OR 12 – Guidance on Managing Outsourcing Risk

Banks have long relied on outside firms for core processing and information technology, but the range of work handed to third parties is now much wider: human resources, internal audit, loan servicing and loan review, procurement, appraisal management, marketing and sales, accounting, and wealth and asset management. Each arrangement moves the work outside the institution while leaving the institution answerable for the result, and that gap between who does the work and who carries the accountability is the source of outsourcing risk.

The Federal Reserve Board set out its expectations in SR 13-19/CA 13-21, a supervisory letter dated December 2013. The letter describes the risks that arise when a bank uses service providers and lists what a sound program for managing them should contain. It builds on earlier material about risk from technology service providers (TSP risk), including the FFIEC Outsourcing Technology Services Booklet of June 2004, and extends that thinking to any business function a bank chooses to outsource.

Who the guidance covers

On the bank side, a “financial institution” means a state member bank, a bank holding company or savings and loan holding company together with its nonbank subsidiaries, and the U.S. operations of a foreign banking organization. On the provider side the definition is deliberately wide: a “service provider” is any entity that has a contract with the institution to deliver a business function or activity. It can be a bank or a nonbank, affiliated or unrelated, regulated or unregulated, domestic or foreign. So, a bank cannot argue that an affiliate inside its own group falls outside the guidance; if a contract exists and a business activity flows through it, the relationship belongs inside the program.

Some outsourcing risk is built into the activity whoever performs it: loan servicing carries compliance exposure whether the bank does it or a vendor does. The rest is added by involving an outside party, because the bank now depends on another firm’s people, systems, finances and jurisdiction. Left unmanaged, either kind can end in lawsuits, direct losses, damage to the bank’s name or action by supervisors. The guidance names six categories to weigh before signing an agreement and throughout the relationship.

The categories overlap. A data breach at a vendor starts as an operational failure but can quickly become a compliance, legal and reputational problem as well, so the value of the list lies in forcing each question to be asked rather than assuming a capable provider removes them.

The central principle of the guidance is that a bank can delegate the work but not the responsibility. Once an activity is outsourced, the board of directors and senior management must still make sure it is carried out safely, soundly and lawfully, and a supervisor will treat a failure at the vendor as a failure of the bank’s own oversight.

What the board does

The board, or an executive committee acting for it, sets and approves the policies on using service providers. Those policies create a service provider risk management program covering four things: assessing risk and conducting due diligence, setting standards for what contracts contain, monitoring providers on an ongoing basis, and planning for business continuity and contingencies. The board owns the architecture of the program rather than individual vendor relationships.

What senior management does

Senior management carries out the board-approved policies. It oversees the design and rollout of a risk management and reporting framework containing the elements of the guidance, and it reports regularly to the board on whether the outsourcing policies are being followed. That reporting loop tells the board whether the program it approved actually works, so a bank where vendor issues never reach the board has a governance gap even when its policies look sound on paper.

The program should be risk-focused, with oversight and controls scaled to the risk each arrangement presents. Attention goes first to activities that meet any of four tests: a substantial effect on the bank’s financial condition, criticality to ongoing operations, involvement of sensitive customer information or new bank products and services, or material compliance risk.

How deep and formal the program needs to be depends on how critical and complex the outsourced activities are and how many material ones there are. A community bank that outsources a few critical activities to highly reputable providers can run a simpler program with fewer components. An institution relying on hundreds or thousands of providers for material activities needs many more of them, because its dependence on outsiders is far greater.

The six core elements

Effective programs usually contain six core elements, labelled A to F. They form a cycle rather than a one-time checklist, because monitoring and contingency findings feed the next risk assessment.

A. Risk assessment

The first question is whether to outsource at all. The bank checks that outsourcing fits its strategic direction and overall business plan, then weighs the benefits and risks of handing over the activity, the risk of the particular provider, and the cost of setting up the arrangement. It should also ask whether qualified, experienced providers are available to deliver the service over time, and whether the bank has the skills to oversee the relationship once it begins. A bank that cannot supervise a sophisticated vendor has a risk that no contract can fix. The assessment is refreshed at intervals set by the program, and mitigation plans are revised when the updated results call for it.

