Outsourcing for Financial Service Providers

Outsourcing is now a key element of the structure of most Financial Services firms, requiring a comprehensive framework to manage suppliers and to manage the additional risks inherent in a more fragmented value chain.

The Central Bank’s Consultation Paper (No. 138 - ‘Cross Industry Guidance on Outsourcing’) closes to submissions in July and the final guidance is expected to be issued before the end of the year.

The draft guidance is intended to apply to all regulated financial services providers, from the very complex banking and insurance groups to the small insurance intermediary. Proportionality is permitted in determining the extent of measures appropriate to individual firms, permitting boards and senior managers to have regard to “the nature, scale and complexity” of the business. This is a much-used term in regulatory guidance and has found its way into many company policies but, being a relative measure, it can be difficult to apply in practice.

The guidance also focuses on the outsourcing of services or functions deemed to be ‘critical or important’; another relative term which individual firms need to interpret to their particular situation.

With room for ‘Proportionality’ and the need to determine what is ‘Critical or Important’ individual firms must develop their own Outsourcing Framework, ensuring that due attention is paid to the cross-industry guidance. At a minimum, the framework should include:

1. An Outsourcing Strategy which clearly states which elements of the business are appropriate to outsource;

2. An Outsourcing Policy which will adapt the guidance to the specifics of the firm, addressing the ‘nature, scale and complexity’ question and assigning responsibilities accordingly;

3. An Outsourcing Risk Management Framework, including risk appetite, risk assessment methodology and a risk register with appropriate risk mitigation controls;

4. For Critical or Important Services, a plan to recover the service or transfer to an alternative provider in the instance of actual or imminent failure on the part of the outsource provider to deliver the service; and

5. An Outsourcing performance dashboard or other form of MI to allow the board and senior management to oversee the achievement of the outsourcing strategy and the management of associated risk.

Through documentation of the above, the very comprehensive cross industry guidance is mapped to the specifics of the company. Proportionality is applied through a series of practical statements and actions which define the company’s outsourcing strategy and facilitate the controlled implementation of same.

Seamus@GovernanceMatters.ie

June 2021