Conducting a PRA SS2/21 Regulatory Gap Assessment

Introduction

Northbridge Bank has classified its proposed engagement with SecureAccess Cloud Ltd as material outsourcing.

The provider will operate customer authentication infrastructure supporting the bank's online and mobile banking services.

The Third-Party Risk Management (TPRM) team has completed the initial supplier assessment and developed a regulatory control mapping matrix linking the arrangement to relevant expectations under PRA SS2/21.

However, the Compliance Manager has raised a concern.

Although several policies and procedures exist, the bank has not established whether they adequately address the applicable regulatory expectations or whether the controls operate as intended.

You have been asked to conduct a regulatory gap assessment before the arrangement proceeds through final approval.

Your task is not simply to check whether the bank has an outsourcing policy or whether the supplier holds ISO 27001 certification.

You must establish what the PRA expects, identify the controls Northbridge has implemented, examine supporting evidence and determine whether any significant gaps require remediation.

This is the purpose of a regulatory gap assessment.

In this article, you will learn how to plan and conduct a PRA SS2/21 gap assessment, evaluate evidence, document findings and prepare a report that supports management decision-making.

---

Learning Objectives

By the end of this article, you should be able to:

1. Explain the purpose of an SS2/21 regulatory gap assessment.
2. Define the assessment scope and applicable regulatory expectations.
3. Develop an evidence request and assessment plan.
4. Evaluate control design, implementation and operating effectiveness.
5. Distinguish control failures from missing or insufficient evidence.
6. Document and prioritise findings using a risk-based approach.
7. Develop remediation actions and validate their completion.
8. Prepare an evidence-based regulatory assurance report.

---

1. What Is a Regulatory Gap Assessment?

A regulatory gap assessment compares an organisation's existing arrangements against applicable regulatory requirements and supervisory expectations.

It identifies differences between what is expected and what the organisation has implemented or can demonstrate.

For PRA SS2/21, this involves evaluating the firm's outsourcing and third-party risk management arrangements against relevant supervisory expectations.

A gap assessment may examine:

• Outsourcing governance and accountability.
• Outsourcing classification and materiality.
• Supplier due diligence.
• Risk assessment and concentration risk.
• Contractual arrangements.
• Data security.
• Access, audit and information rights.
• Sub-outsourcing.
• Business continuity and exit planning.
• Ongoing oversight and monitoring.

The objective is to determine whether the organisation has appropriate arrangements for meeting its obligations and managing the associated risks.

1.1 Gap assessment versus supplier risk assessment

These activities are related but answer different questions.

A supplier risk assessment examines the risks associated with a particular provider or service.

For example:

"Does SecureAccess Cloud Ltd have adequate controls to protect customer authentication information?"

A regulatory gap assessment examines whether the regulated firm's arrangements address applicable regulatory expectations.

For example:

"Has Northbridge Bank established appropriate contractual rights, oversight arrangements and exit plans for this material outsourcing relationship?"

A supplier could demonstrate strong cybersecurity controls while the bank still has significant gaps in its own outsourcing governance.

Both assessments are important.

1.2 Gap assessment versus regulatory audit

A regulatory gap assessment is not necessarily an internal audit.

A gap assessment may be performed by TPRM, Risk, Compliance or a consultant to understand the current state and identify improvements.

An internal audit typically provides independent assurance in accordance with its approved mandate and methodology.

The evidence and methods may overlap, but the assessment's independence, scope and assurance conclusions should be described accurately.

Practical takeaway: Do not describe a limited gap assessment as a comprehensive regulatory compliance audit.

---

2. Establishing the Assessment Scope

A regulatory gap assessment should begin with a clearly defined scope.

Without an agreed scope, the exercise may expand unnecessarily, overlook important requirements or produce conclusions that are broader than the available evidence supports.

2.1 Determine what is being assessed

An SS2/21 assessment can be conducted at different levels.

Framework-level assessment

Examines the organisation's overall outsourcing and third-party risk management framework.

This might include policies, governance structures, record-keeping, materiality assessment processes and monitoring arrangements.

Arrangement-level assessment

Examines the application of regulatory expectations to a particular outsourcing arrangement.

For example, the SecureAccess Cloud Ltd engagement.

Thematic assessment

Examines a specific control area across several outsourcing arrangements.

For example, the effectiveness of exit planning across all material outsourcing providers.

These assessments have different scopes and evidence requirements.

2.2 Example assessment scope

Northbridge Bank has requested an arrangement-level assessment.

