Introduction
You are a Third-Party Risk Management (TPRM) Analyst working for Northbridge Bank, a fictional UK financial institution.
The bank's Digital Banking team has proposed engaging SecureAccess Cloud Ltd to operate the authentication service used by customers accessing online and mobile banking.
The business has already selected the preferred provider, and the project manager wants the contract approved within two weeks.
Your initial review reveals that:
- The service will be delivered and managed by an external provider.
- The provider will process customer authentication requests.
- A prolonged service failure could prevent customers from accessing their accounts.
- The provider uses another company to host parts of its infrastructure.
- No formal outsourcing classification or materiality assessment has been completed.
The project manager argues that SecureAccess Cloud Ltd is a reputable technology provider and already holds ISO 27001 certification. They believe a standard supplier security assessment should be sufficient.
Would you agree?
Before making a recommendation, you need to establish two important things:
- Does the proposed arrangement qualify as outsourcing?
- If it does, is the arrangement material?
These decisions will influence which regulatory expectations apply, what evidence must be collected, who needs to approve the arrangement, and whether the PRA must be notified.
In this article, we will examine how a TPRM analyst can approach these decisions systematically and document conclusions that can withstand internal audit and regulatory scrutiny.
Learning Objectives
By the end of this article, you should be able to:
- Distinguish outsourcing from other third-party arrangements using the principles in PRA SS2/21.
- Apply a structured approach to assessing outsourcing classification.
- Identify the regulatory criteria used to determine materiality.
- Understand the relationship between materiality, business impact and third-party risk.
- Document materiality decisions with appropriate evidence and justification.
- Recognise when an arrangement requires reassessment or consideration for regulatory notification.
- Apply these concepts to realistic financial-services scenarios.
1. Understanding Outsourcing Classification
Before assessing materiality, you need to understand the nature of the third-party relationship.
This is important because not every supplier relationship constitutes outsourcing.
A bank may purchase products, engage consultants, acquire software licences, use managed service providers or contract external organisations to perform operational functions.
These arrangements introduce different types of risks and may be subject to different regulatory expectations.
1.1 What constitutes outsourcing?
Chapter 2 of PRA SS2/21 discusses the definition and scope of outsourcing.
Broadly, an outsourcing arrangement involves a third-party service provider performing a process, service or activity that would otherwise be undertaken by the regulated firm itself.
The PRA's approach also distinguishes outsourcing from other supplier relationships that may involve products or services but do not meet the applicable outsourcing definition.
The precise regulatory definition, relevant exclusions and the nature of the arrangement must be considered before making a final determination.
For example, imagine a bank uses its own employees and technology infrastructure to operate its customer support centre.
It subsequently engages an external company to manage the customer support function on an ongoing basis.
The external provider now performs an activity that would otherwise be undertaken by the bank.
This would generally be classified as outsourcing.
Now consider a bank purchasing office furniture from a supplier.
The supplier provides goods rather than taking responsibility for performing an ongoing bank function.
This would not normally constitute outsourcing.
1.2 Why classification matters
An incorrect outsourcing classification can create significant compliance problems.
If an arrangement that should be classified as material outsourcing is incorrectly recorded as a routine supplier engagement, the bank might fail to:
- Apply the appropriate governance and approval requirements.
- Conduct the necessary regulatory assessments.
- Include required provisions in the outsourcing agreement.
- Maintain sufficient oversight of the arrangement.
- Establish appropriate business continuity and exit arrangements.
- Make regulatory notifications where required.
However, incorrectly treating every supplier engagement as outsourcing also creates problems.
It can introduce unnecessary administrative work, delay procurement and divert assurance resources away from arrangements that present more significant risks.
The objective is not to classify as many suppliers as possible as outsourcing.
The objective is to classify each arrangement correctly and apply proportionate risk management.
1.3 Classification is about the arrangement, not the supplier
A common mistake is to classify suppliers based solely on their industry or service category.
