Outsourcing Risk Assessments

Outsourcing risk assessments examine what could go wrong through a provider, how it would affect a specific service, and what limits that harm or supports recovery. DORA's provisions on ICT risk management and on ICT third party risk expect such assessments to be grounded in the firm's services, because a provider risk that does not touch a service is a different matter from a provider risk that can stop one. A useful assessment therefore starts with the service and its tolerance, traces the provider dependencies that support it, and asks how each dependency could fail, degrade, change, or become unavailable. It then considers the controls, contract terms, monitoring, and recovery arrangements that address each failure mode, and records where residual risk remains. An assessment that lists generic vendor risks without connecting them to a service has described a supplier. It has not assessed a risk.

Failure modes deserve concrete treatment. A provider component can fail outright, degrade slowly, return incorrect results, become unavailable through a change, or be withdrawn as a product. A provider can also change its own suppliers, its hosting, or its support model in ways that alter the service without any obvious failure. Each mode affects a service differently. An outright failure is visible and triggers recovery, while slow degradation may be harder to detect and may cause harm before it is recognised. Incorrect results may be the most damaging mode of all, because a service can appear to operate while producing wrong balances, decisions, or records. An assessment that considers only total outage will miss the modes that cause harm while the service appears to run.

Concentration risk extends the assessment beyond a single provider. A firm may depend on one provider for several services, so that a single provider event affects many services at once. It may also depend on several providers that share an underlying host, network, or software component, so that diversity at vendor level hides concentration at infrastructure level. A savings service illustration helps: deposits, interest calculation, and customer communications might use different providers, yet all might depend on the same identity service or the same data centre area. An assessment that counts providers without tracing shared underpinnings will overstate diversification. Tracing the chain to shared components, and recording where concentration remains, gives a more honest picture of exposure.

Sub-provider and change risk are closely related. A provider's decision to sub-contract, to change a sub-provider, or to update its platform can alter the firm's risk without any action by the firm. An assessment should therefore consider how sub-contracting is governed, what notice the firm receives, and what the firm can do if it objects. It should also consider change risk in general: provider updates, configuration changes, and new features can improve a service or disrupt it, and the firm needs a way to understand, test, and where necessary challenge changes that affect its service. An assessment that treats the provider arrangement as fixed at signing will become outdated as soon as the provider evolves, which providers regularly do.

Proportionality keeps risk assessment useful rather than bureaucratic. A provider supporting a peripheral internal tool does not need the same depth of assessment as a provider operating a customer-facing service that cannot tolerate prolonged loss. Depth should follow service importance, tolerance, and the harm caused by failure, with the reasoning recorded. That reasoning also helps prioritise mitigations: design changes, additional monitoring, stronger contract terms, alternative arrangements, or a revised tolerance discussion, each matched to a specific risk rather than applied uniformly. An assessment that produces the same mitigations for every provider, regardless of service, has not assessed anything. It has applied a template.

The assessment record should support later decisions. It names the service, its tolerance, the provider dependencies, the failure modes considered, the mitigations in place, the residual risks accepted, and the owner and review trigger for each item. When an incident occurs, that record helps the firm judge whether the event was foreseen, whether mitigations worked, and what needs to change. When a provider changes, it helps the firm judge whether the original assessment still holds. When governance reviews provider risk, it provides a basis for challenge that goes beyond general confidence in a vendor. A risk assessment that cannot be used in those moments was written for a file. A risk assessment that can be used in those moments was written for a service.