{"id":"F2012L02439","name":"Banking, Insurance and Life Insurance (prudential standard) determination No. 1 of 2012 - Prudential Standard CPS 231 - Outsourcing","slug":"banking-insurance-and-life-insurance-prudential-standard-determination-no-1-of-2012-prudential-stand","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"repealed","isInForce":false,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":90415,"registerId":"commonwealth-F2012L02439-current","compilationNumber":null,"startDate":"2026-04-02","status":"Repealed","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Prudential Standard CPS 231","sectionType":"part","heading":"Prudential Standard CPS 231","content":"![](image.002.png)\n\n# Prudential Standard CPS 231\n\n## Outsourcing\n\n### Objective and key requirements of this Prudential Standard\n\nThis Prudential Standard requires that all outsourcing arrangements involving material business activities entered into by an APRA-regulated institution be subject to appropriate due diligence, approval and ongoing monitoring. All risks arising from outsourcing material business activities must be appropriately managed to ensure that the regulated institution is able to meet its financial and service obligations to its depositors and/or policyholders.\n\nThe ultimate responsibility for the outsourcing policy of an APRA-regulated institution (or of the members of a Level 2 group) rests with its Board of directors (or equivalent).\n\nThe key requirements of this Prudential Standard are that a regulated institution must:\n\n-   have a policy, approved by the Board, relating to outsourcing of material business activities;\n-   have sufficient monitoring processes in place to manage the outsourcing of material business activities;\n-   for all outsourcing of material business activities with third parties, have a legally binding agreement in place, unless otherwise agreed by APRA;\n-   consult with APRA prior to entering into agreements to outsource material business activities to service providers that conduct their activities outside Australia; and\n-   notify APRA after entering into agreements to outsource material business activities.\n\nWhere a regulated institution is the Head of a Level 2 group, this Prudential Standard requires that any outsourcing arrangements involving material business activities entered into by members of the group must be subject to appropriate due diligence, approval and on-going monitoring, and the provisions of this Prudential Standard must be are applied appropriately throughout the group.\n\n##   \nAuthority\n\n1.  This Prudential Standard is made under:\n\n(a) section 11AF of the Banking Act 1959 (Banking Act) in relation to authorised deposit‑taking institutions (ADIs) and non‑operating holding companies authorised under the Banking Act (authorised banking NOHCs);\n\n(b) section 32 of the Insurance Act 1973 (Insurance Act) in relation to general insurers and non‑operating holding companies authorised under the Insurance Act (authorised insurance NOHCs) and parent entities of Level 2 insurance groups; and\n\n(c) section 230A of the Life Insurance Act 1995 (Life Insurance Act) in relation to life companies, including friendly societies, and non‑operating holding companies registered under the Life Insurance Act (registered life NOHCs).\n\n## Application\n\n2. This Prudential Standard applies to:\n\n(a) all ADIs, including foreign ADIs, and authorised banking NOHCs;\n\n(b) all general insurers, including Category C insurers, authorised insurance NOHCs and parent entities of Level 2 insurance groups; and\n\n(c) all life companies, including friendly societies and eligible foreign life insurance companies (EFLICs), and registered life NOHCs.\n\nThese institutions are collectively referred to as ‘regulated institutions’ in this Prudential Standard.\n\n3. A requirement imposed upon a regulated institution that is also the Head of a Level 2 group[\\[1\\]](#_ftn1) is to be read as requiring that regulated institution to ensure that the requirement is applied appropriately throughout the Level 2 group.[\\[2\\]](#_ftn2)\n\n4. All regulated institutions have to comply with this Prudential Standard in its entirety, unless otherwise expressly indicated. The obligations imposed by this Prudential Standard on, or in relation to, a foreign ADI, a Category C insurer or an EFLIC apply only in relation to the Australian business of that institution.\n\n5. Nothing in this Prudential Standard prevents a regulated institution from adopting and applying a group policy used by a related body corporate[\\[3\\]](#_ftn3), provided that the policy has been approved by the Board[\\[4\\]](#_ftn4) and meets the requirements of this Prudential Standard.\n\n6. This Prudential Standard commences on 1 January 2013.\n\n## Interpretation\n\n7. Terms that are defined in Prudential Standard APS 001 Definitions (APS 001), Prudential Standard GPS 001 Definitions (GPS 001) or Prudential Standard LPS 001 Definitions (LPS 001) appear in bold the first time they are used in this Prudential Standard.\n\n8. A ‘Level 2 group’ is:\n\n(a) the consolidation of institutions defined as Level 2 in APS 001; or\n\n(b) a Level 2 insurance group as defined in GPS 001.\n\n9. The ‘Head of a Level 2 group’ is :\n\n(a) where an ADI that is a member of a Level 2 group is not a subsidiary of an authorised banking NOHC or another ADI, that ADI;\n\n(b) where an ADI that is a member of a Level 2 group is a subsidiary of an authorised banking NOHC, that authorised banking NOHC; or\n\n(c) the parent entity of a Level 2 insurance group as defined in GPS 001.\n\n10. ‘Outsourcing’ involves a regulated institution entering into an arrangement with another party (including a related body corporate) to perform, on a continuing basis, a business activity that currently is, or could be, undertaken by the regulated institution itself.\n\n11. For the purposes of this Prudential Standard, ‘offshoring’ means the outsourcing by a regulated institution of a material business activity associated with its Australian business to a service provider[\\[5\\]](#_ftn5) (including a related body corporate) where the outsourced activity is to be conducted outside Australia. Offshoring includes arrangements where the service provider is incorporated in Australia, but the physical location of the outsourced activity is outside Australia. Offshoring does not include arrangements where the physical location of an outsourced activity is within Australia but the service provider is not incorporated in Australia.\n\n12. The international business of a Level 2 group does not constitute offshoring as defined in paragraph 11; therefore, the requirements of this Prudential Standard relating to offshoring do not apply to the international business of a Level 2 group. However, the Board of the Head of a Level 2 group must comply with any requirement relating to offshoring in respect of any other activity falling within the meaning of offshoring under this Prudential Standard.\n\n## Materiality\n\n13. This Prudential Standard only applies to the outsourcing of a material business activity as defined in this Prudential Standard.\n\n14. A ‘material business activity’ is one that has the potential, if disrupted, to have a significant impact on the regulated institution’s business operations or its ability to manage risks effectively, having regard to such factors as:\n\n(a) the financial and operational impact and impact on reputation of a failure of the service provider to perform over a given period of time;\n\n(b) the cost of the outsourcing arrangement as a share of total costs;\n\n(c) the degree of difficulty, including the time taken, in finding an alternative service provider or bringing the business activity in-house;\n\n(d) the ability of the regulated institution to meet regulatory requirements if there are problems with the service provider;\n\n(e) potential losses to the regulated institution’s customers and other affected parties in the event of a service provider failure; and\n\n(f) affiliation or other relationship between the regulated institution and the service provider.\n\n15. For the purposes of this Prudential Standard, the internal audit function is a material business activity.\n\n## The role of the Board and senior management\n\n16. A regulated institution must identify, assess, manage, mitigate and report on risks associated with outsourcing to ensure that it can meet its financial and service obligations to its depositors, policyholders and other stakeholders.