The proposed scope is:

Assessment title: SecureAccess Cloud Ltd: PRA SS2/21 Regulatory Gap Assessment.

Assessment objective: Evaluate whether Northbridge has established and implemented appropriate controls addressing relevant SS2/21 expectations for its proposed material outsourcing arrangement.

In scope:

• Classification and materiality.
• Governance and approval arrangements.
• Pre-outsourcing due diligence.
• Risk assessment.
• Contractual safeguards.
• Data security arrangements.
• Audit and information rights.
• Sub-outsourcing.
• Business continuity and exit planning.

Out of scope:

• An independent penetration test of the provider's infrastructure.
• A comprehensive assessment of every supplier used by Northbridge.
• A legal opinion on regulatory compliance.
• Testing the provider's entire enterprise security programme.

Assessment output: Regulatory gap register, prioritised remediation plan and management assurance summary.

2.3 Confirm the regulatory baseline

The analyst must identify the applicable regulatory version before starting.

For this exercise, the baseline is the November 2024 version of PRA SS2/21.

The March 2026 revised version takes effect on 18 March 2027.

The assessment should distinguish currently applicable expectations from future requirements.

Where preparation for future changes is included, those findings should be clearly labelled as readiness or implementation gaps, rather than incorrectly presented as breaches of requirements not yet in force.

---

3. Developing the Assessment Plan

Once the scope is agreed, develop an assessment plan.

The plan should explain:

1. Which regulatory areas will be reviewed.
2. Which controls will be assessed.
3. What evidence is required.
4. Who will provide the evidence.
5. What testing methods will be used.
6. How findings will be documented.
7. Who will review the assessment results.

Example assessment plan

Assessment Area	Planned Activity	Evidence Required
Governance	Review responsibilities and approval process	Outsourcing policy, responsibility matrix, approvals
Materiality	Verify classification and materiality determination	Completed assessments and supporting rationale
Due diligence	Review supplier assessment coverage	Questionnaires, assurance reports, risk assessment
Contracts	Evaluate applicable contractual safeguards	Draft agreement and legal review
Data security	Review security requirements and controls	Data flow diagrams, security assessments
Audit rights	Assess information and audit provisions	Contract clauses and review records
Sub-outsourcing	Evaluate subcontracting oversight	Subcontractor register and risk assessment
Continuity and exit	Review resilience and exit arrangements	Recovery plans, exit strategy, test evidence

The assessment plan should be proportionate to the arrangement's significance and risk.

Not every control requires the same level of testing.

---

4. Collecting and Reviewing Evidence

Evidence collection is one of the most important stages of a regulatory gap assessment.

An organisation may claim that a control exists, but the analyst must establish what evidence supports that claim.

4.1 Preparing an evidence request

An evidence request should be specific enough for the relevant stakeholder to understand what is needed.

Consider these two requests.

Weak request:

"Please provide all outsourcing compliance documents."

This is vague and may result in large amounts of irrelevant documentation.

Improved request:

"Please provide the approved outsourcing policy, the completed classification and materiality assessment for SecureAccess Cloud Ltd, evidence of the relevant approvals, and the supplier risk assessment completed before the proposed engagement."

The second request identifies the documents and the arrangement concerned.

4.2 Recommended evidence request fields

An evidence tracker can include:

• Evidence request ID.
• Regulatory area.
• Requested document or information.
• Responsible stakeholder.
• Request date.
• Due date.
• Status.
• Evidence received.
• Evidence location.
• Reviewer comments.
• Follow-up action.

The tracker helps distinguish between evidence that has not been requested, evidence that is outstanding and evidence that has been reviewed.

4.3 Evaluating evidence quality

Receiving a document does not necessarily mean the relevant control has been demonstrated.

Assess:

Relevance: Does the evidence relate to the specific requirement and arrangement?

Scope: Does it cover the services, systems and activities being assessed?

Currency: Is the evidence sufficiently recent?

Reliability: Can the source and authenticity be established?

Completeness: Does the document contain enough information to support a conclusion?

Effectiveness: Does the evidence demonstrate control design, implementation or operation?

Example

SecureAccess provides a business continuity policy.

The policy states that the provider maintains recovery arrangements.

However, it does not contain recovery testing results or demonstrate whether the proposed recovery capabilities align with Northbridge's requirements.

The policy provides evidence that the provider has documented an approach.

It does not, by itself, demonstrate that Northbridge has adequate assurance over service recovery or that the bank has an effective exit strategy.

