GB
Following on from our previous post on audit rights, this instalment looks at what happens between audits.
Reporting, monitoring, governance and record-keeping are what give regulated entities ongoing visibility over their outsourced arrangements. Rather than relying on periodic inspections, they provide a continuous view of performance, risk and compliance throughout the life of the contract.
Just like audit rights, these obligations are rarely the subject of debate. Everyone accepts they're required under the EBA Guidelines on Outsourcing Arrangements (EBA/GL/2019/02) (the Guidelines). The real negotiation is around the practicalities:
Getting those details right helps regulated entities meet their regulatory obligations while ensuring the commercial relationship remains practical and sustainable.
Paragraph 75(h) of the Guidelines makes it clear that monitoring isn't something that only happens during an audit or when a regulator comes knocking. Regulated entities must be able to monitor outsourced services on an ongoing basis, particularly where they're supporting critical or important functions.
That means outsourcing agreements need to preserve the right to monitor service provider performance throughout the life of the arrangement, supported by processes that track performance, risk and compliance in real time.
Paragraph 75(j) then builds on this by requiring outsourcing agreements to include reporting obligations. At a minimum, providers should:
Where appropriate, providers may also be required to share reports from their internal audit function. In practice, many regulated entities go further by requesting information on operational incidents, subcontracting, business continuity testing and wider risk management. While sensible, these requirements extend beyond the minimum position set out in paragraph 75(j).
The Guidelines also recognise that monitoring should be proportionate. Paragraph 85 confirms there is no one-size-fits-all approach. The level of reporting, monitoring and oversight should reflect the level of risk, with the greatest scrutiny reserved for critical or important outsourcing arrangements.
Like audit rights, the Guidelines set the minimum standard, not the finished contract.
The parties are free to negotiate practical points such as:
However, there are limits. Whatever is agreed must still allow the regulated entity to demonstrate effective oversight and meet its ongoing monitoring obligations under paragraph 75(h).
From a regulated entity's perspective, the key question is simple: could you demonstrate to your regulator that you have genuine visibility over the outsourced function?
Reporting and governance obligations are what provide that visibility between formal audits.
The aim isn't to receive every report imaginable. Instead, it's about receiving enough meaningful information, at an appropriate frequency, to monitor the risks associated with the outsourced service.
That often means regular reporting on:
Quarterly or annual reporting is often sufficient for lower-risk arrangements, while more critical services may justify monthly reporting or enhanced management information.
Regulated entities will also usually resist arrangements that restrict oversight to scheduled reporting alone. They typically want the ability to request additional information where reasonably necessary, for example following an incident, regulatory enquiry or emerging risk.
Alongside routine reporting, providers are generally expected to notify the regulated entity promptly of any development that could materially affect service delivery. Increasingly, this includes material ICT incidents, cyber security events and significant subcontracting changes.
From a cost perspective, routine reporting is generally treated as part of the contracted service. While bespoke reporting may attract additional charges, regulated entities will often resist paying for information they need to meet their regulatory obligations.
Service providers face a familiar challenge. Although the Guidelines don't apply directly to them, the contractual obligations often do.
It's therefore reasonable for providers to ensure reporting obligations remain proportionate and commercially workable, particularly where the same infrastructure supports multiple regulated customers.
Broadly drafted reporting clauses can become operationally burdensome, requiring providers to produce a constant stream of information on compliance, business continuity, legal obligations and performance.
Providers will often try to limit reporting to standard assurance outputs, such as SOC 1, SOC 2 Type II or certification reports, with bespoke reporting triggered only by specific events.
Regulated entities will usually push back, as the Guidelines contemplate more than periodic third-party assurance reports.
In practice, the compromise is often to limit reporting to information genuinely relevant to the outsourced services and the regulated entity's compliance obligations, while avoiding wording that effectively creates unlimited audit rights.
Open-ended rights to request information at any time can place significant strain on operations.
Providers therefore typically seek:
Urgent regulatory requests are, of course, a different matter and usually justify much shorter response times.
Defining what counts as a reportable incident is often another key negotiation point.
Providers usually favour materiality thresholds, while regulated entities tend to seek broader notification obligations.
A practical compromise is to define categories of reportable events, such as data loss, unauthorised access, denial of service attacks, critical control failures or missed recovery testing, with agreed reporting timescales for each.
Most providers accept that standard reporting forms part of the service.
Where requests become bespoke or particularly resource-intensive, however, they'll often expect those additional costs to sit with the customer.
Paragraph 91(b) of the Guidelines, which we explored in our previous article on audit rights, is also relevant here.
It allows regulated entities to rely on third-party certifications or internal audit reports instead of, or alongside, their own audits. The same principle can reduce the need for bespoke reporting.
Where providers maintain robust reporting supported by certifications such as SOC 2 Type II or ISO 27001, regulated entities may have less need for frequent audits or additional reporting. That creates a useful negotiating position, particularly for cloud providers and other multi-tenant environments where bespoke customer reporting can be difficult to deliver.
That said, substitute assurance only works if it's meaningful. Regulated entities should ensure providers are required to keep certifications up to date, notify them of any lapses or qualifications, and preserve the right to request additional reporting or carry out a direct audit where there's a genuine concern about the adequacy of those assurances.
Reporting, monitoring and governance clauses can easily look like standard contractual boilerplate. In reality, they're some of the most important provisions in any regulated outsourcing agreement.
For regulated entities, they provide the evidence needed to demonstrate ongoing oversight and regulatory compliance. For service providers, the challenge is making those obligations practical and proportionate.
Like audit rights, these objectives don't have to be in conflict. A well-drafted reporting framework reduces compliance risk for regulated entities while keeping operational demands manageable for service providers.
Next time, we'll turn our attention to business continuity and disaster recovery, another area where regulatory expectations and commercial reality don't always align.
Need bespoke support, we'd be happy to help - get in touch today.
