Mapping PRA SS2/21 Requirements to TPRM Controls

Introduction

You have completed an outsourcing classification and materiality assessment for Northbridge Bank.

The bank plans to engage SecureAccess Cloud Ltd to operate the authentication infrastructure supporting its online and mobile banking services.

Your assessment concluded that the arrangement qualifies as material outsourcing.

The bank's Compliance Manager now asks you an important question:

"How can we demonstrate that our third-party risk management arrangements meet the PRA's expectations under SS2/21?"

You could respond by sending a copy of the regulation and explaining that the bank must comply with it.

But that would not answer the question.

The Compliance Manager needs to know whether the bank has appropriate controls, whether those controls address the relevant supervisory expectations and whether sufficient evidence exists to demonstrate that the controls are operating effectively.

This requires regulatory control mapping.

Regulatory control mapping is the process of translating applicable regulatory requirements and supervisory expectations into specific, assessable organisational controls.

It connects what a regulator expects with what an organisation actually does.

In this article, you will learn how to map PRA SS2/21 expectations to internal TPRM controls, identify control owners, evaluate supporting evidence and recognise potential compliance gaps.

Rather than simply reading about the regulatory framework, you will practise applying it to a realistic financial institution.

---

Learning Objectives

By the end of this article, you should be able to:

1. Explain the purpose of regulatory control mapping.
2. Identify relevant requirements and supervisory expectations within PRA SS2/21.
3. Distinguish regulatory provisions, control objectives, control activities and evidence.
4. Translate regulatory expectations into clear and testable controls.
5. Identify appropriate control owners.
6. Define evidence requirements for assessing control design and operation.
7. Identify potential control gaps and recommend corrective actions.
8. Develop a regulatory control mapping matrix suitable for compliance and assurance activities.

---

1. What Is Regulatory Control Mapping?

Regulatory control mapping links external obligations and expectations to an organisation's internal processes, procedures and controls.

In the context of PRA SS2/21, it helps a regulated firm demonstrate how its outsourcing and third-party risk management arrangements address relevant supervisory expectations.

Consider the PRA's expectations regarding materiality assessments.

A firm should assess the materiality of outsourcing arrangements using relevant regulatory criteria.

However, knowing that the PRA expects materiality assessments does not tell you whether the firm has implemented an appropriate process.

You need to examine how the requirement has been translated into internal operations.

For example, a bank may have established a process requiring the TPRM function to complete a documented materiality assessment before a proposed outsourcing arrangement receives approval.

The assessment might be reviewed by Compliance and approved through the bank's governance framework.

The resulting assessment, supporting evidence and approval record would provide evidence that the process was performed.

This creates a connection between regulatory expectations and operational controls.

1.1 Why regulatory mapping matters

Without a structured mapping process, organisations may struggle to determine:

• Which regulatory expectations apply to a particular arrangement.
• Whether internal controls adequately address those expectations.
• Which team is responsible for implementing each control.
• What evidence should exist to demonstrate compliance.
• Whether controls are operating effectively.
• Where control gaps or duplications exist.
• Whether regulatory changes require updates to existing controls.

Regulatory mapping also provides a foundation for internal compliance reviews, risk assessments, control testing and audit activities.

However, a completed mapping spreadsheet does not, by itself, demonstrate regulatory compliance.

The organisation must implement appropriate controls and assess whether they operate as intended.

1.2 A regulatory mapping example

Consider the following simplified example.

Regulatory expectation: The firm should undertake appropriate materiality assessments for outsourcing arrangements.

Control objective: Ensure outsourcing arrangements are classified and assessed for materiality before the relevant approval decision.

Internal control: The TPRM function completes a documented classification and materiality assessment for proposed outsourcing arrangements, with appropriate review and approval.

Control owner: Head of Third-Party Risk Management.

Supporting evidence: Completed materiality assessments, assessment criteria, workflow records and approvals.

Testing approach: Select a sample of recently approved outsourcing arrangements and verify that the assessments were completed, supported by evidence and appropriately approved.

This is the basis of regulatory control mapping.

---

2. Understanding the Components of a Control Mapping Matrix

Before developing a matrix, you need to understand its main components.

These components should not be treated as interchangeable.

2.1 Regulatory source

The regulatory source identifies where an obligation or supervisory expectation originates.

For example:

PRA SS2/21, Chapter 5: Pre-Outsourcing Phase.

