Document ID: chunk:federal_register_of_legislation:F2016L01436:body:0:p6
Version: federal_register_of_legislation:F2016L01436
Segment Type: other
Provision Reference: 
Character Range: 13977–17215

The Board is ultimately responsible for oversight of any outsourcing of a material business activity undertaken by an APRA-regulated institution. Although outsourcing may result in the service provider having day-to-day managerial responsibility for a business activity, the APRA-regulated institution is responsible for complying with all prudential requirements that relate to the outsourced business activity.

Outsourcing policy
23.         The Board of an APRA-regulated institution must approve the institution's outsourcing policy, which must set out the approach to outsourcing of material business activities, including a detailed framework for managing all such outsourcing arrangements.
24.         The Board of an APRA-regulated institution must ensure that outsourcing risks and controls are taken into account as part of the institution's risk management strategy and when completing a risk management declaration required to be provided to APRA.[7]
25.         The outsourcing policy must set out specific requirements in relation to outsourcing to related bodies corporate and outsourcing to service providers conducting the material business activity outside Australia.

Assessment of outsourcing options
26.         An APRA-regulated institution must be able to demonstrate to APRA that, in assessing the options for outsourcing a material business activity to a 'third party',[8] it has:
(a)          prepared a business case for outsourcing the material business activity;
(b)          undertaken a tender or other selection process for selecting the service provider;
(c)          undertaken a due diligence review of the chosen service provider, including the ability of the service provider to conduct the business activity on an ongoing basis;
(d)          involved the Board of the APRA-regulated institution, Board committee of the APRA-regulated institution, or senior manager of the institution with delegated authority from the Board, in approving the agreement;
(e)          considered all the matters outlined in paragraph 29, that must, at a minimum, be included in the outsourcing agreement itself;
(f)           established procedures for monitoring performance under the outsourcing agreement on a continuing basis;
(g)          addressed the renewal process for outsourcing agreements and how the renewal will be conducted; and
(h)          developed contingency plans that would enable the outsourced business activity to be provided by an alternative service provider or brought in-house if required.
27.         An APRA-regulated institution must be able to demonstrate to APRA that, in assessing the options for outsourcing to related bodies corporate, it has taken into account:
(a)          the changes to the risk profile of the business activity that arise from outsourcing the activity to a related body corporate and how this changed risk profile is addressed within the institution's risk management framework;
(b)          that the related body corporate has the ability to conduct the business activity on an ongoing basis;
(c)          the required monitoring procedures to ensure that the related body corporate is performing effectively and how potential inadequate performance would be