Due diligence takes place before the bank engages a provider, and its intensity should match the arrangement. The size, complexity and importance of the intended arrangement push toward a more formal review, while familiarity with the provider and its standing in the industry can justify a lighter one. The bank’s technical experts and the stakeholders who will depend on the service should take part in the review and approval as needed. The review covers three areas.

1. Business background, reputation and strategy

The bank first establishes who the provider is: its corporate history, qualifications and position in the industry, and the background and reputation of the firm and its principals. The provider should run its own background checks on employees, and its experience with this specific service matters, since a strong firm in one line of work may be untested in another. The bank should also judge the provider’s business model (strategy, mission, service philosophy, quality initiatives and internal policies) and how resilient and adaptable that model is, because a business that might not survive a market shift is a weak long-term partner. Finally, it should call references, verify licences and certifications, and look for pending litigation, regulatory actions or complaints against the provider or its principals.

2. Financial performance and condition

A provider in financial trouble cannot keep delivering, so the bank examines the finances of the provider and of affiliates closely tied to it. The review may cover:

• the latest financial statements and annual report, read for capital strength, liquidity, operating results and outstanding commitments;
• sustainability, judged by how long the provider has operated and how its market share in the service has grown;
• how much the bank’s own business would affect the provider’s finances;
• the money and staff the provider commits to serving the bank for the full contract term;
• the adequacy of its insurance and of its reviews of subcontractors’ finances; and
• any other current problems that could weaken its finances later.

3. Operations and internal controls

The bank remains answerable for making sure outsourced services are lawful and consistent with safe-and-sound practice, so it judges whether the provider’s standards, policies and procedures are adequate. Which items need review depends on the activity.

The terms of an outsourcing arrangement belong in a written contract that the bank’s legal counsel reviews before signing, and the bank should understand the legal issues before it commits. The exact terms depend on the activity and on how the provider plans to deliver it, but sound agreements cover a common set of topics. The first group defines what is being bought, what it costs, how the bank can check it, and how information is protected.

Scope

The contract spells out each party’s rights and responsibilities: support, maintenance and customer service; contract timeframes; compliance with laws, regulations and guidance; training of bank employees; whether the provider may subcontract; delivery of statements or disclosures owed to the bank’s customers; insurance requirements; and terms for the provider’s use of the bank’s staff, equipment and property.

Cost and compensation

The contract describes compensation, variable charges and fees for non-recurring items and special requests. It states who pays examination, audit and legal fees connected with the outsourced activity and, where relevant, who buys and maintains the related equipment, hardware and software. The bank should also check that variable fees or commissions do not reward imprudent risk-taking on its behalf.

Right to audit and performance standards

The agreement may let the bank or its representatives audit the provider or receive its audit reports, and should then name the report types and how often audits and reports occur. It should also set measurable standards of performance for what is delivered, because a standard that cannot be measured cannot be enforced.

Confidentiality and security of information

The provider must protect both the bank’s confidential information and its customers’ information, and an outsourced function deserves the same security protections it would receive in-house. The bank must make sure providers pursue the objectives of the information security guidelines in Federal Financial Institutions Examination Council (FFIEC) guidance, including the FFIEC Information Security Booklet of July 2006, and meet the requirements of the Gramm-Leach-Bliley Act, section 501(b). Those measures should map to the bank’s own security processes and be included or referenced in the agreement. The provider should receive only the information the service needs, and may disclose confidential supervisory information only as far as the law allows, a limit found in 12 CFR Part 261.

