{"text_format":"1","workbook":"xlsx","n_sheets":4,"sheets":["Notes","Detail","Systems sign-off","Overall declaration"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":0,"defined_names":7,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Notes","index":0,"n_rows":19,"n_cols":2,"rows_kept":19,"cut":false,"hidden":false,"merged":[]}
[null,"Please answer the question below to reveal the rest of this page"]
["*","Is the application being made in respect of an electronic money issuer?  (Select Y or N)"]
[]
[null,"Notes to help you complete this form"]
[1,"This form should be completed by technical and security professionals. "]
[2,"Only submit this form when the planning and implementation of the systems it relates to has reached the point where you know for sure what the answers are. Once submitted, the form will be reviewed, and we may ask you further questions and request further information. Therefore, you should submit it in good time, rather than just before the date you need authorisation."]
[3,"The ’Systems sign-off’ and ‘Overall declaration’ tabs should be printed out, signed by two directors responsible for the form’s subject matter, and forwarded to your contact at the FCA. If the signatories will not be in a position to sign the systems sign-off until shortly before you need authorisation, you can send this part after submitting the other parts of this form."]
[4,"Please enter your answers in the yellow boxes, attaching additional information if necessary. "]
[5,"Please answer the questions in respect of all key business systems, irrespective of location or outsourcing arrangements. (E.g. hosted at the applicant's main processing site, hosted at other sites, hosted overseas, hosted/supported by other companies in the same group, hosted/supported by third parties, or any combination thereof.) However, you do not need to provide answers in about the development processes for software packages supplied by software houses (Sections 5.1 and 5.2)."]
[6,"Questions in bold are more important. If you are cannot answer 'Yes' to a question in bold, you should consider taking action to enable you to do so. If you do not consider it as applicable in your firm’s circumstances, please explain why."]
[7,"If you have any questions about completing this form, please email authorisation.info.itds@fca.org.uk "]
[]
[]
[]
[]
[]
[null,"I confirm that I understand the above notes"]
[]
[null,"You must select from the above box to view the detailed questionnaire."]

{"sheet":"Detail","index":1,"n_rows":168,"n_cols":5,"rows_kept":168,"cut":false,"hidden":false,"merged":[[142,0,144,0]]}
[null,null,null," Yes/No","Describe"]
[]
["Old number",null,"Where the answers to the questions below differ depending on systems, locations etc, please complete separate copies of this questionnaire for separate IT operations or systems, and indicate in the box below which part of the applicant's operations each copy refers to."]
[{"$f":"Notes!C17","v":0}]
[{"$f":"Notes!C2","v":0},null,"Section 1 IT Governance and Strategy",null,{"$f":"IF(OR(Notes!C2=\"\",Notes!C17=\"\"),\"PLEASE ANSWER BOTH QUESTIONS ON THE PREVIOUS TAB BEFORE PROCEEDING\",\"\")","v":"PLEASE ANSWER BOTH QUESTIONS ON THE PREVIOUS TAB BEFORE PROCEEDING"}]
[1.01,1.01,"Is the governance of the IT function defined in writing, (e.g. by means of organisation charts, job responsibilities, and the terms of reference of any committees)?"]
[1.02,1.02,"Is the governance of the IT function linked to the governance of the business as a whole?"]
[1.03,1.03,"Does the Board agenda include IT issues at least once a quarter?"]
[1.04,1.04,"Is there a written IT Strategy that is approved by senior IT and business management?"]
[1.05,1.05,"Is the IT Strategy updated and approved at least once a year?"]
[1.06,1.06,"Is the IT Strategy based on forecasting the volume of business over the period of the Strategy?"]
[1.07,1.07,"Does the IT Strategy provide for sufficient processing, storage, and communications capacity for the systems so they can cope with the upper range of business volume forecasts?"]
