DORA, Business Continuity & Third-Party Risk: The Hidden Gaps in Resilience

In this exclusive Q&A, Jeff Simmons, Senior Advisor at Alba Partners and former Chief Risk Officer at MUFG Securities Europe, discusses strategies for building resilience in third-party risk management beyond regulatory compliance.

What strategies reinforce exit plans in a stricter regulatory environment?

Organizations should exceed regulatory requirements. Exit strategies, often seen as unenforceable, should be tailored to critical functions. For example, categorizing processes (e.g., trading platforms, payroll) and developing materiality-specific strategies ensures readiness for supplier exits. Breaking problems into manageable components aids actionable planning.

How do exit plans tie into business continuity efforts?

Exit plans must include clear triggers linked to supplier agreements. Provisions for suppliers’ business continuity should integrate into the organization’s framework. Concentration risks and interdependencies (e.g., cloud services impacting payroll providers) highlight the need for robust contingency planning.