Commission Delegated Regulation (EU) 2025/2180 Article 8: Criteria for ensuring that outsourcing assessment activities does not materially impair the quality of the internal control of the external reviewer

Article 8 - Criteria for ensuring that outsourcing assessment activities does not materially impair the quality of the internal control of the external reviewer

‹

Article 8

Criteria for ensuring that outsourcing assessment activities does not materially impair the quality of the internal control of the external reviewer

›

When ensuring that outsourcing of assessment activities does not materially impair the quality of their internal control, external reviewers shall ensure that the following criteria are fulfilled:

((a))

the expected number and type of assessment activities to be outsourced do not give rise to an over-reliance on the third-party service provider;

((b))

safeguards are in place to manage the risks involved in the outsourcing, including dependency risks for the provision of the outsourced assessment activities;

((c))

arrangements are in place for the continuity of service, including contingency plans and periodic testing of back-up facilities;

((d))

arrangements are in place for the security of data and systems, including any use of cloud technology;

((e))

safeguards are in place to ensure that the external reviewer is capable of monitoring and overseeing the outsourced assessment activities;

((f))

where the third-party service provider is contractually permitted to further outsource the performance of the assessment activities, those activities fulfil the criteria set out in points (a) to (e).