Your client's supplier review, run on you first.
We run your client's supplier review on you before they do, then build the continuity and exit plans it is likely to test.
Business continuity in banks since 2000.
What suppliers tell us
- The bank sent a questionnaire we can't fully answer.
- We have SOC 2. Why isn't that enough?
- They want an exit plan.
Your client decides whether your service is critical. If it is, it will ask for tested continuity and an exit plan.
Who it is for
Suppliers to banks, insurers and asset managers, where one client's review is holding up a deal. Three people usually carry it.
Sales director
A plan and a date to give the bank.
CTO or COO
The evidence, built for you. You sign it off.
CEO
One fixed fee, quoted before we start.
What the review is likely to test
Five areas, with exit and continuity first, because they are the two a critical supplier is least likely to have ready.
- Exit Whether your client could move away from your service in an orderly way, with a plan that is written down and workable.
- Continuity Whether your service keeps running, and comes back in the time your client needs, with plans that have been tested.
- Incidents and crisis How you spot, escalate and report an incident, and who takes the decisions.
- Your own suppliers Who your service depends on, and what happens to your client if one of them fails.
- Governance A named owner, board oversight, and evidence that is kept current.
Regulation behind this, for reference: DORA Article 30(3) and the UK outsourcing rules.
How it works
1. Review
About two weeksWe run your client's review on you and hand you a red-flag list.
2. Build
Fixed fee per itemWe build the continuity and exit plans, and a standing response pack. You sign them off.
3. Keep current
Monthly coverWe keep the evidence up to date, and stand ready when your client or its auditors ask.
Four ways through the review
| Do nothing | Do it yourselves (platform plus templates) | A large consultancy | Beforehand | |
|---|---|---|---|---|
| Cost | None now; the deal may wait | Your team's time, plus the platform you already pay for | Not published; day rates, larger teams | One fixed fee, quoted before we start |
| Sees you the way your client's reviewer will | No | Partly: the platform covers the security questions | Often, from the client side | Yes: someone who ran these reviews from inside a bank |
| Exit and continuity plans built and tested | No | Templates exist; testing is on you | Yes, at their scale | Yes, sized to your firm |
| Your team's time | None until the questionnaire lands | High | Medium | Low: built for you, signed off by you |
| Best when | No finance client and no deal coming | You have in-house resilience people | You are large or a bank already uses them | You are small, critical to a finance client, and the deal has a date |
See what a red-flag list looks like
A sample of the questions a client's review is most likely to ask, the red flags behind them, and what good looks like. Mark each one "Have it", "Partly" or "Not yet", and the "Not yet" marks are where a review is likely to slow down.
Who stands behind it
Business continuity in banks since 2000. Founder and Principal Consultant, Beforehand Advisory.
Jamie Watters
- At a global bank, about 25 critical supplier reviews and about 30 client due-diligence requests a year, so he has sat on both sides of the same table.
- Wrote the bank's standing response pack and briefed client panels of specialists.
- Wrote two books on business continuity, disaster recovery and crisis management.
Beforehand Advisory was founded in 2026. We are taking our first clients now. Jamie on LinkedIn
Straight answers
Is SOC 2 not enough?
Keep it: it shows your security controls are working. But a client that treats your service as critical will also ask for tested continuity and an exit plan, and a SOC 2 report won't give them your exit plan.
Will you tell the bank anything?
No. It's confidential, and we only ever work on one side for any supplier.
Can you promise we'll pass?
No. We prepare and build; your client decides.
Is this AI-specific?
No.
Tell us which client and what they asked for
On the call, we tell you what the review is likely to test. No charge, no obligation.