Introduction
Northbridge Bank has completed its initial assessment of SecureAccess Cloud Ltd, the technology provider selected to operate its customer authentication infrastructure.
The arrangement has been classified as material outsourcing.
SecureAccess has supplied an ISO 27001 certificate, a SOC 2 Type II report and information about its business continuity arrangements.
The Information Security team is satisfied with the provider's general security posture.
However, during your review, you discover that SecureAccess does not operate all the infrastructure used to deliver its services.
It relies on CloudCore Infrastructure Ltd for computing and data storage.
You then examine Northbridge's supplier register and discover something more concerning.
Two other suppliers supporting the bank's digital operations also depend on CloudCore.
These providers have separate contracts with Northbridge and were assessed independently.
But behind these apparently independent services sits a common infrastructure provider.
A significant failure at CloudCore could potentially disrupt all three services.
The bank has assessed the direct suppliers, but has it adequately assessed the dependency they share?
This is where sub-outsourcing and concentration risk become important.
In this article, we will examine how PRA SS2/21 addresses these risks and how a Third-Party Risk Management (TPRM) Analyst can identify, assess and manage dependencies that extend beyond a firm's direct suppliers.
Learning Objectives
By the end of this article, you should be able to:
- Explain sub-outsourcing and distinguish it from other fourth-party relationships.
- Understand the PRA's expectations for overseeing material sub-outsourcing.
- Assess whether a sub-outsourcing arrangement is material.
- Identify different forms of supplier concentration risk.
- Map significant dependencies across the supply chain.
- Evaluate contractual notification, approval, termination and audit rights.
- Assess the primary provider's oversight of subcontractors.
- Document assurance gaps and recommend proportionate risk mitigation.
1. Understanding Sub-Outsourcing
1.1 What is sub-outsourcing?
Chapter 9 of PRA SS2/21 addresses sub-outsourcing.
Paragraph 9.1 draws on the definition used in the European Banking Authority's outsourcing guidelines.
Sub-outsourcing occurs when a service provider under an outsourcing arrangement transfers all or part of the outsourced function to another service provider.
It is sometimes called chain outsourcing.
Consider the following arrangement:
Northbridge Bank → SecureAccess Cloud Ltd → CloudCore Infrastructure Ltd
Northbridge contracts SecureAccess to provide customer authentication services.
SecureAccess uses CloudCore to host the infrastructure supporting those services.
CloudCore performs part of the activity necessary for SecureAccess to deliver the outsourced function.
Depending on the precise responsibilities transferred, this relationship may constitute sub-outsourcing.
1.2 Third parties versus fourth parties
In TPRM, a third party is an organisation with which the firm has a direct supplier relationship.
A fourth party is generally a supplier to one of those third parties.
For example:
| Organisation |
Relationship to Northbridge |
| SecureAccess Cloud Ltd |
Direct third-party provider |
| CloudCore Infrastructure Ltd |
Fourth-party provider through SecureAccess |
| A specialist provider used by CloudCore |
Potential further supply-chain dependency |
However, not every fourth-party relationship constitutes sub-outsourcing under SS2/21.
A subcontractor may supply an incidental product or service without performing part of the outsourced function.
The analyst must establish the actual activities and responsibilities involved.
Practical takeaway: Fourth-party risk is a broader supply-chain concept. Sub-outsourcing is a specific form of onward delegation within an outsourcing arrangement.
1.3 Why sub-outsourcing creates additional risks
Paragraph 9.1 identifies risks associated with complex outsourcing chains.
These include reduced visibility and control, particularly where services are delivered through several organisations across different jurisdictions.
Sub-outsourcing can also create dependencies that the regulated firm may not fully understand.
For example, a bank might believe it has diversified its technology providers because it uses several different companies.
However, those companies may depend on the same infrastructure provider.
The bank's apparent supplier diversity may therefore conceal an important common failure point.
2. PRA SS2/21 Expectations for Sub-Outsourcing
Chapter 9 establishes expectations for assessing and overseeing sub-outsourcing arrangements.
The main areas are:
- Risk assessment before entering the outsourcing arrangement.
- Visibility over relevant subcontracting dependencies.
- Assessment of materiality.
- Oversight of material subcontractors.