\n\n17. A regulated institution must have procedures to ensure that all its relevant business units are made aware of, and have processes and control for monitoring compliance with, the outsourcing policy.\n\n18. The Board is ultimately responsible for any outsourcing of a material business activity undertaken by a regulated institution. Although outsourcing may result in the service provider having day-to-day managerial responsibility for a business activity, the regulated institution is responsible for complying with all prudential requirements that relate to the outsourced business activity.\n\n## Outsourcing policy\n\n19. The Board must approve the regulated institution’s outsourcing policy, which must set out its approach to outsourcing of material business activities, including a detailed framework for managing all such outsourcing arrangements.\n\n20. The Board of the Head of a Level 2 group must have an outsourcing policy that includes a strategy for the outsourcing of material business activities for both Australian and international businesses of the Level 2 group.\n\n21. The Board must ensure that the regulated institution’s outsourcing risks and controls are taken into account as part of its overall risk management systems and when completing a risk management declaration required to be provided to APRA.[\\[6\\]](#_ftn6)\n\n22. A regulated institution’s outsourcing policy must set out specific requirements in relation to outsourcing to related bodies corporate and outsourcing to service providers conducting the material business activity outside Australia.\n\n## Assessment of outsourcing options\n\n23. A regulated institution must be able to demonstrate to APRA that, in assessing the options for outsourcing a material business activity to a ‘third-party’[\\[7\\]](#_ftn7), it has:\n\n(a) prepared a business case for outsourcing the material business activity;\n\n(b) undertaken a tender or other selection process for service providers;\n\n(c) undertaken a due diligence review of the chosen service provider;\n\n(d) involved the Board, Board committee, or senior manager with delegated authority from the Board, in approving the agreement;\n\n(e) considered all the matters outlined in paragraph 26, that must, at a minimum, be included in the outsourcing agreement itself;\n\n(f) established procedures for monitoring performance under the outsourcing agreement on a continuing basis;\n\n(g) addressed the renewal process for outsourcing agreements and how the renewal will be conducted; and\n\n(h) developed contingency plans that would enable the outsourced business activity to be provided by an alternative service provider or brought in-house if required.\n\n24. A regulated institution must be able to demonstrate to APRA that, in assessing the options for outsourcing to related bodies corporate, it has taken into account:\n\n(a) the changes to the risk profile of the business activity that arise from outsourcing the activity to a related body corporate and how this changed risk profile is addressed within the regulated institution’s risk management framework;\n\n(b) that the related body corporate has the ability to conduct the business activity on an ongoing basis;\n\n(c) the required monitoring procedures to ensure that the related body corporate is performing effectively and how potential inadequate performance would be addressed;\n\n(d) contingency issues in accordance with Prudential Standard CPS 232 Business Continuity Management (CPS 232) should the outsourced activity need to be brought in-house; and\n\n(e) the need to apply any of the requirements set out in paragraph 23 to the extent they are relevant to outsourcing agreements with related bodies corporate.\n\n## The outsourcing agreement\n\n25. Except where otherwise provided in this Prudential Standard, all outsourcing arrangements must be contained in a documented legally binding agreement. The agreement must be signed by all parties to it before the outsourcing arrangement commences.\n\n26. At a minimum, the agreement (including arrangements with related bodies corporate) must address the following matters:\n\n(a) the scope of the arrangement and services to be supplied;\n\n(b) commencement and end dates;\n\n(c) review provisions;\n\n(d) pricing and fee structure;\n\n(e) service levels and performance requirements;\n\n(f) audit and monitoring procedures;\n\n(g) business continuity management;\n\n(h) confidentiality, privacy and security of information;\n\n(i) default arrangements and termination provisions;\n\n(j) dispute resolution arrangements;\n\n(k) liability and indemnity;\n\n(l) sub-contracting;\n\n(m) insurance; and\n\n(n) to the extent applicable, offshoring arrangements (including through sub-contracting).\n\n27. A regulated institution that outsources a material business activity must ensure that its outsourcing agreement includes an indemnity to the effect that any sub-contracting by a third-party service provider of the outsourced function will be the responsibility of the third-party service provider, including liability for any failure on the part of the sub-contractor.\n\n28. The requirements in paragraph 25 do not apply to an outsourcing arrangement with a related body corporate unless:\n\n(a) after having consulted with the regulated institution, APRA notifies the regulated institution, in writing, that the outsourcing arrangement must be evidenced by a documented legally binding agreement;\n\n(b) another prudential standard requires the arrangement to be undertaken under a documented legally binding agreement; or\n\n(c) in the case of a general insurer, the outsourcing arrangement is between a Category D insurer[\\[8\\]](#_ftn8) and a related body corporate.\n\n29. Where a foreign ADI, Category C insurer or EFLIC enters into an outsourcing arrangement with its head office, the requirements of subparagraph 24(d) and 25 do not apply.\n\n30. Where a regulated institution enters into an outsourcing agreement as a result of an unexpected extreme event that results in:\n\n(a) the regulated institution invoking its Business Continuity Plan[\\[9\\]](#_ftn9); or\n\n(b) the sudden financial or operational failure of an existing service provider,\n\nthen paragraphs 23 to 28 inclusive, 34 and 35 need be complied with only to the extent that is reasonably possible having regard to the nature of the extreme event. The regulated institution must notify APRA as soon as practicable of any such outsourcing arrangement.\n\n## APRA access to service providers\n\n31. An outsourcing agreement must include a clause that allows APRA access to documentation and information related to the outsourcing arrangement. In the normal course, APRA will seek to obtain whatever information it requires from the regulated institution; however, the outsourcing agreement must include the right for APRA to conduct on-site visits to the service provider if APRA considers this necessary in its role as prudential supervisor. APRA expects service providers to cooperate with APRA’s requests for information and assistance. If APRA intends to undertake an on-site visit to a service provider, it will normally inform the regulated institution of its intention to do so.\n\n32. Where a regulated institution enters into an outsourcing arrangement with a related body corporate, the Board of the regulated institution must ensure that access by APRA to the related body corporate is not impeded.\n\n33. The regulated institution must take all reasonable steps to ensure that a service provider will not disclose or advertise that APRA has conducted an on-site visit, except as necessary to coordinate with other institutions regulated by APRA that are existing clients of the service provider.\n\n## Notification requirement\n\n34. A regulated institution must notify APRA as soon as possible after entering into an outsourcing agreement, and in any event no later than 20 business days after execution of the outsourcing agreement. This notification requirement applies to all outsourcing of material business activities.\n\n35. When a regulated institution notifies APRA of a new outsourcing agreement, it must also provide a summary to APRA of the key risks involved in the outsourcing arrangement and the risk mitigation strategies put in place to address these risks. APRA may request additional material where it considers it necessary in order to assess the impact of the outsourcing arrangement on the regulated institution’s risk profile.