The Supplier Assurance Framework is the product of an initiative from the Cross Market Operational Resilience Group (CMORG) which leads financial sector-wide collective action on operational resilience and is co-chaired by senior executives of the Prudential Regulation Authority (PRA) and UK Finance.
CMORG considered the problem of collective supplier assurance and asked UK Finance with assistance from KY3P® to develop a framework to find an efficient and highly cost-effective solution for financial sector firms to assess suppliers' operational resilience in a collaborative way.
The framework will be launched on 2 March and will be made freely available to firms and suppliers on the UK Finance website. It follows a successful proof of concept with five of the largest UK banks and five global suppliers to the financial services industry. Detailed assessments of the five suppliers were undertaken against the framework and shared for consumption by all five banks, reducing the effort required by the suppliers by 80% in just the initial proof of concept.
The framework provides a sound foundation for a "pooled audit" which the PRA, in its Supervisory Statement (SS2/21), states are "more efficient and cost effective for (financial services) firms and less disruptive for service providers. Pooled audits will also help spread costs and disseminate best industry practices with regards to audit methods among (financial services) firms."
At present, UK financial services firms use a relatively common supply base but slightly different assessments for onsite assurance, risk rating and remediation. The current approach has contributed to supplier frustration with some citing capacity and prioritisation constraints. In addition, within the current framework, firms are not fully leveraging opportunities to collaborate to identify common supply chain risks and improve visibility.
"When fully implemented, the Supplier Assurance Framework will allow suppliers to store and reuse responses, reducing duplicative processes and optimizing the workflow for the on-boarding and due-diligence process," said Richard Blore, Chief Executive Officer, KY3P®, IHS Markit. "We are delighted to work with UK Finance on the new standards which will raise the bar on control standards across the industry and will move the industry towards a sustainable solution that delivers a more resilient and robust supply chain."
Ian Burgess, Director of Cyber and Third Party Risk at UK Finance said "UK Finance is delighted to launch the Supplier Assurance Framework and wish to express our thanks to KY3P® for the expertise they have brought to it. This is an important issue for our members, and we hope that by making this framework available to the whole sector and its suppliers that it will help enable a more collective approach to supplier assurance."
Benefits of the Supplier Assurance Framework
UK Finance brought key financial firms together on behalf of the industry to address concerns relating to operational resilience in their supply chain. This collaboration benefits financial firms and suppliers alike by:
• Building a networked community of financial firms and their suppliers
• Driving industry convergence on common approaches to achieve assurance of suppliers' operational resilience
• Introducing an industry standard operational resilience risk framework to help suppliers identify key risks to their clients
• Encouraging suppliers to work with their financial service clients to mitigate risks
• Driving efficiency and effectiveness
• Promoting the use of an industry standard framework that allows suppliers to be prepared with responses and evidentiary documentation, and minimises supplier efforts responding to multiple flavours of questionnaire
• Reducing turnaround times and improving due diligence information on suppliers
• Building confidence in supplier relationships