- Appropriate contractual safeguards.
- Notification and change management.
- Rights to object to material changes or terminate in relevant circumstances.
These expectations should be applied proportionately and in the context of the applicable regulatory requirements.
2.1 Pre-contract risk assessment
Paragraph 9.3 expects firms to assess relevant sub-outsourcing risks before entering an outsourcing agreement.
This means the firm should not wait until a supplier experiences problems before investigating its significant subcontracting dependencies.
During due diligence, an analyst should seek to understand:
- Which activities the primary provider performs directly.
- Which activities are subcontracted.
- Which subcontractors support the relevant outsourced function.
- Where the services are delivered.
- Whether the subcontractors are necessary for important business services.
- What risks arise from these dependencies.
- How the primary provider oversees its subcontractors.
The level of detail should reflect the significance and complexity of the arrangement.
2.2 Supply-chain visibility
Paragraph 9.3 also emphasises the importance of visibility across the outsourcing supply chain.
The PRA encourages arrangements under which service providers maintain current information about their sub-outsourced providers.
For a TPRM analyst, the challenge is not necessarily to identify every supplier used anywhere in the primary provider's business.
It is to understand the dependencies relevant to the outsourced function and the firm's risks.
For example, SecureAccess may use a catering company for its offices.
That relationship is unlikely to require the same level of scrutiny as the cloud infrastructure provider hosting customer authentication systems.
The analyst should focus on dependencies that could materially affect service delivery, regulatory compliance or operational resilience.
3. Assessing the Materiality of Sub-Outsourcing
Paragraph 9.5 expects firms to assess sub-outsourcing against the materiality criteria established in Chapter 5.
This includes considering its potential effect on operational resilience and important business services.
A material outsourcing arrangement does not mean that every subcontractor involved in delivering the service must automatically be treated as a material sub-outsourcing provider.
The significance of the onward delegation needs to be assessed.
3.1 Factors to consider
Relevant questions include:
- Which part of the outsourced function is performed by the subcontractor?
- Could failure of that subcontractor disrupt an important business service?
- How dependent is the primary provider on the subcontractor?
- Could the primary provider continue delivering the service without it?
- Are alternative subcontractors available?
- Would replacing the subcontractor involve significant technical or operational changes?
- Could the arrangement create additional security, data protection or regulatory risks?
- Could the dependency affect the firm's ability to remain within its impact tolerances?
These factors help establish the significance of the sub-outsourcing arrangement.
3.2 Worked example: CloudCore Infrastructure
CloudCore provides the infrastructure on which SecureAccess operates its authentication platform.
SecureAccess does not maintain an independent production environment outside CloudCore.
If CloudCore suffers a major outage, SecureAccess may be unable to deliver authentication services.
Northbridge's customers could consequently lose access to digital banking.
The dependency therefore warrants assessment against the applicable materiality criteria.
Proposed assessment conclusion:
CloudCore performs a significant infrastructure function supporting Northbridge's material outsourcing arrangement. Based on the stated dependency and potential effect on digital banking access, the sub-outsourcing arrangement is likely to be material.
The conclusion should be supported by appropriate technical and business impact evidence and approved through the firm's established governance process.
3.3 What if the subcontractor is not material?
Non-material subcontracting relationships may still introduce relevant risks.
For example, a supplier might rely on an external provider for routine operational support.
The relationship may not be material in its own right, but weaknesses could still affect the supplier's overall control environment.
The firm should manage such risks proportionately rather than automatically applying every detailed material sub-outsourcing expectation.
4. Assessing the Primary Provider's Oversight
A regulated firm often has no direct contract with a material sub-outsourcing provider.
That makes the primary provider's oversight particularly important.
Paragraph 9.6 expects firms to establish that the primary provider has the ability and capacity to oversee material sub-outsourcing on an ongoing basis.
This includes appropriate testing, monitoring and control.
4.1 What should the analyst assess?
Consider whether the primary provider:
- Maintains records of relevant subcontractors.
- Conducts appropriate subcontractor due diligence.
- Assesses subcontractor risks.
- Establishes contractual safeguards.
- Monitors service performance.
- Reviews relevant security and resilience evidence.
- Identifies significant changes in subcontracting arrangements.