\n\n## Offshoring arrangements – requirement for consultation\n\n36. A regulated institution must consult with APRA prior to entering into any offshoring agreement involving a material business activity so that APRA may satisfy itself that the impact of the offshoring arrangement has been adequately addressed as part of the regulated institution’s risk management framework.\n\n37. If, in APRA’s view, the offshoring agreement involves risks that the regulated institution is not managing appropriately, APRA may require the regulated institution to make other arrangements for the outsourced activity as soon as practicable.\n\n## Monitoring the relationship\n\n38. A regulated institution must ensure it has sufficient and appropriate resources to manage and monitor the outsourcing relationship at all times. The type and extent of resources required will depend on the materiality of the outsourced business activity. At a minimum, monitoring must include:\n\n(a) maintaining appropriate levels of regular contact with the service provider. This will range from daily operational contact to senior management involvement; and\n\n(b) a process for regular monitoring of performance under the agreement, including meeting criteria concerning service levels.\n\n39. A regulated institution must advise APRA of any significant problems that have the potential materially to affect the outsourcing arrangement and, as a consequence, materially affect the business operations, profitability or reputation of the regulated institution.\n\n40. Where an outsourcing agreement is terminated, a regulated institution must notify APRA as soon as practicable and provide a statement about the transition arrangements and future strategies for carrying out the outsourced material business activity.\n\n## Audit arrangements\n\n41. A regulated institution’s internal audit function must review any proposed outsourcing of a material business activity and regularly review and report to the Board or Board Audit Committee on compliance with the regulated institution’s outsourcing policy. Where APRA has exempted a regulated institution from having a dedicated internal audit function, or approved alternative arrangements under CPS 510, APRA may also vary the requirements of this paragraph.\n\n42. APRA may request the external auditor of a regulated institution, or an appropriate external expert, to provide an assessment of the risk management processes in place with respect to an arrangement to outsource a material business activity. This could cover areas such as information technology systems, data security, internal control frameworks and business continuity plans. Such reports will be paid for by the regulated institution and must be made available to APRA.\n\n## Adjustments and exclusions\n\n43. APRA may, by notice in writing to a regulated institution, adjust or exclude a specific prudential requirement in this Prudential Standard in relation to that regulated institution.[\\[10\\]](#_ftn10)\n\n## Determinations made under previous prudential standards\n\n44. An exercise of APRA’s discretion (such as an approval, waiver or direction) under a previous version of this Prudential Standard continues to have effect as though exercised pursuant to a corresponding power (if any) exercisable by APRA under this Prudential Standard.\n\nFor the purposes of this paragraph, ‘a previous version of this Prudential Standard’ includes:\n\n(a) Prudential Standard APS 231 Outsourcing made on 29 September 2006, as amended;\n\n(b) Prudential Standard GPS 231 Outsourcing made on 23 June 2008;\n\n(c) Prudential Standard LPS 231 Outsourcing made on 29 September 2006, as amended;\n\n(d) Prudential Standard GPS 221 Risk Management: Level 2 Insurance Groups (GPS 221) made on 17 December 2008, to the extent that GPS 221 related to outsourcing; and\n\n(e) Prudential Standard CPS 231 Outsourcing made on 9 September 2011.","sortOrder":0},{"sectionNumber":"Outsourcing","sectionType":"part","heading":"Outsourcing","content":"## Outsourcing\n\n### Objective and key requirements of this Prudential Standard\n\nThis Prudential Standard requires that all outsourcing arrangements involving material business activities entered into by an APRA-regulated institution be subject to appropriate due diligence, approval and ongoing monitoring. All risks arising from outsourcing material business activities must be appropriately managed to ensure that the regulated institution is able to meet its financial and service obligations to its depositors and/or policyholders.\n\nThe ultimate responsibility for the outsourcing policy of an APRA-regulated institution (or of the members of a Level 2 group) rests with its Board of directors (or equivalent).\n\nThe key requirements of this Prudential Standard are that a regulated institution must:\n\n-   have a policy, approved by the Board, relating to outsourcing of material business activities;\n-   have sufficient monitoring processes in place to manage the outsourcing of material business activities;\n-   for all outsourcing of material business activities with third parties, have a legally binding agreement in place, unless otherwise agreed by APRA;\n-   consult with APRA prior to entering into agreements to outsource material business activities to service providers that conduct their activities outside Australia; and\n-   notify APRA after entering into agreements to outsource material business activities.\n\nWhere a regulated institution is the Head of a Level 2 group, this Prudential Standard requires that any outsourcing arrangements involving material business activities entered into by members of the group must be subject to appropriate due diligence, approval and on-going monitoring, and the provisions of this Prudential Standard must be are applied appropriately throughout the group.\n\n##   \nAuthority\n\n1.  This Prudential Standard is made under:\n\n(a) section 11AF of the Banking Act 1959 (Banking Act) in relation to authorised deposit‑taking institutions (ADIs) and non‑operating holding companies authorised under the Banking Act (authorised banking NOHCs);\n\n(b) section 32 of the Insurance Act 1973 (Insurance Act) in relation to general insurers and non‑operating holding companies authorised under the Insurance Act (authorised insurance NOHCs) and parent entities of Level 2 insurance groups; and\n\n(c) section 230A of the Life Insurance Act 1995 (Life Insurance Act) in relation to life companies, including friendly societies, and non‑operating holding companies registered under the Life Insurance Act (registered life NOHCs).\n\n## Application\n\n2. This Prudential Standard applies to:\n\n(a) all ADIs, including foreign ADIs, and authorised banking NOHCs;\n\n(b) all general insurers, including Category C insurers, authorised insurance NOHCs and parent entities of Level 2 insurance groups; and\n\n(c) all life companies, including friendly societies and eligible foreign life insurance companies (EFLICs), and registered life NOHCs.\n\nThese institutions are collectively referred to as ‘regulated institutions’ in this Prudential Standard.\n\n3. A requirement imposed upon a regulated institution that is also the Head of a Level 2 group[\\[1\\]](#_ftn1) is to be read as requiring that regulated institution to ensure that the requirement is applied appropriately throughout the Level 2 group.[\\[2\\]](#_ftn2)\n\n4. All regulated institutions have to comply with this Prudential Standard in its entirety, unless otherwise expressly indicated. The obligations imposed by this Prudential Standard on, or in relation to, a foreign ADI, a Category C insurer or an EFLIC apply only in relation to the Australian business of that institution.\n\n5. Nothing in this Prudential Standard prevents a regulated institution from adopting and applying a group policy used by a related body corporate[\\[3\\]](#_ftn3), provided that the policy has been approved by the Board[\\[4\\]](#_ftn4) and meets the requirements of this Prudential Standard.\n\n6. This Prudential Standard commences on 1 January 2013.\n\n## Interpretation\n\n7. Terms that are defined in Prudential Standard APS 001 Definitions (APS 001), Prudential Standard GPS 001 Definitions (GPS 001) or Prudential Standard LPS 001 Definitions (LPS 001) appear in bold the first time they are used in this Prudential Standard.\n\n8. A ‘Level 2 group’ is:\n\n(a) the consolidation of institutions defined as Level 2 in APS 001; or\n\n(b) a Level 2 insurance group as defined in GPS 001.\n\n9. The ‘Head of a Level 2 group’ is :\n\n(a) where an ADI that is a member of a Level 2 group is not a subsidiary of an authorised banking NOHC or another ADI, that ADI;\n\n(b) where an ADI that is a member of a Level 2 group is a subsidiary of an authorised banking NOHC, that authorised banking NOHC; or\n\n(c) the parent entity of a Level 2 insurance group as defined in GPS 001.