The Australian Prudential Regulation Authority has issued new prudential standards governing the issue of outsourcing that are applicable to life insurance companies, authorised deposit taking institutions and general insurers.
The standards are the first of their kind to include the life insurance sector and have been formulated to ensure the risks associated with outsourcing arrangements are managed in a sensible manner.
In particular, the standards have addressed the issues involved with outsourcing to an offshore party and have also sought to establish a more flexible approach to intra-group outsourcing.
In regard to offshore outsourcing, the standards alert these financial institutions to common risks associated with arrangements of this nature.
Those detailed include country risk, which alludes to the socio-political stability of the other party’s trading base, and compliance risk, which refers to the impact the practice of the other party may have on the compliance capability of the regulated organisation.
In this area the standards also cover contractual risk, which is the limits on the ability of the regulated entity to enforce the contract overseas, and access risk, which relates to how easily the regulated organisation can access the other party’s records.
In terms of the more general issues involved with outsourcing, the standards require that organisations devote sufficient resources to managing and monitoring the process and that the monitoring framework put in place is reflective of the magnitude of the outsourcing arrangements undertaken.
Furthermore, the standards enforce a level of expectation that those regulated companies involved in an offshore outsourcing relationship obtain and retain copies in English of the contractual agreement, the due diligence assessment, the business continuity management documents and the financial statements relating to the other party.
The aim of the new standards is to streamline across sectors the approach institutions adopt toward outsourcing.
“The use of third parties to perform business activities can be beneficial but can also entail additional risks. APRA has introduced a principles-based, harmonised approach setting out minimum requirements for managing risks from outsourcing, but enabling institutions to tailor their outsourcing policy to meet their individual needs,” APRA chair John Laker said.
“Well-run institutions already address these outsourcing principles as part of their operational risk management systems,” he added.
