Purpose
Ensure the correct internal approval and CBCS engagement path is completed before an outsourcing arrangement begins.
Scope
This procedure applies to outsourcing arrangements and material changes to outsourcing arrangements as defined in the Bitkaya Outsourcing Risk Management Manual.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Confirm the documented outsourcing classification and risk assessment | No outsourcing arrangement may begin without internal approval | Classification and risk assessment confirmation |
| 2 | Route standard outsourcing for approval under normal management authority | — | Standard outsourcing approval record |
| 3 | Route material outsourcing for enhanced review and management escalation | — | Material outsourcing escalation record |
| 4 | Route critical or essential outsourcing for senior escalation and prior CBCS approval | CBCS states that regulated entities must engage CBCS in a timely manner prior to outsourcing critical or essential functions and that prior approval for the outsourcing of these functions is required | Senior escalation and CBCS engagement record |
| 5 | Where required, seek CBCS permission at least 60 days before the proposed start date and submit the draft outsourcing agreement together with the required supporting information | — | CBCS permission request and draft agreement submission |
| 6 | For material outsourcing that is not critical or essential, assess whether supervisory dialogue or notification is appropriate | Based on the nature of the service, the risks involved, and any uncertainty regarding classification. Where doubt exists, Bitkaya may consult CBCS | Supervisory dialogue or notification assessment |
| 7 | If a large standardized provider does not meet all preferred terms, that does not automatically block the arrangement | But any important gap in a material or critical arrangement must be documented, assessed, and approved at the appropriate level | Gap assessment and approval record |
| 8 | Record the approval decision, approval date, conditions and CBCS correspondence in the register or evidence file | — | Approval decision record and CBCS correspondence |
Evidence
- approval record
- CBCS request or consultation record
- draft agreement submitted where applicable
- approval conditions
Relationships
- Requirements: REQ-OUT-002 Obtain CBCS Approval for Critical or Material Outsourcing, REQ-OUT-007 Maintain Outsourcing Governance and Accountability, REQ-OUT-010 Maintain Outsourcing Register and Compliance Notifications
- Process: PRC-GRO-001 Governance Risk and Outsourcing
- Controls: CTRL-OUT-001 Ensure Outsourcing Is Classified Before Engagement, CTRL-OUT-003 Ensure Required Approval and CBCS Engagement Is Completed, CTRL-OUT-008 Ensure CBCS Outsourcing Reporting Is Completed
- System: SYS-OUT-001 Outsourcing Register
- Publication: PUB-OUT-001 Outsourcing Risk Management Manual
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: drafted from approved manual
History
- 2026-07-25: Created procedure from the Bitkaya Outsourcing Risk Management Manual version 1.0.
- 2026-07-25: Set procedure status to implemented based on Board approval of the Outsourcing Risk Management Manual on 2026-04-16.