Outsourcing Due Diligence

The Outsourcing Due Diligence assesses whether a prospective service provider is suitable, under the factors CSSF Circular 22/806 sets out at points 65(d) and 71–75. It turns those factors into a structured pre-contract questionnaire with statuses and a conclusion rule, and it brings forward the certification-reliance conditions of points 94–96 — which formally sit in the access-and-audit-rights section but are most useful applied at the selection stage, before you rely on a provider's third-party certificate. Items that operationalise other circular obligations (points 70, 77, 87, 102) into pre-contract evidence are tagged as overlay, and the status scale and conclusion rule are flagged as practitioner convention rather than circular text — the circular names suitability factors but prescribes no questionnaire or scoring. Requirement wording is paraphrased, with the consolidated circular the source of truth. It runs entirely in the browser — nothing is stored or sent — and exports to Excel, a printable memo and a JSON working file. It is the third tool in the outsourcing chain, feeding the pre-outsourcing decision alongside the Criticality and Risk Assessments and handing off to the Contract Clause Gap Checker.

• Provider-suitability assessment under CSSF 22/806 points 65(d) and 71–75
• The points 94–96 certification-reliance conditions applied at selection stage
• Overlay items that turn related obligations (points 70, 77, 87, 102) into pre-contract evidence
• A status scale and conclusion rule flagged as practitioner convention, reconcilable to the circular
• Feeds the pre-outsourcing decision alongside the Criticality and Risk Assessments
• Excel, printable memo and JSON export — plus a save/resume working file
• Fully browser-based — nothing is stored or sent

CSSF Circular 22/806 requires due diligence on a prospective outsourcing provider and lists suitability factors at points 71–75, but — as with the risk assessment — it prescribes no questionnaire, no status scale and no conclusion rule. Firms improvise, and the certification-reliance conditions of points 94–96, which really belong at the moment you decide whether to trust a provider's third-party certificate, get buried in the audit-rights section and applied too late, if at all. This tool structures the suitability assessment into a pre-contract questionnaire, brings the points 94–96 conditions forward to selection stage, and folds in related obligations as tagged overlay evidence — all reconcilable to the circular, with the practitioner conventions labelled as such. It closes the outsourcing tool chain: criticality decides the depth, the risk assessment sizes the exposure, and the due diligence tests the provider before the contract is checked clause by clause.