C4-4.3.10
Before entering into, or significantly changing, an outsourcing arrangement, a
(a) Analyse how the arrangement will fit with its organisation and reporting structure; business strategy; overall risk profile; and ability to meet its regulatory obligations;
(b) Consider whether the agreements establishing the arrangement will allow it to monitor and control its operational risk exposure relating to the outsourcing;
(c) Conduct appropriate due diligence of the service provider’s financial stability and expertise;
(d) Consider how it will ensure a smooth transition of its operations from its current arrangements to a new or changed outsourcing arrangement (including what will happen on the termination of the contract);
(e) Consider any concentration risk implications such as the business continuity implications that may arise if a single service provider is used by several firms; and
(f) Analyse the outsourcing provider’s financial soundness, its technical competence, its commitment to the arrangement, its reputation, its adherence to international standards, and the associated country risk.
Added: January 2022