Third-party tool oversight: from regulatory burden to competitive advantage

The TR24/1 data survey paints a clear picture of how dependent IFA firms are on third-party technology. Of 977 firms surveyed, 842 use third-party risk profiling tools, 817 use investment research tools, 765 use cashflow modelling tools, 596 use capacity for loss tools, and 535 outsource compliance functions (paragraph 4.26). Only 46 firms — under 5% — operate without any third-party tools at all. The modern IFA practice is, in operational terms, a technology-dependent business.

This dependency runs deep. The tools are not peripheral — they shape the advice output. The risk profiling tool determines the client's risk category. The cashflow model determines whether the income strategy is projected as sustainable. The investment research tool influences which funds are recommended. The compliance tool determines which files are reviewed and what standards they are measured against. If any of these tools is poorly designed, misconfigured, or applied inconsistently, the advice quality suffers regardless of the adviser's competence.

The regulatory implication is significant. When a firm relies on third-party tools to perform functions that directly affect advice quality, the firm remains responsible for the output. The FCA does not accept "the tool told me to" as a defence for unsuitable advice. Under SYSC 8 and the principles in TR24/1, the firm must satisfy itself that each tool is fit for purpose, appropriate for its client base, and producing outputs that the firm understands and can validate.

SYSC 8 sets out the outsourcing framework, and TR24/1 applies it specifically to advice tools (paragraphs 4.25–4.27). Firms must conduct due diligence before selecting a tool: understanding what methodology it uses, what assumptions it makes, and whether those are appropriate for the firm's client base. They must have service agreements with clear terms covering performance, liability, data handling, and termination. They must review each tool regularly — at minimum annually — to confirm it remains fit for purpose.

Exit plans are a requirement the FCA found many firms had overlooked. If a tool provider fails, is acquired, or changes its methodology in a way that is no longer suitable, the firm needs a plan for transitioning to an alternative without disrupting advice delivery. The FCA highlighted good practice from firms that maintained master agreements with detailed terms, conducted external screening of providers, and had documented exit strategies (4.27).

The due diligence gap is stark: only 50% of firms had completed research on their tool providers. The other 50% were using tools that directly influence advice quality without having formally assessed whether those tools were appropriate. This is not a minor administrative shortfall. It represents a fundamental gap in the firm's control framework. If the risk profiling tool produces outputs that are not appropriate for decumulation clients — as TR24/1 found across all 24 firms — and the firm has not conducted due diligence to identify this, the firm has failed in its regulatory obligation.

The typical IFA firm operates with 5–8 separate tools: a risk profiler, a cashflow modelling tool, a compliance tracker, a document management system, a CRM, an e-signature service, and a back-office platform. Each requires a separate vendor relationship, a separate due diligence assessment, a separate service agreement, a separate annual review, a separate data processing agreement, and a separate security assessment. For a firm that takes its SYSC 8 obligations seriously, this is a significant governance burden.

Data inconsistency is the operational consequence. Client data exists in three or more systems, often entered separately into each. The name and address in the CRM may differ from the fact-find tool. The risk profile in the risk profiler may not match what was recorded in the suitability report. The advice register in the compliance tool may not reflect the actual recommendations in the file. Each disconnection is a potential error, a potential compliance issue, and a potential source of poor client outcomes.

Audit trail gaps arise where tools do not integrate. The client completes a fact-find in tool A, the adviser runs a risk assessment in tool B, generates a cashflow model in tool C, writes a suitability report in tool D, and sends it for signature in tool E. If these tools do not share a common data model, the trail of evidence has breaks. The FCA, reviewing the file, cannot see a continuous chain from data collection to recommendation. The MI picture is similarly fragmented — producing a board report requires manual extraction from multiple systems, a process that is slow, error-prone, and inherently outdated by the time it is complete.

Fewer vendors means simpler due diligence. If one platform handles risk profiling, cashflow modelling, fact-finding, suitability reports, and compliance logging, the firm has one vendor to assess instead of five. One service agreement instead of five. One annual review instead of five. One exit plan instead of five. The governance burden does not scale linearly with the number of functions — it scales with the number of vendors.

A single data model eliminates consistency issues. When the fact-find, risk assessment, cashflow model, and suitability report all draw from the same client record, there is no opportunity for data to diverge between systems. The client's name, fund value, income need, and risk profile are the same in every output because they come from the same source. This is not an efficiency argument — it is a data integrity argument with direct regulatory consequences.

One audit trail means complete evidence. Every action — from the first fact-find question to the final client signature — is logged in one system. There are no gaps between tools, no manual transfers to introduce errors, and no missing steps. MI is generated from one source in real time, without manual extraction. When the FCA asks for your advice register, your MI dashboard, or your file evidence, you have one place to look. This is not about technology preference. It is about regulatory resilience in an environment where the FCA is explicitly scrutinising the accuracy of firms' data and the completeness of their evidence.

If consolidation makes regulatory sense, the evaluation framework should reflect regulatory priorities. First: does the platform cover the core advice functions — risk profiling, cashflow modelling, suitability assessment, and compliance monitoring? If it only covers two of the four, the consolidation benefit is limited. Second: is the audit trail continuous from data collection to recommendation? A platform that covers all functions but does not log every action in a traceable sequence is not delivering the evidence chain the FCA expects.

Third: can the platform generate MI without manual extraction? If producing a board report still requires exporting data into a spreadsheet, the MI benefit of consolidation is theoretical rather than practical. Fourth: data portability — can you export all client data, files, and audit logs if you need to move? This addresses the SYSC 8 exit plan requirement. A platform that locks your data in a proprietary format creates a vendor dependency that the FCA would view as a risk management weakness.

Fifth: regulatory alignment — does the platform track evolving FCA requirements, including Consumer Duty outcomes, COBS 9.2 suitability standards, and TR24/1 expectations? A platform designed around regulatory requirements is more likely to remain fit for purpose than one where compliance is an add-on. Sixth: vendor viability — how established is the platform, what is its customer base, and what is its development roadmap? These are the same questions the FCA expects you to ask of any third-party tool. Apply them consistently, document your assessment, and you will have met your SYSC 8 obligation while reducing the number of vendors you need to manage.