OM-3.4.2
The risk assessment should – amongst other things – include an analysis of:
(a) The business case;
(b) The suitability of the outsourcing provider; and
(c) The impact of the outsourcing on the licensee's overall risk profile and its systems and controls framework.
October 07