A supplier assessment begins with the service it could disrupt
A useful first scope: identify the contracted entity, affected important services, materiality rationale, available supplier evidence and decision date. Distinguish a document/contract assessment from independently tested recovery: neither should be promised unless explicitly included. Read about the 2027 third-party reporting change or request a targeted review.
Third-party risk assessment for financial-services firms should establish what a provider actually supports, how essential the arrangement is, what would happen if the service failed and whether alternative arrangements could work. A standard information-security questionnaire cannot answer these questions by itself. A provider can be secure, financially stable and contractually robust while still creating unacceptable concentration or recovery risk.
The starting point is materiality: the affected services, the dependency chain, the potential harm of failure and the firm’s regulatory category. Assessment depth should reflect the result, not assign every vendor an identical 120-question form.
Our suggested assessment structure
- Inventory and tier: record the arrangement, business owner, legal entity, services supported and justification for criticality or materiality.
- Review evidence: evaluate contractual rights, continuity and recovery provisions, incident communications, subcontracting visibility and the supplier’s own test results.
- Analyse concentration: identify shared clouds, locations, specialist staff, data stores and fourth parties that could cause correlated failure.
- Challenge exit plans: ask whether records, permissions and alternatives exist to execute a transfer or controlled termination.
- Document decisions: produce risks with owners, mitigations, residual-risk rationale, monitoring frequency and escalation paths.
The 2027 regulatory change is narrower than general supplier risk
From 18 March 2027, the FCA’s new material third-party reporting regime adds notifications and an annual register for a defined subset of firms. It is not the same population as the broader operational incident reporting regime, and it does not automatically apply to every entity calling itself “FCA regulated”. A scoped review would determine applicability before adding reporting deliverables. Existing outsourcing and notification obligations still matter before that date.
An example of hidden concentration
A firm may use two apparently independent outsourced processors, each with its own contract and availability commitment. Both rely on the same identity or cloud service. Testing the failure of one processor may therefore miss the scenario in which the shared underlying provider fails. The assessment should document both direct and indirect relationships and identify what substitute route is available, not just tick the “dual sourced” box.
Ongoing versus one-off assurance
A fixed assessment is suitable for a new material arrangement or emerging concern. Continuing supplier monitoring makes more sense when there are frequent contract changes, subcontractors, product launches or incident issues. A scoped review would not claim to inspect vendor controls ourselves unless access and scope make that possible; evidence limitations remain visible in the final report.
Example supplier assessment record
A vendor’s assurance pack is an input, not a verdict. Consider a fictional specialist payment firm whose transaction routing depends on one cloud-based service. The assessment should document the business outcome supported, critical people and systems, subcontractors, alternate processing routes, concentration exposure, notification rights and how quickly actual exit could occur without violating customer or financial-control requirements.
A traceable finding might read: ‘Supplier restoration objective: four hours; no observed test linking that recovery to merchant settlement; internal workaround capacity not measured; service owner to commission a joined-up test by the agreed date.’ This is much more useful than a generic ‘medium risk’ label.
When the March 2027 third-party register is relevant
The FCA’s PS26/2 register and notification requirements apply to a specified subset of firms. The regulatory perimeter should be established before commissioning a register build. If the firm is in scope, compare procurement records with the regulator’s published template, confirm materiality ownership and capture arrangements that are material but may not be technically categorised as outsourcing. Do not treat the value of a contract as a substitute for a defensible materiality assessment.
For the register itself, use actual FCA-provided fields as the system of record. Any downloadable checklist here is a preparation aid, not a substitute for an official submission template.
Frequently asked questions
What is a material third-party arrangement?
For the 2027 regime the FCA uses defined harm, system-risk and regulatory-threshold criteria; a firm must assess materiality under the applicable requirements rather than use a universal supplier-value cut-off.
Is third-party assessment the same as penetration testing?
No. Technical testing may be one evidence source, but the broader assessment covers service dependency, governance, recovery, contractual and concentration risk.
Do all firms need an annual register in 2027?
No. The FCA lists a specific subset of firms for the new material-arrangement reporting obligations.