.png)
.png)
A useful supplier dependency record connects a critical or time-sensitive business process to the outside service it needs, the latest time that service can return, and the options available if it does not. The template below gives BCM teams the fields and interview questions needed to document that relationship during a BIA.
Use it as an add-on to BIA pre-work and interviews. Its purpose is to test whether supplier timing, alternatives, and workarounds support the process recovery need. Contract review, supplier due diligence, cybersecurity assessment, and remediation remain separate activities.
Which supplier dependencies belong in the BIA?
Do not turn the template into a list of every company the organization pays. Include a supplier or external service when one or more of these conditions apply:
- A critical process cannot resume without the supplier’s service, product, data, facility, or specialist support.
- The process reaches serious impact quickly.
- No practical substitute has been identified.
- A workaround has limited capacity or duration.
- The supplier’s documented commitment may not support the process recovery need.
- One supplier supports several priority processes.
This screening rule keeps the BIA focused on operational consequences. It also maintains the boundary Michael Herrera describes in The BIA Inputs Most Teams Miss: “The goal is not to turn the BIA into a third-party risk assessment.”
ISO/TS 22317:2021 provides current guidance for a documented BIA process that can be adapted to an organization’s needs, resources, and constraints. ISO/TS 22318:2021 applies business continuity principles to supplier relationships and supply-chain continuity. Neither publication requires the fields or status model below. They are implementation guidance.
The BIA does not need every supplier. It needs the suppliers that can delay a critical process beyond its recovery target.
BIA supplier dependency template
Create one record for each in-scope supplier service. If one supplier provides several materially different services, record them separately.
| Field | What to capture |
|---|---|
| Supplier and service | Recognized supplier name and the specific product, service, data, facility, or resource used |
| Supported process and critical output | Process supported, point of use, and the minimum output that must continue or resume |
| Process recovery need | Approved or proposed process recovery target and any critical period |
| Supplier outage tolerance | Latest acceptable time for the supplier service to return before the recovery target or critical output is threatened |
| Contracted commitment | Relevant SLA, contract term, or stated restoration commitment |
| Alternative and switching time | Substitute supplier, internal option, inventory, redundant service, or alternate process, including the time and conditions needed to activate it |
| Workaround capacity and duration | Steps, owner, required resources, percentage or volume supported, and maximum sustainable duration |
| Internal owners | Business process owner and supplier-relationship owner |
| Recovery fit | Meets stated need, gap, or unknown |
| Evidence status | Demonstrated, documented only, outdated, or missing, with source and date |
| Action and review trigger | Issue, action owner, due date, destination process, normal review date, and events that should reopen the record |
Supplier outage tolerance is a local working field, not a standardized supplier RTO or another name for maximum tolerable period of disruption. Derive it from the process recovery need, minimum critical output, available inventory, workaround capacity, and other operating conditions.
Pre-populate contract and supplier information when procurement or vendor-management records are available. Ask the business owner to confirm how the service is used and what happens when it is unavailable. Do not expect one participant to know both the operational and contractual answers.
Questions to validate during the BIA interview
- What stops or falls below an acceptable level if this service is unavailable?
- What minimum output must continue, and for how long?
- When must the supplier service return?
- What commitment is documented, and where?
- Is the team confusing availability, response time, or support priority with restoration?
- How quickly can the alternative or workaround start?
- What volume can it support, and how long can it last?
- What evidence supports those assumptions?
- Who owns each unresolved decision?
The interview should expose an unsupported recovery assumption, not negotiate the contract or assess every supplier control.
Evaluate recovery fit and evidence separately
A supplier can appear to meet the stated need on paper without demonstrating that capability. Track two dimensions so those conditions do not collapse into one status.
