Learn how to assess business continuity and exit planning under PRA SS2/21, including stressed exits, supplier recovery capabilities, operational resilience, exit feasibility and evidence-based assurance.
Northbridge Bank relies on SecureAccess Cloud Ltd to operate customer authentication infrastructure supporting its online and mobile banking services.
The arrangement has been classified as material outsourcing.
During due diligence, SecureAccess provides its Business Continuity Policy and Disaster Recovery Plan.
The documents indicate that the supplier maintains backups, operates across multiple availability zones and has established recovery procedures.
Its stated recovery time objective is six hours.
The bank's Digital Banking team is satisfied.
However, Northbridge has established a four-hour impact tolerance for its digital banking access service.
The Head of Operational Resilience raises two questions:
These are different problems.
The first concerns business continuity and recovery.
The second concerns the bank's ability to exit an outsourcing arrangement while maintaining appropriate operational resilience.
Both are addressed in Chapter 10 of PRA SS2/21.
In this article, we will examine how regulated firms approach business continuity and exit planning, and how a Third-Party Risk Management (TPRM) Analyst can assess whether the arrangements are appropriate, credible and supported by sufficient evidence.
By the end of this article, you should be able to:
Chapter 10 of PRA SS2/21 addresses business continuity and exit planning.
Under paragraph 10.1, the PRA expects firms to develop, maintain and test business continuity plans and documented exit strategies for each material outsourcing arrangement.
The exit strategy should distinguish between:
Paragraph 10.2 explains the supervisory focus.
The central concern is whether the firm can continue delivering important business services supported by third parties within its impact tolerances during disruption.
This is significant because outsourcing does not transfer responsibility for operational resilience to the provider.
A bank may rely on an external company to operate an important technology platform, but it remains responsible for understanding and managing the consequences of that dependency.
A conventional supplier assessment may establish that a provider has documented continuity arrangements.
However, the analyst must go further.
The relevant questions include:
A supplier's Business Continuity Policy is useful evidence.
It is not, by itself, proof that the bank has satisfied the relevant expectations.
The detailed expectations in Chapter 10 apply to material outsourcing arrangements.
Other third-party arrangements may still be subject to relevant governance, risk management, business continuity and operational resilience requirements.
The appropriate arrangements depend on the significance and complexity of the service, the risks involved and the firm's regulatory obligations.
Not every service requires the same continuity architecture or exit solution.
The objective is proportionate resilience, supported by defensible decisions.
These concepts are related, but they should not be treated as interchangeable.
Business continuity concerns maintaining or restoring the delivery of business activities during disruption.
For example, if SecureAccess becomes unavailable, Northbridge might activate alternative customer authentication arrangements or temporary service procedures.
The objective is to maintain essential business operations within acceptable limits.
Disaster recovery focuses primarily on restoring technology systems, infrastructure, applications and data following a disruption.
For example, SecureAccess might restore authentication services using a secondary infrastructure environment.
Disaster recovery is an important component of business continuity, but it does not address every business dependency.
A technical system might be restored while the business service remains unavailable because of failed integrations, missing data or other operational problems.
Exit planning concerns the controlled termination, transfer, replacement or internalisation of an outsourced service.
The objective is to preserve the firm's ability to continue the relevant activities when the existing outsourcing arrangement ends.
An exit may involve:
| Area | Primary Question | Example |
|---|---|---|
| Business continuity | How will the business continue during disruption? | Activate contingency procedures |
| Disaster recovery | How will affected technology be restored? | Recover the platform in another environment |
| Exit planning | How will the firm stop relying on the provider? | Transfer authentication services to another provider |
These arrangements may operate together.
For example, temporary continuity measures may help a bank maintain essential services while it executes a stressed exit.
Practitioner takeaway: Restoring a supplier's systems is not the same as ensuring continuity of the bank's business services, and neither necessarily demonstrates that the bank can exit the relationship.
PRA SS2/21 expects firms to consider both planned and stressed exits.