When practical, the mapping should identify the specific paragraph or provision being assessed.

It is also important to distinguish between:

• An enforceable rule or statutory obligation.
• A supervisory expectation explaining how compliance is expected to be achieved.
• An internal policy requirement adopted by the organisation.

SS2/21 is a supervisory statement. The underlying obligations may arise from the PRA Rulebook or applicable legislation.

A well-designed mapping record should distinguish these sources rather than treating every supervisory statement paragraph as an independent legal rule.

2.2 Regulatory expectation

This describes what the regulator expects the organisation to achieve.

It should accurately reflect the relevant source without changing its meaning.

For example:

The firm should assess outsourcing materiality in accordance with the applicable criteria.

Do not automatically copy an entire regulatory paragraph into the matrix.

Instead, identify the specific expectation being assessed, while retaining a reference to the authoritative source.

2.3 Control objective

The control objective describes the intended outcome.

For example:

Ensure proposed outsourcing arrangements are assessed for materiality before approval.

A control objective is not the same as a control activity.

It explains what the organisation intends to achieve.

2.4 Control activity

The control activity describes what the organisation actually does to achieve the objective.

For example:

The TPRM team completes a documented materiality assessment using an approved methodology and submits the assessment for review and approval before the arrangement proceeds.

A useful control description should identify:

• What is performed.
• Who performs it.
• When or how frequently it occurs.
• How the activity is carried out.
• What evidence is produced.
• How exceptions are handled, where relevant.

This makes the control easier to evaluate.

2.5 Control owner

The control owner is accountable for ensuring that the control is appropriately designed and performed.

Other teams may execute supporting activities or provide evidence.

For example, the Head of TPRM might own the materiality assessment control, while business owners provide service impact information and Compliance reviews the regulatory interpretation.

The precise responsibilities depend on the firm's governance arrangements.

2.6 Supporting evidence

Evidence demonstrates that a control exists and, where relevant, has operated.

Examples include:

• Approved policies.
• Completed risk assessments.
• Supplier due diligence reports.
• Signed contracts.
• Review and approval records.
• Business continuity test results.
• Supplier performance reports.
• Meeting minutes.
• Remediation tracking records.

Evidence should be relevant, reliable and sufficiently complete to support the assessment conclusion.

2.7 Control assessment

The control assessment records the results of evaluating the control.

This may include:

• Design effectiveness.
• Implementation status.
• Operating effectiveness.
• Evidence limitations.
• Identified deficiencies.
• Required remediation.

These distinctions are important because a control may be well designed but poorly implemented.

Similarly, a control may operate consistently while its design remains insufficient to address the regulatory expectation.

---

3. Identifying the Relevant SS2/21 Expectations

A regulatory mapping exercise should begin with the authoritative regulatory source.

For this article, the primary reference is the November 2024 version of PRA SS2/21.

The supervisory statement is organised into ten chapters.

Chapter	Subject
1	Introduction
2	Definitions and Scope
3	Proportionality
4	Governance and Record-Keeping
5	Pre-Outsourcing Phase
6	Outsourcing Agreements
7	Data Security
8	Access, Audit and Information Rights
9	Sub-Outsourcing
10	Business Continuity and Exit Plans

Not every paragraph will apply equally to every organisation or third-party arrangement.

The analyst must consider the firm's regulatory status, the nature of the relationship, its materiality and any applicable proportionality considerations.

3.1 Establishing applicability

Before mapping individual provisions, confirm:

1. Whether the organisation is within the scope of SS2/21.
2. Whether the relationship qualifies as outsourcing.
3. Whether the arrangement is material.
4. Which expectations apply to the relevant firm and arrangement.
5. Whether other regulatory requirements must also be considered.

For example, some detailed contractual expectations apply specifically to material outsourcing arrangements.

It would therefore be inappropriate to apply every material-outsourcing provision indiscriminately to all suppliers.

3.2 Create a requirements register

Once applicability has been established, create a register of the relevant requirements and expectations.

A simplified example is shown below.

Reference	Regulatory area	Example control objective
Chapter 4	Governance	Ensure clear accountability and oversight
Chapter 4	Record-keeping	Maintain appropriate outsourcing records
Chapter 5	Materiality	Assess and document outsourcing materiality
Chapter 5	Due diligence	Evaluate provider suitability before engagement
Chapter 6	Agreements	Ensure contracts contain appropriate provisions
Chapter 7	Data security	Protect information associated with outsourced services
Chapter 8	Audit rights	Maintain appropriate access and assurance rights
Chapter 9	Sub-outsourcing	Manage relevant subcontracting risks
Chapter 10	Continuity and exit	Maintain appropriate continuity and exit arrangements

This table is a high-level illustration, not an exhaustive mapping of SS2/21.

