In 2003, Luxembourg extended the supervisory powers of the CSSF by granting the statute of Professional of the Financial Sector to service providers that deliver IT services including accessing confidential data on behalf of a financial institution and other major companies.

To obtain this statute, service providers need to demonstrate expertise in providing IT services and fulfill prudential and reporting requirements as defined by the CSSF.

The observance of regulatory audit requirements and other legal obligations by the service provider is fully integrated in the service package in order to provide the customer with the highest level of confidence.

The foundations of organizational excellence are a clearly defined and well described framework of processes, customs and policies that are implemented and regularly measured across the enterprise. PSFs have analysed and closely aligned their business processes with the statutory requirements and business needs of their customers.

Luxembourg IT PSFs are optimising their process management and quality control with internationally recognised standards and best practice models such as ISO 27001, ITIL, COBIT, SAS70 and others. Service level management is the cornerstone of the added value offered by an IT PSF.

Three pillars underpin the concept of organizational excellence: sound internal control mechanisms, good corporate governance principles as well as compliance and audit.

Internal Control
With policies and processes clearly defined and optimized, the management and board of directors of the organization effectively oversee the execution of internal control mechanisms in relation to:

• management oversight
• risk assessment
• accountability measures
• information and communication
• monitoring of activities

Corporate Governance
The tight supervision rules prescribed by Luxembourg’s financial supervisor authorities lead to an effective application of corporate governance principles. These principles provide guidance, foster the balanced exercise of power and control within the organization, and encourage dialogue and transparency in the best interest of all stakeholders.

Compliance and Audit
Supervised companies must comply with the law and with the circulars published by the Luxembourg prudential supervisory authority. Compliance is assessed by conducting evidence based internal audits. The obligatory auditing helps customers to improve control of their outsourced activities, and guarantees that formal agreements are translated into a tangible reality. (source : Luxembourg for Finance)