Objective
Ensure material and critical outsourcing arrangements address continuity, exit, replacement, reintegration and subcontracting risks.
Control Activity
Before the relevant outsourcing step is completed, the responsible owner and Compliance confirm that the required evidence exists, that material gaps are escalated, and that unresolved gaps are recorded for management decision or remediation. Bitkaya must be able to continue operating if the provider fails, performs badly, suffers an incident, or the arrangement has to be terminated. For standard outsourcing, this may require only basic fallback thinking. For material outsourcing, Bitkaya should consider whether the service can be continued or replaced without major disruption. For critical or essential outsourcing, Bitkaya must consider: whether the provider has appropriate continuity arrangements; whether the service can be replaced or transferred; whether Bitkaya can bring the function back in-house if needed; and how continuity would be maintained during any transition. CBCS requires business continuity planning and exit planning for outsourcing, especially critical or essential functions. Sub-contracting is allowed only where Bitkaya agrees to it and the risks remain manageable. Where subcontracting is permitted, the provider must inform Bitkaya in advance where relevant, remain responsible for the subcontractor’s performance, and ensure that confidentiality, security, and other relevant obligations continue to apply. CBCS states that outsourcing should ideally be limited to one level of sub-contracting and that the regulated entity must retain sufficient control and visibility. Bitkaya reserves the right to object to or terminate arrangements where subcontracting materially increases risk.
Evidence
- Expected evidence: continuity assessment.
- Expected evidence: exit plan or fallback rationale.
- Expected evidence: subcontracting review.
- Expected evidence: provider continuity evidence.
- Evidence location: outsourcing register and related outsourcing evidence file.
- Retention: according to Bitkaya compliance record-retention requirements.
- Testing method: Sample material and critical arrangements and confirm continuity, exit and subcontracting evidence is proportionate to risk.
- Testing frequency: annual, and after material outsourcing changes where applicable.
Relationships
- Requirements: REQ-OUT-006 Protect Outsourced Data and Confidential Information, REQ-OUT-008 Maintain Outsourcing Business Continuity and Exit Plans, REQ-OUT-011 Control Sub-Outsourcing
- Process: PRC-GRO-001 Governance Risk and Outsourcing
- Procedures: PROC-OUT-002 Perform Outsourcing Due Diligence and Risk Assessment, PROC-OUT-004 Review and Execute Outsourcing Agreement, PROC-OUT-007 Manage Outsourcing Continuity Exit and Sub-Outsourcing
- System: SYS-OUT-001 Outsourcing Register
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: approved
History
- 2026-07-25: Created control from the Bitkaya Outsourcing Risk Management Manual version 1.0.
- 2026-07-25: Control design approved by Managing Director.