A production regulatory mapping register should identify the specific applicable paragraphs, associated PRA rules where relevant and any exceptions or limitations.

---

4. Translating Regulatory Expectations into Internal Controls

The next step is to convert the regulatory expectations into controls that can be implemented and tested.

A useful principle is:

If an independent reviewer cannot determine whether a control was performed, the control description may be insufficiently specific.

Consider the following two control descriptions.

Weak control description:

"Third-party risks are properly managed."

This is too broad.

It does not explain what activities are performed, who performs them or how their effectiveness can be assessed.

Improved control description:

"Before approval of a proposed material outsourcing arrangement, the TPRM function conducts a documented risk assessment using the approved assessment methodology. Relevant findings are reviewed with the business owner, and unresolved risks are escalated through the established governance process."

This description is clearer because it identifies the activity, timing, responsible function and expected records.

4.1 Example: Governance controls

Relevant regulatory area: SS2/21 Chapter 4.

Control objective: Ensure outsourcing risks are subject to appropriate governance and accountability.

Example controls:

• The firm maintains an approved outsourcing and third-party risk management policy.
• Responsibilities for outsourcing risk management are documented.
• Material outsourcing decisions are reviewed through the appropriate governance process.
• Relevant outsourcing risks and significant issues are reported to appropriate management bodies.

Potential evidence:

• Approved TPRM policy.
• Responsibility matrix.
• Governance committee terms of reference.
• Meeting minutes.
• Management reporting.
• Decision and escalation records.

Testing approach:

Review the policy and governance arrangements, then inspect a sample of material outsourcing decisions to establish whether the required reviews and approvals occurred.

4.2 Example: Due diligence controls

Relevant regulatory area: SS2/21 Chapter 5.

Control objective: Ensure the firm evaluates a provider's suitability and associated risks before entering a relevant outsourcing arrangement.

Example control:

"The TPRM function coordinates risk-based due diligence before onboarding, with relevant specialist assessments completed and significant findings reviewed before approval."

Potential evidence:

• Due diligence questionnaires.
• Financial assessments.
• Information security assessments.
• Compliance reviews.
• Independent assurance reports.
• Supplier risk assessments.
• Approval records.

Testing approach:

Select a sample of outsourcing engagements and determine whether the due diligence was completed at the required stage, covered relevant risks and resulted in appropriate decisions.

4.3 Example: Contractual controls

Relevant regulatory area: SS2/21 Chapter 6.

Control objective: Ensure material outsourcing contracts contain appropriate contractual provisions.

Example control:

"Legal and Procurement review proposed material outsourcing agreements against an approved contractual requirements checklist before execution, escalating unresolved departures for appropriate approval."

Potential evidence:

• Signed outsourcing agreements.
• Contract review checklists.
• Legal review records.
• Contractual deviation registers.
• Approval records.

Testing approach:

Review a sample of executed material outsourcing agreements and verify that applicable contractual requirements were addressed and departures were appropriately managed.

4.4 Example: Data security controls

Relevant regulatory area: SS2/21 Chapter 7.

Control objective: Ensure information associated with outsourcing arrangements is appropriately protected.

Example control:

"Information Security assesses the confidentiality, integrity and availability requirements of information processed through material outsourcing arrangements and identifies appropriate contractual and technical safeguards."

Potential evidence:

• Data classification assessments.
• Information flow diagrams.
• Security architecture reviews.
• Security questionnaires.
• Access control documentation.
• Encryption and key management evidence.
• Security testing and assurance reports.

Testing approach:

Review whether the assessment addressed relevant information risks and whether the selected safeguards are supported by adequate evidence.

4.5 Example: Audit and information rights

Relevant regulatory area: SS2/21 Chapter 8.

Control objective: Ensure sufficient contractual and practical rights exist to support oversight and assurance.

Example control:

"Legal reviews material outsourcing agreements to verify the inclusion of applicable access, audit and information rights for the firm and relevant regulatory authorities."

Potential evidence:

• Executed contracts.
• Audit rights clauses.
• Contract review records.
• Supplier assurance arrangements.
• Evidence of exercised audit or information rights, where applicable.