- Escalates incidents and control failures.
- Maintains continuity arrangements involving subcontractors.
- Takes corrective action when subcontractor performance deteriorates.
These activities help determine whether the primary provider has meaningful oversight.
4.2 Evaluating evidence
Suppose SecureAccess states:
"We conduct appropriate due diligence on all our subcontractors."
This is a statement of process, not conclusive evidence that the process operates effectively.
The analyst might request:
- The subcontractor management policy.
- A description of the due diligence methodology.
- A summary of the assessment performed on CloudCore.
- Relevant security assurance reports.
- Subcontractor performance monitoring records.
- Evidence of incident management and escalation arrangements.
- Information about identified findings and remediation activities.
The level of evidence requested should be proportionate and consistent with the firm's assurance rights.
4.3 Evidence limitations
The primary provider may not be willing or able to share every internal subcontractor assessment.
Confidentiality and commercial restrictions may apply.
This does not automatically establish that the subcontractor is inadequately controlled.
However, the analyst must determine whether alternative forms of assurance are sufficient.
These might include independent audit reports, relevant certifications, structured assurance summaries or other appropriate evidence.
If adequate assurance cannot be obtained, the limitation should be documented and assessed.
5. Understanding Concentration Risk
Sub-outsourcing and concentration risk are closely related, but they are not the same.
Sub-outsourcing concerns the onward delegation of outsourced functions.
Concentration risk concerns the potential consequences of excessive or significant dependence on particular providers, infrastructure, locations or interconnected services.
Paragraph 5.24 of PRA SS2/21 expects firms and groups to periodically reassess their overall reliance on third parties and take reasonable steps to manage concentration risk and vendor lock-in.
The PRA identifies several potential sources of concentration.
5.1 Direct supplier concentration
This occurs when an organisation relies heavily on one supplier across several arrangements.
For example, Northbridge uses the same technology provider for customer authentication, payment processing and transaction monitoring.
A major failure affecting that provider could disrupt several services simultaneously.
The analyst should examine the combined dependency rather than assessing each contract in isolation.
5.2 Indirect concentration
Indirect concentration occurs when apparently unrelated suppliers depend on the same underlying provider.
Consider:
Northbridge Bank
- SecureAccess Cloud Ltd: Customer authentication
- PaymentFlow Systems Ltd: Payment processing
- InsightData Services Ltd: Operational analytics
All three depend on CloudCore Infrastructure Ltd.
Northbridge may have separate contracts, account managers and assurance reports for each direct supplier.
Nevertheless, a common CloudCore failure could affect multiple services.
This is an example of concentration arising through fourth-party dependencies.
5.3 Geographic concentration
Several providers may operate from the same country, region or infrastructure location.
Even where the organisations are independent, they may be exposed to common geographic risks.
For example:
- Regional power disruption.
- Telecommunications failure.
- Flooding or other natural hazards.
- Political or regulatory disruption.
- Shared infrastructure outages.
The PRA specifically recognises geographic concentration as a relevant consideration.
5.4 Vendor lock-in and substitutability
Concentration can also arise where a provider is difficult or impossible to replace.
For example, a proprietary technology platform may require specialist skills, unique data formats or extensive integrations.
Even if alternative providers exist, transferring the service may be costly or slow.
The analyst should examine both the degree of reliance and the practical ability to reduce that reliance.
Important: Having multiple suppliers does not automatically mean that an organisation has diversified its operational risk.
6. Mapping Supplier Dependencies
A dependency map helps identify where services rely on common providers, systems or infrastructure.
Consider Northbridge Bank.
Illustrative dependency map
NORTHBRIDGE BANK
|
+--------------+--------------+
| | |
SecureAccess PaymentFlow InsightData
Authentication Payments Analytics
| | |
+--------------+--------------+
|
CloudCore Ltd
Cloud Infrastructure
|
Regional Infrastructure
and Shared Services
The diagram illustrates how three separate supplier relationships may share a common dependency.
It does not establish that every service uses the same infrastructure region or failure domain.
Those details require verification.
