25 February 2009

IOSCO consults on Principles for Outsourcing by markets

The Report sets out a set of principles that are designed to assist markets and market authorities when considering outsourcing arrangements.

The proposed ‘Outsourcing Principles’ are:

Topic 1: Due diligence in selecting the service provider and in monitoring the service provider’s performance

Principle: An outsourcing market should conduct suitable due diligence processes in selecting an appropriate third party service provider and in monitoring its ongoing performance.

The outsourcing market should also take appropriate steps to identify any conflicts of interest between the outsourcing market and the service provider (including affiliated entities and sub-contractors) and ensure that policies and procedures are in place to mitigate and manage any potential conflicts of interest which have been identified or could arise.

Topic 2: The contract with a service provider

Principle: There should be a legally binding written contract between the outsourcing market and each third party service provider, the nature and detail of which should be appropriate to the materiality and nature of the outsourced activity to the ongoing business of the outsourcing market.

Topic 3: Business Continuity at the Outsourcing Provider

Principle: The outsourcing market should take appropriate measures to determine that its service providers establish and maintain emergency procedures and a plan for disaster recovery, with periodic testing of backup facilities.

Topic 4: Security and Confidentiality of Information

Principle: The outsourcing market should take appropriate measures to determine that procedures are in place to protect the outsourcing market’s proprietary, member-related and potentially market sensitive information and software.

The outsourcing market should take appropriate steps to require that service providers protect confidential information regarding the outsourcing market’s members from intentional or inadvertent disclosure to unauthorised individuals.

Deadline for comments is 20 May 2009. 

Consultation

© IOSCO