Evidence infrastructure for mortgage servicing

NewBridge Pathway

Operational continuity

Operational resilience

Last updated: 12 May 2026

NewBridge Pathway is a small research-led advisory firm. Operational resilience means knowing which services matter, what they depend on, which interruptions would create commercial or client harm, and how the firm would recover from them.

Reference model

The FCA's PS21/3 Operational Resilience policy framework applies to banks, building societies, insurers, enhanced-scope SM&CR firms, and other specified regulated entities. NewBridge Pathway is not directly subject to PS21/3.

The framework is used as a reference model for the firm's own operational posture, because the same conceptual approach – identify important services, map dependencies, define impact tolerances, plan for continuity – applies usefully to firms operating outside the regime. The diagnostic methodology offered to regulated mortgage servicing clients via the Evidence Readiness Assessment draws on similar evidence-reconstruction discipline. NewBridge applies the same discipline to its own operations.

Important services

NewBridge identifies the following as important services. Interruptions to any of these would create client or commercial harm above a tolerable threshold:

  • This website and the research materials hosted on it. Availability supports research distribution, methodology-note delivery, and inbound inquiries.
  • Inquiry capture. The waitlist, Evidence Posture Snapshot request, general contact, and talent network forms collectively capture inbound interest. Interruption to inquiry capture means lost commercial signal.
  • Tier 0 Evidence Posture Snapshot delivery. Once an engagement is underway, the firm's ability to deliver findings within the agreed window is an important service to that engagement.
  • Controlled evidence handling during engagements. Client materials shared under engagement scope must remain controlled, retrievable by NewBridge during the engagement, and recoverable in the event of operational disruption.
  • Client communications during engagements. Engaged clients must be able to reach NewBridge through the channel established at engagement start, with backup contact paths identified.

Dependencies

The important services above depend on:

  • Hosting and content distribution. Static-site hosting and content delivery network.
  • DNS. Apex and subdomain DNS records and registrar.
  • Form delivery. Inbound form submissions reach the operator inbox via a third-party form-handling service.
  • Privacy-friendly analytics. Aggregated engagement signal – not required for service continuity, but loss of analytics during a high-signal period creates measurable commercial cost.
  • Source control. The website monorepo, internal methodology documents, and engagement-related materials are versioned in a protected source-control system.
  • Email. Operator inbox for inquiry triage and engagement correspondence.
  • Password manager. Named-user access to operational secrets.
  • Endpoint devices. Devices used by the operator for engagement work.
  • Backups. Backups of materials not held in source control.
  • Counsel and insurance. Legal counsel for engagement contracts and trademark posture; insurance carriers, once policies are bound, for risk transfer.

Impact tolerances

For each important service, NewBridge maintains an internal estimate of the maximum tolerable interruption before client or commercial harm becomes material. The tolerances are reviewed when the operating environment changes – for example, when a dependency is replaced, when the operating scale changes, or when a new engagement profile creates a different harm threshold.

Internal tolerances are not published. They are made available to commercial engagement counterparts where reasonably required, and they inform the continuity plans below.

Continuity plans

  • Founder and key-person cover. A documented succession contact and operational handover plan exists for the founder. Backup access to operational systems is held with a named alternate.
  • Backup access. Critical credentials are held in named-user vaults with documented recovery paths.
  • Incident response. Written protocol covering detection, containment, evidence preservation, notification to affected parties, and post-incident review.
  • Evidence preservation. Engagement materials and incident artifacts are preserved per retention discipline. A documented hold process exists for engagement-period preservation.
  • Client notification. Notification windows for engagement counterparts are defined in engagement contracts. For research correspondents – waitlist or inquiry submitters – reasonable notification is made via the contact pathway used.

How this connects to the services we provide

The Evidence Readiness Assessment asks whether firms can reconstruct what happened across policy trigger, composition, routing, delivery, archive, customer interaction, and outcome evidence. The same question applies to NewBridge's own operations: can the firm reconstruct what happened, demonstrate it to a counterpart, and recover from operational disruption without depending on any single item in the dependency list above?

The discipline that supports the diagnostic methodology supports the firm.

Related