How to Structure a Board Paper for Material Outsourcing Under PRA SS2/21

A board paper on material outsourcing is not a procurement summary with a risk annex. Under SS2/21 the board is accountable for the decision, the ongoing oversight, and the exit. If the paper does not equip directors to challenge the proposal on resilience, data, concentration, and exit, it has failed, regardless of whether approval is granted.

Start with the decision being asked, not the vendor

The opening page should state plainly: what the board is being asked to approve, why now, the contract value and term, the business services affected, and the materiality classification with the reasoning behind it. Directors should not have to hunt for whether this is material under SS2/21 or why. If classification was finely balanced, say so and show the test applied.

Avoid the common mistake of leading with the commercial rationale. The commercial case matters, but the board's primary duty here is to assess whether the arrangement can be managed safely across its full lifecycle.

Show the due diligence, do not just assert it

Summarise the due diligence actually performed: financial standing, operational capability, information security, data protection, sub-outsourcing chain, geographic footprint, and ESG where relevant. Reference the evidence rather than repeat it. If due diligence surfaced gaps, name them and set out how they have been remediated or why residual risk is acceptable.

Where the provider is a cloud or other third party already used elsewhere in the group, concentration risk needs explicit treatment. The PRA expects firms to understand their aggregate exposure to individual providers, not just the single arrangement in front of the board.

Map the arrangement to the operational resilience framework

This is where most papers underperform. Identify which important business services the outsourcing supports, whether it sits within an impact tolerance, and how the arrangement affects the firm's ability to remain within tolerance during disruption. If the service supports more than one important business service, show the dependency map.

State the recovery expectations contractually agreed with the provider and whether they align with the firm's own impact tolerances. Misalignment is a red flag the board should see, not a detail buried in an appendix.

Treat the exit plan as a first-class section

A credible exit plan sets out the trigger events, the exit routes (insourcing, alternative provider, wind-down), the estimated time and cost, the data retrieval approach, and the dependencies that would complicate execution. Stressed exit should be addressed specifically: what happens if the provider fails suddenly or a regulator forces exit.

If the exit plan relies on capabilities the firm does not currently have, say so and set out the plan to build them. Boards approving outsourcing without a tested exit route are exposed, and the PRA knows it.

Set out the governance and ongoing oversight

Name the SMF holder accountable. Specify the committee that will receive ongoing MI, the frequency, and the KPIs and KRIs that will be tracked. Define what triggers escalation back to the board. If audit rights, access rights, and regulator access are secured in the contract, confirm it plainly.

Present the risks honestly and the conditions clearly

Close with a risk summary that includes residual risks the board is being asked to accept, and any conditions attached to approval: for example, completion of specific remediation before go-live, or a defined review point. A paper that lists only mitigated risks invites challenge. A paper that is candid about trade-offs earns trust.

The next decision

Before the paper goes to the board, ask one question: if this arrangement failed badly in year two, would the minutes show that directors understood what they were approving? If the answer is uncertain, the paper is not ready.

Frequently Asked Questions

How much detail belongs in the main paper versus appendices?

The main paper should stand alone for a director reading it cold. Due diligence evidence, contract extracts, and technical architecture belong in appendices. The materiality assessment, resilience impact, exit plan summary, and risk acceptance should be in the body.

Does every material outsourcing need full board approval?

SS2/21 requires board or board committee approval for material arrangements. Many firms delegate to a board risk committee with upward reporting. Whichever route, the approving body must have the information and time to decide properly.

How should intragroup outsourcing be treated?

Intragroup arrangements are not exempt from SS2/21 expectations. The paper should address them with the same rigour, particularly on exit, substitutability, and alignment of resilience standards across the group.

What is the most common weakness supervisors identify?

Exit plans that are generic, untested, and over-reliant on the provider's cooperation. Supervisors look for evidence that the firm could actually execute the exit under stress, not just that a document exists.