Although both involve ending or changing an outsourcing relationship, their circumstances can be very different.
A planned exit occurs under relatively controlled circumstances.
Examples include:
A planned exit may provide time for procurement, technical migration, testing and stakeholder communication.
For example, Northbridge decides not to renew its SecureAccess contract.
The bank begins a transition project several months before expiry.
It selects another provider, prepares its systems, migrates data and tests the new authentication platform.
The transition takes place according to an agreed schedule.
A stressed exit arises when circumstances threaten the continued viability or acceptability of an outsourcing arrangement.
Examples include:
Unlike a planned exit, the bank may have limited warning and reduced access to the supplier's people, systems or infrastructure.
A stressed exit may also occur while the supplier is dealing with a serious crisis.
That makes cooperation, access to data and technical assistance less certain.
Paragraphs 10.10–10.16 of SS2/21 explain the PRA's expectations concerning stressed exits.
The emphasis is on identifying viable ways of maintaining important business services when other continuity measures cannot adequately manage the disruption.
The PRA does not prescribe a single preferred form of stressed exit.
Instead, firms should consider options capable of achieving the necessary resilience outcomes.
An exit strategy should therefore be based on what is feasible for the particular service, rather than automatically requiring every firm to maintain a fully operational replacement provider.
SecureAccess suffers a destructive cyberattack that compromises its production and recovery environments.
Its infrastructure becomes unavailable for an extended period.
Northbridge cannot assume that normal disaster recovery procedures will succeed.
The bank may need to activate temporary business continuity arrangements while attempting to restore the service through another operating model.
This illustrates the purpose of stressed exit planning.
An exit plan must consider the circumstances in which the existing provider cannot be relied upon to deliver an orderly transition.
Paragraph 10.3 expects firms to implement, and require providers in material outsourcing arrangements to implement, appropriate business continuity plans addressing severe but plausible disruption.
For a TPRM analyst, assessing these arrangements requires more than confirming that a continuity document exists.
Begin by identifying:
For SecureAccess, the authentication platform supports customer access to digital banking.
Its availability therefore affects more than the supplier's own operations.
Relevant evidence may include:
The analyst should consider whether the evidence relates to the actual service being outsourced.
For example, a recovery test covering the supplier's internal corporate network may not provide meaningful assurance over its production authentication platform.
These concepts are particularly important.
Recovery Time Objective (RTO) is the target period for restoring a system or service following disruption.
Recovery Point Objective (RPO) expresses the maximum targeted amount of data loss, normally measured in time.
Impact tolerance describes the maximum tolerable level of disruption to an important business service, as established by the regulated firm under the applicable operational resilience framework.
These measures are connected, but they are not interchangeable.
Northbridge has established:
The supplier's recovery objective exceeds the bank's stated disruption tolerance.
This raises an immediate concern.
However, the analyst should not automatically conclude that the arrangement breaches the impact tolerance.
The relevant questions include:
If no effective alternative exists, a six-hour supplier recovery objective against a four-hour business service impact tolerance represents a significant potential resilience gap.
Practical lesson: The supplier's recovery target must be evaluated in the context of the bank's end-to-end service delivery, not in isolation.
Paragraphs 10.5–10.8 address important considerations for material cloud outsourcing.
The PRA recognises that firms may use different cloud resilience approaches.
These can include:
The appropriate choice depends on the nature and significance of the service.
The PRA does not prescribe a universal combination.
Suppose SecureAccess operates its authentication platform across three availability zones.
This may reduce exposure to the failure of an individual facility.
However, all three zones could still depend on shared services, such as:
An incident affecting a shared dependency could disrupt several zones simultaneously.
The analyst must therefore understand what failures the architecture is designed to withstand.
Operating across multiple regions may provide additional resilience.
However, geographical separation does not automatically eliminate common dependencies.
For example, the regions might depend on the same identity management platform or shared administrative access.
A compromised privileged account could potentially affect both environments.
Paragraph 10.8 specifically addresses the implications of deliberately destructive cyberattacks for data recovery capabilities.
