A financial-services group has 14 months before a new operational-resilience regime applies. It must hold a complete register of third-party arrangements supporting critical functions, documented and tested exit plans for each, and contractual clauses that roughly 40% of its 180 supplier contracts do not contain. The programme plans to build the register first because it is the visible deliverable. Sequence the work properly and name the point of no return.

The sequence

1. Classify which functions are critical, with a crude rule, in the first three weeks. Every other stream is scoped by this list, so a provisional answer now beats a good answer in month four. Choose the crude rule unless a precise one is already agreed: a function is critical if its unavailability for 24 hours would trigger customer harm, a regulatory notification or a material financial loss.
2. Start contract remediation immediately, in the same month. This is the long pole and the only stream that runs at someone else's pace. A supplier negotiation takes 8 to 12 weeks when it goes well, and suppliers concede clauses most readily at renewal, so the calendar of renewal dates determines the order. With 180 contracts, 40% needing change and a small legal team, this stream sets the programme's end date.
3. Generate the register from a source you own — the contract system plus the service catalogue — rather than maintaining it as a document. A register maintained by hand is correct on the day it is submitted and wrong a month later.
4. Write exit plans for the critical arrangements only, then test two of them. An untested exit plan is a claim, and the test is what finds the dependency nobody documented.
5. Wire the register into the change process last: no new supplier arrangement for a critical function without a register entry and an exit plan. This is what stops the work being repeated in two years.

Each step is reversible except the classification freeze, which is why it is numbered first and frozen last.

Where the data can diverge

Three lists exist already and none agrees: procurement's contract list, the service catalogue and the finance vendor ledger. Reconcile them once, early, and publish the differences as a number — typically 10 to 20% of entries in one list and not another. The register must be derived from one of them with the others as check sources, and a monthly diff count is the signal that the derivation still works in production rather than only at submission. Divergence shows up as a supplier paid every month with no contract on file, or a critical function supported by a service nobody listed. Both fail an inspection quietly: the register is internally consistent and describes an estate that does not exist.

The point of no return

The date the criticality classification is frozen for submission. Everything downstream — which contracts are remediated, which exit plans are written and tested, what the register contains — inherits that list. Reclassifying a function as critical eight weeks before the date restarts a contract negotiation you cannot compress, so the freeze must come early enough that a late addition is an exception handled with a documented compensating measure rather than a re-plan.

The rollback at each stage

Classification, register and exit plans are all documents and are freely revisable up to the freeze. Contract changes are not: a clause conceded in exchange for a longer term cannot be unwound, so never trade term length for speed on a supplier you may want to exit. Tooling decisions should be deliberately cheap, because the regime will change and a platform bought to satisfy one submission becomes an asset nobody can remove.

How long it really takes

Assume the calendar, not the effort. With renewal-driven negotiation windows, 72 contracts to change and a legal function that can carry perhaps six concurrently, the contract stream alone consumes most of the 14 months. The register and exit plans are a few months of work that can run in parallel. Programmes that miss the date almost never miss it on the artefacts; they miss it because contract remediation started in month five.

When this is the wrong answer

When the entity is small. For a firm with 20 suppliers and three critical functions, a spreadsheet, a calendar reminder before each renewal and three short exit plans satisfy the same obligations at a fraction of the cost. Buying a third-party risk platform for that estate is the expensive mistake, and the honest advice is to spend the money on the two exit tests instead.