Testing approach:

Inspect relevant contractual provisions and determine whether the firm has adequate arrangements to obtain the assurance information it requires.

4.6 Example: Sub-outsourcing controls

Relevant regulatory area: SS2/21 Chapter 9.

Control objective: Ensure relevant subcontracting arrangements are appropriately understood and managed.

Example control:

"The TPRM function identifies material sub-outsourcing dependencies and coordinates the assessment of related risks, contractual safeguards and changes to subcontracting arrangements."

Potential evidence:

• Subcontractor registers.
• Supplier dependency maps.
• Sub-outsourcing notifications.
• Risk assessments.
• Contractual provisions.
• Records of change reviews.

Testing approach:

Examine whether known material sub-outsourcing dependencies are appropriately recorded and whether relevant changes are identified and reviewed.

4.7 Example: Business continuity and exit controls

Relevant regulatory area: SS2/21 Chapter 10.

Control objective: Ensure material outsourcing arrangements have appropriate continuity arrangements and viable exit strategies.

Example control:

"Business owners, supported by Operational Resilience and relevant technical teams, maintain and periodically review documented business continuity arrangements and exit strategies for material outsourcing arrangements, including planned and stressed exit scenarios."

Potential evidence:

• Business continuity plans.
• Disaster recovery documentation.
• Exit strategies.
• Recovery test reports.
• Dependency assessments.
• Exit feasibility reviews.
• Action tracking records.

Testing approach:

Review whether the plans address the relevant arrangement, have been appropriately maintained and are supported by proportionate testing or validation.

---

5. Building a Regulatory Control Mapping Matrix

A regulatory control mapping matrix brings these components together.

The purpose is to create traceability between the regulatory expectation, the firm's control and the evidence supporting the assessment.

5.1 Recommended fields

A practical matrix should contain:

1. Control ID.
2. Regulatory source and version.
3. Regulatory reference.
4. Requirement or supervisory expectation.
5. Applicability.
6. Control objective.
7. Internal control description.
8. Control owner.
9. Supporting evidence.
10. Testing procedure.
11. Design effectiveness.
12. Operating effectiveness.
13. Gap or observation.
14. Remediation action.
15. Action owner.
16. Target completion date.
17. Assessment status.
18. Review date.

Some organisations may include additional fields such as risk ratings, linked policies, evidence locations and approval references.

5.2 Example regulatory control mapping matrix

For readability, the example below shows only selected fields.

The descriptions are illustrative control mappings, not verbatim regulatory requirements.

Control ID	SS2/21 Area	Control Objective	Control Owner	Evidence
TPRM-01	Ch. 4: Governance	Maintain clear accountability for outsourcing	Head of TPRM	Approved policy and governance records
TPRM-02	Ch. 5: Materiality	Assess and document materiality before approval	TPRM Manager	Materiality assessment and approvals
TPRM-03	Ch. 5: Due Diligence	Evaluate provider suitability before engagement	TPRM Manager	Due diligence and risk assessments
TPRM-04	Ch. 6: Agreements	Include appropriate contractual provisions	Legal Counsel	Executed contracts and reviews
TPRM-05	Ch. 7: Data Security	Protect information in outsourced services	Information Security Manager	Security assessments and control evidence
TPRM-06	Ch. 8: Audit Rights	Maintain appropriate audit and information rights	Legal Counsel	Contract clauses and assurance arrangements
TPRM-07	Ch. 9: Sub-Outsourcing	Identify and manage relevant subcontractor risks	Head of TPRM	Subcontractor records and reviews
TPRM-08	Ch. 10: Exit Planning	Maintain appropriate continuity and exit arrangements	Business Service Owner	Continuity plans and exit test evidence

5.3 Important limitations

A control mapping matrix should not be treated as a substitute for regulatory interpretation.

The analyst must verify the applicable paragraphs and underlying obligations.

For example, mapping an arrangement to Chapter 10 does not establish that all relevant continuity and exit expectations have been addressed.

The analyst should examine the individual provisions, understand their applicability and determine whether the mapped controls collectively address them.

A broad chapter-level mapping is useful for training and initial scoping. A production compliance assessment generally requires more precise traceability.

---

6. Assigning Control Ownership

A good control description is not sufficient if nobody is accountable for implementing or maintaining it.

Ownership should reflect how the organisation operates.

For example, a TPRM team may coordinate supplier assurance activities without owning every technical, legal or operational control.