This is an important distinction.
Traditional recovery planning may assume that backup data and recovery infrastructure remain trustworthy.
A destructive attack may compromise:
The analyst should consider whether recovery arrangements address these possibilities.
Relevant assurance questions include:
Security certification alone does not answer these questions.
A documented exit strategy is useful only if its proposed actions are credible.
Paragraph 10.13 expects firms to identify viable stressed exit options and consider those that best protect their operational resilience.
A TPRM analyst should evaluate both the proposed exit method and the assumptions supporting it.
One approach is to transfer the outsourced service to another provider.
However, the existence of alternative suppliers in the market does not necessarily mean that a rapid transition is possible.
The assessment should examine:
The bank might seek to operate the service internally.
This may reduce certain external dependencies, but it introduces others.
The bank would need appropriate:
The availability of these resources should be assessed rather than assumed.
Paragraph 10.16 encourages firms to consider temporary measures that could support important business services during a disrupted or stressed exit.
For example, a firm may negotiate arrangements allowing continued access to a technology platform for a transition period.
Other possibilities may involve temporary alternative service channels or arrangements for access to necessary data and technology.
Such measures must be assessed for viability.
They may reduce disruption without representing a complete long-term replacement.
A practical exit feasibility review should consider:
| Dimension | Key Question |
|---|---|
| Technical | Can systems and integrations be migrated or replaced? |
| Data | Can necessary information be retrieved, verified and transferred? |
| Operational | Can the service continue during the transition? |
| Contractual | Do relevant rights and obligations support the exit? |
| Financial | Are the expected costs understood and manageable? |
| Resources | Are required skills and capabilities available? |
| Timing | Can the transition be achieved within acceptable limits? |
| Dependencies | Can the exit proceed if the supplier or a subcontractor becomes unavailable? |
The assessment should identify assumptions that have not been validated.
For example, a project manager's estimate that migration will take eight weeks is not sufficient evidence that the bank could complete an emergency transition within that timeframe.
SS2/21 does not prescribe a single mandatory exit plan template.
However, paragraphs 10.17–10.25 provide expectations that can inform a practical assessment.
A well-developed plan may contain the following components.
Identify the outsourced service, its business importance and the intended outcomes of exit.
Define what successful exit means.
For example:
The plan should distinguish planned and stressed circumstances.
Relevant stressed scenarios might include:
Identify circumstances that could lead to consideration or activation of the exit plan.
Examples include:
Triggers should support timely escalation and decisions.
They should not be treated as automatic termination instructions without considering the circumstances.
Identify feasible alternatives and the limitations of each.
An option assessment should explain:
The plan should address access to information and supporting technology.
Relevant considerations include:
The plan should identify who is responsible for:
The plan should explain how its feasibility will be tested and reviewed.
It should also identify circumstances that trigger an update, such as changes to the service, technology or supplier dependencies.
A credible exit plan should explain not only what the organisation intends to do, but also why the proposed approach is achievable.
Business continuity and exit planning are not solely the responsibility of TPRM.
Paragraphs 10.17–10.23 describe the importance of early planning, clear responsibilities and appropriate governance.
The PRA expects firms to begin developing relevant arrangements during the pre-outsourcing phase once an outsourcing arrangement is identified as material.
Waiting until the supplier experiences difficulties is too late.
| Function | Illustrative Responsibility |
|---|---|
| Business Service Owner | Accountable for continuity and exit arrangements for the service |
| Operational Resilience | Advises on impact tolerances, scenarios and resilience testing |
| Technology | Evaluates technical recovery and migration feasibility |
| TPRM | Coordinates supplier assurance and tracks material dependencies |
| Information Security | Assesses security and data protection risks |
| Legal | Reviews contractual termination, assistance and access provisions |
| Procurement | Supports provider transition and alternative sourcing |
| Compliance | Advises on applicable regulatory obligations |
| Authorised Management | Approves relevant strategies and activation decisions |
The exact allocation depends on the firm's governance framework.