The analyst should request further evidence or record an assurance limitation.

---

5. Evaluating Control Effectiveness

In Article 3, we introduced the distinction between control design, implementation and operating effectiveness.

These concepts are central to gap assessment.

5.1 Design effectiveness

Does the control, as designed, adequately address the relevant expectation?

For example, Northbridge has a supplier due diligence procedure.

However, the procedure does not require any review of subcontracting dependencies.

The procedure exists, but its design may be inadequate for arrangements where sub-outsourcing presents material risks.

5.2 Implementation

Has the control actually been established and incorporated into the relevant process?

For example, Northbridge has approved a revised material outsourcing contract checklist.

However, Legal has not yet integrated the checklist into its contract review workflow.

The control is designed but not fully implemented.

5.3 Operating effectiveness

Does the control operate consistently and as intended?

For example, Northbridge's policy requires documented materiality assessments before approval.

A review of relevant engagements identifies several arrangements approved without completed assessments.

This indicates a potential operating effectiveness gap.

5.4 Selecting an assessment rating

A practical gap assessment can use the following ratings.

Rating	Meaning
Effective	Evidence supports the conclusion that the control is appropriately designed and operating as intended
Partially Effective	The control exists, but one or more significant limitations have been identified
Ineffective	Evidence indicates the control does not adequately achieve its objective
Not Implemented	The expected control has not been established or put into operation
Insufficient Evidence	Available evidence is inadequate to reach a reliable conclusion
Not Applicable	The requirement or expectation does not apply, with justification documented

These are illustrative internal assessment ratings, not a scoring system prescribed by the PRA.

5.5 Avoiding unsupported conclusions

Suppose Northbridge cannot provide evidence that a supplier's recovery arrangements were tested.

The analyst should not automatically conclude that no testing occurred.

The available evidence may simply be insufficient.

A defensible finding might state:

"Northbridge has not provided evidence demonstrating that the supplier's recovery arrangements have been tested against the bank's relevant service recovery requirements."

This distinguishes the observed evidence limitation from an unproven claim about the underlying activity.

---

6. Performing the Gap Assessment

The assessment itself involves comparing each applicable expectation with the firm's mapped controls and supporting evidence.

A structured approach is useful.

Step 1: Select the regulatory expectation

Identify the applicable SS2/21 chapter and specific paragraph.

For example, Chapter 10 addresses business continuity and exit planning.

Record the relevant provision and verify that it applies to the arrangement.

Step 2: Identify the internal control

Determine how the firm intends to address the expectation.

For example:

"The Business Service Owner maintains a documented exit strategy for each material outsourcing arrangement, supported by relevant technical and operational stakeholders."

Step 3: Examine the evidence

Request the exit strategy, supporting assessments, approval records and relevant testing evidence.

Determine whether the documents relate to the arrangement being assessed.

Step 4: Assess the control

Evaluate:

• Whether the control is appropriately designed.
• Whether it has been implemented.
• Whether available evidence demonstrates operation.
• Whether identified limitations create significant risks.

Step 5: Record the result

Document the assessment outcome, evidence considered, limitations and any required follow-up.

Example assessment record

Field	Assessment Result
Regulatory area	SS2/21 Chapter 10
Control objective	Maintain appropriate exit arrangements for material outsourcing
Existing control	Exit strategies required under outsourcing policy
Evidence	Outsourcing policy and draft supplier contract
Observation	No arrangement-specific stressed exit strategy provided
Design assessment	Partially effective
Implementation assessment	Not demonstrated for this arrangement
Operating effectiveness	Insufficient evidence
Recommended action	Develop and validate an appropriate stressed exit strategy
Status	Open

The specific conclusion should reflect the evidence reviewed, not assumptions about what may have happened.

---

7. Documenting Regulatory Findings

A gap assessment is only useful when findings are clear, supported and actionable.

A good finding explains:

1. What was expected.
2. What was observed.
3. What evidence supports the observation.
4. Why the gap matters.
5. What needs to be done.
6. Who should address it.

Example finding

Finding ID: SS221-GAP-001

Title: Inadequate assurance over stressed exit arrangements.

Regulatory reference: PRA SS2/21, Chapter 10: Business Continuity and Exit Plans.

Expected control: Appropriate and documented exit arrangements for material outsourcing, supported by proportionate review and testing.

Observation: Northbridge has classified SecureAccess as material outsourcing. However, no arrangement-specific stressed exit strategy has been provided.

Evidence reviewed: Outsourcing policy, materiality assessment, draft contract and supplier business continuity policy.

