Objective
Ensure Bitkaya completes required CBCS outsourcing reporting, including prior approval requests, immediate material-problem reporting and the Compliance-owned annual confirmation by 30 June.
Control Activity
Before the relevant outsourcing step is completed, the responsible owner and Compliance confirm that the required evidence exists, that material gaps are escalated, and that unresolved gaps are recorded for management decision or remediation. Compliance owns the annual CBCS outsourcing confirmation workflow and 30 June deadline tracking. Bitkaya will comply with CBCS outsourcing reporting and supervisory requirements, including: seeking prior approval where required for critical or essential outsourcing; requesting CBCS permission at least 60 days in advance where required; providing the draft agreement and supporting information where required; informing CBCS immediately of material outsourcing problems; and submitting annual confirmation of compliance by 30 June. Internal Audit, or another appropriate independent reviewer, reviews outsourcing arrangements on a risk basis, with more attention to material and critical outsourcing. This manual should also be applied consistently with Bitkaya’s Internal Controls and Audit Manual.
Evidence
- Expected evidence: CBCS permission request.
- Expected evidence: material problem notification.
- Expected evidence: annual confirmation evidence owned by Compliance.
- Expected evidence: management signoff.
- Evidence location: outsourcing register and related outsourcing evidence file.
- Retention: according to Bitkaya compliance record-retention requirements.
- Testing method: Check reporting calendar evidence, Compliance ownership, management signoff where required, and confirm required CBCS submissions were made on time.
- Testing frequency: annual, and after material outsourcing changes where applicable.
Relationships
- Requirements: REQ-OUT-002 Obtain CBCS Approval for Critical or Material Outsourcing, REQ-OUT-009 Monitor Audit and Control Outsourcing Arrangements, REQ-OUT-010 Maintain Outsourcing Register and Compliance Notifications
- Process: PRC-GRO-001 Governance Risk and Outsourcing
- Procedures: PROC-OUT-003 Obtain Outsourcing Approval and CBCS Engagement, PROC-OUT-006 Maintain Outsourcing Register and Reporting
- System: SYS-OUT-001 Outsourcing Register
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: approved
History
- 2026-07-25: Created control from the Bitkaya Outsourcing Risk Management Manual version 1.0.
- 2026-07-25: Control design approved by Managing Director.
- 2026-07-25: Recorded Compliance as owner for annual CBCS outsourcing confirmation deadline tracking.