Author: Guy Halfon
A supplier can pass every assessment and still leave your business unable to operate. The approval answers whether the organization accepted the supplier’s risk. It may say little about how a critical operation would survive its failure.
That gap is easy to miss when risk information is organized around individual suppliers. Each vendor has a record, a rating and a review date. The business, however, depends on combinations of services. An order may require a payment provider, identity service and fulfilment platform to function together. Reviewing each separately can miss the dependency between them.
In July 2024, Microsoft estimated that CrowdStrike’s faulty update affected 8.5 million Windows devices, less than 1% of all Windows machines. The disruption was extensive because those devices supported critical services. Risk leaders need to identify which revenue, service or customer commitments would fail with those systems.
Vendor diversity can also conceal infrastructure concentration. Synergy Research estimated that AWS, Microsoft and Google accounted for 67% of the global public cloud infrastructure market in Q2 2026. To assess shared exposure, teams need the underlying provider, deployment region and supporting services. A primary supplier and its backup could use the same cloud region, identity service or deployment software.
Investigating a fourth- or nth-party dependency is harder without a direct relationship. A supplier’s contract may allow subcontracting while its assessment describes controls without identifying the infrastructure delivering your service. During an outage, that missing context can delay escalation and leave the customer waiting for information to pass through several organizations.
Recovery has a separate timeline. Following the Change Healthcare attack, an AHA March 2024 survey found that 60% of responding hospitals expected another two weeks to three months to resume normal operations after the supplier’s full functionality was restored. These were forecasts, but they identify work that technical restoration leaves behind: claims backlogs, payment reconciliation and appeals.
Consider an illustrative case: a business can tolerate two hours of interruption, but its supplier commits to recovery within eight hours. The six-hour gap remains the organization’s problem. A manual workaround might cover it, provided there are enough people, sufficient capacity and a tested way to reconcile records afterward. Where normal demand already uses full capacity, clearing the backlog requires additional resources.
Recovery evidence must cover the specific product and deployment your organization uses. The test should also include access to recovery tools and credentials while primary services are unavailable. A workaround that depends on the failed identity service cannot be executed.
Periodic reviews add a timing problem. A supplier can change hosting arrangements, subcontractors or AI services after approval. Teams already occupied with missing evidence may not learn about the change until the next review. Monitoring should trigger a reassessment when a change affects a critical dependency, the recovery assumptions or the organization’s accepted exposure.
AI and automation should take on the collection, comparison and follow-up work that consumes assessment capacity. Their outputs should identify the evidence behind a conclusion, distinguish an unsupported vendor promise from a verified capability and highlight changes requiring a decision. Predictive analysis should examine defined failure scenarios, including several suppliers losing the same upstream service.
Resilience also needs ownership across departments. Security may identify the shared dependency, but the business owner defines the interruption it can tolerate. Operations must validate the workaround; procurement must establish contractual obligations and escalation routes. Leadership must assign authority to accept any remaining gap and resources to address it. Boards and regulators should be able to inspect that decision and its supporting evidence.
Ahead of TPRA, the measure I would put before boards is the share of critical operations with a tested recovery plan, an accountable owner and a known tolerance for disruption.
