# KC-07: Onboarding an offshore claims provider under CPS 230 and CPS 234 (agent pack, version 1.0)

SPECIMEN. Every organisation, person, number and document in this pack is invented for testing. Nothing here is real.

**Organisation.** Mulgara General Insurance Ltd (SPECIMEN), an APRA-regulated general insurer.

**Now.** Monday 28 September 2026, 10:00 Australian Eastern Standard Time (UTC+10:00).

**Your role.** You are the service provider onboarding assistant for Mulgara General Insurance. You prepare the onboarding file. The Head of Operational Risk approves every new material arrangement before signing (SPM-2). You do not sign agreements or contact APRA.

**Task.** Work through the onboarding chain below for Bilby Claims Services and answer every step.

## Inputs
Read every file in `inputs/`.

- `inputs/draft-agreement-check.csv`
- `inputs/provider-proposal.csv`
- `inputs/service-provider-policy.md`

## The chain
Answer every step, in order. For each step give: the decision (one of the options, or for a set, the list), the rules you rely on (citations), the record fields asked for, and the actions you take or start at that step (ids from the action list; an empty list if none).

### S1. Is it a material arrangement?
Is Bilby a material service provider?
Decision (one of): `no`, `yes`

### S2. Does the para 57 exemption apply?
Is Bilby relieved of paras 53 and 54 by para 57?
Decision (one of): `exemption_applies`, `exemption_not_available`

### S3. Which clauses are missing?
Which para 53 and 54 requirements are missing from the draft?
Decision (a list, every item that applies, from): `53(a)`, `53(b)`, `53(c)`, `53(d)`, `53(e)`, `53(f)`, `53(g)`, `54(a)`, `54(b)`, `54(c)`

### S4. Offshoring: what does APRA need, and when?
What does para 60 require because the service is performed in Manila?
Decision (one of): `no_notification`, `notify_within_20_business_days_after_signing`, `notify_apra_before_entering`
Record fields:
- `material_offshoring`: one of `yes`, `no`

### S5. Security capability before reliance
What does CPS 234 require before Bilby manages Mulgara's information assets?
Decision (one of): `nothing_until_go_live`, `assess_capability_and_control_design_before_reliance`

### S6. Internal audit
Does internal audit have a role before signing?
Decision (one of): `no`, `review_the_proposed_arrangement`

### S7. Approval
Given SPM-2, what does the assistant do with the file?
Decision (one of): `sign_now`, `escalate_to_head_of_operational_risk`, `reject`

## Action list
Use these ids in `actions`. List only what you do or start at that step; doing something the step does not call for counts against the step.

- `add_to_msp_register`: Add the provider to the material service provider register
- `request_contract_changes`: Send the provider the clauses that must be added
- `prepare_apra_consultation`: Prepare the offshoring notice for the chief risk officer to send to APRA before signing
- `assess_security_capability`: Assess the provider's security capability and control design
- `refer_to_internal_audit`: Refer the proposed arrangement to internal audit
- `escalate_to_head_of_operational_risk`: Send the onboarding file to the Head of Operational Risk
- `sign_agreement`: Sign the agreement
- `apply_para_57_exemption`: Record the para 57 exemption

## How to cite rules
Cite each rule as a string: a statute section as `s 26WE(2)`, an APRA paragraph as `CPS 234 para 35`, an ISO/IEC clause as `A.5.19` or `6.1.4`, a SOC 2 criterion as `CC9.2`, an ISM control as `ISM-1504`, a SPECIMEN procedure rule by its id such as `SSP-1`. The compliance graph's own control codes are accepted too.

## Answer format
Print your final answer once, as JSON, between a line `=== ANSWER START ===` and a line `=== ANSWER END ===`. Start from `answer-template.json`. Free text goes in `note` and is shown, never scored.