For example, the presence of a cloud service provider does not automatically mean that an arrangement qualifies as outsourcing.
The nature of the service and the responsibilities transferred to the provider need to be understood.
Similarly, the same provider may have multiple relationships with a bank.
One arrangement might involve supplying software licences, while another involves managing an operational function.
These arrangements may require different classifications.
This is why classification should be performed at the arrangement level rather than relying solely on a supplier-level label.
2. How to Perform an Outsourcing Classification Assessment
A TPRM analyst should use a structured and repeatable process.
The following five-step workflow is a practical method for supporting classification decisions.
It is an illustrative approach for training purposes, not a prescribed PRA classification template.
Step 1: Understand the service being provided
Start by gathering information about the proposed engagement.
Important questions include:
- What exactly will the supplier deliver?
- Which business function will use the service?
- What activities will the supplier perform?
- Is the service ongoing or a one-off engagement?
- Who currently performs the activity?
- Would the activity otherwise be undertaken by the bank?
- Is the provider supplying a product, performing a function or both?
Do not rely exclusively on the supplier's marketing description.
A service described commercially as a software solution may include operational responsibilities that need closer examination.
Example
SecureAccess Cloud Ltd will operate the authentication infrastructure used by Northbridge Bank's digital banking applications.
It will maintain the authentication platform, manage the supporting infrastructure and process customer authentication requests.
The engagement is expected to run continuously under a multi-year service agreement.
These facts provide a basis for assessing whether an operational function is being performed on behalf of the bank.
Step 2: Determine whether a function is being performed on behalf of the bank
Consider whether the supplier is performing a process, service or activity that falls within the applicable outsourcing definition.
The following questions can help:
- Is the provider performing an identifiable activity or function for the bank?
- Would the bank otherwise need to perform that activity itself, or arrange for its performance?
- Does the arrangement involve ongoing or recurring service delivery?
- Does it fall within any relevant regulatory exclusions?
No single question should be treated as an automatic classification test.
The complete arrangement and applicable definitions must be considered.
Step 3: Review the contractual and operational arrangements
The service description may not provide enough information.
Review relevant documentation, including:
- Statements of work.
- Service descriptions.
- Proposed service agreements.
- Service-level agreements.
- Architecture and operational responsibility documents.
- Procurement questionnaires.
- Business requirements.
These documents can clarify what the provider will actually do.
Where responsibilities are unclear, obtain clarification from the business owner, technology team or supplier.
Step 4: Record the proposed classification and reasoning
The assessment should produce a documented conclusion.
A basic classification record might look like this:
| Field |
Assessment |
| Supplier |
SecureAccess Cloud Ltd |
| Service |
Customer authentication infrastructure |
| Business owner |
Head of Digital Banking |
| Service model |
Externally managed, ongoing service |
| Function performed |
Operation of authentication infrastructure |
| Initial classification |
Outsourcing |
| Basis |
Provider performs an ongoing operational function supporting digital banking |
| Further review required |
Materiality assessment |
| Status |
Proposed classification pending approval |
A simple "Yes" or "No" entry is not sufficient if there is no explanation of how the conclusion was reached.
Step 5: Obtain appropriate review and approval
The analyst may prepare the classification, but final approval should follow the bank's established governance arrangements.
Depending on the organisation, this may involve:
- The business service owner.
- Third-party risk management.
- Operational risk.
- Compliance.
- Legal.
- The designated outsourcing governance function.
Where an arrangement is ambiguous, the analyst should document the uncertainty and seek an appropriate interpretation.
Practitioner takeaway: A defensible classification is supported by an accurate understanding of the service, relevant evidence, documented reasoning and appropriate governance.
3. What Is Material Outsourcing?
Once an arrangement has been classified as outsourcing, the next task is to determine its materiality.
Under the November 2024 version of SS2/21, material outsourcing concerns services whose weakness or failure would be sufficiently significant to cast serious doubt on the firm's continued satisfaction of relevant regulatory conditions or compliance with fundamental requirements.