A practical responsibility model might look like this:

Control Area	Typical Accountable Function	Supporting Functions
Outsourcing governance	Senior Management / Risk Governance	TPRM, Compliance
Materiality assessment process	TPRM	Business Owner, Compliance, Operational Risk
Supplier due diligence	TPRM	Information Security, Finance, Legal
Contractual safeguards	Legal / Procurement	TPRM, Information Security
Information security	Information Security	Technology, TPRM
Sub-outsourcing oversight	TPRM / Business Owner	Legal, Procurement, Technology
Business continuity	Business Service Owner	Operational Resilience, Technology
Exit strategy	Business Service Owner	Technology, Legal, Operational Resilience

These assignments are illustrative.

The actual accountable owner must be determined by the firm's governance arrangements.

A common ownership problem

Imagine a material outsourcing contract is signed without sufficient audit rights.

The TPRM team says Legal is responsible for contractual terms.

Legal says it was not informed that the arrangement qualified as material outsourcing.

Procurement says it followed the standard contract approval process.

The problem is not necessarily that no team has responsibilities.

The problem is that the responsibilities and information handovers were not sufficiently defined.

A control mapping exercise should help expose these gaps.

---

7. Assessing Control Effectiveness

After mapping a regulatory expectation to an internal control, the next question is whether that control is effective.

It is useful to distinguish three concepts.

7.1 Control design effectiveness

Does the control, as designed, adequately address the relevant regulatory expectation and associated risk?

For example, a bank may have a materiality assessment procedure.

However, the procedure might rely entirely on contract value and fail to consider regulatory or operational consequences.

The procedure exists, but its design may be inadequate.

7.2 Control implementation

Has the designed control actually been put in place?

For example, the bank may have approved a revised outsourcing assessment procedure but not yet incorporated it into its procurement workflow.

The control is documented but has not been fully implemented.

7.3 Operating effectiveness

Does the control operate consistently and as intended?

For example, the bank may have a well-designed materiality assessment procedure.

But when the analyst reviews ten relevant supplier engagements, several have no completed materiality assessment.

This indicates a potential operating effectiveness failure.

Example

Regulatory area: SS2/21 Chapter 5.

Control: Materiality assessments must be completed and approved before relevant outsourcing decisions.

Design assessment: The procedure includes appropriate criteria, responsibilities and approval requirements.

Implementation assessment: The procedure is integrated into the supplier onboarding workflow.

Operating effectiveness test: Review ten recently approved outsourcing arrangements.

Results: Three arrangements were approved without documented materiality assessments.

Finding: The control appears appropriately designed but is not operating consistently.

Recommended action: Identify the causes of the missed assessments, strengthen the onboarding workflow and verify that remediation is effective.

The analyst should avoid claiming that the entire firm is non-compliant based only on an isolated control test.

The significance of the finding depends on factors including the sample, affected arrangements, applicable provisions and wider evidence.

---

8. Evidence Quality: What Should an Analyst Look For?

A control assessment is only as reliable as the evidence supporting it.

Not all evidence provides the same level of assurance.

Consider a material outsourcing arrangement where the bank must assess the provider's resilience capabilities.

The supplier provides a document titled "Business Continuity Policy".

Does this demonstrate that the relevant resilience arrangements are effective?

Not necessarily.

The policy may show that the provider has documented an approach.

It does not automatically demonstrate that the approach is appropriate for the service, has been implemented or has been successfully tested.

Evidence evaluation questions

When reviewing evidence, consider:

Relevance: Does the evidence relate to the specific control and service being assessed?

Scope: Does it cover the relevant systems, services, locations and responsibilities?

Currency: Is the evidence sufficiently recent for the purpose of the assessment?

Authenticity and reliability: Is the evidence credible, and can its source be established?

Completeness: Does it demonstrate the full control activity or only part of it?

Effectiveness: Does it support conclusions about control design, operation or both?

Example: SOC 2 evidence

Suppose SecureAccess Cloud Ltd provides a SOC 2 Type II report.

The report may contain valuable information about the provider's control environment.

However, the analyst should examine:

• The services covered by the report.
• The reporting period.
• Relevant control exceptions.
• The auditor's opinion.
• Subservice organisations and exclusions.
• Complementary user entity controls.
• Whether the controls relate to the bank's outsourcing risks.

A clean SOC 2 report is not automatically evidence that the bank itself has satisfied all relevant SS2/21 expectations.

