---
title: [OR] [Pillar] [E4] [C6] Scenario Testing for Third-Party Failures
description: [OR] [Pillar] [E4] [C6] Scenario Testing for Third-Party Failures
image: https://blog.bcm-institute.org/hubfs/OR%20Pillar%20E4%20Morepost/%5BOR%5D%20%5BPillar%5D%20%5BE4%5D%20%5BC6%5D%20Scenario%20Testing%20for%20Third-Party%20Failures.jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Understanding Third-Party Risk Management (TPRM) in Operational Resilience
# \[OR\] \[Pillar\] \[E4\] \[C6\] Scenario Testing for Third-Party Failures
[![\[Pillar\] \[Banner\] \[C4\] Third-Party Risk Management](https://no-cache.hubspot.com/cta/default/3893111/17b06bdf-83ed-4b7f-9778-61a40cbf17f0.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/17b06bdf-83ed-4b7f-9778-61a40cbf17f0)As organisations become increasingly dependent on third parties, the ability to withstand and recover from third-party failures becomes a defining element of Operational Resilience.
Scenario testing is a critical tool that enables financial institutions to simulate disruptions and assess whether their Critical Business Services (CBS) can continue operating within defined impact tolerances.
Regulators such as the **Bangko Sentral ng Pilipinas (BSP)** and **Bank Negara Malaysia (BNM)** require financial institutions to conduct **rigorous yet plausible scenario testing, including** third-party failures.
These tests must validate whether the organisation can continue to deliver essential services despite disruptions to outsourced or externally supported operations.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/cb2bc914-636c-4d77-aa9f-06324259bc7c)
[![\[Pillar\] \[3_4\] \[Banner\] \[C4\] Third-Party Risk Management](https://no-cache.hubspot.com/cta/default/3893111/1ab1982e-100b-41e9-b830-23583eeb5b97.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1ab1982e-100b-41e9-b830-23583eeb5b97)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) Apr 17, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [![\[Pillar\] \[Banner\] \[C4\] Third-Party Risk Management](https://no-cache.hubspot.com/cta/default/3893111/17b06bdf-83ed-4b7f-9778-61a40cbf17f0.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/17b06bdf-83ed-4b7f-9778-61a40cbf17f0)
### eBook 4: Chapter 6
### Scenario Testing for Third-Party Failures
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/cb2bc914-636c-4d77-aa9f-06324259bc7c)
#### **Introduction**
[![\[OR\] \[Pillar\] \[E4\] \[C6\] Scenario Testing for Third-Party Failures](https://no-cache.hubspot.com/cta/default/3893111/dc829fbf-e80f-45bb-bfbd-fa660f70095b.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/dc829fbf-e80f-45bb-bfbd-fa660f70095b)As organisations become increasingly dependent on third parties, the ability to withstand and recover from third-party failures becomes a defining element of Operational Resilience.
Scenario testing is a critical tool that enables financial institutions to simulate disruptions and assess whether their Critical Business Services (CBS) can continue operating within defined impact tolerances.
Regulators such as the **Bangko Sentral ng Pilipinas (BSP)** and **Bank Negara Malaysia (BNM)** require financial institutions to conduct **severe but plausible scenario testing**, including scenarios involving third-party failures.
These tests must validate whether the organisation can continue to deliver essential services despite disruptions to outsourced or externally supported operations.
