Risk-based due diligence, contractual audit rights and compliance clauses, and ongoing monitoring are the main tools. Outsourcing does not transfer accountability; the organisation remains answerable for its providers' controls.
Source: ISO 37001, COSO, ISO 27036
Related terms
Anti-bribery and corruptionThe set of policies, controls and training designed to prevent the offering or acceptance of undue advantages to or from public officials or private sector employees.Service organisation assurance report (ISAE 3402 / SOC 1)An independent auditor's report on the controls of an organisation providing outsourced services such as payroll, IT infrastructure or payment services.Value chainThe full range of activities, resources and relationships related to an entity's business model, from raw materials to end users, including supplier, customer, distribution and financing relationships.Application controlsAutomated or IT-dependent manual controls embedded in a software application that ensure transactions are processed completely, accurately and with authorisation.Business continuity planA plan to keep critical activities running at an acceptable level and return to normal within set timeframes after a disruption, disaster or cyber attack.Compliance auditAn examination of whether an organisation's activities are carried out in accordance with the relevant laws, regulations, contracts or internal rules.
Last updated: November 8, 2026 · This definition is for general information only.