4.1 This chapter sets out the PRA’s expectations on:

• board engagement on outsourcing;

• allocation of responsibilities;

• outsourcing and the SM&CR;

• outsourcing policies; and

• record-keeping, in particular regarding the Outsourcing Register.

4.2 In this chapter, the term ‘board’ encompasses the terms ‘governing body’ and ‘management body’ in the PRA Rulebook, and refers to the board of directors or equivalent body in a firm.

Governance

Board engagement on outsourcing

4.3 Boards and senior management, in particular individuals performing SMFs, cannot outsource their responsibilities. Firms that enter into outsourcing arrangements remain fully accountable for complying with all their regulatory obligations. This is a key principle underlying all requirements and expectations regarding outsourcing and non-outsourcing third party arrangements, including the expectations in this SS.

4.4 Firms’ boards should:

• set ‘the control environment throughout the firm, including the appetite and tolerance levels in respect of outsourcing’ and third party risk management;

• ‘bear responsibility for the effective management of all risks to which the firm is exposed’, including by: