The outsourcing agreementThe outsourcing agreement

The outsourcing agreement

18. Except where otherwise provided, all outsourcing arrangements must be evidenced by a written, legally binding agreement. The agreement must be executed before the outsourcing arrangement commences.

19. At a minimum, the agreement (including arrangements with related bodies corporate) must address the following matters:

(a) the scope of the arrangement and services to be supplied;

(b) commencement and end dates;

(c) review provisions;

(d) pricing and fee structure;

(e) service levels and performance requirements;

(f) audit and monitoring procedures;

(g) business continuity management;

(h) confidentiality, privacy and security of information;

(i) default arrangements and termination provisions;

(j) dispute resolution arrangements;

(k) liability and indemnity;

(l) subcontracting;

(m) insurance; and

(n) to the extent applicable, offshoring arrangements (including through subcontracting).

20. An insurer that outsources a material business activity must ensure that its outsourcing agreement includes an indemnity to the effect that any subcontracting by a third party service provider of the outsourced function will be the responsibility of the third party service provider including liability for any failure on the part of the subcontractor.

21. The requirements in paragraph 18 do not apply to an outsourcing arrangement with a related body corporate unless:

(a) after having consulted with the insurer, APRA notifies the insurer, in writing, that the arrangement must be evidenced by a written legally binding agreement; or

(b) another prudential standard requires the arrangement to be undertaken using a written legally binding agreement.

22. Where an insurer enters into an outsourcing agreement as a result of an unexpected extreme event which results in:

(a) the insurer invoking its Business Continuity Plan;[3] or

(b) the sudden financial or operational failure of an existing service provider,

then paragraphs 16 to 21 inclusive, 26 and 27 need only complied with to the extent that is reasonably possible having regard to the nature of the extreme event. The insurer must notify APRA as soon as practicable of any such outsourcing arrangement.

APRA access to service providers

23. An outsourcing agreement must include a clause that allows APRA access to documentation related to the outsourcing arrangement. In the normal course, APRA will seek to obtain whatever information it requires from the insurer; however, the outsourcing agreement must include the right for APRA to conduct on-site visits to the service provider if APRA considers this necessary in its role as prudential supervisor. APRA expects service providers to cooperate with APRA’s requests for information and assistance. If APRA intends to undertake an on-site visit to a service provider, it will normally inform the insurer of its intention to do so.

24. Where an insurer enters into an outsourcing arrangement with a related body corporate, the Board of the insurer must ensure that access by APRA to the related body corporate will not be impeded.

25. The insurer must take all reasonable steps to ensure that a service provider will not disclose or advertise that APRA has conducted such a visit, except as necessary to coordinate with other institutions regulated by APRA which are existing clients of the service provider.