Risk: An unexpected failure of SecureAccess could prevent Northbridge from maintaining or restoring customer authentication services within acceptable limits.

Recommended action: Develop a stressed exit strategy addressing alternative delivery arrangements, technical dependencies, data transfer, responsibilities and testing.

Proposed owner: Head of Digital Banking.

Status: Open.

This finding connects the regulatory expectation to the observed weakness and its potential consequences.

Distinguishing gaps from breaches

An identified control gap is not automatically proof of a regulatory breach.

The analyst must distinguish between:

• A weakness in internal control.
• An inability to demonstrate control effectiveness.
• A failure to meet an applicable supervisory expectation.
• A potential breach of an enforceable regulatory requirement.

Where a potential regulatory breach is identified, it should be escalated to the appropriate Compliance or Legal function for assessment.

Avoid making legal conclusions without sufficient evidence or authority.

---

8. Prioritising Findings

Not every gap presents the same level of risk.

A missing review signature on a low-impact document may have different consequences from the absence of a viable exit strategy for a material outsourcing arrangement.

A risk-based approach should consider:

• Severity of the potential consequences.
• Importance of the affected service.
• Applicable regulatory obligations.
• Existing mitigating controls.
• Exposure to operational disruption.
• Customer or policyholder impact.
• Urgency of the required action.

Illustrative finding priorities

Critical: A severe weakness creates an immediate or potentially unacceptable exposure affecting important operations or obligations, requiring urgent escalation.

High: A significant regulatory or operational control weakness requires prompt management attention and remediation.

Medium: A meaningful deficiency requires corrective action, but the available evidence does not indicate an immediate severe exposure.

Low: A limited deficiency with relatively minor consequences that can be addressed through routine improvement.

These are illustrative internal ratings. SS2/21 does not prescribe a universal four-level finding severity scale.

Example prioritisation

Finding	Illustrative Priority	Reason
No stressed exit strategy for a material service	High	Potential difficulty maintaining service after provider failure
Audit rights not adequately established	High	Could prevent appropriate assurance and regulatory access
Unclear subcontractor dependencies	Medium–High	Potential concentration and continuity exposure requiring further assessment
Incomplete document version information	Low	Primarily affects traceability, assuming underlying controls remain effective

These preliminary ratings should be validated against the bank's risk methodology and the specific evidence.

---

9. Developing a Remediation Plan

Identifying gaps is not the end of the assessment.

Each significant finding should have an appropriate remediation action.

A remediation plan should record:

• Finding identifier.
• Description of the gap.
• Required action.
• Accountable owner.
• Target completion date.
• Priority.
• Interim risk mitigation, where needed.
• Supporting evidence required.
• Current status.
• Validation outcome.

Example remediation register

Finding	Required Action	Owner	Completion Evidence
SS221-GAP-001	Develop and assess a stressed exit strategy	Digital Banking	Approved strategy and validation evidence
SS221-GAP-002	Review contractual audit and information rights	Legal	Revised agreement and legal review
SS221-GAP-003	Document significant subcontracting dependencies	TPRM	Updated dependency assessment
SS221-GAP-004	Validate scope and findings of supplier assurance reports	Information Security	Completed assurance review

The analyst should ensure that recommended actions address the underlying deficiency rather than simply creating additional paperwork.

Example: Weak versus effective remediation

Weak action:

"Update the supplier risk assessment."

This does not explain what needs to change.

Improved action:

"Review the supplier's SOC 2 Type II report, confirm that the scope covers the authentication service, assess relevant exceptions and complementary user entity controls, and document any residual assurance gaps."

The improved action is specific and verifiable.

---

10. Validating Remediation

A finding should not be considered resolved merely because the responsible owner reports that the work is complete.

The remediation should be supported by suitable evidence.

Example

Northbridge's Legal team updates the SecureAccess contract to include additional audit and information rights.

The Legal team confirms that the action is complete.

Before closing the finding, the reviewer should establish whether:

• The relevant contractual requirements have been addressed.
• The revised provisions are included in the appropriate agreement.
• Any remaining deviations have been assessed and approved.
• The agreement has reached the required approval or execution stage.

The closure conclusion should accurately reflect the work performed.

If the contract has not yet been executed, it may be appropriate to record that the required provisions have been agreed in draft while final execution remains outstanding.

Remediation validation versus retesting

Some findings require document review.

Others require testing the operation of a revised control.

For example, introducing a revised onboarding checklist may address a design weakness.