6.1 What information should a dependency register contain?
A practical register may include:
| Field |
Purpose |
| Primary supplier |
Direct contractual provider |
| Outsourced service |
Function supported |
| Business service |
Important activity or service affected |
| Subcontractor |
Relevant onward provider |
| Subcontracted function |
Activity performed |
| Materiality |
Significance of the dependency |
| Service location |
Relevant jurisdiction or region |
| Common dependencies |
Other services relying on the same provider |
| Substitutability |
Ability to replace the provider |
| Assurance evidence |
Relevant assessments and reports |
| Last review |
Currency of information |
| Risk owner |
Function accountable for the dependency |
A register is useful only when the information is sufficiently accurate and maintained.
6.2 Identifying common failure points
After mapping dependencies, the analyst should examine potential common failure scenarios.
For example:
- Multiple suppliers rely on the same cloud region.
- Several applications depend on the same identity platform.
- Different providers use the same telecommunications network.
- Several services depend on a single specialist data processor.
The analyst should then consider whether disruption to that dependency could affect several services simultaneously.
6.3 Concentration is not automatically unacceptable
A common provider may offer strong security, mature infrastructure and better resilience than several less capable alternatives.
Using a highly capable provider may reduce some risks while increasing others.
The assessment should therefore consider:
- The benefits of the existing arrangement.
- Potential common failure consequences.
- Available resilience measures.
- Substitutability.
- Recovery capabilities.
- Possible diversification options.
- Cost and feasibility of additional safeguards.
The objective is to identify and manage concentration risk, not automatically prohibit shared providers.
7. Contractual Requirements for Material Sub-Outsourcing
Paragraph 9.9 of SS2/21 sets out expectations for written agreements governing material outsourcing.
These include provisions addressing whether material sub-outsourcing is permitted and the conditions under which it may occur.
7.1 Permitted and restricted activities
The outsourcing agreement should establish whether material sub-outsourcing is permitted.
Where appropriate, it should identify activities that cannot be sub-outsourced.
For example, a firm may impose restrictions on the onward transfer of particular functions or sensitive information.
These restrictions should reflect the risks and relevant regulatory obligations.
7.2 Ongoing responsibility
The agreement should establish the primary provider's responsibility for overseeing subcontracted activities.
The provider should not be able to avoid its contractual responsibilities simply because it has delegated part of the service to another organisation.
7.3 Notification of changes
The contract should address notification of proposed sub-outsourcing or material changes.
The notice should be sufficiently early to allow the firm to assess relevant risks and exercise applicable rights before the changes take effect.
For example, SecureAccess proposes moving its infrastructure to a different cloud provider.
Northbridge should have an opportunity to understand how the change affects:
- Security controls.
- Data processing locations.
- Operational resilience.
- Service recovery.
- Concentration risk.
- Contractual obligations.
- Regulatory access and assurance.
7.4 Rights to approve, object or terminate
Paragraphs 9.7 and 9.9 address circumstances in which firms should be able to object to material sub-outsourcing or exercise contractual termination rights.
For example, a proposed change may create a substantive increase in operational risk.
The bank should not simply accept the change because the direct supplier believes it is commercially beneficial.
The relevant rights and governance procedures should enable an appropriate assessment and response.
7.5 Access, audit and information rights
Paragraph 9.5 addresses equivalent contractual access, audit and information rights for material sub-outsourcing.
The PRA expects the relevant arrangements to preserve appropriate rights for the regulated firm, the Bank of England and the PRA.
The analyst should work with Legal and Compliance to determine whether the necessary rights are appropriately established throughout the relevant outsourcing chain.
A supplier's willingness to provide a certification or audit report is not necessarily a substitute for the applicable contractual rights.
7.6 Data protection considerations
Where subcontractors process personal data, relevant UK data protection requirements may also apply.
For example, UK GDPR Article 28 contains conditions concerning the engagement of sub-processors by processors.
These obligations must be considered alongside the outsourcing requirements.
They should not be confused with a blanket rule requiring the same authorisation mechanism for every subcontracting relationship.
8. Managing Changes to Sub-Outsourcing Arrangements
Subcontracting arrangements can change throughout the supplier relationship.
A provider might:
- Introduce a new infrastructure supplier.
- Replace an existing subcontractor.
- Move services to another jurisdiction.
- Transfer additional processing activities.