#### **Purpose of This Chapter**
This chapter provides structured approaches and **CBS-aligned templates** for conducting scenario testing focused on third-party failures. By the end of this chapter, readers will:
- Understand the role of scenario testing in TPRM and Operational Resilience
- Develop **third-party failure scenarios** aligned to CBS
- Use **standardised templates** for scenario testing
- Evaluate resilience against **impact tolerances (MTD, MTDL)**
- Strengthen recovery and response strategies
#### **Types of Third-Party Failure Scenarios**
Third-party failure scenarios should reflect **realistic and severe disruptions**, including:
- Vendor system outage (cloud, core banking, payment gateway)
- Cyberattack on third-party provider
- Third-party financial failure or insolvency
- Supply chain disruption (fourth-party failure)
- Data breach or data loss
- Service performance degradation
- Regulatory non-compliance by the vendor
#### **Scenario Testing Framework**
##### **Key Components of Scenario Testing**
| Component | Description |
| --- | --- |
| Scenario Definition | Description of disruption |
| CBS Impact | Critical services affected |
| Dependencies | Third parties involved |
| Impact Tolerance | MTD, MTDL thresholds |
| Response Actions | Steps to mitigate the impact |
| Recovery Strategy | Restoration approach |
| Lessons Learned | Improvement actions |
#### **Section 1: CBS-Level Scenario Testing Table**
##### **Template: Scenario Testing for CBS (High-Level)**
| CBS | Scenario | Third Party | Impact Description | MTD | MTDL | Response Strategy | Recovery Strategy | Outcome | Remarks |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
##### **Example: CBS-1 Deposit and Account Services**
| CBS | Scenario | Third Party | Impact Description | MTD | MTDL | Response Strategy | Recovery Strategy | Outcome | Remarks |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| CBS-1 | Core banking system outage | Core Banking Vendor | Customers are unable to access their accounts | 4 hrs | 0 data loss | Activate the DR site | Switch to the backup system | Within tolerance | Tested annually |
| CBS-1 | Data breach at cloud provider | Cloud Vendor | Exposure of customer data | Immediate | Minimal | Incident response activation | Data recovery & containment | Partial breach | Improve controls |
#### **Section 2: Sub-CBS Scenario Testing (Detailed Processes)**
##### **Template: Scenario Testing for Sub-CBS**
| Sub-CBS Code | Sub-CBS | Scenario | Third Party | Impact | MTD | Response Action | Recovery Action | Status |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
##### **Example: CBS-1 Detailed Processes**
| Sub-CBS Code | Sub-CBS | Scenario | Third Party | Impact | MTD | Response Action | Recovery Action | Status |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 1.1 | Customer Onboarding | KYC system failure | KYC Vendor | Delayed onboarding | 24 hrs | Manual onboarding | Restore system | Within tolerance |
| 1.6 | Deposit Transactions | Payment processor outage | Payment Vendor | Transactions fail | 2 hrs | Queue transactions | Switch provider | Exceeded tolerance |
| 1.11 | Digital Access | Mobile app outage | Cloud Provider | Customers are unable to log in | 1 hr | Notify customers | Failover to DR | Within tolerance |
#### **Section 3: Severe but Plausible Scenarios**
##### **Template: Severe Scenario Testing**
| Scenario ID | Scenario Description | Type (Cyber/Operational/etc.) | CBS Impacted | Third Party | Severity | Likelihood | Overall Risk | Remarks |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
##### **Example Scenarios**
| Scenario ID | Scenario Description | Type | CBS Impacted | Third Party | Severity | Likelihood | Overall Risk | Remarks |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| S1 | Cloud provider regional outage | Operational | CBS-1, CBS-2 | Cloud Vendor | High | Medium | High | Multi-CBS impact |
| S2 | Ransomware attack on the vendor | Cyber | CBS-1 | IT Vendor | Critical | Medium | Critical | Data risk |
| S3 | Vendor insolvency | Financial | CBS-2 | Payment Vendor | High | Low | Medium | Replace vendor |
#### **Section 4: Scenario Testing Evaluation Template**
##### **Template: Test Results and Evaluation**
| Scenario | CBS | Test Objective | Result | Within Tolerance (Y/N) | Gaps Identified | Action Plan | Owner | Timeline |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
##### **Example**
| Scenario | CBS | Test Objective | Result | Within Tolerance | Gaps Identified | Action Plan | Owner | Timeline |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Cloud outage | CBS-1 | Validate DR capability | Success | Y | None | Maintain readiness | IT | Ongoing |
| Payment failure | CBS-2 | Ensure continuity | Failed | N | No backup vendor | Add redundancy | Ops | 3 months |
#### **Section 5: Integration with Operational Resilience**
##### **Mapping Scenario Testing to the OR Framework**
| OR Component | Scenario Testing Role |
| --- | --- |
| CBS | Identify impacted services |
| BIA | Define impact tolerance |
| TPRM | Identify third-party dependencies |
| Crisis Management | Execute response |
| Recovery Planning | Validate recovery strategies |
#### **Section 6: Best Practices for Scenario Testing**
**1. Use Severe but Plausible Scenarios**
Focus on realistic disruptions with significant impact.
**2. Include Third and Fourth Parties**
Test extended supply chain dependencies.
**3. Align with Impact Tolerance**
Validate against MTD and MTDL thresholds.
**4. Conduct Regular Testing**
At least annually for critical vendors.
**5. Involve Cross-Functional Teams**
Include IT, Risk, Business Units, and Vendors.
**6. Capture Lessons Learned**
Continuously improve resilience strategies.