However, evidence from subsequent onboarding activities may be needed to demonstrate that the updated control operates consistently.

The level of validation should reflect the nature and significance of the finding.

---

11. Preparing the Management Assurance Report

Management needs a concise explanation of the assessment results.

A useful report should communicate the scope, major findings, associated risks, limitations and actions required.

It should not simply reproduce the entire gap register.

Recommended report structure

1. Executive Summary

Explain the purpose of the assessment and the overall conclusion.

2. Scope and Methodology

Identify the arrangement, regulatory baseline, controls assessed and testing approach.

3. Summary of Findings

Present the significant gaps and their priorities.

4. Key Risk Implications

Explain the operational, regulatory and business consequences.

5. Recommended Actions

Identify the most important remediation activities and accountable owners.

6. Limitations

Explain any restrictions caused by missing evidence, incomplete scope or untested controls.

7. Management Decisions Required

Identify outstanding approvals, risk decisions or escalation requirements.

Example executive summary

Northbridge Bank: SecureAccess Cloud Ltd Regulatory Gap Assessment

The assessment reviewed Northbridge Bank's proposed material outsourcing arrangement with SecureAccess Cloud Ltd against selected expectations under PRA SS2/21.

The review covered governance, materiality, due diligence, contractual safeguards, sub-outsourcing, information security and exit planning.

The available evidence indicates that Northbridge has established elements of its outsourcing governance framework, including an approved policy and a documented materiality assessment.

However, significant assurance gaps remain.

These include the absence of an arrangement-specific stressed exit strategy, insufficient evidence of contractual audit and information rights, and incomplete assessment of subcontracting dependencies.

These weaknesses may affect the bank's ability to maintain effective oversight and manage disruption to an important digital banking service.

The assessment therefore recommends that the identified high-priority gaps be addressed or otherwise managed through the bank's authorised governance process before final approval of the arrangement.

This review does not constitute a comprehensive opinion on Northbridge's compliance with SS2/21.

---

12. Practical Exercise: Northbridge Bank Regulatory Gap Assessment

You are the TPRM Analyst assigned to assess Northbridge Bank's proposed engagement with SecureAccess Cloud Ltd.

The arrangement has been classified as material outsourcing.

Your manager has provided the following fictional evidence summary.

Evidence A: Outsourcing Policy

Northbridge maintains an approved outsourcing policy.

The policy requires materiality assessments and supplier due diligence before approval.

However, responsibility for reviewing subcontracting dependencies is not clearly assigned.

Evidence B: Materiality Assessment

A completed materiality assessment classifies SecureAccess as material outsourcing.

The assessment includes supporting rationale and approval by the relevant business owner.

Evidence C: Supplier Due Diligence

SecureAccess has provided:

• ISO 27001 certification.
• A SOC 2 Type II report.
• A penetration testing summary.
• A business continuity policy.

Northbridge's assessment records confirm receipt of these documents but do not demonstrate that the SOC 2 report's relevant scope and exceptions have been assessed.

Evidence D: Outsourcing Agreement

The draft agreement includes service levels, confidentiality obligations and termination provisions.

The available contract review records do not establish whether appropriate audit, access and information rights have been included.

Evidence E: Sub-Outsourcing

SecureAccess relies on a cloud infrastructure subcontractor.

The bank has recorded the subcontractor's name but has not assessed the dependency's operational and concentration risks.

Evidence F: Business Continuity and Exit

The supplier has a documented business continuity policy.

No arrangement-specific stressed exit strategy has been prepared by Northbridge.

The bank has not documented how customer authentication services would be maintained or transferred following an unexpected supplier failure.

Your assignment

Task 1: Define the assessment scope

Prepare a short scope statement identifying the regulatory areas to be examined and any limitations.

Task 2: Evaluate the evidence

For each evidence item:

1. Identify the relevant SS2/21 expectations.
2. Determine what the evidence demonstrates.
3. Identify any missing information.
4. Assess whether the relevant control is effective, partially effective, ineffective, not implemented or cannot yet be assessed.

Support your conclusions with reasoning.

Task 3: Prepare a gap register

Identify at least four findings.

For each finding, record:

Field	Learner Response
Finding ID
SS2/21 reference
Expected control
Observation
Evidence reviewed
Evidence limitation
Associated risk
Priority
Recommended action
Proposed owner
Status

Task 4: Develop a remediation plan

Prepare practical actions for the identified findings.

Explain what evidence would be required to demonstrate successful remediation.