In practical terms, materiality is concerned with the importance of the arrangement and the consequences of its failure.
Consider two outsourcing arrangements.
Arrangement A: An external company provides a routine document-formatting service for a small internal administrative team.
Arrangement B: An external company operates infrastructure supporting customers' ability to make online payments.
Both involve external service providers.
However, a prolonged failure of Arrangement B could have significantly greater consequences for customers, the bank's operational resilience and regulatory compliance.
This is why materiality must be assessed rather than assumed.
3.1 Materiality is not the same as supplier risk rating
This distinction is particularly important.
A traditional third-party risk assessment might consider the likelihood and consequences of events such as:
- A cybersecurity breach.
- Financial failure.
- Poor supplier performance.
- Data loss.
- Regulatory non-compliance.
These factors contribute to risk assessment, but they are not identical to materiality.
Materiality asks how important the arrangement is to the firm and what its failure or disruption could mean for the firm's obligations and operations.
For example, a highly reputable supplier may demonstrate excellent security controls.
The likelihood of a significant incident might be relatively low.
However, if that supplier operates infrastructure essential to the bank's payment services, the outsourcing arrangement could still be material.
Low assessed residual risk does not automatically mean an arrangement is non-material.
Likewise, a supplier with significant cybersecurity weaknesses is not automatically a material outsourcing provider.
The two assessments answer different questions.
3.2 Materiality is not determined by contract value
A contract worth £20,000 annually may support a highly important business function.
Another contract worth £500,000 may provide services whose disruption would have relatively limited consequences for the bank's regulatory obligations.
Contract value may provide useful context, but it is not a reliable standalone measure of materiality.
The consequences of failure are more important than the price of the service.
4. PRA SS2/21 Materiality Assessment Criteria
Chapter 5 of SS2/21 establishes supervisory expectations for assessing materiality during the pre-outsourcing phase.
The November 2024 version includes criteria that would generally indicate materiality and additional factors that should be considered individually and collectively.
The following sections explain how these can be applied.
4.1 Impact on regulatory compliance
Would disruption or failure of the outsourced service materially affect the bank's ability to comply with its regulatory obligations?
Consider a provider responsible for operating a system that supports mandatory regulatory reporting.
If the service fails, the bank may be unable to produce or submit required information.
The analyst should examine the potential consequences and whether the affected obligation is significant enough to meet the applicable materiality criteria.
4.2 Impact on operational resilience
Would disruption prevent the bank from delivering an important business service within its established impact tolerance?
For example, Northbridge Bank identifies customer access to digital banking as an important business service.
Its authentication infrastructure is a significant dependency supporting that service.
A sustained authentication failure could prevent customers from accessing accounts, initiating transfers or carrying out other important activities.
The analyst should work with operational resilience specialists to understand:
- Which important business services depend on the arrangement.
- How the service contributes to their delivery.
- What happens when the supplier becomes unavailable.
- Whether alternative arrangements exist.
- How the disruption relates to relevant impact tolerances.
A direct connection to an important business service is a significant consideration, but classification should still follow the applicable regulatory criteria and documented methodology.
4.3 Impact on financial resilience
Could failure of the provider materially affect the bank's financial position or safety and soundness?
For example, disruption to a provider responsible for an important transaction-processing function could result in substantial operational losses or other financial consequences.
The assessment should consider relevant impacts on financial resilience, including potential effects on capital, funding and liquidity where applicable.
4.4 Impact on customers and policyholders
The analyst should consider the consequences of disruption for customers or, in the case of insurers, policyholders.
Relevant factors include:
- The number of customers potentially affected.
- The importance of the service to those customers.
- Whether customers could access alternative channels.
- The duration and severity of potential disruption.
- Potential financial or other harm.
A service that supports a large population of customers may require closer scrutiny.
However, customer volume alone should not be treated as a definitive materiality threshold.
