(a)

the expected number and type of assessment activities to be outsourced do not give rise to an over-reliance on the third-party service provider;

(b)

safeguards are in place to manage the risks involved in the outsourcing, including dependency risks for the provision of the outsourced assessment activities;

(c)

arrangements are in place for the continuity of service, including contingency plans and periodic testing of back-up facilities;

(d)

arrangements are in place for the security of data and systems, including any use of cloud technology;

(e)

safeguards are in place to ensure that the external reviewer is capable of monitoring and overseeing the outsourced assessment activities;

(f)

where the third-party service provider is contractually permitted to further outsource the performance of the assessment activities, those activities fulfil the criteria set out in points (a) to (e).