In today’s interconnected world, a firm’s resilience is only as strong as its most vulnerable critical third party. As regulatory expectations around operational resilience continue to evolve, third parties, particularly those in the ICT and financial services sectors, are increasingly expected to participate in joint scenario testing with their clients. This shift is driven by regulatory frameworks aimed at strengthening the ability of financial institutions and their third parties to withstand and recover from operational disruptions.
While the benefits of these exercises are clear, so too are the challenges; many third parties face limited resources and significant pressure to meet rising demands.
Historically, financial institutions focused on internal scenario exercises to meet regulatory requirements. However, due to growing risks from outsourcing and reliance on third-party providers for critical services, regulators now emphasize collaborative testing. Key expectations include:
Yet, third parties face constraints. Resource limitations and logistical hurdles make bespoke testing for each client impractical.
To address these challenges, WTW has developed a scalable, structured "Test Once, Use Many" approach to joint testing. This model aligns regulatory and contractual obligations with operational feasibility, offering independent facilitation of scenario testing workshops while minimizing the burden on third parties. Key components include:
Under regulations like the UK’s Operational Resilience framework, applicable from 31 March 2022, and the EU’s DORA, applicable from 17 January 2025, financial institutions must conduct joint scenario testing with critical suppliers. These exercises validate recovery plans, ensure continuity of critical services, and demonstrate preparedness for severe disruptions. While financial institutions bear regulatory responsibility, critical suppliers face growing direct and indirect risks, through designation or contractual obligations, as regulators expand oversight of third-party dependencies.
This is not just a challenge; it’s an opportunity. By adopting collaborative, scalable "Test Once, Use Many" approaches, third parties can meet demands, build stronger partnerships and maintain commercial viability with their highly regulated financial services clients. How are you responding to client requests for joint scenario workshops? How have your contracts evolved to include resilience testing?
If you're exploring these questions, our Operational Risk Solutions team is here to help. Contact us to learn how our collaborative workshops can simplify joint testing and deliver real value.
