[OR] [P2] [S4] [ST] [C8] Mapping Dependencies for Scenario Testing

[P2] [S4] Chapter 8

Mapping Dependencies for Scenario Testing

Introduction

Operational resilience is fundamentally dependent on the interconnected network of people, processes, technology, and third parties that enable the delivery of Critical Business Services (CBS).

Scenario testing that does not adequately reflect these interdependencies risks becoming overly simplistic and failing to identify real vulnerabilities.

Dependency mapping, conducted in earlier stages of the operational resilience methodology, provides the foundation for realistic and effective scenario testing.

It reveals how services are delivered end-to-end and how disruptions can propagate across the organisation and its ecosystem.

This chapter focuses on how dependency mapping outputs should be leveraged to design, execute, and evaluate scenario testing in a way that reflects true operational complexity.

Purpose of the Chapter

The purpose of this chapter is to demonstrate how dependency mapping should be used to ensure that scenario testing accurately reflects real-world interconnections, identifies critical vulnerabilities, and tests the resilience of end-to-end service delivery.

Use of Mapping Outputs (People, Process, Technology, Third Parties)

Dependency mapping provides a structured view of all components supporting a CBS. These outputs are essential inputs for scenario design.

Key Dependency Categories

1.1 People

• Key operational staff and subject matter experts
• Decision-makers and crisis management teams
• Skills and knowledge dependencies

Scenario Application:

• Simulate staff unavailability (e.g., pandemic, attrition, access restrictions)
• Test decision-making under constrained resources

1.2 Processes

• Operational workflows and procedures
• Manual and automated activities
• Process handoffs and dependencies

Scenario Application:

• Disrupt critical process steps
• Introduce delays or failures in workflow execution
• Test the effectiveness of manual workarounds

1.3 Technology

• Applications and systems supporting CBS
• Infrastructure (servers, networks, cloud platforms)
• Data flows and integrations

Scenario Application:

• Simulate system outages or degradation
• Test failover and recovery mechanisms
• Assess data integrity and system resilience

1.4 Third Parties

• Vendors and service providers
• Outsourced functions
• External networks and utilities

Scenario Application:

• Simulate vendor outages or service degradation
• Test reliance on external providers
• Evaluate contractual and operational resilience

Outcome

By using mapping outputs, scenarios become:

• Realistic and data-driven
• Aligned with actual service delivery structures
• Capable of testing end-to-end resilience

Identifying Critical Dependencies and Concentration Risks

Not all dependencies are equal. Scenario testing must prioritise those that are critical to the delivery of CBS.

Critical Dependencies

These are components whose failure would:

• Directly disrupt CBS delivery
• Cause impact tolerance breaches
• Trigger cascading failures

Examples:

• Core banking systems
• Payment processing engines
• Key operational teams
• Critical third-party providers

Concentration Risks

Concentration risk arises when:

• Multiple CBS rely on a single dependency
• There is over-reliance on a single vendor, system, or team
• Limited redundancy or alternatives exist

Examples:

• Single cloud service provider supporting multiple systems
• One vendor handling all payment processing
• Centralised operations team supporting multiple CBS

Scenario Testing Implications

• Design scenarios that target critical dependencies
• Simulate the failure of highly concentrated resources
• Assess whether alternative arrangements are effective

This enables organisations to:

• Identify single points of failure
• Evaluate the resilience of high-risk dependencies
• Prioritise remediation and diversification strategies

Testing Upstream and Downstream Impacts

Operational resilience requires understanding how disruptions propagate across the service delivery chain.

Upstream Dependencies

These are inputs required for CBS delivery.

Examples:

• Data inputs from upstream systems
• Third-party services feeding into operations
• Pre-processing activities

Testing Focus:

• What happens when upstream inputs are unavailable or delayed?
• Can the CBS continue operating with degraded inputs?

Downstream Dependencies

These are outputs or services that depend on the CBS.

Examples:

• Customer-facing channels
• Reporting and regulatory submissions
• Settlement and reconciliation processes

Testing Focus:

• How does CBS disruption affect downstream services?
• Are there cascading impacts across business units?

End-to-End Impact Assessment

Scenario testing should:

• Trace disruption from origin to final impact
• Evaluate how failures cascade across upstream and downstream components
• Assess whether containment measures are effective

This ensures that testing reflects real operational dynamics, rather than isolated events.

Visualising Interconnections for Scenario Design

Complex interdependencies are often difficult to understand without a visual representation.

Visualisation tools play a critical role in scenario development.

Types of Visualisation

• Dependency Maps:
  Show relationships between CBS and supporting components
• Process Flow Diagrams:
  Illustrate step-by-step workflows
• Network Diagrams:
  Highlight technology and system interconnections
• Ecosystem Maps:
  Display third-party and external dependencies

Benefits of Visualisation

• Enhances understanding of complex relationships
• Identifies critical paths and bottlenecks
• Highlights concentration risks and interdependencies
• Supports scenario design and stakeholder communication

Application in Scenario Testing

Visualisation enables organisations to:

• Design scenarios that reflect realistic disruption pathways
• Identify where to introduce scenario “injects.”
• Communicate scenarios effectively to participants
• Analyse cascading effects during and after testing

Practical Dependency Mapping Table for Scenario Testing

The following table illustrates how dependency mapping can be structured and used in scenario testing:

This table:

• Provides a structured view of dependencies
• Supports identification of critical components
• Enables targeted scenario design

Mapping dependencies is a critical enabler of effective scenario testing.

It ensures that scenarios reflect the true complexity of service delivery, capturing the intricate interconnections between people, processes, technology, and third parties.

By leveraging mapping outputs, organisations can:

• Identify critical dependencies and concentration risks
• Test upstream and downstream impacts
• Design realistic scenarios with cascading effects
• Visualise and understand complex interdependencies

Ultimately, dependency mapping transforms scenario testing from a theoretical exercise into a comprehensive, end-to-end validation of operational resilience, ensuring that organisations are prepared to manage disruptions in a complex and interconnected environment.