Objective
Ensure standard, material and critical or essential outsourcing arrangements follow the correct approval and CBCS engagement path.
Control Activity
Before the relevant outsourcing step is completed, the responsible owner and Compliance confirm that the required evidence exists, that material gaps are escalated, and that unresolved gaps are recorded for management decision or remediation. No outsourcing arrangement may begin without internal approval. Standard outsourcing may be approved by management under normal authority. Material outsourcing requires enhanced review and management escalation. Critical or essential outsourcing requires senior escalation and prior CBCS approval. CBCS states that regulated entities must engage CBCS in a timely manner prior to outsourcing critical or essential functions and that prior approval is required. Where required, Bitkaya must seek CBCS permission at least 60 days before the proposed start date and submit the draft outsourcing agreement together with supporting information. For material outsourcing that is not critical or essential, Bitkaya assesses whether supervisory dialogue or notification is appropriate; where doubt exists, Bitkaya may consult CBCS. If a large standardized provider does not meet all preferred terms, that does not automatically block the arrangement, but any important gap in a material or critical arrangement must be documented, assessed, and approved at the appropriate level.
Evidence
- Expected evidence: internal approval record.
- Expected evidence: CBCS request or consultation record.
- Expected evidence: approval conditions.
- Expected evidence: timing evidence.
- Evidence location: outsourcing register and related outsourcing evidence file.
- Retention: according to Bitkaya compliance record-retention requirements.
- Testing method: Sample material and critical arrangements and confirm approval and CBCS engagement records are complete before start date.
- Testing frequency: annual, and after material outsourcing changes where applicable.
Relationships
- Requirements: REQ-OUT-002 Obtain CBCS Approval for Critical or Material Outsourcing, REQ-OUT-007 Maintain Outsourcing Governance and Accountability, REQ-OUT-010 Maintain Outsourcing Register and Compliance Notifications
- Process: PRC-GRO-001 Governance Risk and Outsourcing
- Procedures: PROC-OUT-003 Obtain Outsourcing Approval and CBCS Engagement
- System: SYS-OUT-001 Outsourcing Register
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: approved
History
- 2026-07-25: Created control from the Bitkaya Outsourcing Risk Management Manual version 1.0.
- 2026-07-25: Control design approved by Managing Director.