- Consolidate services under one provider.
- Change its recovery architecture.
Such changes may alter the firm's risk profile.
Example: Proposed migration
SecureAccess informs Northbridge that it intends to migrate the authentication platform from CloudCore to another provider.
The project is expected to improve performance and reduce costs.
The proposed change could also affect:
- Data processing locations.
- Encryption and key management.
- Recovery capabilities.
- Authentication service availability.
- Existing concentration risks.
- Data portability.
- Applicable contractual obligations.
Practical change assessment process
Step 1: Identify the change
Establish what is being altered and which activities are affected.
Step 2: Determine significance
Assess whether the change involves material sub-outsourcing or significantly changes the risks of the arrangement.
Step 3: Review supporting evidence
Obtain relevant technical, security, contractual and operational information.
Step 4: Evaluate potential impacts
Consider operational resilience, data protection, regulatory obligations and concentration.
Step 5: Identify mitigating controls
Assess existing or proposed safeguards.
Step 6: Recommend a governance decision
Document whether the change can proceed through the appropriate approval process, requires additional safeguards or warrants objection.
Step 7: Update records
Maintain current supplier, subcontractor and dependency information.
The analyst should not assume that every subcontractor change requires the same level of review.
The approach should reflect materiality, risk and contractual requirements.
9. Assessing Concentration Risk in Practice
A concentration risk assessment should consider how the failure of a common dependency could affect the firm.
Step 1: Identify shared dependencies
Use supplier registers, architectural information and due diligence evidence to identify common providers.
Step 2: Establish affected business services
Determine which operations depend on the shared provider.
For example, CloudCore supports three providers delivering different services to Northbridge.
Step 3: Evaluate common failure scenarios
Consider severe but plausible events such as:
- Regional cloud failure.
- Compromise of shared infrastructure.
- Prolonged network outage.
- Insolvency or business discontinuation.
- Major data integrity failure.
Step 4: Assess resilience and substitutability
Determine whether the affected services have independent recovery arrangements or viable alternatives.
Step 5: Evaluate the potential aggregate impact
A dependency may appear manageable when considered within a single supplier relationship.
Its failure may have substantially greater consequences when several services are affected simultaneously.
Step 6: Identify mitigation options
Depending on the circumstances, options may include:
- Improved resilience within the existing provider.
- Geographic separation.
- Independent recovery arrangements.
- Alternative infrastructure.
- More effective exit planning.
- Increased testing.
- Enhanced monitoring.
- Targeted supplier diversification.
The selected controls should be proportionate and technically feasible.
Example concentration assessment
| Area |
Observation |
| Shared dependency |
CloudCore Infrastructure |
| Direct suppliers affected |
SecureAccess, PaymentFlow, InsightData |
| Potential impact |
Simultaneous disruption to several digital operations |
| Existing mitigation |
Suppliers report resilience arrangements |
| Evidence gap |
Independent recovery and common failure scenarios not validated |
| Recommended action |
Conduct cross-service dependency and resilience assessment |
The finding should reflect what the evidence establishes.
It should not automatically assume that all services would fail simultaneously merely because they use the same cloud provider.
10. Worked Example: Northbridge Bank
Northbridge's TPRM team identifies that three suppliers depend on CloudCore.
Further review establishes the following.
SecureAccess Cloud Ltd
Provides customer authentication infrastructure.
CloudCore hosts its primary production environment.
PaymentFlow Systems Ltd
Provides payment-processing software.
Some supporting infrastructure operates on CloudCore.
InsightData Services Ltd
Provides operational analytics.
CloudCore hosts the analytics platform.
The bank has not verified whether these services operate in the same region or share critical infrastructure components.
10.1 Initial assessment
The analyst identifies a potentially significant common provider dependency.
However, there is insufficient evidence to determine the full extent of common failure exposure.
The appropriate conclusion is therefore not that Northbridge has already breached its impact tolerance.
The conclusion is that the bank needs to assess the potential aggregate consequences of a CloudCore failure.
10.2 Additional evidence required
The analyst requests:
- Relevant infrastructure locations.
- Significant shared services.
- Recovery arrangements.
- Subcontractor oversight information.
- Relevant resilience testing evidence.
- Service dependency maps.