#### **Section 7: Implementation Roadmap**
##### **Step-by-Step Approach**
| Step | Action |
| --- | --- |
| 1 | Identify CBS and supporting vendors |
| 2 | Define impact tolerances (MTD/MTDL) |
| 3 | Develop scenarios |
| 4 | Execute tests |
| 5 | Evaluate results |
| 6 | Identify gaps |
| 7 | Implement improvements |
#### **Key Takeaways**
- Scenario testing validates **real-world resilience capability**
- Third-party failures must be explicitly tested
- CBS alignment ensures **business-focused resilience**
- Severe scenarios reveal hidden vulnerabilities
- Continuous testing improves **preparedness and response**
**[](https://cta-redirect.hubspot.com/cta/redirect/3893111/a87f934a-0808-4f9a-a6cf-dc1c897d31d4)**
Scenario testing is a critical component of Third-Party Risk Management and Operational Resilience. It transforms theoretical risk assessments into practical insights by simulating real-world disruptions and evaluating organisational readiness.
By aligning scenario testing with Critical Business Services and incorporating third-party failure scenarios, financial institutions can ensure that they are prepared not only for internal disruptions but also for failures across their extended ecosystem.
This capability is essential for meeting regulatory expectations under BSP Circular No. 1203 and BNM guidelines, and for maintaining customer trust and service continuity in an increasingly interconnected world.
[![\[Pillar\] \[3_4\] \[Banner\] \[C4\] Third-Party Risk Management](https://no-cache.hubspot.com/cta/default/3893111/1ab1982e-100b-41e9-b830-23583eeb5b97.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1ab1982e-100b-41e9-b830-23583eeb5b97)
| **C1** | **C2** | **C3** | **C4** |
| --- | --- | --- | --- |
| [![\[OR\] \[Pillar\] \[E4\] \[C1\] Introduction to TPRM](https://no-cache.hubspot.com/cta/default/3893111/82945f27-604a-406d-83f2-9df0180e126f.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/82945f27-604a-406d-83f2-9df0180e126f) | [![\[OR\] \[Pillar\] \[E4\] \[C2\] Types of Third-Party Risks](https://no-cache.hubspot.com/cta/default/3893111/714cfc41-261a-42e0-9c2d-f517bd787323.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/714cfc41-261a-42e0-9c2d-f517bd787323) | [![\[OR\] \[Pillar\] \[E4\] \[C3\] Framework and Lifecycle](https://no-cache.hubspot.com/cta/default/3893111/e8b02e92-416f-4ab2-bb4e-0499db349f40.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/e8b02e92-416f-4ab2-bb4e-0499db349f40) | [![\[OR\] \[Pillar\] \[E4\] \[C4\] Governance and Operating Model](https://no-cache.hubspot.com/cta/default/3893111/34bdac31-acb4-4daa-8d16-ff1b5ab43747.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/34bdac31-acb4-4daa-8d16-ff1b5ab43747) |
| **C5** | **C6** | **C7** | **C8** |
| [![\[OR\] \[Pillar\] \[E4\] \[C5\] Tools, Templates and Scoring Models](https://no-cache.hubspot.com/cta/default/3893111/453d5c46-1981-4519-bfee-4d9e4aa32d21.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/453d5c46-1981-4519-bfee-4d9e4aa32d21) | [![\[OR\] \[Pillar\] \[E4\] \[C6\] Scenario Testing for Third-Party Failures](https://no-cache.hubspot.com/cta/default/3893111/dc829fbf-e80f-45bb-bfbd-fa660f70095b.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/dc829fbf-e80f-45bb-bfbd-fa660f70095b) | [![\[OR\] \[Pillar\] \[E4\] \[C7\] Regulatory Compliance Checklist](https://no-cache.hubspot.com/cta/default/3893111/7e12ff2a-59e6-40cc-ac60-e0b17bcfd00e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7e12ff2a-59e6-40cc-ac60-e0b17bcfd00e) | [![\[OR\] \[Pillar\] \[E4\] \[C8\] Case Study_ Implementation in Banking](https://no-cache.hubspot.com/cta/default/3893111/51d31b0f-dbf9-44ef-a127-999420c9fbd4.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/51d31b0f-dbf9-44ef-a127-999420c9fbd4) |
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-05-20T10:06:10.347Z",
"datePublished" : "2026-04-17T13:55:07.000Z",
"headline" : "[OR] [Pillar] [E4] [C6] Scenario Testing for Third-Party Failures",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-pillar-e4-c6-scenario-testing-for-third-party-failures",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```