4.5 Connection to regulated activities and key functions
The PRA expects particular attention to arrangements involving an entire regulated activity or relevant internal control or key function.
For example, outsourcing responsibility for the performance of an entire regulated activity could have significant regulatory implications.
Similarly, transferring a key control function to an external provider requires careful evaluation.
The precise assessment depends on the nature of the function and the applicable regulatory provisions.
4.6 Data confidentiality, integrity and availability
Materiality assessments should also consider the nature and importance of the data involved.
A supplier processing sensitive customer financial information may create significant consequences if confidentiality, integrity or availability is compromised.
However, the presence of personal data does not automatically make every arrangement material.
The analyst should consider the sensitivity of the data, scale of processing, potential consequences and connection to the firm's operations and regulatory responsibilities.
4.7 Substitutability and exit complexity
How easily could the bank replace the provider or bring the function back in-house?
Consider a technology provider operating a proprietary authentication platform.
Moving to another provider may require:
- Application integration changes.
- Data migration.
- Customer re-enrolment.
- Testing and validation.
- Contractual negotiations.
- Operational transition arrangements.
If replacing the provider is technically difficult, costly or time-consuming, the dependency may increase the consequences of disruption.
Substitutability should therefore form part of the materiality assessment.
4.8 Concentration and interconnected dependencies
The bank may depend on a single provider for several services.
Alternatively, multiple apparently independent suppliers may rely on the same infrastructure provider.
For example:
- SecureAccess Cloud Ltd provides customer authentication.
- PaymentFlow Systems Ltd provides payment-processing services.
- Both depend on the same cloud infrastructure provider.
A serious disruption affecting their common dependency could affect multiple bank services simultaneously.
This illustrates why the analyst should examine not only the direct supplier but also relevant subcontracting and concentration risks.
5. A Practical Materiality Assessment Workflow
We will now bring these criteria together into a structured workflow.
The process below is an example that a regulated firm could adapt to its own approved framework.
It should not be interpreted as a mandatory PRA scoring methodology.
Step 1: Establish the assessment scope
Identify the arrangement being assessed and its business context.
Record:
- Supplier name.
- Arrangement identifier.
- Business owner.
- Description of the service.
- Outsourcing classification.
- Contract scope and duration.
- Important business services supported.
- Significant operational dependencies.
The assessment should focus on the actual arrangement rather than simply evaluating the supplier as an organisation.
Step 2: Identify potentially decisive materiality criteria
Before assigning any numerical ratings, examine whether the arrangement meets criteria that would generally lead to a materiality determination under SS2/21.
For example:
- Could failure materially impair the firm's ability to meet relevant regulatory conditions?
- Could failure materially affect compliance with applicable fundamental rules?
- Could disruption materially undermine operational resilience?
- Does the arrangement involve the outsourcing of an entire regulated activity?
- Does it involve an internal control or key function falling within the relevant criteria?
Where an applicable criterion clearly supports materiality, the analyst should not allow a simple weighted average or an otherwise low score to override that conclusion.
This is an important limitation of purely numerical materiality models.
Step 3: Evaluate the wider materiality factors
For arrangements not already determined to be material, consider the wider criteria individually and collectively.
A practical assessment table might look like this:
| Assessment dimension |
Example question |
Evidence |
| Operational resilience |
Could disruption affect an important business service? |
Service maps and business impact analysis |
| Regulatory impact |
Could failure affect compliance with relevant requirements? |
Regulatory obligations and compliance analysis |
| Customer impact |
What would disruption mean for customers? |
Service impact assessment |
| Financial impact |
Could failure materially affect financial resilience? |
Finance or risk impact analysis |
| Data impact |
What are the consequences of losing data confidentiality, integrity or availability? |
Data classification and security assessment |
| Substitutability |
Could the bank replace the provider within an acceptable period? |
Exit feasibility assessment |
| Concentration |
Are there significant dependencies on this provider or its subcontractors? |
Supplier inventory and dependency mapping |
The purpose of this table is to support consistent decision-making.
