Concentration you did not underwrite

Concentration limits are ordinary practice on the asset side. No institution of any seriousness allows a single counterparty to hold an unbounded share of its exposure, and the limits are set, monitored and breached loudly. On the technology side the same institution will often accept that one hosting provider carries every production system, one supplier delivers the accounting ledger and the reporting layer, and one identity service controls access to both. Nobody underwrote that. It accumulated.

The firm maps its technology dependencies the way it maps its credit book. Each service is recorded with its supplier, the business processes that depend on it, the maximum tolerable outage, the location of the data and the terms on which the relationship can end. The map is maintained by the Information and Data division and reviewed by the Information Governance Committee. The purpose is not an inventory for its own sake. It is to make a concentration visible before it is tested.

Three concentrations appear repeatedly at institutions of our size. Hosting is the obvious one and the best understood. Identity is the dangerous one, because a single sign-on failure removes access to every system at once and cannot be worked around by staff who cannot log in. The third is data format, since a supplier whose export produces a file nobody else can read holds the relationship regardless of what the contract says. Exit cost is a concentration measure.

Contracts are read for the ending rather than the beginning. Our third-party terms require an agreed exit period, a defined export format, assistance with migration at a stated rate, and the right to test a restoration from that export at least annually. The test matters more than the clause. An export that has never been read back is an assumption, and the practice here is to convert assumptions into evidence on a schedule rather than during an incident.

Proportionate automation is the discipline that governs how far this goes. Automation is introduced where the cost of an error is understood and where a named person answers for the outcome. A supplier relationship becomes a form of automation once a process cannot be performed without it, and the same question applies: if this fails, who is accountable, what do they do first, and how long can the firm operate while they do it. Those answers are recorded beside the dependency.

The reason a financial institution should care is that its clients cannot see any of this and are entitled to assume it has been done. A client who has satisfied itself about our balance sheet, our custody arrangements and our conflicts position has not asked whether one supplier failure would stop reporting for a fortnight. That question belongs to us. Technology concentration is an operational risk in name and a client obligation in substance.

Published 2022-01-19 by the Information & Data division. Research is prepared for eligible counterparties and does not constitute advice.