Over time, issues and challenges in your third party outsourcing relationships, such as Denial of Service (DoS) attacks or data breaches may occur. If this happens, keeping a detailed log of the issue, the action taken and any future mitigation steps is important to keeping your outsourcing relationships SM&CR compliant.
Here's how to keep an issues log for a third party outsourcer:
Click WORKBENCH and then click DATASETS.
Then click SM&CR.
Then choose Senior Managers Regime.
Then click on Outsourcing.
Then select Outsourced functions.
A list of all third party providers for which you have recorded outsourced functions will appear.
If a functions record has not yet been created, you would need to create a new one - see here for more details. Create this record, and then follow steps 8 onwards below.
To add an issues log to an existing record - click on the supplier you'd like to amend.
A new pop-up window will appear.
Scroll down to the Issues log section.
If you are editing an existing log and this section has been used previously, the button will say VIEW TABLE (click it and skip to Step 15 of this section). If this is the first time this section has been used, the button will say LINK TABLE.
Click the button and a new pop-up will appear.
This pop-up asks if you want to create a new dataset, or link to an existing one. If you have recorded this information elsewhere - in another reference request, click the Existing button and choose which dataset you want to link from the the list under Linked Entity. Otherwise, you'll need to create a new table dataset. Select New.
Once you have chosen New or Existing, click CONFIRM to proceed or CANCEL to go back to the regulatory reference request record.
A new pop-up box will appear.
You can give a descriptive name to this dataset under Dataset description, and then choose the name of the third party from the dropdown list next to Issues log. NB - if the business which is providing the outsourced function doesn't appear in this list, you'll need to create it as a Business Entity first - here's how).
If this is a blank table, with no information in it currently, skip to step 18. Otherwise if there is already information here you can update an existing row here by clicking the EDIT button, or add a new additional information request for the same person here by clicking ADD ROW, and following the steps below.
In this table dataset (reading from left to right) you can:
Choose the Outsourcer name for which you are recording an issue in the dropdown box.
Use the text box under contract reference to record a reference number for the contract if you have one.
Use the text box under Issue summary to outline the issue you're recording.
Use the dropdown box under Issue status to confirm whether the issue is resolved or ongoing (using the RAG status).
Use the text box under Issue details to record why the issue is in the status you have chosen in point d above.
Use the date picker under Notification date to record when the third party alerted your firm to the issue.
Use the date picker under Remediation deadline to record by when the third party is supposed to have corrected the issue.
Use the date picker under Remediation date to record when the third party actually corrected the issue.
Use the dropdown under Regulator notified to record if details of this issue has been passed to the regulator. (Choose N/A if not required to report this issue).
Use the date picker under Date regulator notified to record the date of this notification (if any).
Use the dropdown under Accountable executive to choose the member of your firm responsible for this relationship and its performance.
Use the text box under Outsourcer contact to confirm who in the third party firm is the key contact.
Finally, you can use the button under the Documents section to upload any necessary supporting documents.
Once done, if you need to add another issue for this third party, click ADD ROW and repeat the steps under point 18 above.
Finally, click SAVE and then CLOSE.