The bank still needs to assess matters such as governance, materiality, contractual rights and exit readiness.

---

9. Identifying Control Gaps

A control gap occurs when an existing control does not adequately address an applicable requirement or expectation, or when a necessary control is absent or ineffective.

Common types of gaps include:

9.1 Missing control

No suitable control has been established.

Example: The firm has no documented process for assessing outsourcing materiality.

9.2 Inadequate control design

A control exists but does not sufficiently address the applicable expectation.

Example: The materiality assessment methodology considers only the annual contract value.

9.3 Control implementation gap

A suitable control has been designed but has not been implemented.

Example: A revised contract review checklist has been approved but is not used in the procurement process.

9.4 Operating effectiveness gap

A control is implemented but does not operate consistently.

Example: Supplier assessments are regularly approved without the required independent review.

9.5 Evidence gap

The organisation cannot provide sufficient evidence to demonstrate that a control was performed or is effective.

Example: The business owner states that an exit plan was tested, but no test records or results are available.

An evidence gap does not always prove that the underlying control failed.

The analyst should determine whether the evidence is missing, incomplete or unavailable before drawing a conclusion.

---

10. Documenting Regulatory Control Gaps

Regulatory findings should communicate the issue clearly enough for management to understand and address it.

A useful structure includes:

1. Regulatory reference.
2. Expected control or outcome.
3. Observation.
4. Supporting evidence.
5. Risk or potential consequence.
6. Root cause, if established.
7. Recommended remediation.
8. Responsible owner.
9. Target completion date.
10. Status.

Worked finding

Finding ID: SS221-004

Regulatory Area: PRA SS2/21, Chapter 10: Business Continuity and Exit Plans.

Control Objective: Maintain appropriate continuity and exit arrangements for material outsourcing.

Observation: Northbridge Bank has classified its customer authentication service as material outsourcing. The bank has received a supplier business continuity policy but has not documented a stressed exit strategy for the arrangement.

Evidence Reviewed: Supplier business continuity policy, proposed service agreement and materiality assessment.

Risk: An unexpected provider failure could prevent the bank from maintaining or restoring customer authentication services within acceptable limits.

Recommended Action: Develop a documented exit strategy addressing relevant failure scenarios, recovery dependencies, alternative delivery arrangements, responsibilities and testing requirements.

Proposed Owner: Head of Digital Banking, supported by Operational Resilience and Technology.

Status: Open.

The finding identifies the expectation, the evidence gap and the potential business consequences.

It also recommends an action that management can implement.

---

11. Managing Regulatory Changes

Regulatory control mapping is not a one-time exercise.

Regulatory requirements and supervisory expectations can change, and the organisation's arrangements may evolve.

For example, the PRA published a revised SS2/21 in March 2026, with changes taking effect on 18 March 2027.

These changes relate to operational incident and material third-party reporting.

A firm preparing for implementation may need to review existing controls concerning:

• Material third-party identification.
• Supplier and arrangement records.
• Regulatory notification workflows.
• Reporting responsibilities.
• Data quality and completeness.
• Changes to material third-party relationships.

A practical regulatory change process

When a relevant regulatory update is published, an analyst might:

1. Identify the changed provisions.
2. Determine which business activities and arrangements are affected.
3. Compare the new expectations with existing controls.
4. Identify control changes or new activities required.
5. Assign responsibilities for implementation.
6. Update policies, procedures and supporting systems where necessary.
7. Validate that the revised controls are implemented.
8. Retain evidence of the change assessment and approval.

A well-maintained regulatory mapping matrix makes this process easier because it already connects regulatory expectations to control owners and supporting processes.

Version control matters

Each mapping record should identify the relevant regulatory source and version.

Without version control, an organisation may struggle to establish whether its control assessment was based on the applicable requirements at the time.

For SS2/21, the November 2024 version remains effective as of November 2026. The March 2026 revised version takes effect on 18 March 2027.

---

12. Practical Exercise: Northbridge Bank Regulatory Control Mapping

You are a TPRM Analyst at Northbridge Bank.

The bank has completed the materiality assessment for its proposed SecureAccess Cloud Ltd arrangement.

The arrangement has been classified as material outsourcing.

The Compliance Manager wants you to assess whether the bank has mapped the relevant SS2/21 expectations to appropriate internal controls.

You have been provided with the following fictional evidence.

