Purpose
Monitor outsourced services proportionately so issues, provider changes and regulatory concerns are identified and escalated.
Scope
This procedure applies to outsourcing arrangements and material changes to outsourcing arrangements as defined in the Bitkaya Outsourcing Risk Management Manual.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Confirm the internal owner is assigned and the register entry remains current | Each outsourcing arrangement must be monitored by its internal owner | Owner assignment and register currency confirmation |
| 2 | Monitor service quality, issues or incidents, provider changes, legal or regulatory concerns, and assurance reports or certifications | Monitoring should be proportionate | Monitoring record |
| 3 | Collect assurance reports, certifications or provider notices where proportionate | For standardized providers, Bitkaya may rely on platform notices, audit reports, certifications, and management review rather than expensive bespoke audit activity where that is proportionate and sensible | Provider assurance evidence |
| 4 | Perform at least annual reassessment for standard outsourcing | Standard outsourcing should be reviewed at least annually | Annual standard outsourcing review record |
| 5 | Perform at least annual review for material outsourcing, and when there is a meaningful issue or change | — | Material outsourcing review record |
| 6 | Perform closer review for critical or essential outsourcing upon material change or issue | CBCS expects periodic review, proactive provider management, escalation of adverse developments, and prompt action where needed | Critical or essential outsourcing review record |
| 7 | Escalate adverse developments and track remediation actions | — | Issue escalation and remediation record |
| 8 | Update classification, due diligence, continuity and register records when monitoring identifies a material change | — | Updated classification, due diligence, continuity and register records |
Evidence
- monitoring record
- annual review record
- provider assurance evidence
- issue escalation and remediation record
Relationships
- Requirements: REQ-OUT-003 Assess Outsourcing Criticality Materiality and Risk, REQ-OUT-007 Maintain Outsourcing Governance and Accountability, REQ-OUT-009 Monitor Audit and Control Outsourcing Arrangements, REQ-OUT-010 Maintain Outsourcing Register and Compliance Notifications
- Process: PRC-GRO-001 Governance Risk and Outsourcing
- Controls: CTRL-OUT-005 Ensure Outsourcing Register Is Complete and Current, CTRL-OUT-006 Ensure Outsourcing Monitoring and Annual Review Occurs, CTRL-OUT-008 Ensure CBCS Outsourcing Reporting Is Completed
- System: SYS-OUT-001 Outsourcing Register
- Publication: PUB-OUT-001 Outsourcing Risk Management Manual
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: drafted from approved manual
History
- 2026-07-25: Created procedure from the Bitkaya Outsourcing Risk Management Manual version 1.0.
- 2026-07-25: Set procedure status to implemented based on Board approval of the Outsourcing Risk Management Manual on 2026-04-16.