Assessment of outsourcing optionsAssessment of outsourcing options

Assessment of outsourcing options

23. A regulated institution must be able to demonstrate to APRA that, in assessing the options for outsourcing a material business activity to a ‘third-party’[7], it has:

(a) prepared a business case for outsourcing the material business activity;

(b) undertaken a tender or other selection process for service providers;

(c) undertaken a due diligence review of the chosen service provider;

(d) involved the Board, Board committee, or senior manager with delegated authority from the Board, in approving the agreement;

(e) considered all the matters outlined in paragraph 26, that must, at a minimum, be included in the outsourcing agreement itself;

(f) established procedures for monitoring performance under the outsourcing agreement on a continuing basis;

(g) addressed the renewal process for outsourcing agreements and how the renewal will be conducted; and

(h) developed contingency plans that would enable the outsourced business activity to be provided by an alternative service provider or brought in-house if required.

24. A regulated institution must be able to demonstrate to APRA that, in assessing the options for outsourcing to related bodies corporate, it has taken into account:

(a) the changes to the risk profile of the business activity that arise from outsourcing the activity to a related body corporate and how this changed risk profile is addressed within the regulated institution’s risk management framework;

(b) that the related body corporate has the ability to conduct the business activity on an ongoing basis;

(c) the required monitoring procedures to ensure that the related body corporate is performing effectively and how potential inadequate performance would be addressed;

(d) contingency issues in accordance with Prudential Standard CPS 232 Business Continuity Management (CPS 232) should the outsourced activity need to be brought in-house; and

(e) the need to apply any of the requirements set out in paragraph 23 to the extent they are relevant to outsourcing agreements with related bodies corporate.