PRA SS2/21 Practitioner Workbook: Overview and Getting Started
A practical Excel workbook for mapping PRA SS2/21 expectations to internal controls, reviewing evidence, testing control effectiveness, documenting regulatory gaps and managing remediation. Includes worked examples and a reporting dashboard.
- Who it is for
- Aspiring and practising GRC analysts, Third-Party Risk Management analysts, Information Security and Security Assurance professionals, Compliance analysts, Operational Risk practitioners and Internal Auditors.
- Before you begin
- Understanding of the TPRM lifecycle and basic familiarity with PRA SS2/21, regulatory control mapping and gap assessments.
Introduction
The PRA SS2/21 Practitioner Workbook is a practical resource designed to help GRC and Third-Party Risk Management (TPRM) analysts assess outsourcing arrangements against the Prudential Regulation Authority's supervisory expectations.
It complements the GRC Workshop PRA SS2/21 learning series, giving learners an opportunity to apply regulatory knowledge to realistic assessment activities.
What's Included?
The workbook provides structured templates for:
- Regulatory Requirements Mapping: Identify applicable SS2/21 expectations and map them to internal controls.
- Evidence Management: Track evidence requests, review supporting documentation and record assessment observations.
- Control Testing: Evaluate control design and operating effectiveness.
- Gap Assessment: Identify regulatory assurance gaps and document associated risks.
- Remediation Planning: Assign corrective actions, owners and target dates.
- Management Reporting: Summarise assessment findings and track progress through a dashboard.
Worked examples based on the fictional Northbridge Bank scenario demonstrate how to use the templates.
How to Use the Workbook
- Start with the Start Here worksheet to understand the workbook structure.
- Review the Sources & Guidance worksheet and confirm the applicable regulatory requirements.
- Complete the regulatory mapping, evidence review and control testing worksheets.
- Record identified gaps and develop a remediation action plan.
- Review the dashboard and prepare a management summary.
Use the worked examples for guidance before completing your own assessment.
Learning Outcome
By completing the workbook, you should be able to conduct a structured, evidence-based regulatory gap assessment, document defensible findings and communicate recommendations to management.
This workbook is intended for educational purposes. Always verify regulatory references against the applicable version of PRA SS2/21 before using it in a real engagement.