Supplier

The supplier as a continuity category exists because outsourcing transfers work but not accountability — the obligation to customers and regulators stays with you. Leaders therefore need to know which suppliers are critical, meaning their failure interrupts an important service faster than a replacement can be found. The dependent decision is contractual: what continuity commitments to demand, and what dependence to accept, before signing. That question is cheapest to answer at tender stage and most expensive during an incident.

Critical suppliers are identified through the business impact analysis, assessed by procurement together with the continuity function, and reviewed at least annually. The results live in the supplier register and in contract clauses: recovery time commitments, notification duties, the right to audit and to test. A working example — a critical IT provider contracted to restore service within 4 hours, to join one joint exercise per year, and to report any incident within 60 minutes. Substitution time is the key metric: a supplier replaceable in 2 weeks needs a different regime from one that takes 6 months to replace.

The usual mistake is equating a signed SLA with actual capability — service credits compensate pennies while the interrupted service loses millions. A commitment that has never been exercised is a hope, not a control. How supplier dependence is assessed and tested within a resilience programme is covered in module M2 "From enterprise risk management to business resilience" of the ERGP programme.