A service provider assessment should support a decision about a defined service. A large questionnaire with many completed answers can still leave the institution uncertain about its dependencies, unresolved risks and ability to continue the activity if the provider fails. The central task is to connect what the provider says with evidence, internal challenge and a reasoned decision.
This worked example considers Cedar Processing, a fictional provider proposed by Illustrative Finance Ltd, a fictional NBFC, to process scanned servicing documents. At 30 September 2026, no production customer data has been transferred. The case shows why one completed control check does not resolve two remaining onboarding conditions. Banks can use the same assessment structure with the appropriate entity, activity and regulatory scope.
Define the service before rating the provider
The internal servicing lead describes the activity, information involved, locations, interfaces and expected outputs. Cedar would process documents under instruction, while customer decisions remain with the NBFC. This boundary matters because the institution must understand what it is delegating and what responsibilities it retains. A supplier name alone does not define the risk.
The team records systems that depend on the output and the consequences of interruption. It also asks whether the provider performs other services for the institution and whether a shared subcontractor creates concentration. Commercial attractiveness is considered separately from operational suitability. A competitive price cannot answer whether records will remain accessible during disruption. The assessment scope should be agreed before sending the questionnaire, so responses address the actual proposed arrangement rather than the provider’s general marketing description of its business.
Confirm the applicable framework
The RBI has separate outsourcing directions for commercial banks and NBFCs, with scope provisions that distinguish relevant entities and activities.[1][2] An institution should examine the text applicable to its category and the service concerned. It should not assume that all suppliers fall within an identical framework or that a standard questionnaire proves compliance with every requirement.
For the fictional case, the compliance reviewer is tasked with confirming the entity and activity treatment before approval. The document-processing proposal may raise both financial-service and technology considerations, depending on the actual arrangement. The assessment records that question rather than selecting whichever label seems administratively convenient. Where several requirements apply, identify how the review addresses each material area and who resolves uncertainty. Legal and compliance input should inform the decision early enough to affect the contract and implementation plan, rather than appearing only after a preferred supplier has been announced.
Explain criticality using the business impact
The fictional NBFC treats the proposed service as critical under its internal method because an extended interruption would delay servicing decisions. The record explains that reasoning and the assumed alternatives. It does not use a numeric score borrowed from another institution or imply that the label has been assigned by a regulator.
Criticality should influence the depth of evidence and challenge. The team examines replacement options, time needed to transfer the activity, data availability and the institution’s ability to perform essential work during a disruption. These assumptions should be revisited if volumes or dependencies change. A provider can be financially strong while the institution is still operationally dependent on a fragile interface or a scarce internal skill. Assessing the service exposes those dependencies more clearly than a questionnaire focused solely on the supplier’s corporate profile or the number of years it has operated.
Ask for evidence that answers a specific question
The questionnaire separates provider responses from the evidence reviewed and the conclusion drawn. DD-01 contains fictional capability and financial information. DD-02 records a test of access removal for ten invented identities. The security reviewer accepts the specific access-removal evidence on 28 September, with the reviewed log retained under TP-04-03.
That conclusion has a defined boundary. It does not prove that every security control is effective or that all access scenarios were covered. The record should identify the test population, date, method and limitations. Similarly, a certification, policy document or assurance report should be assessed for scope, period and exceptions before it is treated as support for a particular assertion. The reviewer’s task is to explain what the evidence demonstrates and what remains untested. This prevents a collection of impressive documents from being mistaken for an assessment of the actual service.
Record evidence and conditions together
Two conditions remain open. The provider has supplied a recovery plan, but there is no joint exercise result demonstrating the arrangement for this service. TP-04-01 therefore requires the service owner to arrange a recovery exercise by 7 October. Separately, the proposed contract does not yet settle subcontractor change notification. TP-04-02 assigns procurement and legal review by 5 October.
