Performing and evidencing criticality assessments are an important part of remaining compliant with SM&CR while relying on the services of a third party to perform business functions for your firm. Corterum can easily help you record these assessments.
Here's how:
Click WORKBENCH and then click DATASETS.
Then click SM&CR.
Then choose Senior Managers Regime.
Then click on Outsourcing.
Then select Outsourced functions.
A list of all third party providers for which you have recorded outsourced functions will appear.
If a functions record has not yet been created, you would need to create a new one - see here for more details. Create this record, and then follow steps 8 onwards below.
To add a criticality assessment to an existing record - click on the supplier you'd like to amend.
A new pop-up window will appear.
Scroll down to the Criticality assessment section.
If you are editing an existing assessment and this section has been used previously, the button will say VIEW TABLE (click it and skip to Step 15 of this section). If this is the first time this section has been used, the button will say LINK TABLE.
Click the button and a new pop-up will appear.
This pop-up asks if you want to create a new dataset, or link to an existing one. If you have recorded this information elsewhere - in another reference request, click the Existing button and choose which dataset you want to link from the the list under Linked Entity. Otherwise, you'll need to create a new table dataset. Select New.
Once you have chosen New or Existing, click CONFIRM to proceed or CANCEL to go back to the regulatory reference request record.
A new pop-up box will appear.
You can give a descriptive name to this dataset under Dataset description, and then choose the name of the third party from the dropdown list next to Criticality assessment. NB - if the business which is providing the outsourced function doesn't appear in this list, you'll need to create it as a Business Entity first - here's how).
If this is a blank table, with no information in it currently, skip to step 18. Otherwise if there is already information here you can update an existing row here by clicking the EDIT button, or add a new additional information request for the same person here by clicking ADD ROW, and following the steps below.
In this table dataset (reading from left to right) you can:
Choose the Function for which you are performing a criticality assessment by selecting from the drop down list.
If you have selected 'Other' in point a above, use the text box under Function (if other) to record which function you're recording a criticality assessment for.
Use the dropdown box under Critical or important function? to confirm if the function is critical or important.
Use the dropdown box under Material outsourcing? to confirm if the function is of material importance to the ongoing compliance with the Principles of Business.
If your firm is an authorised payment institution or an authorised electronic money institution, you can use the dropdown box under Outsourcing of important operational function? to confirm if the function is important.
Use the dropdown box under Regulated activity? to confirm if the function being outsourced is regulated activity or not.
Use the dropdown box under Function supports time-critical business operations? to record if this is true or not.
Use the text box under Time-critical business operations to record the details of these operations (if you answered 'yes' in point g above).
Use the dropdown under Financial impact to record the level of potential financial risk associated with outsourcing this function (from Very low to Very high).
Use the dropdown under Reputational impact to record the level of potential reputation risk associated with outsourcing this function (from Very low to Very high).
Use the dropdown under Regulatory impact to record the level of potential regulatory risk associated with outsourcing this function (from Very low to Very high).
Use the dropdown under Impact on clients to record the levels of potential risk to clients associated with outsourcing this function (from Very low to Very high).
Use the text box under Summary of conclusions to record the details of the conclusions that you as a firm have reached on the criticality of this outsourced function.
Use the dropdown box under Assessment performed by to choose which person within your firm conducted this assessment.
Use the date picker under Date of last assessment to record the date of this assessment.
Finally, you can use the button under the Documents section to upload any necessary supporting documents.
Once done, if you need to add another criticality assessment, click ADD ROW and repeat the steps under point 18 above.
Finally, click SAVE and then CLOSE.