The process of answering these ten questions is the starting point to implement a solid outsourcing privacy environment. To assist in developing and applying good outsourcing privacy practices, elements of the AICPA/CPA Canada's GAPP can be used to address risks or exposures when management collects the necessary information to answer the 10 privacy outsourcing questions listed above