Third-Party Risk Assurance
Regulated firms are responsible for what their suppliers do on their behalf. Most cannot demonstrate that their oversight of critical outsourcers and third parties is adequate. We provide the independent assurance that closes that gap.
Regulatory expectations are rising. FCA SYSC 8, the PRA's outsourcing supervisory statements, and DORA for financial entities operating in or connected to the EU all require firms to maintain effective oversight of material outsourcers and critical third parties. The FCA has made clear that relying on contractual protections without ongoing oversight is not sufficient. Internal audit is expected to provide independent assurance over the firm's third-party risk management framework, not just review the policy.
Most firms have a third-party risk policy and a vendor register. Fewer have an oversight framework that is operating as the board expects. Common gaps include: critical third parties that have not been subject to meaningful oversight review since they were onboarded; concentration risk that has not been assessed at portfolio level; and exit planning that exists in documents but has never been tested.
The FCA has found these gaps consistently across its supervisory engagement. Internal audit that reviews the policy and confirms the vendor register exists is not providing the assurance the regulator expects.
We scope third-party risk assurance around your actual risk exposure, not around a generic template. That means starting with which third parties are genuinely critical to your operations or regulated activities, what would happen if they failed, and whether your oversight arrangements are proportionate to that dependency. From there we design the right assurance programme for your firm.
In numbers
HM Treasury has designated four cloud providers under the UK critical third parties regime, bringing them under direct oversight by the Bank of England, PRA and FCA. Regulated firms remain responsible for their own outsourcing arrangements.
Sources: HSF Kramer: HM Treasury makes first designations under the UK CTP regime (opens in a new tab)
What we deliver
Structured around the full lifecycle of third-party risk, from onboarding through to exit.
Assessment of your overall third-party risk management framework against FCA SYSC 8, PRA expectations and DORA where applicable. Covers policy, risk appetite, oversight governance, escalation and reporting. Identifies design gaps before a supervisory review does.
Deep-dive assurance over one or more critical outsourcers or material third parties. Tests whether your oversight is operating effectively in practice, not just documented in the contract. Includes review of service levels, sub-outsourcing, audit rights and exit planning.
Assessment of your onboarding and due diligence process for new third parties. Tests whether risk assessments are proportionate, whether approval governance is functioning, and whether ongoing monitoring obligations are being met after onboarding.
Portfolio-level review of third-party dependencies to identify concentration risk, single points of failure and gaps in business continuity planning. Includes assessment of cloud provider and critical infrastructure dependencies that boards often underestimate.
Assessment of whether your exit plans for critical outsourcers are credible and tested, including sub-outsourcer substitutability, data portability and transition planning. Connects directly to FCA and PRA operational resilience expectations.
Specific assurance over outsourced AML, KYC, screening and onboarding operations. Tests whether the firm's oversight of outsourced financial crime controls meets MLR 2017 requirements and whether reliance on group-level frameworks is adequately evidenced.
Who this serves
Related services
Get in touch
We scope third-party assurance around your actual dependencies and regulatory obligations, not a generic template. Let us know what you are dealing with.