[1.08,1.08,"Is the IT Strategy linked to all other relevant aspects of the business strategy? (e.g. locations, products)"]
[1.0900000000000001,1.0900000000000001,"Is there an annual IT budget, based on the IT Strategy, which is approved by senior management?"]
[]
[]
[null,null,"Section 2 IT Risk Management "]
[1.1000000000000001,2.0099999999999998,"Is there a mechanism for identifying and assessing IT risks, and determining appropriate mitigating actions?"]
[1.1100000000000001,2.02,"Is there a mechanism for reporting the results of this process to appropriate levels of management?"]
[1.1200000000000001,2.0299999999999998,"Does management formally consider risks and mitigating actions at least once a quarter?"]
[1.1299999999999999,2.04,"Are IT systems and controls subject to regular audit by an independent and qualified audit function?"]
[1.1399999999999999,2.0499999999999998,"Does management formally consider outstanding audit issues and remedial action at least once a quarter?"]
[]
[]
[null,null,"Section 3 Project and Change Management "]
[5.0999999999999996,3.1,"Project management and systems development methodology"]
[null,null,"Note: there is no need to provide answers in respect of the development processes for software packages supplied by software houses."]
["5.1.01","3.1.01","Is the proposed business system(s) needed to support the activities for which you are seeking authorisation already in place? If so, please go to question 3.2.01"]
["5.1.02","3.1.02","Are the project organisation structure, reporting lines, roles, and responsibilities (including third parties if appropriate) defined in writing?"]
["5.1.03","3.1.03","Is there a formal project plan?"]
["5.1.04","3.1.04","Are progress, project risks and issues formally monitored and reported to senior management at least once a month?"]
["5.1.05","3.1.05","Is a formal project management methodology used?  (If it is a recognised standard, please give its name)."]
["5.1.06","3.1.06","Is a formal system development methodology used?  (If it is a recognised standard, please give its name)."]
["5.1.07","3.1.07","Will the project as a whole be formally signed off by relevant senior IT and business management before the system goes live?"]
[null,null,"Note: Senior management should sign off on systems and controls at least two weeks before the date you hope to be authorised."]
[]
[]
[5.2,3.2,"Software maintenance"]
[null,null,"Note: there is no need to provide answers in respect of the development processes for software packages supplied by software houses."]
["5.2.01","3.2.01","Are all changes to the key business applications’ program code only made by installing new releases of packaged software? (Instead of programmers changing bespoke program code). If the answer to this question is Yes, please go to question 3.3"]
["5.2.02","3.2.02","Do documented program change control procedures require program changes (including emergency fixes) to be tested by developers (and, if appropriate, by users), and do they need to document and  sign-off the change, and update program documentation, before live implementation?"]
["5.2.03","3.2.03","Is a system in place to control and track the versions of each module of the source code in development, through testing, and in the live environment (both within the organisation, and updates distributed to business partners or customers’ PCs )?"]
["5.2.04","3.2.04","Is a system in place to control and track the various builds of the system that have existed during its history that enables previous versions to be reinstated?"]
["5.2.05","3.2.05","Is a system in place to detect unauthorised changes to systems and reconcile changes back to change authorisations?"]
["5.2.06","3.2.06","Are there separate development, testing, and live environments?"]
["5.2.07","3.2.07","Is the program documentation of sufficient quality to enable a programmer unfamiliar with the system to support it?"]
[]
[]
[5.3,3.3,"Software package maintenance"]
["5.3.01","3.3.01","Are all changes to the program source code of all key business applications written by the applicant's own programmers?   (As opposed to installing package updates made by another organisation). If the answer to this question is Yes, please go to question 5.4."]
["5.3.02","3.3.02","Are there formal procedures for implementing patches and upgrades that also apply to emergency fixes?"]
["5.3.03","3.3.03","Do these procedures require program changes to be tested using a standard test pack in a separate testing environment, with bugs resolved, changes signed-off, and user documentation updated?"]
["5.3.04","3.3.04","Are key software packages protected by escrow agreements?"]
