Manage cohorts of small suppliers whose combined impact matters

An insurer has many small providers of claims-assessment services. Each handles a modest share of work, so an individual-provider review finds limited exposure. During a regional disruption, however, several may be unavailable just as demand increases.

The combined service consequence can be important even where no single provider explains it. A cohort review examines that common exposure without automatically treating every member as a material service provider.

APRA's CPG 230 explicitly discusses cohorts whose aggregate operational impact is material, while individual providers are not. It distinguishes managing that exposure from classifying each cohort member as material. The workflow below is a suggested way to investigate it.

Define the shared source of exposure

A procurement category is a starting point, but it may be too broad to explain the risk. Identify what could affect several providers together and how that would interrupt the operation.

Examples worth investigating include a shared region, specialist labour pool, dispatch platform, transport route or critical subcontractor. These are hypotheses until supported by evidence.

Avoid grouping suppliers solely because they have low contract values. Spend says little about whether they can replace one another or whether the same event would affect them all. A cohort should be useful for understanding a plausible service consequence.

Work a regional assessment scenario

Consider a fictional general insurer with a panel of independent assessors. Its usual allocation process distributes work across the region. The insurer assumes that spare capacity elsewhere can absorb a local disruption.

A workshop asks what would happen if access to part of the region were restricted while claims volumes rose. The team identifies three uncertainties: which assessors could travel, whether remote assessment is appropriate for the affected work, and whether the alternate panel has capacity when other insurers also seek support.

The scenario does not establish that the panel will fail. It reveals assumptions the insurer should verify before treating the contingency as dependable.

Ask the operations team to explain the customer consequence: which assessments would be delayed, which decisions depend on them and what work can continue through another route. This connects the cohort analysis to the claims operation rather than stopping at supplier availability.

Build a small, service-focused evidence set

Start with information your organisation already holds: work allocation, service geography, capability, performance during previous demand changes and known dependencies. Check whether it is current enough for the scenario.

Then seek targeted information about the remaining assumptions. Useful questions could include:

• Which services can each provider deliver outside its usual area?
• What constraints affect remote work or substitute personnel?
• How are surge requests prioritised and confirmed?
• Which shared systems are necessary to allocate or complete the work?
• What evidence supports the proposed contingency capacity?

Do not ask providers to disclose confidential details about other customers unnecessarily. A provider can describe its capacity constraints and commitments at an appropriate level without handing over another insurer's information.

Separate confirmed facts, estimates and unavailable data. Unknown capacity should not quietly become available capacity in the model.

Choose controls that match the common problem

If geography is the concern, adding another supplier in the same affected area may not improve the proposed fallback. If the problem is a shared dispatch platform, a larger panel may still depend on the same system.

Potential responses to examine include alternative allocation arrangements, tested remote capabilities, different capacity sources or changes to the way urgent work is prioritised. Their usefulness depends on the actual service and constraints.

For each proposed control, ask what it changes in the scenario and what evidence would show it can work. An agreement to “assist where possible” may leave the critical capacity question unanswered. A walkthrough or exercise may reveal practical constraints before the insurer relies on the option.

The current CPS 230 standard provides the wider operational-risk and continuity framework. The cohort worksheet is a way to organise analysis within that framework, not an alternative compliance regime.

Keep individual and aggregate decisions separate

Record each provider's classification according to the relevant criteria. Maintain the aggregate exposure separately, with links to the affected providers and operation.

This avoids two mistakes: assuming that individually non-material providers need no collective oversight, or automatically reclassifying every provider because the group matters. If an individual arrangement changes, revisit its own assessment on the facts.

Give the cohort exposure an accountable owner. Otherwise, each supplier relationship manager may assume another team is managing the shared issue. The owner should be able to explain the scenario, evidence, controls, remaining uncertainty and next action.

Monitor the assumptions that matter

A practical review might track changes in regional allocation, availability of specialist skills, reliance on a common system or the outcome of a surge exercise. Select indicators because they could change the assessment, not because they are easy to count.

Record what would trigger renewed analysis. A new dependency or a failed contingency exercise may be more significant than routine movement in individual contract values.

Compare this with the shared-cloud concentration scenario, where distinct suppliers depend on a common technical layer rather than the same local capacity.

Begin with one supplier cohort linked to an important operation. Write down the common disruption, the assumed fallback and the evidence supporting that fallback. Where the answer is incomplete, use the evidence checklist to assign a clear question and owner.