Where the persons referred to in the first paragraph of Article R. 561-38-2 use an external service provider pursuant to Article R. 561-38-2, they shall ensure that their internal control system also covers the activities they entrust to this service provider.