[]
[]
[5.4,3.4,"Changes to the configuration of application software and systems software"]
["5.4.01","3.4.01","Are there formal procedures that require changes to the parameters, standing data, or configuration of key software, where errors could cause system problems, to be tested and signed off?"]
["5.4.02","3.4.02","Do you maintain a log of these changes?"]
["5.4.03","3.4.03","Is documentation of configuration settings, parameters, network diagrams, and critical standing data maintained and promptly updated after each change?"]
["5.4.04","3.4.04","Do the systems maintain a full audit trail of the changes?"]
[]
[]
[5.5,3.5,"Testing and sign off"]
[null,null,"Is testing the proposed business system(s) needed to support the activities for which authorisation is sought, planned, in progress, or completed? (Select from drop-down list)."]
["5.5.01","3.5.01",{"$f":"IF(D$64=\"planned\",\"Will there be a standard test pack for testing program changes?\",IF(D$64=\"in progress\",\"Is there a standard test pack for testing program changes?\",\"Is there a standard test pack for testing program changes?\"))","v":"Is there a standard test pack for testing program changes?"}]
["5.5.02","3.5.02",{"$f":"IF(D$64=\"planned\",\"Will you document the expected and actual results of testing?\",IF(D$64=\"in progress\",\"Are you documenting the expected and actual results of testing?\",\"Did you document the expected and actual results of testing?\"))","v":"Did you document the expected and actual results of testing?"}]
["5.5.03","3.5.03",{"$f":"IF(D$64=\"planned\",\"Will the system be tested by representatives of all business areas (including third parties such as customers) that will use the system?\",IF(D$64=\"in progress\",\"Is the system being tested by representatives of all business areas (including third parties such as customers) that will use the system?\",\"Was the system tested by representatives of all business areas (including third parties such as customers) that will use the system?\"))","v":"Was the system tested by representatives of all business areas (including third parties such as customers) that will use the system?"}]
["5.5.04","3.5.04",{"$f":"IF(D$64=\"planned\",\"Will all bugs that could cause data errors or unacceptable performance be resolved before the system goes live?\",IF(D$64=\"in progress\",\"Are all bugs that could cause data errors or unacceptable performance being resolved before the system goes live?\",\"Were all bugs that could cause data errors or unacceptable performance resolved before the system went live?\"))","v":"Were all bugs that could cause data errors or unacceptable performance resolved before the system went live?"}]
["5.5.05","3.5.05",{"$f":"IF(D$64=\"planned\",\"Will the testers and relevant senior IT and business management formally sign off on the tests before the system goes live?\",IF(D$64=\"in progress\",\"Are the testers and relevant senior IT and business management formally signing off on the tests before the system goes live?\",\"Did the testers and relevant senior IT and business management formally sign off on the tests before the system went live?\"))","v":"Did the testers and relevant senior IT and business management formally sign off on the tests before the system went live?"}]
[null,null,"Note: Testing should be completed and signed off at least two weeks before the date you hope to be authorised."]
[]
[]
[5.6,3.6,"Reviews and audits"]
["5.6.01","3.6.01","Were the systems relating to this authorisation reviewed in the last 12 months, or will they have been reviewed in the 12 months before launch, by internal audit, external audit, or an independent and qualified third party?"]
["5.6.02","3.6.02","Will follow-up reviews take place at least every three years, regardless of location and whether the systems are hosted in-house or by a third party? (State frequency.)"]
[]
[]
[null,null,"Section 4 Service Delivery and Incident Handling"]
[null,null,"See SYSC 4.1.6 for our requirements for resilience and availability"]
[3.3,4.01,"Are procedures and processes in place to log actual or potential availability problems, such as warnings and error messages, and manage them?"]
[3.4,4.0199999999999996,"Are procedures and processes in place to log and monitor system performance statistics, and to manage any actual or potential issues highlighted?"]