Recovery fit
| Status | Use when |
|---|---|
| Meets stated need | The documented supplier commitment, viable alternative, or sustainable workaround supports the process recovery need. This is not a guarantee of performance. |
| Gap | Known timing, switching, capacity, or duration does not support the process need. |
| Unknown | A material answer is missing or conflicting, so recovery fit cannot be determined. |
Evidence status
| Status | Use when |
|---|---|
| Demonstrated | Relevant exercise results or incident-performance evidence supports the recorded assumption. |
| Documented only | A contract, SLA, supplier statement, procedure, or business estimate exists, but comparable performance has not been demonstrated. |
| Outdated | Evidence exists but no longer meets the organization’s age or relevance criteria. |
| Missing | No credible source has been retained. |
A record might therefore read meets stated need, documented only or gap, demonstrated. The first needs validation. The second gives the organization stronger evidence for a treatment decision.
Worked supplier dependency example
Consider a hypothetical claims process with a 24-hour recovery target. After the first eight hours, the organization must maintain at least 60 percent of normal claims volume. Falling below that level for more than one business day creates an unacceptable customer and regulatory backlog.
The process depends on an external document-imaging service:
- The contract states a 48-hour restoration commitment.
- A manual workaround can support 30 percent of normal volume for no more than 12 hours.
- Moving to an alternate provider requires ten business days for contracting, data transfer, configuration, and testing.
- No exercise or comparable incident record supports the workaround estimate.
Recovery fit: Gap. The supplier commitment exceeds the 24-hour process target, the workaround falls below the 60 percent minimum output and expires too soon, and the alternate cannot be activated within the required period.
Evidence status: Documented only. The contract and business estimate are recorded, but demonstrated performance evidence is absent.
The BIA should document the consequence and route the work. The process owner can confirm the minimum output. Procurement or vendor management can examine the supplier commitment. The recovery-strategy process can assess a stronger workaround or alternate service. For deeper recovery-target guidance, see MHA Consulting’s article on setting defensible RTO and RPO targets.
A supplier name is not a dependency record. The useful record explains the service, timing, alternatives, evidence, and owner.
Assign and maintain the follow-up
The BCM team should control the template and its connection to the BIA, but it should not own every supplier decision.
| Role | Responsibility |
|---|---|
| Business process owner | Explain operational reliance, minimum critical output, consequences, and workaround capacity. |
| BCM program owner | Apply the template consistently, connect the dependency to the process need, report results, and track the handoff. |
| Procurement or vendor manager | Confirm relationship ownership, contract evidence, renewal timing, and supplier follow-up. |
| Risk, security, compliance, or legal | Complete deeper assessment, control review, or contract work within the appropriate process. |
Every gap, unknown, outdated record, and missing evidence item needs a named owner and due date. Reopen the record when the supplier, service, contract, process target, workaround, owner, or evidence changes. Supplier incidents, failed exercises, acquisitions, and contract renewals are useful event-based triggers.
Quality reviews should also look across processes. The same supplier may appear under different names or support several business units. Program owners need to identify shared dependencies, unresolved gaps, stale evidence, and actions without owners.
Keeping Supplier Dependency Records Consistent and Current
BCMMetrics' BIA On-Demand supports pre-work questionnaires, configurable impact categories and recovery inputs, internal and external dependencies, and BIA reporting. These capabilities can help a program owner collect and review consistent dependency information across business units.
The template in this article is practitioner guidance. It is not presented as a standard native BIA On-Demand template. Before configuring or selecting a platform, confirm that it can retain the fields, relationships, evidence references, statuses, ownership, and reporting your program requires.
Software can organize the data. Practitioners still need to challenge assumptions, evaluate evidence, assign decisions, and follow through.
Build recovery priorities on better supplier data
Copy the template into your existing pre-work and interview process. Apply it only to dependencies that can materially affect critical or time-sensitive work. Then evaluate recovery fit and evidence separately so a contractual promise is not mistaken for demonstrated capability.
To see how stronger inputs support recovery decisions, watch From BIA Inputs to Defensible Recovery Priorities. If dependency records are difficult to manage across questionnaires and spreadsheets, take the BIA On-Demand virtual tour.
