Purpose
Maintain the central outsourcing register and support internal and CBCS reporting obligations.
Scope
This procedure applies to outsourcing arrangements and material changes to outsourcing arrangements as defined in the Bitkaya Outsourcing Risk Management Manual.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Create or update the register entry before the arrangement starts | Bitkaya maintains a central outsourcing register | Outsourcing register entry |
| 2 | Record at minimum: provider name; service description; service/data location where relevant; and whether the arrangement is standard, material, or critical/essential | — | Register fields record |
| 3 | Record owner, approval path, CBCS engagement status, contract reference, review date and material issues where available | — | Register fields record |
| 4 | Make the register available to management, supervisory function and CBCS on request | CBCS requires an outsourcing register and expects it to be available on request | Register availability confirmation |
| 5 | Compliance prepares the annual outsourcing compliance confirmation by 30 June | Bitkaya will comply with CBCS outsourcing reporting and supervisory requirements, including submitting annual confirmation of compliance by 30 June | Annual outsourcing compliance confirmation |
| 6 | Inform CBCS immediately of material outsourcing problems where required | — | CBCS notification evidence |
| 7 | Seek prior approval where required for critical or essential outsourcing; request CBCS permission at least 60 days in advance where required; provide the draft agreement and supporting information where required | — | CBCS prior approval request and supporting documentation |
| 8 | Retain register review evidence and reporting evidence | Internal Audit, or another appropriate independent reviewer, reviews outsourcing arrangements on a risk basis, with more attention to material and critical outsourcing. This manual should also be applied consistently with Bitkaya’s Internal Controls and Audit Manual | Register review and reporting evidence |
Evidence
- outsourcing register
- annual confirmation evidence, including Compliance owner and management signoff where required
- CBCS notification evidence
- register review evidence
Relationships
- Requirements: REQ-OUT-002 Obtain CBCS Approval for Critical or Material Outsourcing, REQ-OUT-009 Monitor Audit and Control Outsourcing Arrangements, REQ-OUT-010 Maintain Outsourcing Register and Compliance Notifications
- Process: PRC-GRO-001 Governance Risk and Outsourcing
- Controls: CTRL-OUT-005 Ensure Outsourcing Register Is Complete and Current, CTRL-OUT-006 Ensure Outsourcing Monitoring and Annual Review Occurs, CTRL-OUT-008 Ensure CBCS Outsourcing Reporting Is Completed
- System: SYS-OUT-001 Outsourcing Register
- Publication: PUB-OUT-001 Outsourcing Risk Management Manual
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: drafted from approved manual
History
- 2026-07-25: Created procedure from the Bitkaya Outsourcing Risk Management Manual version 1.0.
- 2026-07-25: Set procedure status to implemented based on Board approval of the Outsourcing Risk Management Manual on 2026-04-16.
- 2026-07-25: Recorded Compliance as owner for the annual CBCS outsourcing confirmation workflow due by 30 June.