R-001Third-party / OperationalOpenOutside appetite

Critical ICT third-party concentration

Description

Over-reliance on a small number of critical ICT providers (cloud, payments switching, KYC) creates concentration and substitutability risk. Failure or exit of a Tier-1 provider could disrupt important business services beyond impact tolerance.

Rating

Treatment: Mitigate

INHERENT

Critical

RESIDUAL

High

vs last review

Remediation

1/3 plans closed

Mitigation is attributed per action plan and issue — a risk may need several plans across issues before it is fully mitigated.

Issues

Tier-1 cloud provider exit plan is stale and untested

ISS-001

1/2

Critical third-party concentration exceeds risk appetite

ISS-004

0/1

Mitigating action plans

AP-001Refresh and board-approve the Tier-1 cloud exit planMitigated

Mitigated by AP-001 under ISS-001 · 28 Mar 2026

AP-002Run a substitutability test for the primary cloud provider45%

Contributing · AP-002 under ISS-001

AP-004Onboard a secondary KYC provider to reduce concentration10%

Contributing · AP-004 under ISS-004