Foreword

Section 3 of the ASF Internal Audit Procedure already anticipates this document: it allows ASF to engage an external, qualified individual for a specific audit where ASF's own size limits available independent auditors, and points to this policy for the controls that govern doing so. This is the genuine, structural reality of an organization ASF's size operating to international standards — there will be moments where the right independent expert is not already inside ASF, and pretending otherwise would mean either a worse outcome or a compromised one [1].

1. Purpose and Scope

This policy governs any instance where ASF engages an external party to perform work that would otherwise be performed by ASF's own Council, staff, or certified surveyors, consistent with the outsourcing controls ISO/IEC 17011 requires of accreditation bodies [1].

2. Why Retained Accountability Matters: The Real Evidence

This policy's insistence, throughout Sections 4 and 5, that ASF retains full accountability for outsourced work is not a formality. Research on outsourcing failure consistently identifies the same underlying pattern: an organization rarely fails because of the specific external party it chose, but because of insufficient ongoing assessment, challenge, and monitoring of that party once the engagement was underway [2]. Gartner research finds that compliance leaders across industries commonly believe eleven to forty percent of their own third-party providers carry genuine, elevated risk — a real, substantial share, not an edge case [2].

A specific, recurring pattern in third-party risk research is directly relevant to how this policy is structured: due diligence conducted before an engagement begins is typically thorough and well-documented, while oversight after the engagement is underway is, in most organizations, considerably weaker [3]. This is precisely why Section 5 of this policy treats ASF's review and acceptance of outsourced work as an ongoing obligation, not a one-time vetting step completed at Section 4's outset.

3. What May Be Outsourced — and What May Never Be

3.1 What May Be Outsourced

• A specific internal audit, where ASF's own available independent auditors are genuinely insufficient (ASF Internal Audit Procedure, Section 4)
• Specialized technical expertise genuinely unavailable within ASF's own Revision Panels for a specific standard revision, engaged as a technical contributor rather than a decision-maker
• Administrative or technical support functions that do not involve accreditation judgment — for instance, the technical infrastructure underlying the public registry, provided the data and decisions it displays remain entirely ASF's own

3.2 What May Never Be Outsourced

The following remain exclusively ASF's own, and are never delegated to an external party, under any circumstance:

• A final accreditation decision, under Section 4.1 of the ASF Accreditation Process Guide
• A final decision on a sentinel event's resolution, under the ASF Sentinel Event Policy
• A decision on a public complaint, under the ASF Public Complaints & Feedback Policy
• Certification of an individual surveyor, under the ASF Surveyor Training Standard

4. Requirements for an Outsourced Party

Any external party engaged under this policy meets the same substantive requirements ASF applies to its own personnel performing comparable work — not a lesser standard adopted for convenience [1]:

• Genuine, verifiable competence in the specific work being engaged, documented the same way ASF documents its own personnel's competence
• The same conflict of interest declaration and review required of any ASF Council member, Revision Panel member, or surveyor under Section 10 of How ASF Develops and Revises Standards
• A written confidentiality undertaking, consistent with the confidentiality principle governing ASF's own personnel

5. ASF's Retained Responsibility

ASF remains fully responsible for any outsourced work product, exactly as if ASF's own personnel had performed it. An external auditor's audit report is reviewed and accepted by ASF the same way an internal auditor's report would be; a technical contributor's input to a standard revision goes through the same Council approval gate as any other input. Outsourcing changes who performs specific work — it never changes who is accountable for the result. Consistent with the real pattern in Section 2, this responsibility is exercised continuously through the life of the engagement, not only at its outset.

6. Agreement and Record-Keeping

Every outsourcing arrangement under this policy is documented in writing before the work begins, specifying the scope of the engagement, the competence and conflict-of-interest confirmation under Section 4, and the confidentiality undertaking. ASF retains this record for the same period it retains comparable records for its own personnel's work.

References

1. International Organization for Standardization. ISO/IEC 17011:2017, Conformity Assessment — Requirements for Accreditation Bodies Accrediting Conformity Assessment Bodies. Geneva: ISO; 2017.
2. Magistral Consulting, citing Gartner research. 7 Critical Outsourcing Failure Risks to Avoid in 2026.
3. calQrisk. Outsourcing and Third-Party Risk Management for Financial Firms. 2026.
4. Effective Strategies for Managing the Outsourcing of Information Technology, citing Jørgensen's research on vendor failure predictors. Walden University dissertation.

Annex A — Outsourcing Engagement Record

External party name: _____________________________________________

Scope of engagement: _____________________________________________

☐ Confirmed: this engagement does not involve a decision reserved to ASF under Section 3.2

Competence

_______________________________________________________________________

Conflict of Interest

☐ Declaration completed and reviewed (Section 4)

Confidentiality

☐ Written undertaking obtained

Engagement start date: ______________________________

ASF reviewer of the work product: ________________________________________

☐ Ongoing review confirmed at midpoint of engagement (Section 5)

Index

Competence Requirement (real predictor), 2, 4

Confidentiality Undertaking, 4

Conflict of Interest Review, 4

Never-Outsourced Decisions, 3.2

Ongoing Oversight (real gap), 2, 5

Retained Responsibility, 5

What May Be Outsourced, 3.1

Outsourcing the work is sometimes necessary. Outsourcing the accountability for it is never acceptable — and the real evidence on why organizations actually fail when they outsource is exactly why this policy does not permit it.