Undertakings remain fully responsible for their obligations when outsourcing. Outsourcing critical or important functions must not materially impair governance, unduly increase operational risk, impair supervisory monitoring or undermine continuous service to policy holders, and the supervisor must be notified in advance and of later material developments. The Delegated Regulation requires a written outsourcing policy; due diligence on the provider's ability, capacity, authorisation and conflicts; a written agreement explained to and authorised by the AMSB, covering duties, compliance and cooperation with the supervisor, disclosure of material developments, termination rights and notice, instructions, confidentiality, access and on-site inspection by the undertaking, its auditor and the supervisor, direct supervisory questions and sub-outsourcing terms; and oversight of the provider's risk management, resources and contingency plans.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.