Enabling joint scenario testing between third parties and clients

In today’s interconnected world, a firm’s resilience is only as strong as its most vulnerable critical third party. As regulatory expectations around operational resilience continue to evolve, third parties, particularly those in the ICT and financial services sectors, are increasingly expected to participate in joint scenario testing with their clients. This shift is driven by regulatory frameworks aimed at strengthening the ability of financial institutions and their third parties to withstand and recover from operational disruptions.

While the benefits of these exercises are clear, so too are the challenges; many third parties face limited resources and significant pressure to meet rising demands.

The challenge: Rising expectations, limited capacity

Historically, financial institutions focused on internal scenario exercises to meet regulatory requirements. However, due to growing risks from outsourcing and reliance on third-party providers for critical services, regulators now emphasize collaborative testing. Key expectations include:

• Inclusion of scenario testing clauses in contracts
• Active third-party engagement in resilience planning
• Execution of joint testing exercises

Yet, third parties face constraints. Resource limitations and logistical hurdles make bespoke testing for each client impractical.

A framework for collaborative scenario testing

To address these challenges, WTW has developed a scalable, structured "Test Once, Use Many" approach to joint testing. This model aligns regulatory and contractual obligations with operational feasibility, offering independent facilitation of scenario testing workshops while minimizing the burden on third parties. Key components include:

1. Third-party led agenda: Prioritising services critical across a representative group of clients.
2. Scenario co-design: Developing plausible, multi-dimensional scenarios reflecting shared risks.
3. Confidential execution planning: Exercises under Chatham House Rules and breakout rooms with secure communication protocols.
4. Facilitated testing: Structured injects to simulate real-world conditions and communication requirements.
5. Post-exercise analysis: Confidential feedback highlighting strengths, vulnerabilities, and improvement opportunities.

Key benefits of WTW’s collaborative workshop

• Efficiency: A single, third-party-led scenario serves multiple clients, reducing repetitive testing.
• Cost-effectiveness: Shared resources and independent facilitation lower compliance costs.
• Minimal disruption: Streamlined coordination minimises operational downtime.
• Regulatory assurance: Support compliance with FCA, PRA, and DORA.

Why this matters now

Under regulations like the UK’s Operational Resilience framework, applicable from 31 March 2022, and the EU’s DORA, applicable from 17 January 2025, financial institutions must conduct joint scenario testing with critical suppliers. These exercises validate recovery plans, ensure continuity of critical services, and demonstrate preparedness for severe disruptions. While financial institutions bear regulatory responsibility, critical suppliers face growing direct and indirect risks, through designation or contractual obligations, as regulators expand oversight of third-party dependencies.

Let’s talk about it

This is not just a challenge; it’s an opportunity. By adopting collaborative, scalable "Test Once, Use Many" approaches, third parties can meet demands, build stronger partnerships and maintain commercial viability with their highly regulated financial services clients. How are you responding to client requests for joint scenario workshops? How have your contracts evolved to include resilience testing?

If you're exploring these questions, our Operational Risk Solutions team is here to help. Contact us to learn how our collaborative workshops can simplify joint testing and deliver real value.