Maintain Outsourcing Governance and Accountability

Purpose

Translate the CBCS outsourcing guideline into a testable BCMS requirement for outsourcing governance and control.

Normative

Bitkaya shall retain accountability, oversight and sufficient substance for outsourced activities and shall not allow outsourcing to impair governance, internal control, supervision or regulatory compliance.

Descriptive

Management and supervisory functions remain accountable for outsourcing policy, risk management, monitoring, internal control, reporting, remedial action, access for CBCS and the ability to resume control where necessary.

Source reference: CBCS Guideline on Outsourcing, Article 5, Article 7, Article 25, Article 26, Article 27 and Article 28.

Assurance Assertions

• Outsourcing responsibilities are assigned and resourced.
• Management and supervisory oversight of outsourcing is documented.
• Internal audit covers outsourcing on a risk-based basis.

Relationships

• Source: SRC-OUT-001 CBCS Guideline for the Sound Management of Outsourcing
• Policies: POL-OUT-001 Outsourcing Risk Management Manual
• Process: PRC-GRO-001 Governance Risk and Outsourcing
• Procedures: PROC-OUT-001 Classify Outsourcing Arrangement, PROC-OUT-003 Obtain Outsourcing Approval and CBCS Engagement, PROC-OUT-005 Monitor Outsourcing Arrangement
• Controls: CTRL-OUT-001 Ensure Outsourcing Is Classified Before Engagement, CTRL-OUT-003 Ensure Required Approval and CBCS Engagement Is Completed, CTRL-OUT-005 Ensure Outsourcing Register Is Complete and Current
• Systems: not yet assigned; tracked under ISS-OUT-001
• Publications: PUB-OUT-001 Outsourcing Risk Management Manual
• Issues: ISS-OUT-001 Complete Outsourcing Operating Artifacts and Evidence

Assurance

• Source verified: yes
• Implementation linked: yes; remaining operational follow-up is tracked in ISS-OUT-001 where applicable
• Wording unambiguous: approved

History

• 2026-07-25: Created from SRC-OUT-001.
• 2026-07-25: Linked outsourcing operational implementation objects derived from the Bitkaya outsourcing manual.
• 2026-07-25: Approved outsourcing requirement for BCMS use.