On 27 October 2021, the Board of International Organization of Securities Commissions (IOSCO) published a report titled, ‘Principles on Outsourcing’. The principles are intended for regulated entities that outsource tasks to service providers. They have been developed based on the earlier 2005 Outsourcing Principles for Market Intermediaries and the 2009 Outsourcing Principles for Markets, but their application has been expanded and now includes trading venues, intermediaries market participants acting on a proprietary basis and credit rating agencies.
The principles consist of a set of fundamental precepts and seven principles. The fundamental precepts cover issues such as the definition of outsourcing, the assessment of materiality and criticality, affiliates, sub-outsourcing and outsourcing on a cross-border basis. The seven principles cover the following areas:
- Due diligence in the selection and monitoring of a service provider and its performance
- The contract with a service provider
- Information security, business resilience, continuity and disaster recovery
- Confidentiality Issues
- Concentration of outsourcing arrangements
- Access to data, premises, personnel and associated rights of inspection
- Termination of outsourcing arrangements
This Report also briefly addresses the impact of COVID-19 on outsourcing and operational resilience. An annex has been included which details how outsourcing integrates with cloud computing and how credit rating agencies use and incorporate outsourcing and cloud computing in their organisational strategies and structures.