Step 4: Form a proposed conclusion
After reviewing the available evidence, the analyst should prepare a justified conclusion.
For example:
Proposed determination: Material outsourcing
Rationale: The arrangement supports customer authentication for digital banking. A significant failure could disrupt customer access to an important business service and potentially undermine the bank's operational resilience. The service also presents substantial technical dependencies that may make rapid substitution difficult.
This conclusion should identify which applicable regulatory criteria support the assessment.
Where evidence remains incomplete, the analyst should record the uncertainty rather than present an unsupported conclusion as final.
Step 5: Obtain review and approval
The proposed materiality determination should be reviewed in accordance with the firm's governance framework.
This could involve the business owner, TPRM, Operational Risk, Compliance, Legal and the appropriate delegated decision-maker.
The analyst should retain evidence of:
- The proposed classification.
- Assessment methodology.
- Materiality criteria considered.
- Supporting evidence.
- Assumptions and limitations.
- Review comments.
- Final approval.
- Assessment date and reassessment triggers.
Step 6: Determine the required next actions
A materiality determination influences the next stages of the outsourcing lifecycle.
For material outsourcing, the firm will generally need to consider:
- The appropriate regulatory notification requirements.
- Enhanced and proportionate due diligence.
- Contractual requirements.
- Access, audit and information rights.
- Business continuity and exit planning.
- Ongoing oversight and monitoring.
- Relevant record-keeping requirements.
For non-material arrangements, proportionate risk assessment and appropriate oversight still apply.
The objective is not simply to complete a materiality form. It is to ensure that the assessment leads to the correct governance and risk management activities.
6. Should Materiality Assessments Use Numerical Scores?
Some organisations use numerical scoring models to support consistency.
For example, they may assess business impact, regulatory impact, customer impact and substitutability using a defined rating scale.
Such models can help structure evidence gathering and comparison.
However, SS2/21 does not prescribe a universal numerical materiality scoring model.
A scoring approach is an internal methodology, not a regulatory substitute for applying the actual criteria.
Example of a common weakness
An organisation assigns each dimension a score from 1 to 5.
The final score is calculated as the average.
The assessment produces:
| Dimension |
Illustrative rating |
| Regulatory impact |
5 |
| Operational resilience |
5 |
| Customer impact |
5 |
| Financial impact |
2 |
| Substitutability |
3 |
| Average |
4.0 |
Suppose the organisation automatically labels anything below 4.5 as non-material.
That approach could produce an indefensible conclusion where the arrangement clearly meets an applicable materiality criterion.
A better methodology would examine potentially decisive regulatory criteria first.
Where appropriate, numerical scores could then support the broader assessment.
Recommended approach
Use a combination of:
- Regulatory criteria checks.
- Structured impact analysis.
- Evidence-based professional judgement.
- Documented review and approval.
Numerical scores should support the decision, not replace the reasoning behind it.
7. Worked Example: Northbridge Bank
Let us return to the SecureAccess Cloud Ltd engagement introduced at the beginning of this article.
7.1 Background
Northbridge Bank plans to outsource the operation of its customer authentication infrastructure.
SecureAccess Cloud Ltd will:
- Operate the authentication platform.
- Process customer authentication requests.
- Maintain the supporting infrastructure.
- Provide service monitoring and technical support.
- Use a cloud infrastructure subcontractor.
The arrangement will support customers accessing Northbridge's online and mobile banking services.
7.2 Outsourcing classification
Initial classification: Outsourcing.
Rationale: SecureAccess Cloud Ltd will perform an ongoing operational function supporting Northbridge's digital banking services. The function would otherwise need to be performed or arranged by the bank.
The final classification remains subject to confirmation of the contractual and operational details and applicable regulatory definitions.
7.3 Materiality assessment
The analyst obtains the following information:
Operational resilience: The authentication service supports customer access to digital banking, an important business service identified by the bank.
