How to Structure a Board Paper Proposing a Material Outsourcing Arrangement

A board paper on material outsourcing is not a procurement document with a governance wrapper. It is the record of how the board tested whether the firm can remain resilient, controlled, and accountable while a third party performs work that matters. If the paper reads as a recommendation to approve, rather than an honest case to be examined, it will fail the next SMF conversation with the supervisor, regardless of whether the board votes yes.

Key Executive Takeaways

• The paper must demonstrate that the board understood the resilience, concentration, and exit implications before approving, not that management had already decided and sought ratification.
• Materiality assessment, impact tolerance mapping, and exit strategy are the three areas supervisors probe hardest: weak treatment here undermines the whole submission.
• Good papers show the dissenting view, the rejected alternatives, and the conditions attached to approval, not a clean linear case for the preferred vendor.

Start with the decision, not the vendor

Open with a single paragraph that states what the board is being asked to approve, why now, and what changes if they say no. Directors need to know whether this is a build versus buy decision, a replacement of an incumbent, or a new capability the firm cannot deliver internally. If the honest answer is that procurement has already run and the paper is seeking formal sign off, say so, and explain how the board was involved earlier in the process. Supervisors read minutes. Retrofitting board oversight after a vendor is selected is one of the most common findings in SS2/21 and DORA style reviews.

Treat materiality as an argued judgement

A material outsourcing classification is not a tick box. Set out the criteria you applied, the scoring, and the areas where reasonable people could disagree. If the service supports an important business service, say which one, and reference the firm's mapping. If it sits adjacent to one, explain the reasoning. Boards get into trouble when the paper asserts materiality without showing the working, because the classification drives every downstream obligation: due diligence depth, contractual provisions, exit planning, and regulatory notification.

Map the arrangement to impact tolerances

This is the section most papers do poorly. For each important business service the arrangement touches, show the current impact tolerance, the severe but plausible scenarios tested, and how the proposed arrangement performs under them. If the vendor failure scenario breaches tolerance, say so and explain the mitigations. Do not present a vendor's SOC 2 report as evidence of resilience. It is not.

Be concrete about concentration

Address both firm level and sector level concentration. If the provider already supports other critical services within the group, quantify the aggregate exposure. If the provider is a hyperscaler or a dominant specialist, acknowledge the sector concentration debate and explain why the firm is comfortable. Vague language here invites supervisory follow up.

Make the exit strategy credible

An exit plan that assumes an orderly 18 month transition to an unnamed alternative is not an exit plan. The board paper should identify stressed exit scenarios, including vendor insolvency and regulatory stop, name the fallback options, estimate the cost and time, and state who is accountable for maintaining exit readiness. If no viable alternative exists today, say so, and set out what the firm will do about it.

Show the governance architecture

Name the SMF holder accountable for the arrangement. Describe how performance, risk, and resilience will be monitored, who reviews what at which committee, and what triggers escalation back to the board. Attach the key contractual protections: audit rights, sub outsourcing controls, data location, termination triggers, and cooperation with resolution authorities.

Surface dissent and alternatives

Include the second and third ranked options and why they were rejected. Record the risk function's view, the internal audit perspective if available, and any conditions the executive risk committee attached. If the CRO has reservations, the board must see them.

Close with conditions, not just approval

The recommendation should specify the conditions of approval: contractual terms to be finalised, exit milestones, reporting cadence, and the date of the first post implementation review. This gives directors something to hold management to, and gives the supervisor evidence of active board ownership.

Before the paper goes to the pack, ask one question: if this arrangement fails badly in year two, will the minutes and this paper show that the board asked the right questions? If not, rewrite it.

Frequently Asked Questions

How long should the paper be?

Typically 12 to 20 pages for the main paper, with annexes for the due diligence summary, contractual term sheet, exit plan, and risk assessment. Longer than that and directors stop reading the parts that matter.

Should the vendor present to the board?

Sometimes, but not as part of the approval meeting. If directors want to meet the provider, do it separately so the decision discussion is not anchored by a sales pitch.

When should we notify the regulator?

For PRA and FCA regulated firms, notification of material outsourcing is required before entering into the arrangement or making a material change. Build the notification timeline into the paper so the board understands when the point of no return falls.

What if the executive is split?

Say so in the paper. A board asked to approve something the risk function opposes needs to see that opposition in writing, with the reasoning. Hiding internal disagreement is how firms end up with enforcement findings about governance quality rather than the outsourcing itself.

Does intra group outsourcing need the same treatment?

Yes, under current rules. The counterparty risk profile differs, but the resilience, exit, and oversight analysis still applies. Boards that wave intra group arrangements through on familiarity grounds are routinely challenged by supervisors.