Objective
Ensure the central outsourcing register records required information and remains available for management, supervisory function and CBCS request.
Control Activity
Before the relevant outsourcing step is completed, the responsible owner and Compliance confirm that the required evidence exists, that material gaps are escalated, and that unresolved gaps are recorded for management decision or remediation. Bitkaya maintains a central outsourcing register. At minimum, the register records: provider name; service description; service/data location where relevant; and whether the arrangement is standard, material, or critical/essential. CBCS requires an outsourcing register and expects it to be available to management, supervisory function, and CBCS on request. Risk and Compliance maintain the outsourcing register.
Evidence
- Expected evidence: outsourcing register.
- Expected evidence: register owner review.
- Expected evidence: change log or review evidence.
- Evidence location: outsourcing register and related outsourcing evidence file.
- Retention: according to Bitkaya compliance record-retention requirements.
- Testing method: Compare known outsourcing arrangements to register entries and check required fields for completeness.
- Testing frequency: annual, and after material outsourcing changes where applicable.
Relationships
- Requirements: REQ-OUT-007 Maintain Outsourcing Governance and Accountability, REQ-OUT-010 Maintain Outsourcing Register and Compliance Notifications
- Process: PRC-GRO-001 Governance Risk and Outsourcing
- Procedures: PROC-OUT-001 Classify Outsourcing Arrangement, PROC-OUT-005 Monitor Outsourcing Arrangement, PROC-OUT-006 Maintain Outsourcing Register and Reporting
- System: SYS-OUT-001 Outsourcing Register
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: approved
History
- 2026-07-25: Created control from the Bitkaya Outsourcing Risk Management Manual version 1.0.
- 2026-07-25: Control design approved by Managing Director.