The analyst may not personally design the replacement infrastructure or execute an emergency migration.
Instead, the analyst should establish whether:
This is an assurance and coordination responsibility, rather than sole ownership of the entire exit process.
Testing is necessary because an apparently reasonable plan may fail when used.
Paragraphs 10.18–10.25 discuss the PRA's expectations for testing, governance and ongoing review.
Testing should be risk-based and proportionate to the arrangement.
A tabletop exercise allows stakeholders to work through a hypothetical disruption.
For example, Northbridge could simulate a severe SecureAccess outage.
Participants would discuss:
Tabletop exercises help identify weaknesses in procedures, coordination and responsibilities.
However, they do not necessarily prove that technical recovery or migration is feasible.
A technical exercise may test whether affected systems, applications and data can be restored.
For example, the supplier may recover the authentication platform in a secondary environment.
The analyst should examine whether the results demonstrate:
A full exit test may be impractical or introduce unacceptable risk.
However, firms should take reasonable steps to test exit plans, particularly stressed exit arrangements.
Depending on the service, practical validation could include:
Testing should not create disproportionate new operational or security risks.
Consider the following example.
SecureAccess reports that its disaster recovery exercise was successful.
The evidence consists of a two-page summary stating that recovery was completed.
Before accepting the result, the analyst should establish:
A supplier's assertion of a successful test should be evaluated against the relevant scope and supporting evidence.
An exit plan should remain relevant throughout the outsourcing lifecycle.
Paragraph 10.25 explains that continuity and exit plans should be reviewed periodically to reflect changes that may affect their feasibility.
Such changes could include:
A firm might use indicators such as:
| Indicator | Potential Concern |
|---|---|
| Repeated critical outages | Deteriorating service reliability |
| Missed recovery objectives | Reduced confidence in recovery capability |
| Unresolved resilience findings | Known weaknesses remain untreated |
| Significant subcontractor changes | Additional or altered dependencies |
| Deteriorating supplier financial position | Increasing risk of provider failure |
| Untested exit arrangements | Uncertainty over exit feasibility |
| Expired or outdated recovery documentation | Reduced assurance over current arrangements |
These are illustrative monitoring indicators, not a mandatory list prescribed by the PRA.
The analyst should understand how such information feeds into supplier governance and decisions concerning the outsourcing arrangement.
Return to the SecureAccess Cloud Ltd arrangement.
The following information is available:
The evidence establishes that SecureAccess has documented recovery arrangements.
However, it does not demonstrate that Northbridge can maintain its important business service within its impact tolerance during a severe provider disruption.
The supplier's six-hour recovery objective also creates a potential mismatch with the bank's four-hour tolerance.
Additional information is needed to establish whether alternative continuity measures adequately address that gap.
The proposed exit approach is not yet sufficiently supported.
An unvalidated migration estimate does not demonstrate that Northbridge could complete a stressed exit while maintaining essential operations.
The bank should therefore assess:
Finding ID: SS221-BCP-001
Title: Insufficient assurance over continuity and stressed exit arrangements.
Regulatory reference: PRA SS2/21, Chapter 10.
Observation: Northbridge relies on SecureAccess for customer authentication. The supplier's recovery objective exceeds the bank's stated impact tolerance, and the available evidence does not demonstrate that alternative continuity measures or a viable stressed exit strategy have been established.
Risk: A severe provider disruption could prevent the bank from maintaining digital banking access within acceptable limits.
Recommendation: Conduct an end-to-end resilience assessment, validate the provider's recovery capabilities, develop feasible contingency and stressed exit arrangements, and perform proportionate testing.
Proposed owner: Head of Digital Banking, supported by Operational Resilience, Technology and TPRM.
Status: Open.
This is an evidence-based finding.
It identifies what is known, what remains uncertain and what should happen next.
You are reviewing Northbridge Bank's proposed material outsourcing arrangement with SecureAccess.
The business owner provides the following statement:
SecureAccess has a Disaster Recovery Plan and operates across multiple availability zones. If the provider fails, we will terminate the contract and move to another authentication platform. The migration should take around eight weeks.
