments for business customers (CHAPS)breached by 44 h
Down 48 h; tolerance 4 h (the line).
IBS5 Mortgage payments and redemptionswithin, 24 h to spare
Down 48 h; tolerance 72 h (the line).

Services breached2 of 4

Longest outage with no breach4 h

Mobile and online banking already fail over to Cirrovane's second region; payments can only after A05. Card payments fall back on stand-in authorisation (control C10) within an hour, whichever supplier is down. Workaround times are illustrative.

Worked example

Cirrovane loses the bank's region for two days

The book's scenario S4: the cloud region hosting mobile banking and payments fails for two days (48 hours), once in 20 years, a typical loss of £10m and a severe one of £100m (L3.7.06: Scenario analysis). Workaround times are illustrative.

Which services breach, and what fixes it

Step 1 of 5

1
Which services depend on Cirrovane
IBS1, IBS2, IBS4, IBS5: Faster Payments, digital banking, CHAPS and mortgage payments. Only card payments (IBS3) do not.

When a workaround works: Paxtorn, 2022

On 17 June 2022 Paxtorn's card processing was down for 9 hours, inside the 12-hour tolerance for card payments. Stand-in authorisation (C10) kept most card payments going within limits, in this lesson's model within 1 hour. The bank still lost £3.9m in declined payments and goodwill and recovered £1.2m from Paxtorn: £2.7m net. Payments have no equivalent yet; that is what A05 is for.

Regulatory lens

In the EU, the EBA's Guidelines on outsourcing arrangements (February 2019, applying from 30 September 2019) set out due diligence, contract terms, a register of outsourcing arrangements and exit strategies for critical or important functions. The PRA's SS2/21, in force since 31 March 2022, builds on them for UK banks, with a chapter on business continuity and exit plans. Concentration across the sector is now regulated at the supplier: under the Financial Services and Markets Act 2023, HM Treasury can designate critical third parties, and the Bank of England, PRA and FCA rules for them (PS16/24) took effect on 1 January 2025. In July 2026 the first designations were made: entities in the Amazon, Google, Microsoft and Oracle groups. In the EU, the supervisors designated 19 critical ICT third-party providers under DORA in November 2025. Neither regime moves responsibility: firms still manage their own suppliers and their own resilience (L3.7.15: Operational resilience).

Spark Atoms

Spark AtomOne supplier, many banks

The CrowdStrike outage of July 2024 (L3.7.09: Technology and change risk) came from one supplier's update and hit banks and airlines on the same day. Every affected firm had its own supplier risk; together they were the sector's concentration risk. That is the gap the critical third parties regime is meant to fill.

Spark AtomFive suppliers, two blind spots

RiskAtoms Bank's two most important suppliers, by the services they sit under, are the two whose exit plans have never been tested. The suppliers that are hardest to leave are the ones most worth having a tested way out of.

Key takeaways

Outsourcing hands over the work, not the responsibility: the board stays accountable for the service.
Manage suppliers through a lifecycle: plan, due diligence, contract, monitor, exit.
Measure concentration by spend and by services: Cirrovane is 42% of spend and sits under 4 of 5 important business services.
A supplier outage breaches every dependent service without a workaround once it outlasts that service's tolerance: 4 hours for Cirrovane today, 72 after payments can fail over.
Exit plans must cover stressed exits and be tested; the UK and EU now also oversee critical suppliers directly.

Reaction

Check what stuck

Question 1 · objective 2

RiskAtoms Bank spends £90m a year on its five main suppliers, £38m of it with Cirrovane Cloud. What share of the spend is Cirrovane, in %?

Question 2 · objective 3

Cirrovane's region is down for 30 hours. Today only mobile and online banking can fail over to the second region. How many of the bank's important business services breach their impact tolerance?

Question 3 · objective 3

In 2022 Paxtorn's card processing was down for nine hours. The bank lost £3.9m and recovered £1.2m from Paxtorn. What was the net loss, in £m?

£m

Question 4 · objective 4

A cloud provider used by the bank has been designated a critical third party in the UK. Its outage breaches one of the bank's impact tolerances. Who is responsible for the bank's service?

AThe bank: designation adds oversight of the provider, but firms stay responsible for their own resilienceBThe provider, because the regulators now oversee it directlyCHM Treasury, which designated the providerDNobody, because the outage was outside the bank's control

Question 5 · objective 4

What makes a stressed exit harder to plan for than a non-stressed exit?

AIt follows the supplier's failure or insolvency, often at short notice, with no help from the supplierBIt costs more because contracts charge exit feesCIt needs the regulator's approvalDIt only applies to cloud providers

Glossary

Third-party risk: The risk of loss when a supplier fails, performs badly or causes harm: an outage, a data breach, a collapse, a dispute.
Outsourcing: Having a supplier perform a service the firm would otherwise do itself, such as hosting systems, processing cards or running a call centre.
Material outsourcing: An outsourcing whose failure would seriously impair the firm's services, its compliance or its safety and soundness: the PRA's term in SS2/21; the EBA speaks of critical or important functions.
Due diligence: Checks before signing: can the supplier do the job, is it sound, how will it protect data and keep running?
Concentration risk (suppliers): Dependence on one supplier for many services (at the firm), or of many firms on one supplier (across the sector).
Service level agreement (SLA): Service level agreement: the measurable standards a supplier promises, such as availability or response times.
Exit plan: A documented plan to move a service away from a supplier: to another supplier, in-house, or a fallback.
Stressed exit: Leaving a supplier because it has failed or become insolvent, often at short notice.
Non-stressed exit: A planned exit for commercial, performance or strategic reasons, on the firm's timetable.
Critical third party: A supplier HM Treasury designates, under powers given by FSMA 2023, because its failure could threaten UK financial stability or confidence; the regulators then oversee it directly.
Stand-in authorisation: When the card processor is down, the bank's systems approve card payments themselves within set limits.

Deep Dives & Origins

Deep Dives

Prudential Regulation Authority, SS2/21 Outsourcing and third party risk management, March 2021, Chapter 10 on business continuity and exit plans. Intermediate.
Bank of England, PRA and FCA, PS16/24 Operational resilience: Critical third parties to the UK financial sector, November 2024. Advanced.

Origins

Prudential Regulation Authority, SS2/21, March 2021 (effective 31 March 2022), paragraph 4.3 and Chapter 10.
European Banking Authority, Guidelines on outsourcing arrangements (EBA/GL/2019/02), February 2019.
Bank of England, PRA and FCA, PS16/24, 12 November 2024.
Linklaters, “UK designates four tech firms as critical to financial system”, 10 July 2026.
Morgan Lewis, “DORA: EU Regulators Announce List of Critical ICT Third-Party Providers”, 18 November 2025.
Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk, BIS, March 2021.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 12-minute video will sit here, made from this page's script.

Previous · L3.7.09

Technology and change risk

Next · L3.7.11

Fraud and financial crime