Objective
Ensure outsourced services are monitored by the internal owner and reassessed at least annually or after material change.
Control Activity
Before the relevant outsourcing step is completed, the responsible owner and Compliance confirm that the required evidence exists, that material gaps are escalated, and that unresolved gaps are recorded for management decision or remediation. Each outsourcing arrangement must be monitored by its internal owner. Monitoring should be proportionate and may include: service quality; issues or incidents; provider changes; legal or regulatory concerns; assurance reports or certifications; and annual reassessment. CBCS expects periodic review, proactive provider management, escalation of adverse developments, and prompt action where needed. Standard outsourcing should be reviewed at least annually. Material outsourcing should be reviewed at least annually and when there is a meaningful issue or change. Critical or essential outsourcing should receive closer attention and be reviewed upon material change or issue. For standardized providers, Bitkaya may rely on platform notices, audit reports, certifications, and management review rather than expensive bespoke audit activity where that is proportionate and sensible.
Evidence
- Expected evidence: annual review record.
- Expected evidence: monitoring notes.
- Expected evidence: provider assurance evidence.
- Expected evidence: issue remediation record.
- Evidence location: outsourcing register and related outsourcing evidence file.
- Retention: according to Bitkaya compliance record-retention requirements.
- Testing method: Inspect register review dates and evidence for overdue reviews, issue escalation and updated classifications.
- Testing frequency: annual, and after material outsourcing changes where applicable.
Relationships
- Requirements: REQ-OUT-003 Assess Outsourcing Criticality Materiality and Risk, REQ-OUT-009 Monitor Audit and Control Outsourcing Arrangements, REQ-OUT-010 Maintain Outsourcing Register and Compliance Notifications
- Process: PRC-GRO-001 Governance Risk and Outsourcing
- Procedures: PROC-OUT-005 Monitor Outsourcing Arrangement, PROC-OUT-006 Maintain Outsourcing Register and Reporting
- System: SYS-OUT-001 Outsourcing Register
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: approved
History
- 2026-07-25: Created control from the Bitkaya Outsourcing Risk Management Manual version 1.0.
- 2026-07-25: Control design approved by Managing Director.