Banking (prudential standard) determination No. 12 of 2006 - Prudential Standard APS 231 - Outsourcing
Outsourcing policyOutsourcing policy
Start here
Get a plain-English read of Outsourcing policy
Turn the raw legal text into a practical explanation grounded in Banking (prudential standard) determination No. 12 of 2006 - Prudential Standard APS 231 - Outsourcing.
Outsourcing policy
-
An ADI must develop an outsourcing policy, approved by the Board,[1] that sets out its approach to outsourcing of material business activities, including a detailed framework for managing all such outsourcing arrangements.
-
Although outsourcing may result in day-to-day managerial responsibility for a business activity moving to the service provider, the ADI remains responsible for complying with all prudential requirements[2] that relate to the outsourced business activity.
-
An ADI must ensure that procedures are in place such that all relevant business units of the ADI are fully aware of, and comply with, the outsourcing policy.
-
The ADI’s risk management framework[3] must deal with the risks associated with the outsourcing of a material business activity.
-
An ADI’s outsourcing policy must deal with specific requirements in relation to outsourcing to related bodies corporate and outsourcing to service providers conducting the material business activity outside Australia.
Assessment of outsourcing options
- An ADI must be able to demonstrate that, in assessing the options for outsourcing a material business activity to a third party, it has:
(a) prepared a business case for outsourcing the material business activity;
(b) undertaken a tender or other selection process for service providers;
(c) undertaken a due diligence review of the chosen service provider;
(d) involved the Board, or Board committee or senior manager with delegated authority from the Board in approving the agreement;
(e) considered all the matters outlined in paragraph 20, that must, at a minimum, be included in the outsourcing agreement itself;
(f) established procedures for monitoring performance under the outsourcing agreement on a continuing basis;
(g) addressed the renewal process for outsourcing agreements and how the renewal will be conducted; and
(h) developed contingency plans that would enable the outsourced business activity to be provided by an alternative service provider or brought in-house if required.
- An ADI must be able to demonstrate that, in assessing the options for outsourcing to related bodies corporate, it has considered:
(a) the changes to the risk profile of the business activity that arise from outsourcing the activity to a related body corporate and how this changed risk profile is addressed within the ADI’s risk management framework;