3. The policy shall determine the due diligence process for selecting and assessing the prospective ICT third-party service providers and shall indicate which of the following elements are to be used for the required level of assurance on the ICT third-party service provider’s performance:
|
(a)
|
audits or independent assessments performed by the financial entity itself or on its behalf;
|
|
(b)
|
the use of independent audit reports made on request by the ICT third-party service provider;
|
|
(c)
|
the use of audit reports made by the internal audit function of the ICT third-party service provider;
|
|
(d)
|
the use of appropriate third-party certifications;
|
|
(e)
|
the use of other relevant information available to the financial entity or other information provided by the ICT third-party service provider.
|