Evidence A: Outsourcing Policy

Northbridge has an approved Outsourcing and Third-Party Risk Management Policy.

The policy requires supplier risk assessments, but it does not clearly define the responsibilities for reviewing material outsourcing decisions.

Evidence B: Materiality Assessment

The SecureAccess arrangement has a completed materiality assessment.

The assessment identifies the service as material outsourcing and includes approval from the relevant business owner.

Evidence C: Supplier Due Diligence

The TPRM team completed an information security questionnaire.

The supplier provided ISO 27001 certification and a SOC 2 Type II report.

However, the assessment records do not show whether the SOC 2 report's scope and control exceptions were reviewed.

Evidence D: Draft Outsourcing Agreement

The agreement includes service-level commitments and confidentiality clauses.

The documentation does not establish whether the required audit, information access and relevant regulatory rights have been adequately addressed.

Evidence E: Sub-Outsourcing

SecureAccess uses a cloud infrastructure provider.

Northbridge has not documented a detailed assessment of the relevant subcontracting dependencies.

Evidence F: Business Continuity and Exit

SecureAccess has submitted its business continuity policy.

Northbridge has not yet prepared a documented stressed exit strategy for the arrangement.

---

Task 1: Identify the relevant regulatory expectations

Using the official November 2024 version of SS2/21, identify the provisions relevant to:

1. Outsourcing governance.
2. Materiality assessment.
3. Supplier due diligence.
4. Contractual protections.
5. Audit and information rights.
6. Sub-outsourcing.
7. Business continuity and exit arrangements.

Record the applicable paragraph references wherever possible.

Distinguish direct regulatory obligations from the PRA's supervisory expectations.

Task 2: Create a control mapping matrix

Prepare a matrix using the following headings:

Field	Learner Response
Control ID
Regulatory source and version
Regulatory paragraph reference
Requirement or expectation
Applicability
Control objective
Existing control
Control owner
Evidence reviewed
Assessment procedure
Design effectiveness
Operating effectiveness
Gap or observation
Recommended action
Action owner
Assessment status

Complete at least six control mappings using the fictional evidence.

Where a relevant control is missing, identify the control that should exist rather than inventing evidence.

Task 3: Assess control effectiveness

For each mapped control:

• Determine whether the design appears adequate.
• Assess whether implementation has been demonstrated.
• Decide whether sufficient evidence exists to conclude that the control operated effectively.
• Record any uncertainty or missing evidence.

Use the following illustrative ratings:

Effective: Available evidence supports the conclusion that the control is appropriately designed and operating as intended.

Partially Effective: The control exists, but a material limitation has been identified.

Ineffective: Evidence indicates the control does not adequately achieve its intended objective.

Not Implemented: The expected control has not been established or put into operation.

Insufficient Evidence: Available information does not support a reliable effectiveness conclusion.

Do not assign an "Effective" rating solely because a policy exists.

Task 4: Identify three priority control gaps

Select three findings you consider most important.

For each, prepare:

• A finding title.
• Relevant SS2/21 reference.
• Observation.
• Evidence reviewed.
• Associated risk.
• Recommended remediation.
• Proposed owner.

Explain why you prioritised those findings.

Task 5: Management briefing

The Compliance Manager asks you to summarise your assessment.

Prepare a short briefing of no more than 300 words covering:

1. Whether the available evidence demonstrates adequate control coverage.
2. The most significant gaps.
3. Actions needed before the arrangement progresses.
4. Any matters requiring escalation or specialist interpretation.

Avoid claiming that the entire arrangement is compliant or non-compliant unless the evidence supports that conclusion.

Assessment guidance

A strong submission should demonstrate:

• Accurate interpretation of applicable regulatory expectations.
• Clear traceability from expectation to control.
• Appropriate control ownership.
• Relevant evidence selection.
• Reasoned effectiveness assessments.
• Recognition of evidence limitations.
• Practical and proportionate remediation recommendations.
• Clear communication to management.

The purpose of the exercise is to assess the quality of your regulatory reasoning, not simply your ability to complete a spreadsheet.

---

13. Common Mistakes in Regulatory Control Mapping

Mistake 1: Mapping every paragraph to a separate control

One effective control may address several related expectations.

Conversely, one regulatory expectation may require multiple controls.

The objective is adequate coverage and traceability, not maximising the number of spreadsheet rows.

Mistake 2: Copying regulatory text without identifying a control

Repeating what the regulator expects does not show what the organisation actually does.

