Material outsourcing classification and what we need before signing
Email thread Corstorphine Building Society · exec
Catriona Muir has classed the BB-Demo service as a material outsourcing. She needs PRA notification before signing, an exit plan, and audit and access rights, all in writing. Tom Ashdown has promised the clauses.
What was said
What this says
Current to 13 Oct 26Catriona Muir has classed the BB-Demo service as a material outsourcing. She needs PRA notification before signing, an exit plan, and audit and access rights, all in writing. Tom Ashdown has promised the clauses.
Ask: Catriona Muir, Procurement and Supplier Risk Manager, wants to know whether the standard MSA and order form already cover exit, audit and access rights, or whether an addendum is needed. She will not agree anything by phone.
Customer view: the timetable is not flexible. Alasdair Gunn, Chief Operating Officer, will take the decision to the board once security and supplier risk are complete.
Next: Tom will send the exact clauses in writing, with addendum items marked separately, and may ask Hannah to line up exit and data return detail. The thread does not show the clause wording.
The thread
Updated 9 Oct 26Messages
Catriona Muir 3 Sep 2026 13:43Hi Tom, I've now completed the outsourcing assessment for the BB-Demo service and I need to be clear on where it has landed, as I know it affects your timetable. We are classifying this as a material outsourcing. That has three consequences for the file: - The PRA must be notified before we sign anything. That is a step I cannot skip and it cannot be done after the event. - The contract needs an exit plan. What's the exit plan? I'll need that for the file, covering how our data and the derived layer are returned or removed, and over what period. - The contract needs audit and access rights for the society and, where required, for our regulators. Could you tell me whether your standard MSA and order form already cover these, and if not, what you can offer? Is that in the contract today, or would it be an addendum? Please send it in writing so it can be reviewed properly. I won't be agreeing anything by phone. I have copied Alasdair so he is sighted on the process. He will take the decision to the board once security and supplier risk are complete, so I would not want anyone assuming the timetable is flexible. Thanks, Catriona
Tom Ashdown 8 Sep 2026 08:19Hi Catriona, Thanks for this, and for being so clear. No drama on our side: material outsourcing is normal for a regulated buyer and we'd rather do it properly than quickly. On your three points, I won't guess at what our standard paper says. I'm getting the exact wording on exit, audit and access rights checked with our team and I'll send you the clauses in writing, with anything that would need an addendum marked separately. Leave that with me. On the PRA notification, understood that it comes before signature. I'll keep our side's dates to whatever you need to make that work, and I'll not push on timing. Alasdair, nothing needed from you at this stage. I'll keep you copied so you can see where things stand ahead of the board. If it helps, I can also ask Hannah to line up the exit and data return detail alongside her security review material so Euan sees it too. Best, Tom