\n\n10. ‘Outsourcing’ involves a regulated institution entering into an arrangement with another party (including a related body corporate) to perform, on a continuing basis, a business activity that currently is, or could be, undertaken by the regulated institution itself.\n\n11. For the purposes of this Prudential Standard, ‘offshoring’ means the outsourcing by a regulated institution of a material business activity associated with its Australian business to a service provider[\\[5\\]](#_ftn5) (including a related body corporate) where the outsourced activity is to be conducted outside Australia. Offshoring includes arrangements where the service provider is incorporated in Australia, but the physical location of the outsourced activity is outside Australia. Offshoring does not include arrangements where the physical location of an outsourced activity is within Australia but the service provider is not incorporated in Australia.\n\n12. The international business of a Level 2 group does not constitute offshoring as defined in paragraph 11; therefore, the requirements of this Prudential Standard relating to offshoring do not apply to the international business of a Level 2 group. However, the Board of the Head of a Level 2 group must comply with any requirement relating to offshoring in respect of any other activity falling within the meaning of offshoring under this Prudential Standard.\n\n## Materiality\n\n13. This Prudential Standard only applies to the outsourcing of a material business activity as defined in this Prudential Standard.\n\n14. A ‘material business activity’ is one that has the potential, if disrupted, to have a significant impact on the regulated institution’s business operations or its ability to manage risks effectively, having regard to such factors as:\n\n(a) the financial and operational impact and impact on reputation of a failure of the service provider to perform over a given period of time;\n\n(b) the cost of the outsourcing arrangement as a share of total costs;\n\n(c) the degree of difficulty, including the time taken, in finding an alternative service provider or bringing the business activity in-house;\n\n(d) the ability of the regulated institution to meet regulatory requirements if there are problems with the service provider;\n\n(e) potential losses to the regulated institution’s customers and other affected parties in the event of a service provider failure; and\n\n(f) affiliation or other relationship between the regulated institution and the service provider.\n\n15. For the purposes of this Prudential Standard, the internal audit function is a material business activity.\n\n## The role of the Board and senior management\n\n16. A regulated institution must identify, assess, manage, mitigate and report on risks associated with outsourcing to ensure that it can meet its financial and service obligations to its depositors, policyholders and other stakeholders.\n\n17. A regulated institution must have procedures to ensure that all its relevant business units are made aware of, and have processes and control for monitoring compliance with, the outsourcing policy.\n\n18. The Board is ultimately responsible for any outsourcing of a material business activity undertaken by a regulated institution. Although outsourcing may result in the service provider having day-to-day managerial responsibility for a business activity, the regulated institution is responsible for complying with all prudential requirements that relate to the outsourced business activity.\n\n## Outsourcing policy\n\n19. The Board must approve the regulated institution’s outsourcing policy, which must set out its approach to outsourcing of material business activities, including a detailed framework for managing all such outsourcing arrangements.\n\n20. The Board of the Head of a Level 2 group must have an outsourcing policy that includes a strategy for the outsourcing of material business activities for both Australian and international businesses of the Level 2 group.\n\n21. The Board must ensure that the regulated institution’s outsourcing risks and controls are taken into account as part of its overall risk management systems and when completing a risk management declaration required to be provided to APRA.[\\[6\\]](#_ftn6)\n\n22. A regulated institution’s outsourcing policy must set out specific requirements in relation to outsourcing to related bodies corporate and outsourcing to service providers conducting the material business activity outside Australia.\n\n## Assessment of outsourcing options\n\n23. A regulated institution must be able to demonstrate to APRA that, in assessing the options for outsourcing a material business activity to a ‘third-party’[\\[7\\]](#_ftn7), it has:\n\n(a) prepared a business case for outsourcing the material business activity;\n\n(b) undertaken a tender or other selection process for service providers;\n\n(c) undertaken a due diligence review of the chosen service provider;\n\n(d) involved the Board, Board committee, or senior manager with delegated authority from the Board, in approving the agreement;\n\n(e) considered all the matters outlined in paragraph 26, that must, at a minimum, be included in the outsourcing agreement itself;\n\n(f) established procedures for monitoring performance under the outsourcing agreement on a continuing basis;\n\n(g) addressed the renewal process for outsourcing agreements and how the renewal will be conducted; and\n\n(h) developed contingency plans that would enable the outsourced business activity to be provided by an alternative service provider or brought in-house if required.\n\n24. A regulated institution must be able to demonstrate to APRA that, in assessing the options for outsourcing to related bodies corporate, it has taken into account:\n\n(a) the changes to the risk profile of the business activity that arise from outsourcing the activity to a related body corporate and how this changed risk profile is addressed within the regulated institution’s risk management framework;\n\n(b) that the related body corporate has the ability to conduct the business activity on an ongoing basis;\n\n(c) the required monitoring procedures to ensure that the related body corporate is performing effectively and how potential inadequate performance would be addressed;\n\n(d) contingency issues in accordance with Prudential Standard CPS 232 Business Continuity Management (CPS 232) should the outsourced activity need to be brought in-house; and\n\n(e) the need to apply any of the requirements set out in paragraph 23 to the extent they are relevant to outsourcing agreements with related bodies corporate.\n\n## The outsourcing agreement\n\n25. Except where otherwise provided in this Prudential Standard, all outsourcing arrangements must be contained in a documented legally binding agreement. The agreement must be signed by all parties to it before the outsourcing arrangement commences.\n\n26. At a minimum, the agreement (including arrangements with related bodies corporate) must address the following matters:\n\n(a) the scope of the arrangement and services to be supplied;\n\n(b) commencement and end dates;\n\n(c) review provisions;\n\n(d) pricing and fee structure;\n\n(e) service levels and performance requirements;\n\n(f) audit and monitoring procedures;\n\n(g) business continuity management;\n\n(h) confidentiality, privacy and security of information;\n\n(i) default arrangements and termination provisions;\n\n(j) dispute resolution arrangements;\n\n(k) liability and indemnity;\n\n(l) sub-contracting;\n\n(m) insurance; and\n\n(n) to the extent applicable, offshoring arrangements (including through sub-contracting).\n\n27. A regulated institution that outsources a material business activity must ensure that its outsourcing agreement includes an indemnity to the effect that any sub-contracting by a third-party service provider of the outsourced function will be the responsibility of the third-party service provider, including liability for any failure on the part of the sub-contractor.\n\n28. The requirements in paragraph 25 do not apply to an outsourcing arrangement with a related body corporate unless:\n\n(a) after having consulted with the regulated institution, APRA notifies the regulated institution, in writing, that the outsourcing arrangement must be evidenced by a documented legally binding agreement;\n\n(b) another prudential standard requires the arrangement to be undertaken under a documented legally binding agreement; or\n\n(c) in the case of a general insurer, the outsourcing arrangement is between a Category D insurer[\\[8\\]](#_ftn8) and a related body corporate.