Implementing the PRA Supervisory Statement on outsourcing ...
文章推薦指數： 80 %
The Prudential Regulation Authority (PRA) released its much anticipated “Outsourcing and third party risk management” Policy Statement and ... SearchUKFinance YoucanusethesearchfunctiontofindarangeofUKFinancematerial,fromconsultationresponsestothoughtleadershiptoblogs,ortofindcontentonarangeoftopicsfromBrexittocommercialfinance. Searchform Downloadagreement Bydownloadingthisdocument,youunderstandandagreethatanysharing,distributionorrepublishingofthecontent,withoutpriorwrittenauthorisationfromtheauthororcontentmanagersatUKFinance,shallbeconstitutedasabreachoftheUKFinancewebsitetermsofuse. Acceptandcontinue Clickthrougharrow Home NewsandInsight Blogs Implementingthe... ThePrudentialRegulationAuthority(PRA)releaseditsmuchanticipated“Outsourcingandthirdpartyriskmanagement”PolicyStatementandfinalSupervisoryStatementson29March.ThisfollowstheconsultationperiodwhichincludedaresponsefromUKFinancetothePRAonbehalfofourmembers. ThetimingoftheSupervisoryStatementisverywelcome.Thefinancialsectorhasseenagrowingfocusontheneedtoregulateandmanageitsoutsourcingandthird-partyrelationships. ItisimportanttonotethatfirmsareexpectedtocomplywiththeexpectationsintheSupervisoryStatementby31March2022(whichalignswiththedatesetoutinthePRA’soperationalresilienceSupervisoryStatement)andmustseektoreviewandupdatelegacyoutsourcingagreementsenteredintobeforethisdate.Lookingahead,someofthekeychangesthatfirmsmustconsiderinclude,butarenotlimitedto: Definitionsandscope:Firmsshouldassessthematerialityandrisksofallthird-partyarrangementsusingallrelevantcriteriasetoutintheSupervisoryStatementirrespectiveofwhethertheyfallwithinthedefinitionofoutsourcing.Wherenon-outsourcing,thirdpartyarrangementsaredeemedtobematerialorhighrisk,thePRAexpectsfirmstoimplementeffective,risk-basedcontrols. Proportionality:Firmsareencouragedtoreviewtheguidancearoundcontrolandinfluencealongwithminimumexpectationsandadditionalexamplesofproportionalityforthirdcountries. Pre-outsourcingphase:FirmsshouldassessthematerialityofalloutsourcingarrangementsusingthecriteriasetoutintheSupervisoryStatement.TheyareexpectedtonotifythePRAofallmaterialarrangementswiththechoicetosubmitasingleblanketnotification. Datasecurity:Firmsresponsibilityfordataincludeitsclassification,thedefinitionandadoptionofarisk-basedapproachtodatalocationandoverallsecuritymeasures.Thisisparticularlyimportantforhowfirmsapproachdatasecuritywithcloudservices. Access,audit,andinformationrights:Firmsshouldensurethattheserightsareexercisedinanoutcomefocusedwaywhichmayincludepooledauditsandthird-partycertification,butonlyifthisissufficientforfirmstomeettheirobligations. Businesscontinuityandexitplans:Firmsmustdevelop,documentandtestabusinesscontinuityplanandexitstrategycoveringbothstressedandnon-stressedexits. InresponsetothePolicyStatementandfinalSupervisoryStatement,UKFinanceconvenedtworoundtableswiththePRAsupportedbyEY.ThesesessionsprovidedmemberswithanopportunitytohearfromthePRAonthechangesthatwereimplementedfollowingtheconsultationperiod,andthekeyareasthatfirmsshouldfocusupon,andalsowithanopportunitytoposequestionstothePRAinaQ&Asession. Ifyouoracolleaguewereunabletoattendthesessions,theywererecordedandcanbefoundhereandhere.Youmayneedtoregistertowatchthese. ForfurtherinformationonhowUKFinanceissupportingmemberswithnavigatingtheimplementationoftheSupervisoryStatement,[email protected]. Tags: CybercollaborationDigitalEconomiccrimeRisk Writtenby OgeUdensi, Principal,CyberSecurity, UKFinance Publisheddate: 29.04.2021 Share TheSolarWindsimpact:HowtheFSCCCreacted
延伸文章資訊
- 1Outsourcing & Third-party Risk Management – PRA ...
PRA Policy statement on third-party risk management. Operational resilience workshops. Operationa...
- 2PRA issues Supervisory Statement (SS2/21) 'Outsourcing and ...
The SS seeks to strengthen and modernise the prudential framework for outsourcing and third party...
- 3Outsourcing and third party risk management: The PRA's ...
In March 2021, the PRA published a Policy Statement on outsourcing and third party risk managemen...
- 4The PRA's expectations on outsourcing and third party risk ...
Outsourcing arrangements: The PRA expects that if a third party service provider in a material ou...
- 5new rules on outsourcing and third-party risk management