[3.5,4.03,"Are procedures and processes in place to log and monitor system capacity utilisation, and manage any actual or potential issues highlighted?"]
[3.7,4.04,"Are system support staff available throughout business hours and beyond, to resolve problems before the next business day? "]
[]
[]
[null,null,"Section 5 Information Security and Controls"]
[2.1,5.0999999999999996,"Security Policies, Procedures, and Organisation"]
["2.1.01","5.1.01","Is there a written Information Security Policy?"]
["2.1.02","5.1.02","If yes, is it based on a recognised standard? (Please give the name of the standard, e.g. BS7799, ISO27001.)"]
["2.1.03","5.1.03","Is a named and experienced person, independent of IT management, responsible for information security, and the role and responsibilities defined in writing?  (State name and summarise role, responsibilities and experience)"]
["2.1.04","5.1.04","Do systems and procedures, backed up by periodic reviews, enforce compliance with the security policy and supporting standards? (E.g., forms to ensure authorisation is obtained; regular reports on results of reviews.)"]
["2.1.05","5.1.05","If yes, does this also apply to functions outsourced to service providers, or other parts of the group, whether in the UK or overseas?"]
[]
[]
[2.2000000000000002,5.2,"Security Practices"]
["2.2.01","5.2.01","Is sensitive data stored so as to be protected from unauthorised access (e.g. in encrypted form)?"]
["2.2.02","5.2.02","Is data securely transmitted over public networks such as the internet (e.g. encrypted)?"]
["2.2.03","5.2.03","Are all internal networks’ connections to the internet protected by firewalls, a DMZ and an IPS?"]
["2.2.04","5.2.04","Are internal networks, including wireless networks, protected from unauthorised access, e.g. by password protection and by keeping communications equipment in secure areas?"]
["2.2.05","5.2.05","Is all data stored on portable devices or removable media (such as laptops, memory sticks and DVDs) protected, e.g. by encryption? "]
["2.2.06","5.2.06","Are all non IT staff prevented from installing software, or connecting unauthorised devices such as private memory sticks or keystroke loggers, whether accidentally or deliberately?"]
["2.2.07","5.2.07","Is access to data centres restricted to authorised persons?  "]
["2.2.08","5.2.08","Are the persons who maintain the program code or system parameters of key business applications different to the persons who promote code to the live environment, or use the applications as part of the business process?"]
[]
[]
[2.2999999999999998,5.3,"Logical Access Security Administration"]
["2.3.01","5.3.01","Does creating new users, or amending the access rights of existing users require formal authorisation?"]
["2.3.02","5.3.02","Is logical access to applications granted on the principle of least privilege and is it given in a way that enforces segregation of duties? (i.e. does it ensure that separate persons can access functions that need separation for control purposes, e.g. inputting and releasing payments?)"]
["2.3.03","5.3.03","When users leave or their responsibilities change are the access rights or profiles they no longer need promptly deleted?"]
["2.3.04","5.3.04","Are users forbidden to share passwords?"]
["2.3.05","5.3.05","Are users informed of security rules (like the above) that they must follow at induction and periodically thereafter?"]
["2.3.06","5.3.06","Are passwords subject to quality and security standards? (e.g. changed every 30 days, at least eight characters long, not re-usable within a period, communicated securely to users, not re-set without confirming their identity.)"]
["2.3.07","5.3.07","Are security administrators of key applications either separate from the users of those systems or their activities independently reviewed?"]
["2.3.08","5.3.08","Are default passwords changed as a matter of course when new hardware or software is first installed?"]
[]
[]
[2.4,5.4,"Security monitoring"]
["2.4.01","5.4.01","Are powerful administrator passwords subject to additional controls? (e.g. entrusted  to the minimum number of people, use logged and regularly reviewed, with any exceptions followed up.)"]
["2.4.02","5.4.02","Are tools used to monitor security? (e.g. intrusion detection software, security log analysis and reporting software.)"]
