SYSC 15A.4 Mapping
1A firm must identify and document the people, processes, technology, facilities and information necessary to deliver each of its important business services. This must be sufficient to allow the firm to identify vulnerabilities and remedy these as appropriate.
1Where a firm relies on a third party for the delivery of an important business service, we would expect the firm to have sufficient understanding of the people, processes, technology, facilities, and information that support the provision by the third party of its services to or on behalf of the firm so as to allow the firm to comply with its obligations under SYSC 15A.4.1R.
1A firm must keep its compliance with SYSC 15A.4.1R under review and, in particular, review its compliance in the following circumstances:
- (1)
if there is a material change to the firm’s business, the important business services identified in accordance with SYSC 15A.2.1R or impact tolerances set in accordance with SYSC 15A.2.5R; and
- (2)
in any event, no later than 1 year after it last carried out the relevant assessment.