Customer impact: A prolonged failure could prevent a substantial number of customers from accessing their accounts.
Regulatory impact: An extended disruption could affect the bank's ability to meet relevant operational resilience obligations.
Substitutability: The service relies on proprietary integrations. Replacing the provider would require technical changes and testing.
Concentration: The provider depends on a cloud infrastructure company also used by other important bank services.
7.4 Proposed conclusion
Materiality determination: Material outsourcing.
The key basis for this conclusion is the potential effect of service disruption on important digital banking operations, customers and the bank's ability to maintain operational resilience.
Substitutability and concentration dependencies provide additional supporting considerations.
7.5 Next actions
The analyst recommends:
- Obtain formal approval of the materiality determination.
- Refer the arrangement for regulatory notification screening.
- Conduct appropriate due diligence, proportionate to the risks.
- Review the contract against applicable outsourcing requirements.
- Assess the cloud subcontracting dependency.
- Evaluate business continuity and stressed exit arrangements.
- Record the arrangement in the appropriate outsourcing inventory.
- Establish ongoing monitoring arrangements.
The assessment does not itself constitute approval to enter the outsourcing arrangement.
The decision must follow the bank's governance and regulatory processes.
8. When Must the PRA Be Notified?
Materiality assessments are closely linked to regulatory notification obligations.
Under the currently effective November 2024 SS2/21, the PRA Rulebook requires relevant firms to notify the PRA when entering into, or significantly changing, a material outsourcing arrangement.
SS2/21 also describes supervisory expectations regarding the timing of such notifications.
The expectation is that firms assess materiality sufficiently early for the appropriate notification to be made before entering the arrangement.
For material non-outsourcing third-party relationships, notification considerations may also arise under the applicable broader disclosure requirements.
Example
Northbridge Bank intends to sign its SecureAccess Cloud Ltd agreement on 30 November.
The materiality assessment concludes that the arrangement is material outsourcing.
The project team cannot simply assume it can complete the notification process after signing.
The analyst should flag the matter promptly to Compliance and the responsible regulatory reporting function so that the required notification process can be addressed within the appropriate timeframe.
Upcoming changes from March 2027
The PRA's March 2026 revised SS2/21 takes effect on 18 March 2027.
The revised framework introduces changes to notification and reporting arrangements for material third-party relationships, including qualifying material non-outsourcing arrangements.
This means organisations should prepare for a broader and more standardised approach to collecting and reporting material third-party information.
For analysts, accurate classification, materiality decisions and supplier records will become particularly important.
Important: The detailed reporting obligations depend on the firm's regulatory status and the applicable rules. Notification decisions should be confirmed with the responsible Compliance or Regulatory Affairs function.
9. When Should Materiality Be Reassessed?
Materiality is not necessarily a permanent classification.
An arrangement initially assessed as non-material may become material when its scope, usage or importance changes.
SS2/21 expects firms to assess or reassess materiality at appropriate points, including:
- Before entering into the arrangement.
- At appropriate intervals during the relationship.
- When the firm significantly increases its use of, or dependence on, the service.
- Following significant changes affecting the provider or relevant subcontractors that could alter the risk profile.
Example: A change in materiality
Northbridge initially engages a provider to support an internal reporting application.
The application is used by a small operational team, and the arrangement is assessed as non-material.
Two years later, the bank expands the application's role.
It now supports a major business process and becomes an important dependency for a broader range of operations.
Although the supplier has not changed, the consequences of service failure have increased.
The bank should reassess the arrangement's materiality using its current business context and applicable regulatory criteria.
This illustrates an important principle:
A materiality assessment concerns the significance of the arrangement to the firm at the time of assessment.
It should not be treated as a permanent property of the supplier.
10. Common Mistakes in Outsourcing Classification and Materiality Assessments
Mistake 1: Treating all technology providers as outsourcing providers
Technology suppliers can provide products, services or managed operational functions.
