Once an outsourcing agreement has been entered into, the licensees must:

(a) Review, at least annually, the suitability of the outsourcing service provider and the on-going impact of the agreement on their risk profile and systems and controls framework; and
(b) Monitor the associated risks and the effectiveness of its mitigating controls.
Added: January 2020