Document ID: chunk:federal_register_of_legislation:F2016L01436:body:0:p5
Version: federal_register_of_legislation:F2016L01436
Segment Type: other
Provision Reference: 
Character Range: 11187–14281

service provider failure; and
(f)           affiliation or other relationship between the APRA-regulated institution or group and the service provider.
15.         For the purposes of this Prudential Standard, the internal audit function and the risk management function are material business activities.

Additional requirements of the Head of a group
16.         The Head of a group must maintain a group outsourcing policy that meets the requirements of paragraphs 23 to 25 on a group basis. The group outsourcing policy must include a strategy for the outsourcing of material business activities that applies to all members of the group.
17.         The Head of a group must, except where an APRA-regulated institution within the group has otherwise notified APRA of that information:
(a)          notify APRA in accordance with paragraphs 37 to 38 in respect of each outsourcing agreement for a material business activity across the group;
(b)          consult with APRA in accordance with paragraphs 39 to 40 in respect of each offshoring agreement for a material business activity across the group;
(c)          advise APRA of any significant problems that have the potential to materially affect the outsourcing arrangement and, as a consequence, materially affect the business operations, profitability or reputation of the group; and
(d)          notify APRA in accordance with paragraph 43 where an outsourcing agreement for a material business activity across the group is terminated.
18.         The group internal audit function must review any proposed outsourcing of a material business activity of the group, except where the internal audit function of an APRA-regulated institution within the group has reviewed the proposed outsourcing. The group internal audit function must regularly review and report to the Board of the Head of the group or group Board Audit Committee on compliance with the group outsourcing policy.
19.         Where an institution within the group that is not an APRA-regulated institution outsources business activities that are material to the group, the Head of the group must ensure that the outsourcing of those business activities is undertaken in a way that complies with the group outsourcing policy.[6]

The role of the Board and senior management
20.         An APRA-regulated institution must identify, assess, manage, mitigate and report on risks associated with outsourcing to meet the institution's financial and service obligations to its depositors, policyholders and other stakeholders.
21.         An APRA-regulated institution must have procedures to ensure that all the institution's relevant business units are made aware of, and have processes and controls for monitoring compliance with, the outsourcing policy.
22.         The Board is ultimately responsible for oversight of any outsourcing of a material business activity undertaken by an APRA-regulated institution. Although outsourcing may result in the service provider having day-to-day managerial responsibility for a business activity, the APRA-regulated institution is