Outsourcing and Vendor Management

Video for this Topic

Compliance Management

Sections in this Topic

Overview
Why Do Banks Outsource Activities?
What Are the Risks?
How Banks Can Mitigate the Risks
Steps a Bank Can Take to Properly Manage an Outsourcing Relationship
Outsourcing Best Practices
Other Resources
Main Page for Start a Bank

Overview

Outsourcing is the use of a third-party vendor to perform activities on a continuing basis that would normally be undertaken by the bank. The third party could be an affiliated entity within the bank's corporate group or an entity external to the bank's corporate group. Many minority and de novo bank officials have said that the selection and management of vendors has been more complicated and more costly than they expected. It is important to understand how to select vendors and how to mitigate associated risks.

Why Do Banks Outsource Activities?

Banks outsource to take advantage of many different benefits. By outsourcing through experienced service providers, a bank can quickly improve the quality of its services, increase its operational or financial efficiencies, and, in many cases, reduce costs. Outsourcing may also allow bank management to increase its focus on the core business functions, expand the availability of bank services, and accelerate the delivery of such services.

What Are the Risks?

Several risks associated with outsourcing must be understood and carefully managed; for example, strategic risk, reputational risk, compliance risk, and operational risk.

Strategic Risk: Strategic risk can arise from adverse business decisions and may result in adverse effects to earnings or capital. Not choosing the right service provider may result in unnecessary costs to the institution. In addition, the bank may fail to implement appropriate oversight of the provider or lack adequate expertise, and it may not be able to recognize and manage problems caused by the provider.
Reputational Risk: Reputational risk can result from poor service from third parties or from customer interaction that is not consistent with the overall standards of the bank. Sometimes third-party practices and activities may not be in line with the bank's practices or desired image.
Compliance Risk: When consumer or legal compliance controls are inadequate, or if an outsourced provider has inadequate control systems, compliance risks may occur.
Operational Risk: Operational risk may result from technology failure, inadequate financial capacity to fulfill obligations or provide remedies, and fraud or error.

How Banks Can Mitigate the Risks

The board of directors must maintain effective oversight and ensure that effective controls are in place. Management must maintain effective oversight but must also effectively manage any outsourcing relationships. At the start, management must be prepared to select a qualified vendor, manage and monitor the outsourcing agreement, ensure that controls are in place and validated independently, and ensure that a contingency plan is in place.

Steps a Bank Can Take to Properly Manage an Outsourcing Relationship

Managing an outsourcing relationship involves several key steps, including risk assessments, service provider selection, contract documentation, and ongoing monitoring. In the risk assessment, management will evaluate the capability of the service provider to provide the necessary level of service. The service provider selection process must allow time for bank management to evaluate proposals and present necessary information to executive management or the board of directors for review. The contract should clearly define the rights and responsibilities of both parties and contain adequate and measurable service level requirements. As part of ongoing monitoring, the bank should periodically evaluate the vendor's compliance with service level expectations and conduct an annual performance evaluation. In addition, the bank should consider whether the financial condition of the vendor has changed and confirm that the disaster recovery plan is still adequate and updated to accommodate operational changes that may have occurred.

Outsourcing Best Practices

The bank should follow seven principles for outsourcing:

Implement a comprehensive policy to guide the assessment of whether and how activities can be outsourced appropriately
Establish a comprehensive outsourcing risk management program to address outsourced activities and relationships with service providers
Ensure that outsourcing arrangements do not diminish the bank's ability to fulfill obligations to customers or regulators
Conduct appropriate due diligence in selecting third-party providers
Ensure that outsourcing relationships are governed by written contracts
Develop and maintain contingency plans, which should also provide for periodic testing of back-up facilities
Take appropriate steps to require that service providers protect confidential information

Other Resources

FFIEC IT Examination Handbook: http://www.ffiec.gov/ffiecinfobase/index.html
FRB Supervisory Letters: http://www.federalreserve.gov/boarddocs/srLETTERS/
BAI Online: www.bai.org/bankingstrategies
"Outsourcing Financial Services Activities: Industry Practices to Mitigate Risks": http://www.bs.ny.frb.org/departments/operational/Final_Outsourcing_Paper.doc
Interagency Policy Statement on the Internal Audit Function and Its Outsourcing: http://www.federalreserve.gov/boardDocs/SRLetters/2003/SR0305a1.pdf