["2.4.03","5.4.03","Are users and their access rights reviewed at least twice a year, and any users or access rights that are no longer required removed?"]
["2.4.04","5.4.04","Will an independent penetration test of the network be carried out, and all significant weaknesses corrected, before launch and at least annually thereafter?"]
[null,null,"Note: Independent internal and external vulnerability testing of the systems as they will be at launch, and confirmation that significant weaknesses have been resolved, should be completed at least two weeks before the date you hope to be authorised."]
[]
[]
[null,null,"Section 6 Business Continuity Planning and Disaster Recovery "]
[null,null,"(See SYSC 4.1.6-8 for our requirements for resilience and availability for banks and building societies, and SYSC 3.2.19 for our requirements for insurers, managing agents, and Lloyd's.)"]
[null,null,"Note: The disaster recovery plan (for the systems as they will be at launch) is required to be tested and in place, and any significant issues resolved or being resolved at least two weeks before the date you hope to be authorised."]
[3.1,6.01,"Has the business defined the systems availability target (i.e. % up-time during normal business hours) required to support business activities? (Please specify.)"]
[3.2,6.02,"Has the business defined the maximum length of time for which the system could be continuously unavailable during normal business hours without causing unacceptable business disruption to customers?"]
[3.6,6.03,"Are key components duplicated to eliminate single points of failure that could cause interruptions resulting in unacceptable harm to customers? (Consider power supplies, communications lines, processors, disk drives, routers, switches, air conditioning etc.)"]
[3.8,6.04,"Are data centres protected from physical hazards such as fire, water, heat, humidity, dust, forced entry, etc?"]
[4.0999999999999996,6.05,"If the normal system fails, will customers have alternative ways of performing transactions? (e.g. by fax or phone instead of online.)"]
[4.2,6.06,"Is there a disaster recovery plan that provides for critical systems to recover within the maximum period the business has defined as acceptable?"]
[4.3,6.07,"Is the disaster recovery location far enough away from the main site not to be affected by the same disaster?"]
[4.4000000000000004,6.08,"Will the effectiveness of the disaster recovery plan be validated by successful testing on the systems as they will be at launch, before launch and at least annually thereafter, with any failures corrected and retested within six months?"]
[4.5,6.09,"Are up to date copies of the plan kept off site where people who need them can get to them promptly?"]
[4.5999999999999996,6.1,"Is the disaster recovery plan updated at least annually or when any system change affects it?"]
[]
[]
[null,null,"Section 7 Outsourcing/Offshoring"]
[null,null,"See SYSC 13.9 for our outsourcing requirements for insurers"]
[null,null,"See SYSC 8.1 for our outsourcing requirements for other firms"]
[6.1,null,"Does SYSC 13.9 or SYSC8.1 apply to you? (Under","Y"]
[null,null,"SYSC 1.1A"]
[null,7.1,"SYSC 8 applies to all firms that are not:\n* insurers, \n* Lloyd's (of London) managing agents, or\n* the society incorporated by Lloyd's Act 1871 by the name of Lloyd's\n\n(SYSC 13.9 applies to insurers).\n\nIf the answer to this question is No, go to section 8."]
