Purpose
Ensure outsourced services can continue, be transferred, replaced or exited without unacceptable disruption, and that subcontracting remains controlled.
Scope
This procedure applies to outsourcing arrangements and material changes to outsourcing arrangements as defined in the Bitkaya Outsourcing Risk Management Manual.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Identify continuity and exit expectations during classification and due diligence | Bitkaya must be able to continue operating if the provider fails, performs badly, suffers an incident, or the arrangement has to be terminated | Continuity and exit expectations note |
| 2 | For standard outsourcing, this may require only basic fallback thinking | — | Standard outsourcing fallback note |
| 3 | For material outsourcing, consider whether the service can be continued or replaced without major disruption | — | Material outsourcing continuity assessment |
| 4 | For critical or essential outsourcing, assess: whether the provider has appropriate continuity arrangements; whether the service can be replaced or transferred; whether Bitkaya can bring the function back in-house if needed; and how continuity would be maintained during any transition | CBCS requires business continuity planning and exit planning for outsourcing, especially critical or essential functions | Critical or essential continuity and exit assessment |
| 5 | Confirm subcontracting is permitted only where Bitkaya agrees to it and the risks remain manageable | CBCS states that outsourcing should ideally be limited to one level of sub-contracting and that the regulated entity must retain sufficient control and visibility | Subcontracting permission confirmation |
| 6 | Where subcontracting is permitted, confirm the provider: informs Bitkaya in advance where relevant; remains responsible for the subcontractor’s performance; and ensures that confidentiality, security, and other relevant obligations continue to apply | — | Subcontracting oversight confirmation |
| 7 | Document objection, termination or exit rights where subcontracting materially increases risk | Bitkaya reserves the right to object to or terminate arrangements where subcontracting materially increases risk | Objection, termination or exit rights clause in agreement |
| 8 | Review continuity, exit and subcontracting arrangements annually or after material change | — | Annual or post-change review record |
Evidence
- continuity and exit assessment
- subcontracting review
- provider continuity evidence
- exit or transition plan where applicable
Relationships
- Requirements: REQ-OUT-006 Protect Outsourced Data and Confidential Information, REQ-OUT-008 Maintain Outsourcing Business Continuity and Exit Plans, REQ-OUT-011 Control Sub-Outsourcing
- Process: PRC-GRO-001 Governance Risk and Outsourcing
- Controls: CTRL-OUT-004 Ensure Written Agreement Contains Outsourcing Safeguards, CTRL-OUT-007 Ensure Continuity Exit and Sub-Outsourcing Safeguards Exist
- System: SYS-OUT-001 Outsourcing Register
- Publication: PUB-OUT-001 Outsourcing Risk Management Manual
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: drafted from approved manual
History
- 2026-07-25: Created procedure from the Bitkaya Outsourcing Risk Management Manual version 1.0.
- 2026-07-25: Set procedure status to implemented based on Board approval of the Outsourcing Risk Management Manual on 2026-04-16.