A.8 Control of externally provided processes, products and services
All forms of externally provided processes, products and services are addressed in 8.4, e.g. whether
through:
a) purchasing from a supplier;
b) an arrangement with an associate company;
c) outsourcing processes to an external provider.
Outsourcing always has the essential characteristic of a service, since it will have at least one activity
necessarily performed at the interface between the provider and the organization.
The controls required for external provision can vary widely depending on the nature of the processes,
products and services. The organization can apply risk-based thinking to determine the type and extent
of controls appropriate to particular external providers and externally provided processes, products
and services.