The access-removal action is closed with evidence, while those two actions remain visible. The Excel register calculates overdue days and flags certain incomplete closure records, but it does not average the three actions into an approval score. Such an average would obscure the importance of the unresolved conditions. Each action should retain its own owner, due date, evidence and reviewer decision. The overall onboarding decision belongs in the assessment pack, where the authorised decision-maker can explain the significance of the remaining exposure.
| Risk action | Evidence at review | Decision |
|---|---|---|
| TP-04-01: recovery | Provider plan; no joint exercise result | Open condition; due 7 October |
| TP-04-02: subcontractors | Contract draft lacks agreed notification terms | Open condition; due 5 October |
| TP-04-03: access removal | Ten fictional test identities removed; log reviewed | Closed on 28 September |
Test continuity beyond the existence of a plan
A recovery document describes an intended response. An exercise provides evidence about whether relevant people, information and systems can perform that response under stated conditions. The case team wants to test the service arrangement jointly, including access to records and the handoff back to the institution. It records the disruption scenario and success criteria before the exercise.
Basel operational-resilience principles provide international banking context for considering disruptions and dependencies.[3] The fictional exercise design is an original teaching example, not a prescribed recovery objective or mandatory test frequency. In real work, set objectives appropriate to the activity and applicable requirements. Retain failed steps and unresolved assumptions alongside successful results. A test that excludes a key subcontractor or assumes uninterrupted access to an unavailable system may offer limited assurance about the scenario the institution is actually concerned about.
Connect the contract with operational oversight
The legal reviewer considers how the contract supports the proposed monitoring, information access, confidentiality, incident handling, continuity and termination arrangements. The exact provisions need to reflect the service and applicable rules. Operational staff should participate because a legally drafted right may be difficult to exercise without a practical process and identified contacts.
In the example, unresolved subcontractor notification terms matter because a change could alter where work is performed or introduce a new dependency. The team records the concern and the decision required rather than treating contract execution as a procurement formality. Any permitted condition should have a clear owner and completion criterion. If the institution cannot obtain a necessary provision, the resulting decision should be explicit and authorised. Quietly accepting a weaker arrangement while leaving the questionnaire marked satisfactory would make the assessment misleading for future reviewers.
Plan monitoring and exit before onboarding
Before a later approval, the service owner defines ongoing evidence for service performance, incidents, material changes and unresolved exceptions. Reviews should respond to the actual risk and activity rather than a calendar entry that merely requests the same questionnaire each year. Changes in volume, data, subcontractors or service locations may require an earlier reassessment.
Exit planning asks how the institution would preserve access to records and continue the activity during transfer or termination. It identifies transition resources, data return or deletion checks, alternative arrangements and dependencies on the provider’s cooperation. A termination clause alone does not demonstrate that those steps can be completed. The fictional case leaves these preparations with the service owner before any production use. This keeps the decision connected to the institution’s operational responsibilities after contract signature, when an assessment can otherwise become an archived procurement file with little continuing value.
Use the pack to retain a reasoned assessment
The toolkit combines a Word questionnaire, a completed fictional assessment and an Excel risk/action register. Begin with the blank questionnaire and describe the service precisely. Record each evidence reference and conclusion, then transfer unresolved conditions into the register using stable IDs. Preserve the overall decision separately from the individual action statuses.
For a bank, confirm the relevant bank category and service framework. For an NBFC, examine the applicable entity and activity scope rather than adopting a bank template without adjustment. Neither a completed questionnaire nor a spreadsheet status substitutes for expert judgement on the actual arrangement. The practical test is whether an authorised reviewer can explain why the service was approved or deferred, what evidence was relied on and what conditions remain. That record makes subsequent monitoring and reassessment more focused when the service or its risk profile changes.
PRIMARY REFERENCES
Sources & further reading
Primary-source references checked on 13 October 2026. Follow the relevant authority’s current text for applicability, amendments and commencement dates. International standards provide context and are not automatically identical to domestic requirements.