[6.2,7.2,"Do you outsource significant IT functions? If the answer to this question is No, go to Section 8.","Y"]
[6.3,7.3,{"$f":"IF(D$143=\"Y\",IF(D$146=\"Y\",IF(A$5=\"N\",\"Have you exercised due skill, care, and diligence in entering into the outsourcing arrangement, to obtain assurance that an appropriate standard of service will be provided? (SYSC 8.1.7 R or SYSC 13.9.4 G)\",\"Have you exercised due skill, care, and diligence in entering into the outsourcing arrangement, to obtain assurance that an appropriate standard of service will be provided?\"),\"Go to section 8\"),\"Go to section 8\")","v":"Have you exercised due skill, care, and diligence in entering into the outsourcing arrangement, to obtain assurance that an appropriate standard of service will be provided?"}]
[6.4,7.4,{"$f":"IF(D$143=\"Y\",IF(D$146=\"Y\",IF(A$5=\"N\",\"Does the service provider have the ability, capacity, and any authorisation required by law to perform the outsourced functions, services or activities reliably and professionally? (SYSC 8.1.8 (1) R or SYSC 13.9.4 (3) G)\",\"Does the service provider have the ability, capacity, and any authorisation required by law to perform the outsourced functions, services or activities reliably and professionally?\"),\"Go to section 8\"),\"Go to section 8\")","v":"Does the service provider have the ability, capacity, and any authorisation required by law to perform the outsourced functions, services or activities reliably and professionally?"}]
[6.5,7.5,{"$f":"IF(D$143=\"Y\",IF(D$146=\"Y\",IF(A$5=\"N\",\"Do you have the expertise and methods required for assessing the service provider’s performance, supervising the service provider, and initiating corrective actions? (SYSC 8.1.8 (5) R or SYSC 13.9.1-2 G, 13.9.6 G)\",\"Do you have the expertise and methods required for assessing the service provider’s performance, supervising the service provider, and initiating corrective actions?\"),\"Go to section 8\"),\"Go to section 8\")","v":"Do you have the expertise and methods required for assessing the service provider’s performance, supervising the service provider, and initiating corrective actions?"}]
[6.6,7.6,{"$f":"IF(D$143=\"Y\",IF(D$146=\"Y\",IF(A$5=\"N\",\"Can you terminate the arrangement for outsourcing where necessary without impairing the continuity and quality of your services to customers? (SYSC 8.1.8 (7) R or SYSC 13.9.4 (4) G, 13.9.5 (8) G, 13.9.8 G)\",\"Can you terminate the arrangement for outsourcing where necessary without impairing the continuity and quality of your services to customers?\"),\"Go to section 8\"),\"Go to section 8\")","v":"Can you terminate the arrangement for outsourcing where necessary without impairing the continuity and quality of your services to customers?"}]
[6.7,7.7,{"$f":"IF(D$143=\"Y\",IF(D$146=\"Y\",IF(A$5=\"N\",\"Does the contract give you, your auditors, us and any other relevant competent authority the right to audit the service provider? (SYSC 8.1.8 (9) R or SYSC 13.9.5 (2) G)\",\"Does the contract give you, your auditors, us and any other relevant competent authority the right to audit the service provider?\"),\"Go to section 8\"),\"Go to section 8\")","v":"Does the contract give you, your auditors, us and any other relevant competent authority the right to audit the service provider?"}]
[6.8,7.8,{"$f":"IF(D$143=\"Y\",IF(D$146=\"Y\",IF(A$5=\"N\",\"Does the contract require the service provider to protect any confidential information relating to you and your customers? For transfers to non-EU states, does the contract mirror the EU model clauses? (SYSC 8.1.8 (10) R or SYSC 13.9.5 (3) G)\",\"Does the contract require the service provider to protect any confidential information relating to you and your customers? For transfers to non-EU states, does the contract mirror the EU model clauses?\"),\"Go to section 8\"),\"Go to section 8\")","v":"Does the contract require the service provider to protect any confidential information relating to you and your customers? For transfers to non-EU states, does the contract mirror the EU model clauses?"}]
[null,null,{"$f":"IF(D$143=\"Y\",IF(D$146=\"Y\",HYPERLINK(\"http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2002:006:0052:0062:EN:PDF\", \"(The EU model clauses are the standard contractual clauses for the transfer of personal data to processors established in third countries, under Directive 95/46/EC http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2002:006:0052:0062:EN:PDF)\"),\"Go to section 8\"),\"Go to section 8\")","v":"(The EU model clauses are the standard contractual clauses for the transfer of personal data to processors established in third countries, under Directive 95/46/EC http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2002:006:0052:0062:EN:PDF)"}]
[6.9,7.9,{"$f":"IF(D$143=\"Y\",IF(D$146=\"Y\",IF(A$5=\"N\",\"Does the contract require you and the service provider to establish, implement and maintain a contingency plan for disaster recovery and periodic testing of backup facilities? (SYSC 8.1.8 (11) R or SYSC 13.9.5 (6) G, 13.9.8 G)\",\"Does the contract require you and the service provider to establish, implement and maintain a contingency plan for disaster recovery and periodic testing of backup facilities?\"),\"Go to section 8\"),\"Go to section 8\")","v":"Does the contract require you and the service provider to establish, implement and maintain a contingency plan for disaster recovery and periodic testing of backup facilities?"}]
[]
[]
[null,null,"Section 8 Supporting Documents"]
[null,null,"Please confirm whether the following documentation is available. Where this is not provided please give an explanation."]