The matrix must connect expectations to implemented activities.

Mistake 3: Treating policies as evidence of operating effectiveness

A policy demonstrates documented intent.

Additional evidence may be required to establish that the control was implemented and performed.

Mistake 4: Assigning every control to TPRM

Third-party risk management is a shared organisational responsibility.

TPRM may coordinate the framework, but Legal, Information Security, Procurement, Operational Resilience and business owners may own different controls.

Mistake 5: Assessing evidence without understanding its scope

A certificate or assurance report may be genuine and current but irrelevant to the specific service or control.

Evidence must be evaluated in context.

Mistake 6: Treating unavailable evidence as automatic proof of control failure

Missing evidence creates an assurance limitation.

Further investigation may be required to distinguish a missing record from an actual control failure.

Mistake 7: Failing to update the matrix

Changes in regulation, supplier arrangements or internal processes may affect existing mappings.

The register should be maintained as a working compliance tool.

---

14. Key Takeaways

Regulatory control mapping creates a practical connection between regulatory expectations and organisational activities.

The most important lessons are:

1. Start with applicability. Confirm which expectations apply before designing or assessing controls.

2. Distinguish expectations from controls. Regulatory provisions explain what is expected. Internal controls explain how the organisation addresses those expectations.

3. Make controls testable. Good control descriptions identify activities, responsibilities, timing and expected evidence.

4. Assess more than documentation. A policy or procedure does not automatically demonstrate effective control operation.

5. Evaluate evidence critically. Scope, relevance, completeness and reliability matter.

6. Maintain clear ownership. Control accountability should reflect the organisation's actual governance arrangements.

7. Document limitations and gaps. Findings should be supported by evidence and linked to appropriate remediation.

8. Maintain regulatory traceability. The mapping should be updated when requirements, controls or business arrangements change.

For a TPRM analyst, the objective is not simply to populate a compliance matrix.

It is to establish whether the organisation has appropriate controls addressing the relevant expectations and whether those controls can be demonstrated through reliable evidence.

This forms the foundation for a structured regulatory gap assessment.

---

What's Next?

Next Article: Conducting a PRA SS2/21 Regulatory Gap Assessment

In the next article, we will bring together the concepts covered so far.

You will learn how to:

• Define the scope of a regulatory gap assessment.
• Develop an assessment plan.
• Request and evaluate supporting evidence.
• Test mapped controls.
• Document regulatory assurance findings.
• Prioritise remediation actions.
• Prepare a management assurance report.

The practical exercise will build on Northbridge Bank's outsourcing arrangements and introduce a more comprehensive evidence-based assessment.

---

Official References and Further Reading

1. Prudential Regulation Authority. SS2/21: Outsourcing and Third Party Risk Management, November 2024 version.

   https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss

   Particularly relevant:

   • Chapter 4: Governance and Record-Keeping.
   • Chapter 5: Pre-Outsourcing Phase.
   • Chapter 6: Outsourcing Agreements.
   • Chapter 7: Data Security.
   • Chapter 8: Access, Audit and Information Rights.
   • Chapter 9: Sub-Outsourcing.
   • Chapter 10: Business Continuity and Exit Plans.

2. Bank of England. Outsourcing and Third Party Risk Management: Prudential and Resolution Policy Index.

   https://www.bankofengland.co.uk/prudential-regulation/prudential-and-resolution-policy-index/banking/outsourcing-and-third-party-risk-management

3. Prudential Regulation Authority. PS7/26: Operational Resilience, Operational Incident and Third-Party Reporting.

   https://www.bankofengland.co.uk/prudential-regulation/publication/2026/march/operational-incident-and-third-party-reporting-policy-statement

4. Prudential Regulation Authority. SS1/21: Operational Resilience, Impact Tolerances for Important Business Services.

   https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/operational-resilience-impact-tolerances-for-important-business-services-ss

Regulatory Version Note: This resource uses the November 2024 version of SS2/21, effective as of November 2026. The March 2026 revised statement takes effect on 18 March 2027. Readers should consult the applicable version when conducting a live assessment.

Educational Disclaimer: This article is intended for educational and professional development purposes. Northbridge Bank, SecureAccess Cloud Ltd and all exercise evidence are fictional. The illustrative controls are not presented as exhaustive regulatory requirements or legal advice. Regulatory interpretations should be verified against authoritative sources and the requirements applicable to the relevant firm.