Document ID: chunk:federal_register_of_legislation:F2016L01436:body:0:p9
Version: federal_register_of_legislation:F2016L01436
Segment Type: other
Provision Reference: 
Character Range: 22796–26043

– requirement for consultation
39.         An APRA-regulated institution must consult with APRA prior to entering into any offshoring agreement involving a material business activity so that APRA may satisfy itself that the impact of the offshoring arrangement has been adequately addressed as part of the institution's risk management framework.
40.         If, in APRA's view, the offshoring agreement involves risks that the APRA-regulated institution is not managing appropriately, APRA may require the APRA-regulated institution to make other arrangements for the outsourced activity as soon as practicable.

Monitoring the relationship
41.         An APRA-regulated institution must ensure the institution has sufficient and appropriate resources to manage and monitor each outsourcing relationship at all times. The type and extent of resources required will depend on the materiality of the outsourced business activity. At a minimum, monitoring must include:
(a)          maintaining appropriate levels of regular contact with the service provider. This will range from daily operational contact to senior management involvement; and
(b)          a process for regular monitoring of performance under the agreement, including meeting criteria concerning service levels.
42.         An APRA-regulated institution must advise APRA of any significant problems that have the potential to materially affect the outsourcing arrangement and, as a consequence, materially affect the business operations, profitability or reputation of the institution.
43.         Where an outsourcing agreement is terminated, an APRA-regulated institution must notify APRA as soon as practicable and provide a statement about the transition arrangements and future strategies for carrying out the outsourced material business activity.

Audit arrangements
44.         An institution's internal audit function must review any proposed outsourcing of a material business activity and regularly review and report to the Board or Board Audit Committee on compliance with the institution's outsourcing policy. Where APRA has exempted an institution from having a dedicated internal audit function, or approved alternative arrangements under Prudential Standard CPS 510 Governance, APRA may also vary the requirements of this paragraph.
45.         APRA may request the external auditor of an institution, or an appropriate external expert, to provide an assessment of the risk management processes in place with respect to an arrangement to outsource a material business activity. This could cover areas such as information technology systems, data security, internal control frameworks and business continuity plans. Such reports will be paid for by the institution and must be made available to APRA.

Adjustments and exclusions
46.         APRA may adjust or exclude a specific prudential requirement in this Prudential Standard in relation to an APRA-regulated institution.[11]

Determinations made under previous prudential standards
47.         An exercise of APRA's discretion (such as an approval, waiver or direction) under a previous version of this Prudential Standard continues to have effect as though exercised pursuant to a corresponding power (if any)