Prudential Regulation Authority Rulebook

5.1

A firm must take reasonable care to supervise the discharge of outsourced functions by an outsourced provider.

5.2

A firm must take steps to obtain sufficient information from its outsourced provider to enable it to assess the impact of outsourcing on its systems and controls.

5.3

Before entering into, or significantly changing, an outsourcing arrangement, a firm must:

1. (1) analyse how the arrangement will fit with its organisation and reporting structure, business strategy, overall risk profile and ability to meet its regulatory obligations;
2. (2) consider whether the agreements establishing the arrangement will allow it to monitor and control its operational risk exposure relating to the outsourcing;
3. (3) conduct appropriate due diligence of the service provider's financial stability and expertise; and
4. (4) consider how it will ensure a smooth transition of its operations from its current arrangements to a new or changed outsourcing arrangement, including what will happen on the termination of the contract or following a significant loss of services from the service provider.