The outsourcing agreementThe outsourcing agreement

The outsourcing agreement

18. Except where otherwise provided,[2] all outsourcing arrangements must be evidenced by a written, legally binding agreement. The agreement must be executed before the outsourcing arrangement commences.

19. At a minimum, the agreement (including arrangements with related bodies corporate[3]) must address the following matters:

(a) the scope of the arrangement and services to be supplied;

(b) commencement and end dates;

(c) review provisions;

(d) pricing and fee structure;

(e) service levels and performance requirements;

(f) audit and monitoring procedures;

(g) business continuity management;

(h) confidentiality, privacy and security of information;

(i) default arrangements and termination provisions;

(j) dispute resolution arrangements;

(k) liability and indemnity;

(l) subcontracting;

(m) insurance; and

(n) to the extent applicable, offshoring arrangements (including through subcontracting).

20. An insurer that outsources a material business activity must ensure that its outsourcing agreement includes an indemnity to the effect that any subcontracting by a third party service provider of the outsourced function will be the responsibility of the third party service provider including liability for any failure on the part of the subcontractor.

21. The requirements in paragraph 18 do not apply to an outsourcing arrangement with a related body corporate unless:

(a) the outsourcing arrangement is between a Category D insurer and a related body corporate;

(b) after having consulted with the insurer, APRA notifies the insurer, in writing, that the arrangement must be evidenced by a written legally binding agreement; or

(c) another prudential standard requires the arrangement to be undertaken using a written legally binding agreement.

22. Where an insurer enters into an outsourcing agreement as a result of an unexpected extreme event which results in:

(a) the insurer invoking its Business Continuity Plan;[4] or

(b) the sudden financial or operational failure of an existing service provider,

then paragraphs 16 to 21 inclusive, 26 and 27 need only complied with to the extent that is reasonably possible having regard to the nature of the extreme event. The insurer must notify APRA as soon as practicable of any such outsourcing arrangement.