\n\n29. Where a foreign ADI, Category C insurer or EFLIC enters into an outsourcing arrangement with its head office, the requirements of subparagraph 24(d) and 25 do not apply.\n\n30. Where a regulated institution enters into an outsourcing agreement as a result of an unexpected extreme event that results in:\n\n(a) the regulated institution invoking its Business Continuity Plan[\\[9\\]](#_ftn9); or\n\n(b) the sudden financial or operational failure of an existing service provider,\n\nthen paragraphs 23 to 28 inclusive, 34 and 35 need be complied with only to the extent that is reasonably possible having regard to the nature of the extreme event. The regulated institution must notify APRA as soon as practicable of any such outsourcing arrangement.\n\n## APRA access to service providers\n\n31. An outsourcing agreement must include a clause that allows APRA access to documentation and information related to the outsourcing arrangement. In the normal course, APRA will seek to obtain whatever information it requires from the regulated institution; however, the outsourcing agreement must include the right for APRA to conduct on-site visits to the service provider if APRA considers this necessary in its role as prudential supervisor. APRA expects service providers to cooperate with APRA’s requests for information and assistance. If APRA intends to undertake an on-site visit to a service provider, it will normally inform the regulated institution of its intention to do so.\n\n32. Where a regulated institution enters into an outsourcing arrangement with a related body corporate, the Board of the regulated institution must ensure that access by APRA to the related body corporate is not impeded.\n\n33. The regulated institution must take all reasonable steps to ensure that a service provider will not disclose or advertise that APRA has conducted an on-site visit, except as necessary to coordinate with other institutions regulated by APRA that are existing clients of the service provider.\n\n## Notification requirement\n\n34. A regulated institution must notify APRA as soon as possible after entering into an outsourcing agreement, and in any event no later than 20 business days after execution of the outsourcing agreement. This notification requirement applies to all outsourcing of material business activities.\n\n35. When a regulated institution notifies APRA of a new outsourcing agreement, it must also provide a summary to APRA of the key risks involved in the outsourcing arrangement and the risk mitigation strategies put in place to address these risks. APRA may request additional material where it considers it necessary in order to assess the impact of the outsourcing arrangement on the regulated institution’s risk profile.\n\n## Offshoring arrangements – requirement for consultation\n\n36. A regulated institution must consult with APRA prior to entering into any offshoring agreement involving a material business activity so that APRA may satisfy itself that the impact of the offshoring arrangement has been adequately addressed as part of the regulated institution’s risk management framework.\n\n37. If, in APRA’s view, the offshoring agreement involves risks that the regulated institution is not managing appropriately, APRA may require the regulated institution to make other arrangements for the outsourced activity as soon as practicable.\n\n## Monitoring the relationship\n\n38. A regulated institution must ensure it has sufficient and appropriate resources to manage and monitor the outsourcing relationship at all times. The type and extent of resources required will depend on the materiality of the outsourced business activity. At a minimum, monitoring must include:\n\n(a) maintaining appropriate levels of regular contact with the service provider. This will range from daily operational contact to senior management involvement; and\n\n(b) a process for regular monitoring of performance under the agreement, including meeting criteria concerning service levels.\n\n39. A regulated institution must advise APRA of any significant problems that have the potential materially to affect the outsourcing arrangement and, as a consequence, materially affect the business operations, profitability or reputation of the regulated institution.\n\n40. Where an outsourcing agreement is terminated, a regulated institution must notify APRA as soon as practicable and provide a statement about the transition arrangements and future strategies for carrying out the outsourced material business activity.\n\n## Audit arrangements\n\n41. A regulated institution’s internal audit function must review any proposed outsourcing of a material business activity and regularly review and report to the Board or Board Audit Committee on compliance with the regulated institution’s outsourcing policy. Where APRA has exempted a regulated institution from having a dedicated internal audit function, or approved alternative arrangements under CPS 510, APRA may also vary the requirements of this paragraph.\n\n42. APRA may request the external auditor of a regulated institution, or an appropriate external expert, to provide an assessment of the risk management processes in place with respect to an arrangement to outsource a material business activity. This could cover areas such as information technology systems, data security, internal control frameworks and business continuity plans. Such reports will be paid for by the regulated institution and must be made available to APRA.\n\n## Adjustments and exclusions\n\n43. APRA may, by notice in writing to a regulated institution, adjust or exclude a specific prudential requirement in this Prudential Standard in relation to that regulated institution.[\\[10\\]](#_ftn10)\n\n## Determinations made under previous prudential standards\n\n44. An exercise of APRA’s discretion (such as an approval, waiver or direction) under a previous version of this Prudential Standard continues to have effect as though exercised pursuant to a corresponding power (if any) exercisable by APRA under this Prudential Standard.\n\nFor the purposes of this paragraph, ‘a previous version of this Prudential Standard’ includes:\n\n(a) Prudential Standard APS 231 Outsourcing made on 29 September 2006, as amended;\n\n(b) Prudential Standard GPS 231 Outsourcing made on 23 June 2008;\n\n(c) Prudential Standard LPS 231 Outsourcing made on 29 September 2006, as amended;\n\n(d) Prudential Standard GPS 221 Risk Management: Level 2 Insurance Groups (GPS 221) made on 17 December 2008, to the extent that GPS 221 related to outsourcing; and\n\n(e) Prudential Standard CPS 231 Outsourcing made on 9 September 2011.","sortOrder":1},{"sectionNumber":"Objective and key requirements of this P","sectionType":"division","heading":"Objective and key requirements of this Prudential Standard","content":"### Objective and key requirements of this Prudential Standard\n\nThis Prudential Standard requires that all outsourcing arrangements involving material business activities entered into by an APRA-regulated institution be subject to appropriate due diligence, approval and ongoing monitoring. All risks arising from outsourcing material business activities must be appropriately managed to ensure that the regulated institution is able to meet its financial and service obligations to its depositors and/or policyholders.\n\nThe ultimate responsibility for the outsourcing policy of an APRA-regulated institution (or of the members of a Level 2 group) rests with its Board of directors (or equivalent).\n\nThe key requirements of this Prudential Standard are that a regulated institution must:\n\n-   have a policy, approved by the Board, relating to outsourcing of material business activities;\n-   have sufficient monitoring processes in place to manage the outsourcing of material business activities;\n-   for all outsourcing of material business activities with third parties, have a legally binding agreement in place, unless otherwise agreed by APRA;\n-   consult with APRA prior to entering into agreements to outsource material business activities to service providers that conduct their activities outside Australia; and\n-   notify APRA after entering into agreements to outsource material business activities.