The actual nature of the arrangement determines its classification.
Mistake 2: Assuming a low-risk supplier cannot be material
Security maturity and materiality are different considerations.
A well-controlled supplier may still perform a function whose failure could have serious consequences.
Mistake 3: Relying exclusively on a numerical score
An internally developed scoring model should not override regulatory criteria that strongly support a materiality determination.
Mistake 4: Failing to document the reasoning
An assessment that simply records "Material: Yes" without supporting evidence can be difficult to defend.
The rationale and relevant criteria should be documented.
Mistake 5: Ignoring changes in business dependency
A supplier arrangement may become more important over time.
Materiality should be reconsidered when significant changes occur.
Mistake 6: Confusing risk acceptance with materiality classification
Management may accept the residual risks associated with a material outsourcing arrangement within the firm's delegated risk governance.
That does not make the arrangement non-material.
Materiality classification and residual risk acceptance serve different purposes.
Mistake 7: Treating classification as a procurement-only responsibility
Procurement may coordinate the assessment, but business owners and relevant risk and compliance functions must provide the information and judgement needed for an accurate decision.
11. Practical Exercise: Outsourcing Classification and Materiality Assessment
You are a TPRM Analyst at Northbridge Bank.
Five supplier arrangements have been submitted for review.
Your task is to classify each arrangement and assess its potential materiality.
You should not assume that every technology-related service is outsourcing or that every outsourcing arrangement is material.
Supplier A: OfficePro Ltd
OfficePro supplies furniture and office equipment to several Northbridge Bank branches.
The supplier delivers goods under purchase orders and does not perform an ongoing operational function for the bank.
Supplier B: SecureAccess Cloud Ltd
SecureAccess operates the customer authentication infrastructure supporting the bank's online and mobile banking services.
A prolonged outage could prevent customers from accessing their accounts.
The service is delivered continuously and relies on a cloud infrastructure subcontractor.
Supplier C: Insight Advisory Partners
Insight Advisory Partners has been engaged to conduct a one-off strategic assessment of Northbridge's expansion plans.
The firm will deliver a report with recommendations but will not take responsibility for ongoing operational activities.
Supplier D: ReconcileTech Services
ReconcileTech performs daily transaction reconciliation activities on behalf of Northbridge Bank.
The activities would otherwise need to be performed internally.
A failure could result in delayed reconciliation, inaccurate financial information and potential regulatory consequences.
The scale of transactions and available contingency arrangements have not yet been confirmed.
Supplier E: LearningHub Systems
LearningHub provides a hosted employee learning platform used for general professional development.
The bank manages the training content and employee enrolments.
The platform does not currently deliver mandatory regulatory training.
However, the supplier agreement also offers an optional managed training administration service, which the business may activate in the future.
Task 1: Classify the arrangements
For each supplier, determine whether the available information supports:
- Outsourcing.
- Non-outsourcing third-party arrangement.
- Further information required before classification.
Explain your reasoning.
Task 2: Assess materiality
For each arrangement, consider:
- The potential consequences of service failure.
- Regulatory implications.
- Operational resilience.
- Customer or business impact.
- Substitutability and dependencies.
Where there is insufficient information, identify the evidence needed to reach a conclusion.
Do not force a material or non-material decision where the facts are inadequate.
Task 3: Prepare a materiality assessment record
Select either SecureAccess Cloud Ltd or ReconcileTech Services.
Prepare an assessment using the following structure:
| Field |
Learner response |
| Supplier name |
|
| Service description |
|
| Business owner |
|
| Proposed outsourcing classification |
|
| Classification rationale |
|
| Important business services supported |
|
| Relevant regulatory considerations |
|
| Operational impact |
|
| Customer impact |
|
| Substitutability considerations |
|
| Additional evidence required |
|
| Proposed materiality determination |
|
| Materiality rationale |
|
| Required reviews and approvals |
|
| Regulatory notification screening |
|
| Next actions |
|
Task 4: Respond to stakeholder challenge
The Head of Digital Banking sends you the following message:
SecureAccess is already ISO 27001 certified, and our technical team is satisfied with the security controls. I don't understand why we need a materiality assessment before signing the contract. This is delaying the project.