The Head of TPRM asks you to evaluate whether this statement provides adequate assurance.
Identify at least five assumptions in the business owner's statement that require further validation.
Consider technical, operational, contractual and resource dependencies.
Determine what additional evidence you would request to establish whether the bank can maintain its important business service within the four-hour impact tolerance.
Consider whether the proposed eight-week migration would remain feasible during:
Identify the factors that could make the scenarios different.
Recommend three activities that would provide meaningful evidence of continuity or exit readiness.
Explain what each activity would demonstrate and what it would not prove.
Write a recommendation of no more than 250 words addressing:
Assessment guidance: A strong response should distinguish documented plans from demonstrated capabilities, recognise the limitations of migration estimates and explain how the bank's operational resilience requirements influence the assessment.
This exercise is intended to reinforce the article. The integrated workplace assessment for the full SS2/21 pathway will be developed separately.
The supplier's plan must be assessed against the firm's own service dependencies and resilience requirements.
An RTO is a recovery target, not proof that recovery will succeed within that period.
Shared technology, management systems and subcontractor dependencies can create common failure points.
The ability to terminate an agreement does not demonstrate that the service can be replaced or restored.
A theoretical replacement is not necessarily a viable option.
Technical compatibility, capacity, timing and commercial feasibility must be considered.
An exit plan designed for a cooperative, financially stable provider may not remain effective during insolvency or a destructive cyber incident.
A tabletop exercise can demonstrate procedural preparedness but may not establish that data transfer, restoration or platform migration will work.
Changes to technology, business services and supplier dependencies can make an existing exit plan ineffective.
Business continuity and exit planning are central to managing the risks associated with material outsourcing arrangements under PRA SS2/21.
The key principles are:
The regulated firm remains responsible for resilience. Outsourcing service delivery does not transfer responsibility for managing the consequences of disruption.
Business continuity and exit planning are different. Continuity arrangements address disruption, while exit strategies address the termination or replacement of an outsourcing relationship.
Stressed exits require particular attention. A credible strategy must consider circumstances where the existing provider cannot support an orderly transition.
Impact tolerances must inform resilience assessments. Supplier recovery capabilities should be assessed in the context of the firm's end-to-end important business services.
Exit strategies must be feasible. Alternative providers, migration timelines, data portability and resource requirements should be supported by evidence.
Testing provides assurance. Documentation alone does not demonstrate that recovery or exit arrangements will work.
Responsibilities must be clear. Business owners, Operational Resilience, Technology, TPRM and other relevant functions need coordinated arrangements.
Exit readiness must be maintained. Changes in services, dependencies and technology can affect the feasibility of existing plans.
For a TPRM analyst, the objective is not simply to confirm that a supplier has submitted a Business Continuity Plan or Disaster Recovery Plan.
It is to assess whether the firm has sufficient evidence that important services can continue during disruption and that viable options exist if the outsourcing relationship must end.
Next Article: Sub-Outsourcing and Concentration Risk Under PRA SS2/21
The next article examines how reliance on subcontractors and shared infrastructure can introduce additional third-party risk.
You will learn how to:
The article will continue using Northbridge Bank as a fictional case study.
Prudential Regulation Authority: SS2/21, Outsourcing and Third Party Risk Management, November 2024.
Particularly relevant:
Prudential Regulation Authority: SS1/21, Operational Resilience: Impact Tolerances for Important Business Services.
Prudential Regulation Authority: PS7/26, Operational Resilience: Operational Incident and Third-Party Reporting.
Regulatory Version Note: This article uses the November 2024 version of SS2/21, effective as of November 2026. The March 2026 revised statement takes effect on 18 March 2027.
Educational Disclaimer: This resource is intended for professional education and development. Northbridge Bank, SecureAccess Cloud Ltd and all associated scenarios are fictional. The material does not constitute legal or regulatory advice. Readers should verify the applicable requirements using current official regulatory publications.