criticality-assessment
Criticality assessment
A criticality assessment is what second-line produces so the firm can set a defensible tier on a third-party arrangement and feed that tier into the rest of the lifecycle. The tier is the single field every downstream skill consumes. Get it wrong and vendor-diligence runs at the wrong depth, contract-gap-review reads against the wrong clauses, exit-plan never gets built, and the DORA register entry carries the wrong flag. The skill stops at the recommendation. The named approver, head of TPRM or operational-risk committee per firm policy, decides.
This skill produces the assessment as a markdown artifact (templates/default-output.md shape) and a structured record (schemas/criticality-assessment.schema.json) that downstream skills consume. The record is upstream of vendor-diligence (which reads the criticality field), and is read by contract-gap-review, exit-plan, concentration-risk-review, and dora-register-builder for the same reasons.
Ask first
Before drafting, get plain answers to four things. Most engagements answer them quickly; if not, default and flag.
- What business process does this arrangement support, and which important business service does that process sit on. Sourced from the firm's IBS map. If the firm has no IBS map, work against the candidate IBS list in the loaded sector overlay and note the absence; do not block.
- What is the firm's impact tolerance for that IBS. Recovery time and recovery point come from the IBS impact analysis, not from the contract. The vendor commitment is the ceiling on what the vendor delivers; the firm tolerance is the test.
- What is the firm's regulatory profile. Institution type and primary regulators. The DORA flag and the UK SS2/21 flag are recorded only for entities in those perimeters; otherwise
not-in-scope. - What is the engagement type. Pre-onboarding, annual recertification, off-cycle trigger, material-change re-review, post-incident re-review, IBS-change re-review, contract-renewal re-review. Each carries a different decision-forum context.
When scope is supplied, the skill consumes it (institution type, sector overlay set, cross-cutting overlay set, persona, source posture). When it is not, ask the four questions and default to public posture if the practitioner declines. Note in the assessment that scope was not formalised; do not silently apply a default sector overlay.