Testing for Small Entities

Testing for small entities follows the same DORA principle as testing for large ones, proportionate to risk profile, complexity, and scale, applied to a smaller, simpler operation. A small entity, such as a local credit union with a handful of staff and a core system run by a supplier, does not need to replicate the testing programme of a large banking group. It does need to test the systems behind its critical functions, understand what its suppliers test on its behalf, and act on the findings. The risk for a small entity is not that its programme is small. It is that its programme is either copied wholesale from a larger peer, and therefore unsustainable, or so thin that a failure in its one core system leaves members without access and staff without a plan.

Focus follows the member or customer journey. For a credit union, the critical functions are likely to include member payments, access to balances, and lending decisions. The systems behind them may be few: a core banking platform, a card service, and a channel for members to transact. Testing should start there, with the journeys that would harm members most if they stopped. A scenario in which the core platform is unavailable, for example, tests not only the supplier's recovery, but the credit union's own communications, its manual workarounds, and its ability to answer members. That exercise, however simple, is more valuable than a broad programme that never touches the core system.

Most small entities depend heavily on suppliers, and supplier evidence is therefore central. A supplier may provide test reports, penetration test summaries, or resilience statements. The small entity's job is not to repeat all of that testing, but to understand it: which systems were tested, what was found, what remains open, and whether the testing covered the configuration the entity actually uses. A supplier test of a standard platform does not automatically cover a custom integration, a local configuration, or a data feed unique to the entity. Asking those questions, and recording the answers, turns supplier evidence from a filed document into a usable part of the testing programme.

Methods should fit the team's capacity and the systems in use. Vulnerability scanning of exposed services, network checks on supplier connections, scenario exercises for the main disruption cases, and end-to-end tests of the principal member journeys may together give a small entity a credible programme, without the need for the most demanding methods used by larger entities. The choice should be explained by risk, not by convenience. A method omitted because it is difficult should be recorded as a gap, with a reason, rather than silently dropped. Simplicity is a virtue in a small programme, but only when the simplification is conscious and its limits are stated.

Two pitfalls recur. The first is concentration: knowledge of the core system, supplier contacts, and recovery steps may sit with one person, so testing that involves only that person proves little about what happens when they are unavailable. Testing should therefore involve a second person, even in a small team, and should check that procedures can be followed by someone less familiar. The second pitfall is the laboratory problem in miniature: testing a supplier's demonstration environment, or a test version of the core system, while the live configuration differs. A small entity should ask, for each test, whether it examined the live service members actually use, and if not, what the difference was.

Sustainability comes from rhythm and ownership. A small programme that runs regularly, with findings owned and retested, will outperform an ambitious programme that collapses after its first cycle. The entity should keep a simple record: what was tested, what was found, who owns each finding, and when it was retested. It should review that record when its services, suppliers, or volumes change, and when incidents or near misses occur. Over time, that record becomes the entity's evidence of resilience, proportionate to its scale, and far more convincing than a borrowed programme that was never really followed.