Mortgage outsourcing provider due diligence checklist

A mortgage outsourcing provider due diligence checklist should produce evidence you can review, not a pile of confident “yes” answers. Before a supplier sees a customer file, an Australian brokerage needs to know who will perform the work, which systems they will use, how quality and access will be monitored, and how the arrangement ends. The questions below are designed for administrative and loan processing support. They are a procurement worksheet, not an approval of any particular provider or a substitute for licensee and privacy advice.

Write the service and authority boundary first

Ask the provider to describe the work as a sequence of inputs, actions and outputs. “Process mortgages” is too vague. A usable scope might state that a named team checks factual application fields against broker-approved documents, records exceptions and returns a pack for broker review. Separately identify customer contact, lender contact, product research, recommendations and submission authority. If any of those activities are proposed, have the licensee assess the actual duties and authorisation before work begins.

ASIC's RG 205 recognises that credit licensees outsource administrative and operational functions, but says they remain responsible for their obligations. It expects care in choosing suitable providers and monitoring their performance. RG 205 also explains that a third party undertaking credit activities on a licensee's behalf will generally need the appropriate credit representative or licensee position. A contract calling someone “back office” does not decide the regulatory status of their actual work.

Ask for a response and evidence against each risk

Use the same question set with every shortlisted provider. Record the document, demonstration or named owner that supports each answer, and mark unanswered items for follow-up. The table is a starting point; add requirements from your aggregator, lender agreements and internal policies.

Question to ask	Evidence to review	Decision to record
Which legal entity contracts with us, employs or engages the worker, and may subcontract the work?	Entity details, proposed agreement, worker arrangement and current subcontractor list.	Approve named entities and a change-notice process.
What exactly may staff prepare, change, send or approve?	Task matrix, sample workflow, representative status where relevant and broker signoff points.	Record exclusions and the person who approves exceptions.
Where will customer information be viewed, stored and copied?	Data-flow diagram, systems list, storage locations, retention schedule and deletion process.	Privacy review of each location and transfer.
How are access and activity controlled?	Demonstration of named accounts, multi-factor authentication, role permissions, logs and revocation.	Approve system access only after testing the actual role.
How will quality and continuity be managed?	Training plan, sample quality report, backup staffing plan and escalation route.	Set acceptance criteria and review cadence.
What happens during an incident or at exit?	Notification contacts, response steps, export format, return or deletion process and test result.	Approve a workable transition and evidence trail.

A certificate or policy document may be useful evidence, but it does not show that your proposed account has the right permissions or that your files can be recovered. Ask for a walkthrough using a fictional file. The Australian Cyber Security Centre's procurement and outsourcing guidance discusses documenting shared security responsibilities and controlling service-provider access with individually attributable accounts, least privilege and multi-factor authentication where relevant. Apply a proportionate version to your own systems.

Trace the personal information, including subcontractors

Start with a single file stage. Which identity, income, property and contact details does the provider need? Can staff download or print them? Will a subcontractor or support administrator have access? Where are backups, logs and temporary working copies held? Include customer information in email and CRM notes, not only uploaded documents.

If the brokerage is an Australian Privacy Principles entity, the OAIC says that giving personal information to an overseas contractor is a disclosure in most circumstances, so APP 8 generally needs to be considered. The OAIC explains limited circumstances in which the entity retains effective control and the handling may be a use rather than a disclosure; the specific contract and practices matter. Its APP 11 guidance covers reasonable technical and organisational measures for information an APP entity holds. Give a privacy adviser the actual data-flow and subcontractor details, not a generic assurance that the provider is “compliant”.

Test the workflow before granting broad access

Run a small trial with fictional information. Ask the provider to receive a broker-approved sample pack, identify a missing item, record an exception and return the work for review. Confirm the worker cannot see unassigned cases or release a lender submission. Measure whether instructions were clear, how long questions waited and whether corrections were traceable. This tests the handoff as well as the provider's skill.

Our access permissions matrix gives a task-level starting point for CRM, document, portal and message rights. The wider offshore support checklist covers role scoping and first-month review. Keep provider selection distinct from those operational steps: the supplier must be able to demonstrate how the controls will work for your brokerage.

Put changes and performance into a review rhythm

Record who at the brokerage owns the provider relationship, who reviews file quality and who handles security or privacy questions. Agree on a small set of reports: accepted work, corrections by cause, open exceptions, access changes and incidents. Ask the provider to notify you before changing the legal entity, subcontractor, work location, system or data handling path. The brokerage then decides whether the change fits the approved arrangement before live access expands.

Do not use an uptime percentage as the only service measure. A provider can respond quickly while returning incomplete files. Review a sample of work against the written acceptance criteria and check that the broker's own review point remains visible. Document any repeated gaps and the correction, then reassess whether the scope or provider still fits.

Rehearse the exit while the relationship is healthy

Before signing, ask for the export format and a sample handover. At exit, the brokerage should be able to identify every in-progress file, its latest approved instruction, open questions, next deadline and system of record. The provider should identify approved copies, retention obligations and the method used to return or delete information under the agreement. System owners should revoke each individual's access and verify that active sessions and sharing invitations are closed where supported.

Record who confirms each step and what evidence they will retain. If the provider cannot explain how a file, audit trail and access list move back to you, the exit plan is incomplete. Review Mortgage Talent's trust and operating controls as one input to your comparison, then use the same evidence questions with every provider on your shortlist.