[null,null,null,null,"State reason if not provided"]
[null,null,"Recent business continuity test results"]
[null,null,"Penetration test results identifying the scope and results of the penetration test(s), including actions taken to eliminate shortcomings and planned frequency"]
[null,null,"Project development plan (if applicable)"]
[]
[null,null,"Now go to Section 9: Management sign-off on the next tab"]
[]
[]
[null,null,null,null,{"$f":"IF(COUNTA(E6:E154)<89,\"Please complete all boxes in the 'Describe' column above.\",\"\")","v":"Please complete all boxes in the 'Describe' column above."}]
[null,null,null,null,{"$f":"CONCATENATE(89-COUNTA(E6:E154),\" boxes are still blank.\")","v":"89 boxes are still blank."}]

{"sheet":"Systems sign-off","index":2,"n_rows":32,"n_cols":1,"rows_kept":32,"cut":false,"hidden":false,"merged":[]}
["Section 9 Management sign-off"]
[]
["We hereby confirm that we have reviewed the development undertaken and results of testing carried out to "]
["[describe the overall purpose of the systems and the business it is intended to support].  "]
["We confirm that the following has been completed and accepted as satisfactory for launch:"]
["·         Development/customisation/configuration of"]
[" [system(s)]"]
["·         Testing of the above systems, including"]
["·         Conducting full functional and non-functional testing of the technical infrastructure and software."]
["·         Satisfactorily completing stress and performance testing of the live environment to levels well beyond forecast levels of activity. (Capacity utilisation will be subject to regular review, and capacity added as necessary.)"]
["·         Successful testing of all interfaces and related systems required for operation. "]
["·         Testing the business continuity failover between data centres, and successfully testing the failover of individual redundant components, including communication links."]
["·         Correcting all significant issues arising from the above testing."]
["·         Correcting significant issues arising from penetration testing, pre-implementation audit, or otherwise. (The systems will be subject to further penetration tests at least every 12 months.)"]
["·         Installation at all data centres"]
["·         Implementing full change control procedures for the production infrastructure and software."]
["·         Implementing systems and controls to ensure that [name of firm] can meet its regulatory requirements for authorisation, including recruiting and training staff, implementing the necessary tools, managing third party providers and fully documenting procedures."]
[]
[]
["Signed:                                                                         Date:"]
[]
[]
[]
["[Enter name and job title]"]
[]
[]
[]
["[Enter name and job title]"]
[]
[]
[]
["Please print and sign this page and send both electronic and printed copies to your point of contact at the FCA."]

{"sheet":"Overall declaration","index":3,"n_rows":17,"n_cols":1,"rows_kept":17,"cut":false,"hidden":false,"merged":[]}
["Section 10 Management declaration"]
[]
["We have reviewed all parts of this form and taken all necessary steps to verify that the information given is complete, accurate, and up to date."]
[]
["Signed:                                                                         Date:"]
[]
[]
[]
["[Enter name and job title]"]
[]
[]
[]
["[Enter name and job title]"]
[]
[]
[]
["Please print and sign this page and send both electronic and printed copies to your point of contact at the FCA."]