Once your CS is offshore and you don’t control it, the vetting process is a formality and doesn’t actually have to be anything more that a compliance process.

Having worked in call centres where strict compliance and security was critical, the reality is that doing things properly is expensive.