Dossier · Reversibility audit
Decide on a residual dependency
Qualify what still requires the source after the test, then have the competent authority choose whether to accept, reduce or replace it.
Decision rule
Do not let an average compensate for a critical impossibility
A residual dependency is an asset, right, service or item of know-how still required from the source after recovery. Each is examined separately: a favourable overall score cannot erase an active account, a missing right or a critical function that was not restored.
Qualification
Describe the effect before choosing treatment
The decision rests on observations attached to the tested scenario, not on an abstract view of the supplier.
Accept
Make acceptance a bounded decision
The authority may accept a dependency when it understands the plausible effect, treatment cost, monitoring conditions and the point at which the decision must be revisited. Acceptance names an owner and is never implicit.
Reduce
Choose a measure that changes exit capability
Every treatment must alter an observation from the test and schedule a new verification.
Treatments and closure evidence
| Treatment | Intended effect | Closure evidence |
|---|---|---|
| Terms and assistance | Obtain missing assets, time or cooperation | Signed contract and executed exercise |
| Architecture | Isolate or replace a captive component | Replayed deployment and journeys |
| Second source | Reduce a single point of failure | Tested switch to the target |
| Skills | Remove an indispensable source intervention | Operation performed by target team |
| Monitoring | Detect before capability is lost | Exercised threshold, alert and decision |
Terms and assistance
- Intended effect
- Obtain missing assets, time or cooperation
- Closure evidence
- Signed contract and executed exercise
Architecture
- Intended effect
- Isolate or replace a captive component
- Closure evidence
- Replayed deployment and journeys
Second source
- Intended effect
- Reduce a single point of failure
- Closure evidence
- Tested switch to the target
Skills
- Intended effect
- Remove an indispensable source intervention
- Closure evidence
- Operation performed by target team
Monitoring
- Intended effect
- Detect before capability is lost
- Closure evidence
- Exercised threshold, alert and decision
Replace
Trigger exit when the residual remains incompatible with the service
Replacement becomes supportable when the dependency blocks a critical function, exceeds the tolerable delay or cannot be reduced under accepted conditions. The decision identifies the target, window, prerequisites and switching authority.
The previous test becomes the exit-plan baseline. Reservations do not disappear: they become migration entry conditions.
Decision register
Connect every residual to an authority and future evidence
The register makes clear who decided, on which facts and until which date.
Reassessment
Reopen the decision when the system or context changes
A material change of model, platform, contract, region, team or critical function can make the previous exercise obsolete. An incident or change in exit rights also triggers reassessment.
Sources and references
- Regulation (EU) 2023/2854 — Data Act (new tab)
Switching data-processing services and removing exit obstacles.
- Regulation (EU) 2022/2554 — DORA (new tab)
ICT third-party risk management, exit strategies and transition plans in the financial sector.
- ANSSI — Recommendations for cloud hosting (new tab)
Security choices, customer responsibilities, reversibility and operational skills.
- ISO 19011:2018 (new tab)
Guidelines for auditing management systems: principles, programme, audit evidence.
Frequently asked questions
Can a critical supplier dependency be accepted?
Yes, when the competent authority understands the effect, alternatives, monitoring conditions and duration of acceptance. The decision must be explicit, assigned and dated.
Why not calculate one reversibility score?
Because an average can hide a critical impossibility. Every blocking asset, right, function and skill must be decided separately before the overall conclusion.
When should the test be repeated?
After a material change in platform, model, contract, region, team or critical function, and after an incident or change in exit rights.
Reversibility dossier
Which dependency still lacks a decision authority?
Present the residual and the function it affects. We assess whether the facts support an explicit decision.