- Alternative delivery capabilities.
- Details of contractual rights and limitations.
10.3 Example finding
Finding ID: SS221-SUB-001
Title: Insufficient visibility over shared fourth-party infrastructure dependencies.
Regulatory references: PRA SS2/21 paragraphs 5.24 and 9.3–9.6.
Observation: Northbridge has identified CloudCore as a common infrastructure provider supporting three direct suppliers. However, the available evidence does not establish whether the services share critical failure domains or whether their combined disruption has been assessed.
Risk: A significant CloudCore incident could disrupt multiple business services, potentially creating greater operational consequences than those identified in individual supplier assessments.
Recommendation: Complete a cross-service dependency assessment, evaluate common failure scenarios, validate relevant recovery arrangements and update the firm's concentration risk records.
Proposed owner: Head of TPRM, supported by Operational Resilience and Technology.
Status: Open.
This finding is supported by the available evidence without making unsupported assumptions about the precise infrastructure architecture.
11. Ongoing Monitoring and Assurance
Sub-outsourcing risk management does not end after a contract is approved.
The firm should continue to understand significant dependencies and changes affecting them.
Relevant monitoring activities
These may include:
- Periodic review of material subcontractor information.
- Assessment of relevant subcontractor changes.
- Review of significant incidents.
- Monitoring of supplier resilience findings.
- Review of independent assurance reports.
- Assessment of changes in concentration exposure.
- Tracking unresolved control weaknesses.
- Updating supplier and dependency records.
Monitoring should be proportionate to the arrangement's significance and risks.
Example monitoring indicators
| Indicator |
Potential Concern |
| New material subcontractor |
Unassessed dependency |
| Increased reliance on a common provider |
Rising concentration |
| Repeated subcontractor outages |
Weakening resilience |
| Material change of processing location |
New operational or regulatory exposure |
| Delayed incident notifications |
Reduced oversight |
| Unresolved assurance findings |
Persistent control weaknesses |
| Reduced availability of alternatives |
Increasing vendor lock-in |
These indicators are examples of useful management information, not mandatory PRA reporting metrics.
Governance and escalation
A TPRM analyst should understand how significant findings are reported.
Potential escalation may involve:
- The relevant business owner.
- Operational Resilience.
- Information Security.
- Legal and Compliance.
- Enterprise Risk Management.
- The appropriate third-party risk governance committee.
The analyst should recommend decisions based on evidence while respecting the organisation's delegated authorities.
12. Practical Exercise: Hidden Concentration at Northbridge Bank
You are a TPRM Analyst reviewing the bank's significant supplier dependencies.
The supplier register contains:
| Direct Supplier |
Service |
Underlying Provider |
| SecureAccess |
Customer authentication |
CloudCore |
| PaymentFlow |
Payment processing |
CloudCore |
| InsightData |
Operational analytics |
CloudCore |
| CustomerConnect |
Contact centre platform |
Independent hosting provider |
The business owners consider their supplier arrangements adequately diversified because different companies provide each service.
However, you identify a common dependency on CloudCore.
Task 1: Identify the risk
Explain why the existing supplier structure may create concentration risk even though Northbridge uses multiple direct providers.
Task 2: Assess materiality
Determine what information you need to assess whether the CloudCore dependency represents material sub-outsourcing in each relevant arrangement.
Do not assume that identical subcontractor names automatically establish identical risk exposure.
Task 3: Request evidence
Identify five pieces of information you would request to understand the potential consequences of a CloudCore disruption.
Explain what each would demonstrate.
Task 4: Review contractual safeguards
Identify relevant contractual arrangements that should be assessed under Chapter 9.
Consider notification, approval, oversight, audit rights and termination.
Task 5: Recommend risk mitigation
Prepare a short management recommendation covering:
- The identified dependency.
- Potential aggregate consequences.
- Evidence limitations.
- Further assessments required.
- Possible risk mitigation measures.
- Appropriate governance escalation.
Keep your recommendation within 250 words.
Assessment guidance: Strong responses should recognise the distinction between a shared provider and a proven common failure point, consider the materiality of individual arrangements and recommend proportionate, evidence-based actions.
This exercise reinforces the article. The full integrated workplace assessment for the PRA SS2/21 pathway will be developed separately.