\n\nWhere a regulated institution is the Head of a Level 2 group, this Prudential Standard requires that any outsourcing arrangements involving material business activities entered into by members of the group must be subject to appropriate due diligence, approval and on-going monitoring, and the provisions of this Prudential Standard must be are applied appropriately throughout the group.","sortOrder":2},{"sectionNumber":"Authority","sectionType":"part","heading":"Authority","content":"##   \nAuthority\n\n1.  This Prudential Standard is made under:\n\n(a) section 11AF of the Banking Act 1959 (Banking Act) in relation to authorised deposit‑taking institutions (ADIs) and non‑operating holding companies authorised under the Banking Act (authorised banking NOHCs);\n\n(b) section 32 of the Insurance Act 1973 (Insurance Act) in relation to general insurers and non‑operating holding companies authorised under the Insurance Act (authorised insurance NOHCs) and parent entities of Level 2 insurance groups; and\n\n(c) section 230A of the Life Insurance Act 1995 (Life Insurance Act) in relation to life companies, including friendly societies, and non‑operating holding companies registered under the Life Insurance Act (registered life NOHCs).","sortOrder":3},{"sectionNumber":"Application","sectionType":"part","heading":"Application","content":"## Application\n\n2. This Prudential Standard applies to:\n\n(a) all ADIs, including foreign ADIs, and authorised banking NOHCs;\n\n(b) all general insurers, including Category C insurers, authorised insurance NOHCs and parent entities of Level 2 insurance groups; and\n\n(c) all life companies, including friendly societies and eligible foreign life insurance companies (EFLICs), and registered life NOHCs.\n\nThese institutions are collectively referred to as ‘regulated institutions’ in this Prudential Standard.\n\n3. A requirement imposed upon a regulated institution that is also the Head of a Level 2 group[\\[1\\]](#_ftn1) is to be read as requiring that regulated institution to ensure that the requirement is applied appropriately throughout the Level 2 group.[\\[2\\]](#_ftn2)\n\n4. All regulated institutions have to comply with this Prudential Standard in its entirety, unless otherwise expressly indicated. The obligations imposed by this Prudential Standard on, or in relation to, a foreign ADI, a Category C insurer or an EFLIC apply only in relation to the Australian business of that institution.\n\n5. Nothing in this Prudential Standard prevents a regulated institution from adopting and applying a group policy used by a related body corporate[\\[3\\]](#_ftn3), provided that the policy has been approved by the Board[\\[4\\]](#_ftn4) and meets the requirements of this Prudential Standard.\n\n6. This Prudential Standard commences on 1 January 2013.","sortOrder":4},{"sectionNumber":"Interpretation","sectionType":"part","heading":"Interpretation","content":"## Interpretation\n\n7. Terms that are defined in Prudential Standard APS 001 Definitions (APS 001), Prudential Standard GPS 001 Definitions (GPS 001) or Prudential Standard LPS 001 Definitions (LPS 001) appear in bold the first time they are used in this Prudential Standard.\n\n8. A ‘Level 2 group’ is:\n\n(a) the consolidation of institutions defined as Level 2 in APS 001; or\n\n(b) a Level 2 insurance group as defined in GPS 001.\n\n9. The ‘Head of a Level 2 group’ is :\n\n(a) where an ADI that is a member of a Level 2 group is not a subsidiary of an authorised banking NOHC or another ADI, that ADI;\n\n(b) where an ADI that is a member of a Level 2 group is a subsidiary of an authorised banking NOHC, that authorised banking NOHC; or\n\n(c) the parent entity of a Level 2 insurance group as defined in GPS 001.\n\n10. ‘Outsourcing’ involves a regulated institution entering into an arrangement with another party (including a related body corporate) to perform, on a continuing basis, a business activity that currently is, or could be, undertaken by the regulated institution itself.\n\n11. For the purposes of this Prudential Standard, ‘offshoring’ means the outsourcing by a regulated institution of a material business activity associated with its Australian business to a service provider[\\[5\\]](#_ftn5) (including a related body corporate) where the outsourced activity is to be conducted outside Australia. Offshoring includes arrangements where the service provider is incorporated in Australia, but the physical location of the outsourced activity is outside Australia. Offshoring does not include arrangements where the physical location of an outsourced activity is within Australia but the service provider is not incorporated in Australia.\n\n12. The international business of a Level 2 group does not constitute offshoring as defined in paragraph 11; therefore, the requirements of this Prudential Standard relating to offshoring do not apply to the international business of a Level 2 group. However, the Board of the Head of a Level 2 group must comply with any requirement relating to offshoring in respect of any other activity falling within the meaning of offshoring under this Prudential Standard.","sortOrder":5},{"sectionNumber":"Materiality","sectionType":"part","heading":"Materiality","content":"## Materiality\n\n13. This Prudential Standard only applies to the outsourcing of a material business activity as defined in this Prudential Standard.\n\n14. A ‘material business activity’ is one that has the potential, if disrupted, to have a significant impact on the regulated institution’s business operations or its ability to manage risks effectively, having regard to such factors as:\n\n(a) the financial and operational impact and impact on reputation of a failure of the service provider to perform over a given period of time;\n\n(b) the cost of the outsourcing arrangement as a share of total costs;\n\n(c) the degree of difficulty, including the time taken, in finding an alternative service provider or bringing the business activity in-house;\n\n(d) the ability of the regulated institution to meet regulatory requirements if there are problems with the service provider;\n\n(e) potential losses to the regulated institution’s customers and other affected parties in the event of a service provider failure; and\n\n(f) affiliation or other relationship between the regulated institution and the service provider.\n\n15. For the purposes of this Prudential Standard, the internal audit function is a material business activity.","sortOrder":6},{"sectionNumber":"The role of the Board and senior managem","sectionType":"part","heading":"The role of the Board and senior management","content":"## The role of the Board and senior management\n\n16. A regulated institution must identify, assess, manage, mitigate and report on risks associated with outsourcing to ensure that it can meet its financial and service obligations to its depositors, policyholders and other stakeholders.\n\n17. A regulated institution must have procedures to ensure that all its relevant business units are made aware of, and have processes and control for monitoring compliance with, the outsourcing policy.\n\n18. The Board is ultimately responsible for any outsourcing of a material business activity undertaken by a regulated institution. Although outsourcing may result in the service provider having day-to-day managerial responsibility for a business activity, the regulated institution is responsible for complying with all prudential requirements that relate to the outsourced business activity.","sortOrder":7},{"sectionNumber":"Outsourcing policy","sectionType":"part","heading":"Outsourcing policy","content":"## Outsourcing policy\n\n19. The Board must approve the regulated institution’s outsourcing policy, which must set out its approach to outsourcing of material business activities, including a detailed framework for managing all such outsourcing arrangements.\n\n20. The Board of the Head of a Level 2 group must have an outsourcing policy that includes a strategy for the outsourcing of material business activities for both Australian and international businesses of the Level 2 group.\n\n21. The Board must ensure that the regulated institution’s outsourcing risks and controls are taken into account as part of its overall risk management systems and when completing a risk management declaration required to be provided to APRA.