Outsourcing and Vendor Management

Video for this Topic

Compliance Management

Sections in this Topic

Overview
Why Do Banks Outsource Activities?
What Are the Risks?
Managing an Outsourcing Relationship
Outsourcing Best Practices
Outsourcing Financial Services Activities
Main Page for Grow Shareholder Value

Overview

In a competitive banking industry, mature banks continue to consider the selection and management of vendors as a way to achieve growth and add shareholder value. Bankers at these institutions have commented that at a mature stage, the selection process can be more complicated and more costly than expected. Please review Outsourcing and Vendor Management in Start a Bank. Although it is focused on the start-up stage, the topic provides information helpful to banks in all stages of development. The information below will cover several elements related to mature banks.

Why Do Banks Outsource Activities?

Mature banks seeking to increase shareholder value outsource to take advantage of a variety of benefits. By outsourcing through experienced service providers, a bank can quickly improve the quality of its services, increase its operational or financial efficiencies, and, in many cases, reduce costs. Outsourcing may also allow bank management to increase its focus on the core business functions, expand the availability of bank services, and accelerate the delivery of such services

What Are the Risks?

Even though mature banks may have successfully passed through the de novo years, several risks associated with outsourcing must be understood and carefully managed. For many mature banks, the decision to outsource and the application of the service can be complicated, particularly when the bank has become more complex in its products, services, and customer base. Mature banks will also experience strategic risks, reputation risks, compliance risks, and operational risks.

Strategic Risks: Strategic risk can arise from adverse business decisions and may result in adverse effects to earnings or capital. Not choosing the right service provider may result in unnecessary costs to the institution. In addition, the bank may fail to implement appropriate oversight of the provider or lack adequate expertise and may not be able to recognize and manage problems caused by the provider.
Reputation Risk: Reputation risk can result from poor service from third parties or from customer interaction that is not consistent with the overall standards of the bank. Sometimes third-party practices and activities may not be in line with the bank's practices or desired image.
Compliance Risk: When consumer or legal compliance controls are inadequate, or if an outsourced provider has inadequate control systems in place, compliance risks may occur.
Operational Risk: Operational risk may result from technology failure, inadequate financial capacity to fulfill obligations or provide remedies, and fraud or error.

Managing an Outsourcing Relationship

Banks should manage an outsourcing relationship using risk assessments, a robust service provider selection process, contract documentation, and ongoing monitoring. In the risk assessment, management should evaluate the service provider's ability to provide the necessary level of service. If the product lines at the bank have become complex, this evaluation should include the service provider's understanding of the products and services involved.

The service provider selection process must allow time for bank management to evaluate proposals and present necessary information to executive management and/or the board of directors for review. This is an important step for banks in mature stages, since there should be a desire to maximize value by determining how the proposal may have a positive impact in other areas of the bank.

The contract should clearly define the rights and responsibilities of both parties and contain adequate and measurable service level requirements. While mature banks may be able to absorb some costs associated with contractual problems, there may be more complex issues to address within the contract. Care should be taken to avoid unnecessary expense.

As part of ongoing monitoring, the bank should periodically evaluate the vendor's compliance with service level expectations and conduct an annual performance evaluation. In addition, the bank should consider whether the vendor's financial condition has changed and confirm that the disaster recovery plan is still adequate and that it has been updated to accommodate operational changes that may have occurred.

Outsourcing Best Practices

Banks in any stage of development should be guided by seven principles:

Implement a comprehensive policy to guide the assessment of whether and how activities can be appropriately outsourced.
Establish a comprehensive outsourcing risk management program to address outsourced activities and relationships with service providers.
Ensure that outsourcing arrangements do not diminish the bank's ability to fulfill obligations to customers and regulators.
Conduct appropriate due diligence in selecting third-party providers.
Ensure that outsourcing relationships are governed by written contracts.
Develop and maintain contingency plans, which should also provide for periodic testing of back-up facilities.
Take appropriate steps to require that service providers protect confidential information.