13. Common Mistakes in Sub-Outsourcing Risk Management
Mistake 1: Assuming direct supplier assessments are sufficient
A firm may understand its immediate suppliers without understanding the infrastructure and organisations on which those suppliers depend.
Mistake 2: Treating every subcontractor as material
The significance of the onward delegation must be assessed against relevant criteria.
Mistake 3: Assuming multiple suppliers eliminate concentration risk
Different suppliers may rely on the same infrastructure, subcontractor or geographic location.
Mistake 4: Confusing certification with complete subcontractor oversight
A supplier's certification does not automatically establish adequate management of every relevant fourth-party dependency.
Mistake 5: Ignoring notification and objection rights
Material subcontracting changes may require the firm to evaluate risks and exercise its contractual rights before the changes take effect.
Mistake 6: Failing to understand common failure scenarios
Shared infrastructure creates potential dependencies, but the analyst must identify whether a realistic incident could affect the relevant services simultaneously.
Mistake 7: Assuming concentration must always be eliminated
Some concentration may be commercially and operationally justified.
The objective is to understand, assess and manage the exposure.
Mistake 8: Failing to maintain dependency information
Outdated subcontractor records can conceal new or changing risks.
14. Key Takeaways
Sub-outsourcing and concentration risk are important elements of outsourcing oversight under PRA SS2/21.
The main principles are:
-
Sub-outsourcing extends the delivery chain. A regulated firm may rely on organisations with which it has no direct contractual relationship.
-
Materiality must be assessed. Not every subcontractor performs a material function.
-
Supply-chain visibility matters. The firm needs sufficient information to understand relevant dependencies and risks.
-
The primary provider must maintain appropriate oversight. Firms should assess whether providers can effectively manage their material subcontractors.
-
Contractual safeguards are essential. Notification, approval, audit, information and termination rights help support effective oversight.
-
Supplier diversity may conceal common dependencies. Several direct suppliers can rely on the same underlying provider.
-
Concentration risk requires an aggregate view. Assessing suppliers individually may miss the combined consequences of a common failure.
-
Monitoring must continue throughout the relationship. Changes in subcontractors, infrastructure and business dependencies can significantly alter risk exposure.
For a TPRM analyst, effective oversight means looking beyond the immediate supplier relationship.
The objective is to understand the wider service delivery chain, identify significant dependencies and help the organisation maintain appropriate control over the risks those dependencies create.
What's Next?
Next Article: PRA SS2/21 Reporting Changes: Preparing for March 2027
The final article in this series will examine the updated regulatory reporting framework taking effect on 18 March 2027.
You will learn how to:
- Understand the changes to material third-party reporting.
- Distinguish reporting arrangements from existing outsourcing oversight.
- Identify relevant material third-party relationships.
- Prepare accurate supplier and arrangement information.
- Support regulatory notification and reporting processes.
- Conduct a practical readiness assessment.
This will complete the PRA SS2/21 regulatory learning series.
The integrated workplace assessment will be designed separately.
Official References and Further Reading
-
Prudential Regulation Authority: SS2/21, Outsourcing and Third Party Risk Management, November 2024 version.
https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/supervisory-statement/2024/ss221-november-2024-update.pdf
Particularly relevant:
- Paragraph 5.24: Firm or group-wide concentration risk.
- Paragraphs 9.1–9.8: Sub-outsourcing and oversight.
- Paragraph 9.9: Written agreements.
- Chapter 8: Access, audit and information rights.
- Chapter 10: Business continuity and exit planning.
-
Bank of England: Official SS2/21 publication page.
https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss
-
Prudential Regulation Authority: SS1/21, Operational Resilience: Impact Tolerances for Important Business Services.
https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/operational-resilience-impact-tolerances-for-important-business-services-ss
Regulatory Version Note: This article is based on the November 2024 version of SS2/21, effective as of November 2026. The March 2026 revision takes effect on 18 March 2027.
Educational Disclaimer: This resource is intended for education and professional development. Northbridge Bank, SecureAccess Cloud Ltd, CloudCore Infrastructure Ltd and the other organisations used in the examples are fictional. The material does not constitute legal or regulatory advice.