[\\[6\\]](#_ftn6)\n\n22. A regulated institution’s outsourcing policy must set out specific requirements in relation to outsourcing to related bodies corporate and outsourcing to service providers conducting the material business activity outside Australia.","sortOrder":8},{"sectionNumber":"Assessment of outsourcing options","sectionType":"part","heading":"Assessment of outsourcing options","content":"## Assessment of outsourcing options\n\n23. A regulated institution must be able to demonstrate to APRA that, in assessing the options for outsourcing a material business activity to a ‘third-party’[\\[7\\]](#_ftn7), it has:\n\n(a) prepared a business case for outsourcing the material business activity;\n\n(b) undertaken a tender or other selection process for service providers;\n\n(c) undertaken a due diligence review of the chosen service provider;\n\n(d) involved the Board, Board committee, or senior manager with delegated authority from the Board, in approving the agreement;\n\n(e) considered all the matters outlined in paragraph 26, that must, at a minimum, be included in the outsourcing agreement itself;\n\n(f) established procedures for monitoring performance under the outsourcing agreement on a continuing basis;\n\n(g) addressed the renewal process for outsourcing agreements and how the renewal will be conducted; and\n\n(h) developed contingency plans that would enable the outsourced business activity to be provided by an alternative service provider or brought in-house if required.\n\n24. A regulated institution must be able to demonstrate to APRA that, in assessing the options for outsourcing to related bodies corporate, it has taken into account:\n\n(a) the changes to the risk profile of the business activity that arise from outsourcing the activity to a related body corporate and how this changed risk profile is addressed within the regulated institution’s risk management framework;\n\n(b) that the related body corporate has the ability to conduct the business activity on an ongoing basis;\n\n(c) the required monitoring procedures to ensure that the related body corporate is performing effectively and how potential inadequate performance would be addressed;\n\n(d) contingency issues in accordance with Prudential Standard CPS 232 Business Continuity Management (CPS 232) should the outsourced activity need to be brought in-house; and\n\n(e) the need to apply any of the requirements set out in paragraph 23 to the extent they are relevant to outsourcing agreements with related bodies corporate.","sortOrder":9},{"sectionNumber":"The outsourcing agreement","sectionType":"part","heading":"The outsourcing agreement","content":"## The outsourcing agreement\n\n25. Except where otherwise provided in this Prudential Standard, all outsourcing arrangements must be contained in a documented legally binding agreement. The agreement must be signed by all parties to it before the outsourcing arrangement commences.\n\n26. At a minimum, the agreement (including arrangements with related bodies corporate) must address the following matters:\n\n(a) the scope of the arrangement and services to be supplied;\n\n(b) commencement and end dates;\n\n(c) review provisions;\n\n(d) pricing and fee structure;\n\n(e) service levels and performance requirements;\n\n(f) audit and monitoring procedures;\n\n(g) business continuity management;\n\n(h) confidentiality, privacy and security of information;\n\n(i) default arrangements and termination provisions;\n\n(j) dispute resolution arrangements;\n\n(k) liability and indemnity;\n\n(l) sub-contracting;\n\n(m) insurance; and\n\n(n) to the extent applicable, offshoring arrangements (including through sub-contracting).\n\n27. A regulated institution that outsources a material business activity must ensure that its outsourcing agreement includes an indemnity to the effect that any sub-contracting by a third-party service provider of the outsourced function will be the responsibility of the third-party service provider, including liability for any failure on the part of the sub-contractor.\n\n28. The requirements in paragraph 25 do not apply to an outsourcing arrangement with a related body corporate unless:\n\n(a) after having consulted with the regulated institution, APRA notifies the regulated institution, in writing, that the outsourcing arrangement must be evidenced by a documented legally binding agreement;\n\n(b) another prudential standard requires the arrangement to be undertaken under a documented legally binding agreement; or\n\n(c) in the case of a general insurer, the outsourcing arrangement is between a Category D insurer[\\[8\\]](#_ftn8) and a related body corporate.\n\n29. Where a foreign ADI, Category C insurer or EFLIC enters into an outsourcing arrangement with its head office, the requirements of subparagraph 24(d) and 25 do not apply.\n\n30. Where a regulated institution enters into an outsourcing agreement as a result of an unexpected extreme event that results in:\n\n(a) the regulated institution invoking its Business Continuity Plan[\\[9\\]](#_ftn9); or\n\n(b) the sudden financial or operational failure of an existing service provider,\n\nthen paragraphs 23 to 28 inclusive, 34 and 35 need be complied with only to the extent that is reasonably possible having regard to the nature of the extreme event. The regulated institution must notify APRA as soon as practicable of any such outsourcing arrangement.","sortOrder":10},{"sectionNumber":"APRA access to service providers","sectionType":"part","heading":"APRA access to service providers","content":"## APRA access to service providers\n\n31. An outsourcing agreement must include a clause that allows APRA access to documentation and information related to the outsourcing arrangement. In the normal course, APRA will seek to obtain whatever information it requires from the regulated institution; however, the outsourcing agreement must include the right for APRA to conduct on-site visits to the service provider if APRA considers this necessary in its role as prudential supervisor. APRA expects service providers to cooperate with APRA’s requests for information and assistance. If APRA intends to undertake an on-site visit to a service provider, it will normally inform the regulated institution of its intention to do so.\n\n32. Where a regulated institution enters into an outsourcing arrangement with a related body corporate, the Board of the regulated institution must ensure that access by APRA to the related body corporate is not impeded.\n\n33. The regulated institution must take all reasonable steps to ensure that a service provider will not disclose or advertise that APRA has conducted an on-site visit, except as necessary to coordinate with other institutions regulated by APRA that are existing clients of the service provider.","sortOrder":11},{"sectionNumber":"Notification requirement","sectionType":"part","heading":"Notification requirement","content":"## Notification requirement\n\n34. A regulated institution must notify APRA as soon as possible after entering into an outsourcing agreement, and in any event no later than 20 business days after execution of the outsourcing agreement. This notification requirement applies to all outsourcing of material business activities.\n\n35. When a regulated institution notifies APRA of a new outsourcing agreement, it must also provide a summary to APRA of the key risks involved in the outsourcing arrangement and the risk mitigation strategies put in place to address these risks. APRA may request additional material where it considers it necessary in order to assess the impact of the outsourcing arrangement on the regulated institution’s risk profile.","sortOrder":12},{"sectionNumber":"Offshoring arrangements — requirement fo","sectionType":"part","heading":"Offshoring arrangements — requirement for consultation","content":"## Offshoring arrangements – requirement for consultation\n\n36. A regulated institution must consult with APRA prior to entering into any offshoring agreement involving a material business activity so that APRA may satisfy itself that the impact of the offshoring arrangement has been adequately addressed as part of the regulated institution’s risk management framework.\n\n37. If, in APRA’s view, the offshoring agreement involves risks that the regulated institution is not managing appropriately, APRA may require the regulated institution to make other arrangements for the outsourced activity as soon as practicable.","sortOrder":13},{"sectionNumber":"Monitoring the relationship","sectionType":"part","heading":"Monitoring the relationship","content":"## Monitoring the relationship\n\n38. A regulated institution must ensure it has sufficient and appropriate resources to manage and monitor the outsourcing relationship at all times. The type and extent of resources required will depend on the materiality of the outsourced business activity. At a minimum, monitoring must include:\n\n(a) maintaining appropriate levels of regular contact with the service provider. This will range from daily operational contact to senior management involvement; and\n\n(b) a process for regular monitoring of performance under the agreement, including meeting criteria concerning service levels.