Objective
Ensure each proposed outsourcing arrangement is classified as standard, material, or critical or essential before Bitkaya enters into the arrangement.
Control Activity
Before the relevant outsourcing step is completed, the responsible owner and Compliance confirm that the required evidence exists, that material gaps are escalated, and that unresolved gaps are recorded for management decision or remediation. Classification must be completed before any outsourcing arrangement starts. The arrangement must be classified as standard, material, or critical or essential. The contractor classification test must be applied: a contractor engagement is generally not outsourcing where the contractor works under Bitkaya’s day-to-day direction and oversight, uses Bitkaya’s systems, controls, and reporting lines, is integrated into Bitkaya’s governance, does not deliver a separate managed service, may not freely substitute or subcontract, and Bitkaya retains direct control. The practical indicators for critical or essential classification must be applied where relevant. Operational activities of internal control functions are generally treated as critical or essential unless assessment shows otherwise. Classification must be reviewed at least annually and sooner where there is a material change, as CBCS requires periodic reassessment.
Evidence
- Expected evidence: classification record.
- Expected evidence: register entry.
- Expected evidence: management escalation record where applicable.
- Evidence location: outsourcing register and related outsourcing evidence file.
- Retention: according to Bitkaya compliance record-retention requirements.
- Testing method: Sample new outsourcing arrangements and confirm classification was completed before start date.
- Testing frequency: annual, and after material outsourcing changes where applicable.
Relationships
- Requirements: REQ-OUT-002 Obtain CBCS Approval for Critical or Material Outsourcing, REQ-OUT-003 Assess Outsourcing Criticality Materiality and Risk, REQ-OUT-007 Maintain Outsourcing Governance and Accountability, REQ-OUT-010 Maintain Outsourcing Register and Compliance Notifications
- Process: PRC-GRO-001 Governance Risk and Outsourcing
- Procedures: PROC-OUT-001 Classify Outsourcing Arrangement, PROC-OUT-003 Obtain Outsourcing Approval and CBCS Engagement
- System: SYS-OUT-001 Outsourcing Register
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: approved
History
- 2026-07-25: Created control from the Bitkaya Outsourcing Risk Management Manual version 1.0.
- 2026-07-25: Control design approved by Managing Director.