Due diligence checklist, United Kingdom
PRA SS2/21: what to ask a vendor
Outsourcing and third party risk management. PRA. Materiality assessment, due diligence, key contract terms, exit plans and a third-party register.
What it is
Materiality assessment, due diligence, key contract terms, exit plans and a third-party register.
Who it applies to
Applies to banks, mutuals and credit unions, insurers and pension and superannuation funds in the United Kingdom.
What to ask a vendor, and the evidence to request
| # | Ask the vendor for | Evidence to request |
|---|---|---|
| 1 | A due diligence pack: financials, security assurance, business continuity and sub-outsourcing | The business continuity and disaster recovery plans for the service, the stated recovery time and recovery point objectives, and the report from the last test with its date and outcome. |
| 2 | Contract terms on access, audit and information rights, sub-outsourcing, termination and data | The list of sub-contractors that deliver any part of the service, what each delivers, where from, and how changes to the list are notified. |
| 3 | Exit plans the institution can test, with return of data | The exit plan: how the service ends, how data is returned and in what format, the transition assistance offered, and the timetable. |
| 4 | The data an outsourcing register needs about the arrangement | A written statement from the vendor, with the policy, specification or sample that supports it. |
In every case
- A named contact at the vendor responsible for this regime, and how the vendor tracks changes to it.
- Which named customers the vendor already serves under this regime, as references you may call.
This checklist is a starting point for a procurement team, not legal advice. Read it with the regulator's own page, your institution's policies and your legal and risk teams; the regime may have changed since the date on this document.
Next
- Every checklist, by country
- What a market scan is and how to run one
- Have Vederca run the procurement: the regime goes into the register as a must-have