Document ID: chunk:federal_register_of_legislation:F2016L01436:body:0:p7
Version: federal_register_of_legislation:F2016L01436
Segment Type: other
Provision Reference: 
Character Range: 16935–20300

(b)          that the related body corporate has the ability to conduct the business activity on an ongoing basis;
(c)          the required monitoring procedures to ensure that the related body corporate is performing effectively and how potential inadequate performance would be addressed;
(d)          contingency issues in accordance with Prudential Standard CPS 232 Business Continuity Management (CPS 232) should the outsourced activity need to be brought in-house; and
(e)          the need to apply any of the requirements set out in paragraph 26 to the extent they are relevant to outsourcing agreements with related bodies corporate.

The outsourcing agreement
28.         Each outsourcing arrangement must be contained in a documented legally binding agreement, except where otherwise provided in this Prudential Standard. The agreement must be signed by all parties to it before the outsourcing arrangement commences.
29.         At a minimum, the agreement (including arrangements with related bodies corporate) must address the following matters:
(a)          the scope of the arrangement and services to be supplied;
(b)          commencement and end dates;
(c)          review provisions;
(d)          pricing and fee structure;
(e)          service levels and performance requirements;
(f)           the form in which data is to be kept and clear provisions identifying ownership and control of data;
(g)          reporting requirements, including content and frequency of reporting;
(h)          audit and monitoring procedures;
(i)            business continuity management;
(j)            confidentiality, privacy and security of information;
(k)          default arrangements and termination provisions;
(l)            dispute resolution arrangements;
(m)        liability and indemnity;
(n)          sub-contracting;
(o)          insurance; and
(p)          to the extent applicable, offshoring arrangements (including through sub-contracting).
30.         An APRA-regulated institution that outsources a material business activity must ensure that its outsourcing agreement includes an indemnity to the effect that any sub-contracting by a third party service provider of the outsourced function will be the responsibility of the third party service provider, including liability for any failure on the part of the sub-contractor.
31.         The requirements in paragraph 28 do not apply to an outsourcing arrangement with a related body corporate unless:
(a)          after having consulted with the APRA-regulated institution, APRA notifies the APRA-regulated institution, in writing, that the outsourcing arrangement must be evidenced by a documented legally binding agreement;
(b)          another prudential standard requires the arrangement to be undertaken under a documented legally binding agreement; or
(c)          in the case of a general insurer, the outsourcing arrangement is between a Category D insurer[9] and a related body corporate.
32.         Where a foreign ADI, Category C insurer or EFLIC enters into an outsourcing arrangement with its head office, the requirements of subparagraph 27(d) and paragraph 28 do not apply.
33.         Where:
(a)          an APRA-regulated institution invokes the institution's Business Continuity Plan[10] as a result of an unexpected event; or
(b)          there is a sudden financial