\n\n39. A regulated institution must advise APRA of any significant problems that have the potential materially to affect the outsourcing arrangement and, as a consequence, materially affect the business operations, profitability or reputation of the regulated institution.\n\n40. Where an outsourcing agreement is terminated, a regulated institution must notify APRA as soon as practicable and provide a statement about the transition arrangements and future strategies for carrying out the outsourced material business activity.","sortOrder":14},{"sectionNumber":"Audit arrangements","sectionType":"part","heading":"Audit arrangements","content":"## Audit arrangements\n\n41. A regulated institution’s internal audit function must review any proposed outsourcing of a material business activity and regularly review and report to the Board or Board Audit Committee on compliance with the regulated institution’s outsourcing policy. Where APRA has exempted a regulated institution from having a dedicated internal audit function, or approved alternative arrangements under CPS 510, APRA may also vary the requirements of this paragraph.\n\n42. APRA may request the external auditor of a regulated institution, or an appropriate external expert, to provide an assessment of the risk management processes in place with respect to an arrangement to outsource a material business activity. This could cover areas such as information technology systems, data security, internal control frameworks and business continuity plans. Such reports will be paid for by the regulated institution and must be made available to APRA.","sortOrder":15},{"sectionNumber":"Adjustments and exclusions","sectionType":"part","heading":"Adjustments and exclusions","content":"## Adjustments and exclusions\n\n43. APRA may, by notice in writing to a regulated institution, adjust or exclude a specific prudential requirement in this Prudential Standard in relation to that regulated institution.[\\[10\\]](#_ftn10)","sortOrder":16},{"sectionNumber":"Determinations made under previous prude","sectionType":"part","heading":"Determinations made under previous prudential standards","content":"## Determinations made under previous prudential standards\n\n44. An exercise of APRA’s discretion (such as an approval, waiver or direction) under a previous version of this Prudential Standard continues to have effect as though exercised pursuant to a corresponding power (if any) exercisable by APRA under this Prudential Standard.\n\nFor the purposes of this paragraph, ‘a previous version of this Prudential Standard’ includes:\n\n(a) Prudential Standard APS 231 Outsourcing made on 29 September 2006, as amended;\n\n(b) Prudential Standard GPS 231 Outsourcing made on 23 June 2008;\n\n(c) Prudential Standard LPS 231 Outsourcing made on 29 September 2006, as amended;\n\n(d) Prudential Standard GPS 221 Risk Management: Level 2 Insurance Groups (GPS 221) made on 17 December 2008, to the extent that GPS 221 related to outsourcing; and\n\n(e) Prudential Standard CPS 231 Outsourcing made on 9 September 2011.","sortOrder":17}],"analysis":{"kimi_summary":{"_metrics":{"model":"kimi-k2.5","source":"moonshot-realtime","completionTokens":2705},"content_quality":"ok","complexity_score":6,"scope_assessment":{"changed":true,"description":"This standard consolidates previously separate industry-specific outsourcing standards (APS 231 for banking, GPS 231 for general insurance, LPS 231 for life insurance, and GPS 221 for insurance groups) into a single cross-industry prudential standard applying uniformly to all APRA-regulated institutions."},"complexity_factors":["14 mandatory contract elements listed in paragraph 26 including sub-contracting liability and offshoring provisions","8-factor materiality assessment test in paragraph 14 requiring subjective judgment on financial impact, reputational risk and replacement difficulty","Cross-references to 5 external prudential standards for defined terms (APS 001, GPS 001, LPS 001, CPS 232, CPS 510)","Nested exception structure for related body corporate arrangements (paragraph 28) with three alternative triggers","Conditional emergency exemption provisions (paragraph 30) that partially suspend compliance obligations based on 'extreme events'"],"plain_english_summary":"CPS 231 sets mandatory rules for APRA-regulated banks and insurers when they outsource material business activities, ensuring third-party arrangements don’t undermine depositor or policyholder protection. The Board remains ultimately responsible.\n\nInstitutions must have a Board-approved outsourcing policy, ensure written contracts and APRA access, consult APRA before offshoring, notify APRA of material deals, and actively monitor providers with contingency plans. Group intra-company deals face lighter paperwork; emergency responses are permitted with prompt APRA notification."},"flash_summary":{"complexity_score":7,"scope_assessment":{"changed":false,"description":"Based on the text, the Standard maintains a materiality‑based scope applying to ADIs, general insurers and life companies (including foreign entities limited to their Australian business) and imposes group‑level duties where there is a Level 2 group (paras 2–5, 11–12, 19–21). Paragraph 44 preserves prior approvals/waivers under earlier versions. The instrument therefore carries forward existing coverage and supervisory flexibility rather than changing scope materially."},"complexity_factors":["Materiality‑based scope — application depends on a fact‑intensive test of \"material business activity\" (para 14)","Multiple regulated classes and group layering — applies to ADIs, general insurers, life companies and Level 2 groups with Head‑of‑group duties (paras 2–3, 8–9, 19–21)","Cross‑references to other prudential standards and definitions (APS 001 / GPS 001 / LPS 001; CPS 232; CPS 510) increasing interdependence (paras 7, 21, 24(d), 41)","Board and senior management accountability combined with delegated approvals — mixes strategic and operational duties (paras 16–19, 23(d))","Detailed procedural requirements (business case, tender, due diligence, monitoring, contingency planning, contract minima) raising compliance burden (paras 23, 26, 23(h))","Differential treatment and exceptions for related bodies corporate, foreign ADIs, Category C/D insurers and EFLICs — multiple carve‑outs and tailored rules (paras 25–29)","Offshoring rules and prior consultation with APRA, plus APRA power to require alternative arrangements — supervisory intervention path (paras 11, 36–37)","APRA access and audit powers, plus requirements to fund external assessments on request — assigns direct costs to institutions (paras 31, 42)","Notification and reporting timelines (20 business days for notification; immediate reporting for significant problems) — operational timing constraints (paras 34–35, 39)","APRA discretion to adjust or exclude requirements and recognition of prior determinations — introduces case‑by‑case regulatory variability (paras 43–44)"],"plain_english_summary":"This Prudential Standard makes APRA‑regulated banks, general insurers and life companies treat outsourcing of any \"material business activity\" as a regulated risk: boards must approve an outsourcing policy, ensure due diligence, use legally binding contracts for third‑party outsourcings, monitor performance, notify APRA and (for offshoring) consult APRA beforehand. The regulated institution stays legally and prudentially responsible; it bears the compliance costs and must provide APRA rights of access, audit reports and the ability to vary or require alternative arrangements."}},"importantCases":[],"_links":{"self":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-1-of-2012-prudential-stand","history":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-1-of-2012-prudential-stand/history","analysis":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-1-of-2012-prudential-stand/analysis","conflicts":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-1-of-2012-prudential-stand/conflicts","importantCases":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-1-of-2012-prudential-stand/important-cases","documents":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-1-of-2012-prudential-stand/documents"}}