What is an Exit Strategy in Outsourcing?
An exit strategy in outsourcing is a documented plan describing how an organization would end its reliance on a third-party provider, by moving the service to another provider, bringing it in-house or discontinuing it, without unacceptable disruption, including under stressed conditions such as the provider's failure. DORA, the EBA outsourcing guidelines and the PRA require one for critical services.
- An exit strategy in outsourcing is the documented plan for ending reliance on a provider, by moving the service, bringing it in-house or discontinuing it, without unacceptable disruption.
- DORA Article 28(8), the EBA outsourcing guidelines and the PRA's SS2/21 all require one for critical or important services, and the PRA expects both stressed and non-stressed exits to be planned.
- A complete strategy covers triggers, options, a transition plan, data return and deletion, contract support such as transition assistance, and roles and governance.
- The stressed exit, where the provider fails or terminates abruptly, is the case that tests the plan: state how long the organization can run without the service and what fills the gap.
- Validate the assumptions (data export, alternative provider capacity, contract clauses) and exercise the plan for critical services on a schedule.
What is an Exit Strategy in Outsourcing?
An exit strategy in outsourcing is a documented plan for ending reliance on a third-party provider, by moving the service elsewhere, bringing it in-house or discontinuing it, without unacceptable disruption, including under stressed conditions.
DORA Article 28(8) requires financial entities to put in place exit strategies for ICT services supporting critical or important functions, taking into account the risk of a provider's failure, a deterioration in service quality, business disruption from inappropriate or failed provision, and termination of the contract. The EBA guidelines on outsourcing arrangements likewise require a documented exit strategy for outsourced critical or important functions covering termination, provider failure and deterioration of service. In the UK, the PRA's SS2/21 distinguishes stressed exits, where the provider fails or the relationship ends abruptly, from non-stressed exits, and expects firms to plan for both and to test exit plans where relevant. US interagency guidance covers the same ground under termination planning.
Why it matters
- Providers fail. Insolvency, a security incident or a market withdrawal can end a service with days of notice.
- Exit is the answer to concentration. A tested route out of a provider is what makes an accepted dependency tolerable.
- Regulators check it. Exit strategies for critical services feature in DORA, EBA, PRA and US expectations.
What an exit strategy contains
- Triggers: the events that would start an exit, and who decides.
- Options: alternative providers, in-house capability or discontinuation, with the feasibility and cost of each.
- Transition plan: sequence, timeline, resources and the interim service arrangements.
- Data: return, migration and deletion, in a usable format and within a stated time.
- Contract support: transition assistance obligations, notice periods, step-in rights and knowledge transfer.
- Roles and governance: owners, decision rights and reporting during the exit.
Stressed versus non-stressed exit
A non-stressed exit is planned: a contract ends or the organization chooses to move, with time to run a procurement and migration. A stressed exit is forced: the provider fails, suffers a severe incident or terminates abruptly. The stressed case is the one that tests the strategy, because transition assistance may not be available and the interim arrangement must hold the service within its impact tolerance. Plans should state how long the organization can operate without the service and what it does in that window.
Keeping the strategy real
An exit strategy is only as good as its assumptions. Confirm that data can be exported in the stated format, that the alternative provider could onboard within the timeline, and that the contract clauses relied on exist. Exercise the plan for critical services on a schedule and review it whenever the service, the provider or its subcontractors change.
Related terms
- Third-party risk management (TPRM)
- Business continuity management (BCM)
- Operational resilience
- Third-party risk
- Important business services
- Supplier management
In SmartSuite
SmartSuite Third-Party Risk Management can store the exit strategy against each critical contract with its triggers, options, data provisions and owners, schedule the periodic review and exercise, and link it to the business continuity plan for the function it protects.
Frequently asked questions
Which vendors need an exit strategy?
Under DORA, every ICT third-party provider supporting a critical or important function. The EBA guidelines require one for outsourced critical or important functions, and the PRA for material outsourcing. Outside regulated sectors, apply the same rule of thumb: any provider whose loss would breach a business impact tolerance should have a documented and tested way out.
What is the difference between an exit strategy and a business continuity plan?
A business continuity plan keeps the service running through a disruption, usually assuming the provider recovers. An exit strategy ends the relationship and moves the service elsewhere, permanently. The two meet in a stressed exit, where the continuity plan covers the gap while the exit strategy is executed.
Do exit strategies have to be tested?
DORA requires exit strategies to be comprehensive, documented and, in line with the regulatory technical standards, sufficiently tested and reviewed periodically. The PRA expects firms to test exit plans where possible and relevant. At minimum, validate the key assumptions such as data portability and alternative provider capacity, and run a desktop exercise for critical services.
Get started with SmartSuite
See how connected GRC, IT and operations work on one platform.