Conduct risk, outsourcing and third-party risk
Conduct risk, outsourcing and third-party risk are the domains where operational risk meets regulation most directly. The exam tests conduct drivers and frameworks, and the controls required when someone else performs a critical activity.
Conduct risk
Conduct risk is the risk that the firm's behaviour, or the behaviour of its staff, causes detriment to customers or market integrity. Drivers include culture and incentives, product design and target market, sales practices, complaints handling and conflicts of interest. Frameworks: the FCA's treating customers fairly outcomes and, since 31 July 2023, the Consumer Duty (PRIN 2A) with four outcomes - products and services, price and value, consumer understanding, consumer support - plus the cross-cutting obligation to act in good faith and avoid foreseeable harm. Conduct events are captured in the same loss and incident framework as other operational events; remediation provisions are a common source of large losses. SM&CR makes senior individuals accountable, and non-financial misconduct is treated as a conduct issue.
Outsourcing and third-party risk
Outsourcing does not transfer regulatory responsibility. Key requirements:
- Identify material or critical/important functions; these trigger regulator notification (SYSC 8 in the UK) and enhanced due diligence.
- Contract clauses covering service levels, audit and access rights, data protection, sub-outsourcing controls, termination and exit assistance.
- Ongoing monitoring, a register of providers, concentration and fourth-party analysis, and a tested exit plan.
- PRA SS2/21 and, in the EU, DORA, which requires ICT third-party registers and specific contractual terms.
Worked example
A firm moves its payments platform to a cloud provider. It supports a critical business service, so the arrangement is material outsourcing. Reasoning: notify the regulator, complete due diligence including financial and security posture, secure audit and exit clauses, assess concentration against other providers, and test the exit plan. Retaining the same service internally with no monitoring would be a governance failure just as much as an unmanaged outsourced one.
Traps that cost marks
- Saying outsourcing transfers the risk.
- Treating all outsourcing as material, or none of it.
- Omitting exit plans and fourth-party concentration.
- Separating conduct from operational risk so conduct losses are never captured.