Prepare a short professional response explaining:
- Why security certification does not determine outsourcing materiality.
- Why the bank needs to understand the potential consequences of service failure.
- What must happen before the arrangement can proceed through the appropriate approval process.
Your response should be clear enough for a business stakeholder without specialist regulatory knowledge.
Suggested assessment criteria
Your work should demonstrate:
- Accurate understanding of outsourcing classification.
- Appropriate use of regulatory materiality criteria.
- Clear distinction between materiality and supplier risk.
- Evidence-based reasoning.
- Recognition of uncertainty and missing information.
- Appropriate escalation and governance.
- Clear written communication.
The quality of your reasoning is more important than producing a predetermined number of material classifications.
12. Key Takeaways
Outsourcing classification and materiality assessment are important parts of regulatory third-party risk management.
The key principles are:
-
Classification comes first. Understand the nature of the supplier arrangement before determining which outsourcing-specific requirements apply.
-
Materiality concerns significance and consequences. A reputable supplier with strong security controls may still support a material outsourcing arrangement.
-
Apply regulatory criteria before relying on scoring models. Internal methodologies should support, rather than override, applicable supervisory expectations.
-
Documentation matters. A defensible materiality decision requires evidence, reasoning, appropriate review and a clear audit trail.
-
Materiality can change. Arrangements should be reassessed when their business importance, dependencies or risk profile materially changes.
-
Materiality has governance consequences. It influences assurance requirements, contractual expectations, regulatory notification considerations and ongoing oversight.
For a TPRM analyst, the objective is not simply to label an arrangement as material or non-material.
It is to provide an accurate, evidence-based assessment that enables the organisation to understand its dependencies and meet its regulatory responsibilities.
What's Next?
Next Article: Mapping PRA SS2/21 Requirements to TPRM Controls
In the next article, we will move from regulatory interpretation to control mapping.
You will learn how to:
- Identify relevant SS2/21 expectations.
- Translate them into assessable internal control requirements.
- Identify control owners.
- Define suitable supporting evidence.
- Assess whether controls are adequately designed and implemented.
- Record compliance gaps and remediation requirements.
This will prepare you for the regulatory gap assessment exercise later in the learning pathway.
Official References and Further Reading
-
Prudential Regulation Authority. SS2/21: Outsourcing and Third Party Risk Management, November 2024 version.
https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/supervisory-statement/2024/ss221-november-2024-update.pdf
Particularly relevant:
- Chapter 2: Definitions and Scope.
- Chapter 4: Governance and Record-Keeping.
- Chapter 5: Pre-Outsourcing Phase.
- Paragraphs 5.1–5.17: Materiality Assessment and Notification.
-
Bank of England. SS2/21 publication page, including current and future versions.
https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss
-
Prudential Regulation Authority. PS7/26: Operational Resilience, Operational Incident and Third-Party Reporting.
https://www.bankofengland.co.uk/prudential-regulation/publication/2026/march/operational-incident-and-third-party-reporting-policy-statement
-
Prudential Regulation Authority. SS1/21: Operational Resilience, Impact Tolerances for Important Business Services.
https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/operational-resilience-impact-tolerances-for-important-business-services-ss
Regulatory version note: This article is based principally on the November 2024 SS2/21, which remains effective as of November 2026. The revised March 2026 statement takes effect on 18 March 2027. Readers should verify the applicable version when undertaking a live assessment.
Educational Disclaimer: This resource is intended for learning and professional development. All organisations, suppliers and scenarios used in the exercises are fictional. The material does not constitute legal or regulatory advice. Regulatory interpretations and obligations should be verified against current official publications and the requirements applicable to the relevant firm.