Task 5: Write a management assurance summary

Prepare a management summary of no more than 350 words.

Your summary should explain:

• What was assessed.
• What appears to be working.
• The most significant gaps.
• What those gaps mean for Northbridge.
• What should happen before the arrangement progresses.
• Any limitations affecting your conclusions.

Assessment criteria

A strong submission should demonstrate:

• Accurate application of regulatory expectations.
• Appropriate use of supporting evidence.
• Clear distinction between control gaps and evidence limitations.
• Reasoned assessment ratings.
• Proportionate risk prioritisation.
• Specific and achievable remediation actions.
• Professional communication of findings.
• Appropriate recognition of the analyst's authority and assessment limitations.

Important: Do not invent missing evidence or assume controls operate effectively simply because policies exist.

---

13. Common Mistakes When Conducting Gap Assessments

Mistake 1: Starting without a defined scope

An unclear scope makes it difficult to identify applicable expectations and produce defensible conclusions.

Mistake 2: Treating document availability as proof of compliance

The existence of a document does not automatically demonstrate that the underlying control is adequate or operating effectively.

Mistake 3: Recording findings without evidence

Findings should be supported by verifiable observations rather than assumptions.

Mistake 4: Treating every finding as equally significant

Prioritisation should reflect the regulatory and business consequences of the identified weaknesses.

Mistake 5: Recommending vague remediation

Actions such as "improve compliance" or "strengthen controls" provide insufficient direction.

Mistake 6: Closing findings without validation

Remediation should be supported by evidence and assessed before closure.

Mistake 7: Making conclusions beyond the assessment scope

A limited arrangement-level review does not provide comprehensive assurance over the firm's entire outsourcing framework.

---

14. Key Takeaways

A PRA SS2/21 regulatory gap assessment helps determine whether an organisation's outsourcing arrangements adequately address applicable regulatory expectations.

The most important principles are:

1. Define the scope before starting. Establish which arrangements, controls and regulatory expectations will be assessed.

2. Use the applicable regulatory baseline. Distinguish current obligations from future changes.

3. Evaluate controls using evidence. Policies, procedures and supplier certifications are starting points, not automatic proof of effectiveness.

4. Distinguish missing evidence from actual control failure. Conclusions must reflect what the assessment demonstrates.

5. Document findings clearly. Connect expectations, observations, evidence, risks and recommended actions.

6. Prioritise remediation. Focus management attention on the weaknesses with the greatest potential consequences.

7. Validate corrective actions. A finding should only be closed when sufficient evidence supports the closure decision.

8. Communicate limitations. Management must understand what the assessment did and did not establish.

For a TPRM analyst, a successful gap assessment is not measured by the number of deficiencies identified.

It is measured by the quality of the analysis, the reliability of the evidence and the usefulness of the resulting recommendations.

---

What's Next?

Final Resource: PRA SS2/21 Integrated Workplace Assessment

You have now covered:

• PRA SS2/21 fundamentals.
• Outsourcing classification and materiality.
• Regulatory control mapping.
• Regulatory gap assessment.

The final resource will bring these skills together.

You will act as a TPRM Analyst reviewing a fictional financial institution's outsourcing arrangements.

Using a case pack and supporting evidence, you will produce:

1. An outsourcing classification and materiality assessment.
2. A regulatory control mapping matrix.
3. A documented gap register.
4. A prioritised remediation plan.
5. A management assurance report.

The objective is to demonstrate your ability to apply regulatory expectations to realistic professional tasks.

---

Official References

1. Prudential Regulation Authority: SS2/21, Outsourcing and Third Party Risk Management, November 2024 version.

   https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss

2. Prudential Regulation Authority: PS7/26, Operational Resilience: Operational Incident and Third-Party Reporting.

   https://www.bankofengland.co.uk/prudential-regulation/publication/2026/march/operational-incident-and-third-party-reporting-policy-statement

3. Prudential Regulation Authority: SS1/21, Operational Resilience: Impact Tolerances for Important Business Services.

   https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/operational-resilience-impact-tolerances-for-important-business-services-ss

Regulatory Version Note: The November 2024 version of SS2/21 remains effective as of November 2026. The March 2026 revision takes effect on 18 March 2027. Live assessments should use the applicable version and relevant underlying regulatory rules.

Educational Disclaimer: This material is intended for educational and professional development purposes. Northbridge Bank, SecureAccess Cloud Ltd and all associated scenarios are fictional. The resource does not constitute legal or regulatory advice.