Documented exit plans are not tested exit plans. How can you evidence your exit from material supplier arrangements is feasible?
FourthLine's Supplier Exit Testing Managed Service develops, maintains, and tests supplier exit plans for material outsourcing arrangements; producing regulatory-grade feasibility evidence against PRA SS2/21, DORA Article 28, FCA SYSC 15A, and FCA FG15/5. The FCA's post-CrowdStrike guidance has made the distinction between documented intent and tested capability explicit. This service closes that gap.
The Problem this solves
Most regulated firms have documented supplier exit plans. Very few have tested them under realistic conditions. A documented plan that has never been walked through against a stressed scenario; supplier insolvency, material service degradation, no-notice disruption, does not constitute evidence of exit feasibility. It constitutes documentation of intent.
The FCA's October 2024 post-CrowdStrike guidance made this distinction explicit: weak exit strategies and the inability to stand up alternative arrangements at pace are named risk areas requiring attention. PRA supervisors applying SS2/21 are asking the same question in supervisory reviews. DORA Article 28 requires firms with EU-connected operations to test exit strategies for ICT services where dependency or substitutability risk is elevated.
The gap is not the plan. The gap is the evidence that the plan is feasible and works.
Tier 1: Exit Plan Diagnostic
- Supplier dependency mapping across all material outsourcing arrangements
- Exit plan documentation review against PRA SS2/21 and DORA requirements
- Gap register: documentation gaps versus execution gaps, clearly distinguished
- Supplier concentration risk assessment
- Risk-based tiering of supplier portfolio (Standard vs Enhanced testing category)
- Prioritised testing roadmap with regulatory risk weighting
- Board-ready findings report and Full Programme proposal
Fee:
£15k–£25k (fixed)
Payment:
50% on commencement, 50% on delivery
Delivered by:
Senior FourthLine Certified Resilience practitioners
Tier 2: Full Testing Programme
- All Tier 1 deliverables, plus:
- Exit plan development or update per in-scope supplier; transition steps, viable exit options, data portability, financial cost estimates
- Contractual gap analysis — notice periods, data return, co-operation obligations, transition assistance provisions
- Stressed exit scenario design — realistic disruption conditions, calibrated to sector and supplier profile
- Standard testing: structured tabletop walkthrough per supplier
- Enhanced testing: scenario-based exercise plus technical validation (for highest-risk suppliers)
- Execution gap analysis: where plans failed, stalled, or depended on unvalidated assumptions
- Regulatory evidence pack — structured for supervisory review against PRA SS2/21 and DORA Article 28
- Lessons-learned register and remediated exit plan documentation
- SMF24 briefing and board reporting on programme outcomes
Fee:
£50k–£100k (fixed)
Contractual Period
12 Months
Delivered by:
Senior FourthLine Certified Resilience practitioners.
Tiered Fee Structure
Diagnostic
5–10 suppliers assessed. Risk tiering. Testing roadmap. Full Programme proposal.
£15,000-£25,000 + VAT
Full Standard
10–20 suppliers. Standard testing tier. Dual Regulated.
£50,000-£80,000 + VAT
Full - Enhanced
20–60 suppliers. Standard and enhanced testing. DORA in scope. Technical validation included.
£80,000 – £100,000 + VAT
Why Choose Fourthline for your Supplier Exit Testing Compliance
Sector delivery record
FourthLine has delivered supplier exit testing programmes for insurers, banks, and payments firms - including DORA-compliant engagements covering cloud providers, SaaS applications, and intragroup ICT arrangements. This is not a methodology being applied for the first time.
Risk-based tiering that satisfies regulators
Not every supplier gets the same test and the rationale for tiering is documented and defensible under supervisory review. Our proportionality approach mirrors the principle regulators themselves apply, so the programme structure itself becomes part of the evidence base.
Honest exit feasibility findings
Our feasibility statements say whether a plan is feasible and under what conditions it may not be. A test programme that produces uniformly positive results raises the same questions with a supervisor as a self-assessment with no identified gaps. We design tests that find the real gaps and opportunities for improvement.
We engaged FourthLine to stress-test our supplier exit plans following a DORA gap review. They identified execution gaps that our documentation review had entirely missed. The live test was uncomfortable in the right way, and the remediated exit plans we now hold are ones we are confident would actually work under pressure.
how this connects to the wider programme
Supplier exit testing is most effective when it builds on an Op Res & BCM foundation.
IBS dependency mapping produced in the BCM programme identifies the suppliers whose failure would breach an impact tolerance. Those are the suppliers whose exit plans need to be tested. FourthLine's approach ensures the testing programme is anchored to the same IBS and impact tolerance architecture your regulator has already reviewed; not a separate, disconnected exercise.