Criteria for ensuring that outsourcing assessment activities does not materially impair the quality of the internal control of the external reviewer
Article 8
When ensuring that outsourcing of assessment activities does not materially impair the quality of their internal control, external reviewers shall ensure that the following criteria are fulfilled: (a) the expected number and type of assessment activities to be outsourced do not give rise to an over-reliance on the third-party service provider; (b) safeguards are in place to manage the risks involved in the outsourcing, including dependency risks for the provision of the outsourced assessment activities; (c) arrangements are in place for the continuity of service, including contingency plans and periodic testing of back-up facilities; (d) arrangements are in place for the security of data and systems, including any use of cloud technology; (e) safeguards are in place to ensure that the external reviewer is capable of monitoring and overseeing the outsourced assessment activities; (f) where the third-party service provider is contractually permitted to further outsource the performance of the assessment activities, those activities fulfil the criteria set out in points (a) to (e).