One of the main reasons for the postponement of the Blueprint Two Phase 1 go live from July to October was the need to provide market participants with sufficient time to perform their many regulatory obligations in terms of assurance. Lloyd’s, Velonetic and the IUA have made it clear over the last few months that the main priority is to deliver the changes safely, with timeliness secondary to that. The delay announced at the end of March was a result of this desire to ensure a smooth transition to the new digital platform and services, very much in line with regulatory expectations from the PRA and the FCA.

Managing Agents, Brokers and Company Market Carriers impacted by Blueprint Two have an important part to play in ensuring that the market is ready for a safe cutover. In particular, they have a number of regulated duties to perform due to the material changes being delivered as part of this phase of the programme. As we previously covered in this article, the phase 1 go live is a significant risk event for the market (specifically, for any market participant who will have signed the new DPSA outsourcing contract with Velonetic). As a result, impacted firms will need to ensure they fulfill their regulatory obligations starting with the outsourcing and operational resilience frameworks. A number of assurance activities will therefore be required for all impacted market participants, covering their own changes and risks as well as the changes and risks inherent to their outsourcing to Velonetic. These activities should culminate in a review and final decision by the Board, after following their internal assurance processes. This needs careful planning and firms should now be well under way in establishing their schedule.

Whilst planning for assurance activities against changes and risks that are within a firm’s control (e.g. impact assessment, risk assessment, …) are one thing, planning for assurance against activities that are performed by third parties is more challenging. They are however just as important – if not more so.

The Data Room

To facilitate this, the progamme has commissioned the provision of a ‘Data Room’ to share the necessary documentation / information to support market participants in their own governance and in performing their own due diligence on the readiness of the solution ahead of cutover. On Friday 31^st May, the programme published more details about the Data Room on their website.

This update provides an overview of the Data Room and an executive summary of the white paper they have now published. The full white paper is available to users who have signed up to the Data Room. You can request access via your own Blueprint Two champion or via your Blueprint Two engagement partner.

The Data room will serve as a secure SharePoint site for signed-up users and will catalogue the artefacts relevant to firms’ governance and assurance efforts.

There is still work for market participants to do!

These artefacts will be crucial to the due diligence process that each firm needs to undertake, however, they will not be the full answer. Firms will need to demonstrate that they have reviewed, challenged and tested the information provided.

Each firm will need to develop its own assessment of these topics and the issues they raise when reviewing specific artefacts. We have shared below some of the more common questions you are likely to need to consider.

Vanguard Testing and Customer Testing

• Are you satisfied that the test coverage is sufficient?
• Are you comfortable with the methodology used to identify and categorise priority defects?
• Are you satisfied that, with your firm’s specific circumstances / requirements in mind, none of the outstanding defects are a showstopper for go live – i.e. they do not have the potential to significantly impact your business and/or threaten your tolerances?

Functional & non-functional requirements

• Are all your business scenarios satisfactorily covered?
• Does your own impact assessment reflect all the changes?
• Are Velonetic’s non-functional requirements matching or exceeding your requirements and in line with the DPSA?

Operational resilience testing

• Are Velonetic’s impact tolerances in line with your own?
• Are the scenarios tested sufficient?
• Are there vulnerabilities that require further review / challenge?

Operational cutover planning

• Is your cutover plan fully aligned with the programme’s?
• Does your communication plan include all relevant cutover steps, including rollback scenarios?

Business continuity planning

• Have you refreshed your own business continuity plans?
• Is your Business Continuity Plan aligned?

Operational & technical services transformation (hypercare, ServiceNow, customer help portals)

• Is it clear who you can talk to after go live if you encounter a major issue?
• Is there a clear escalation mechanism?
• Are your teams aware of the process to raise an incident or ask for support?

In addition to document-specific questions, firms need to satisfy themselves that they have received all the documents that they need to perform their due diligence and that the information they received was sufficiently detailed.

If you need support in completing your assurance activities, we can help. We have developed an assurance health check dedicated to Blueprint Two phase 1 to provide firms with an independent review of their readiness and their compliance with their regulatory obligations. Please do get in touch with Claire King, Benoit Steulet or your usual ICSR contact if this is of interest.

Conclusion

The artefacts to be published by the Programme via the Data Room will help answer one of the key concerns that was highlighted during a roundtable event we organised late January. It will provide the market with a central repository of common information to be consumed by each firm’s assurance processes and avoid the need for each firm to ask for specific details from the Programme.

However, it does not mean that it will deliver assurance on behalf of market participants. It remains the responsibility of each firm signing the new outsourcing agreement with Velonetic to provide their own assurance, proportional to their circumstances, ahead of providing a go live decision. Impacted firms are still required to carefully analyse what this means for them and plan in detail the activities required to follow their own governance process and committee / board schedule.

In order to better understand the impact of the new testing plan, the new cutover timing and the information that will be available via the Data Room, we are organising a second roundtable event on Blueprint Two Phase 1 Assurance. It will take place in person on Wednesday 3^rd July between 8:30 and 10:00 over breakfast. Please contact Claire King or Benoit Steulet if you would like to participate.

Claire King

Risk & Compliance Director