Dossier · Reversibility audit
Qualify what still requires the source after the test, then have the competent authority choose whether to accept, reduce or replace it.
A residual dependency is an asset, right, service or item of know-how still required from the source after recovery. Each is examined separately: a favourable overall score cannot erase an active account, a missing right or a critical function that was not restored.
The decision rests on observations attached to the tested scenario, not on an abstract view of the supplier.
The authority may accept a dependency when it understands the plausible effect, treatment cost, monitoring conditions and the point at which the decision must be revisited. Acceptance names an owner and is never implicit.
Every treatment must alter an observation from the test and schedule a new verification.
| Treatment | Intended effect | Closure evidence |
|---|---|---|
| Terms and assistance | Obtain missing assets, time or cooperation | Signed contract and executed exercise |
| Architecture | Isolate or replace a captive component | Replayed deployment and journeys |
| Second source | Reduce a single point of failure | Tested switch to the target |
| Skills | Remove an indispensable source intervention | Operation performed by target team |
| Monitoring | Detect before capability is lost | Exercised threshold, alert and decision |
Replacement becomes supportable when the dependency blocks a critical function, exceeds the tolerable delay or cannot be reduced under accepted conditions. The decision identifies the target, window, prerequisites and switching authority.
The previous test becomes the exit-plan baseline. Reservations do not disappear: they become migration entry conditions.
The register makes clear who decided, on which facts and until which date.
A material change of model, platform, contract, region, team or critical function can make the previous exercise obsolete. An incident or change in exit rights also triggers reassessment.
Primary sources
Last documentary review: 6 September 2026.
Switching data-processing services and removing exit obstacles.
ICT third-party risk management, exit strategies and transition plans in the financial sector.
Security choices, customer responsibilities, reversibility and operational skills.
Guidelines for auditing management systems: principles, programme, audit evidence.
Before you write to us
Yes, when the competent authority understands the effect, alternatives, monitoring conditions and duration of acceptance. The decision must be explicit, assigned and dated.
Because an average can hide a critical impossibility. Every blocking asset, right, function and skill must be decided separately before the overall conclusion.
After a material change in platform, model, contract, region, team or critical function, and after an incident or change in exit rights.
Reversibility dossier
Present the residual and the function it affects. We assess whether the facts support an explicit decision.
Scope the decision