Nonpublic personal information

Nonpublic personal information (NPPI) is, broadly, personally identifiable financial information that is not public, plus any list or grouping of consumers built from it, as set out in 12 U.S.C. 6801(b). A provider handling NPPI must follow privacy law, including 12 CFR Part 1016, and must tell the bank of any breach that discloses it. The bank and any provider that keeps, stores or processes NPPI are both responsible for it, so contracts should cover its security, retention and access and state each party’s role. Breach duties vary from state to state, and those state requirements should be written into contracts with any provider that stores, processes or transmits NPPI, because misuse of customer data by a provider can expose the bank to liability or regulatory action.

The second group of provisions deals with ownership, failure and the reach of the arrangement beyond the original provider. These clauses decide whether the bank can protect itself and its customers when the relationship goes wrong.

Ownership and license

The agreement should say when the provider may use the bank’s property, including data, hardware, software and intellectual property, and who owns and controls information the provider generates. When the bank buys software from a provider, an escrow agreement may be needed: the vendor’s proprietary source code is held so that the bank can reach it only in set conditions, such as the vendor ending product support or becoming insolvent. Without it, a bank could be left running software nobody can fix.

Indemnification, liability and insurance

Indemnification means the provider covers the bank for claims against it caused by the provider’s negligence. Providers often seek to cap their liability, and the board and senior management should decide whether a proposed cap is reasonable against the harm the bank would suffer if the provider failed; SR 06-4 separately warns against unsafe liability limits in external audit engagement letters. The provider should hold adequate insurance, give proof of it, and report any material change in coverage.

Default and termination

The contract should define defaults, list acceptable remedies and give the provider a chance to cure. It should also set the bank’s termination rights, for example on a change in control, merger or acquisition; a fee increase; failure to meet performance standards, fulfil obligations or give required notices; failure to prevent violations of law; and bankruptcy, closure or insolvency. Notice periods should give the bank enough time to move the service elsewhere, and the provider should preserve and promptly return the bank’s data, records and other resources.

Disputes and customer complaints

A dispute resolution process speeds up disagreements and should say whether the service continues while a dispute is settled. The contract also allocates responsibility for customer complaints; if the provider handles them, it should send the bank summary reports on their status and resolution so that the bank still sees what its customers experience.

Provider continuity, foreign providers and subcontracting

The agreement should cover how the provider keeps services running through operational failures, including backing up information and maintaining disaster recovery and contingency plans, and it may require the provider to test those plans and share the results.

With a foreign-based provider, the bank should consider express choice of law and jurisdiction clauses so that all disputes are decided under one named jurisdiction’s laws. Foreign courts may apply local law, which can enforce contracts differently from U.S. law, so legal advice on enforceability is needed.

If subcontracting is allowed, subcontractors should be bound by the same provisions, and the primary provider should carry overall accountability for everything it and its subcontractors deliver. The agreement should name the services that may be subcontracted, describe how the provider vets and monitors subcontractors and checks their financial capacity, and set notice and approval rules for changing them. Foreign subcontractors deserve particular attention, since privacy and security standards differ across jurisdictions.

D. Incentive compensation review

Many providers sell products or services in the bank’s name, and how they are paid shapes how they behave. The bank needs an effective process to review and approve incentive compensation embedded in provider contracts, along with a check on whether its governance and controls are strong enough for the risks those incentives create. A badly designed incentive can push the provider into imprudent risk-taking, leaving the bank with reputational harm, more litigation and other losses. The guidance’s illustration is variable fees or commissions that encourage a provider to steer customers toward higher-margin products without regard to whether those products suit them.

E. Oversight and monitoring

Monitoring starts with performance metrics chosen by the business line or relationship management as indicators of acceptable performance. The staff overseeing a provider need enough expertise and seniority to manage the arrangement. Oversight, including how often and how fully management reports, is risk-focused. Higher-risk providers may need more frequent assessment, a named person or team as point of contact, and tailored mitigation such as extra reporting by the provider or closer monitoring by the bank. Providers showing performance, financial, compliance or control concerns need still more frequent and stringent monitoring, while lower-risk providers can be watched more lightly.

What ongoing monitoring covers

Financial condition. The bank needs procedures to track each provider’s financial health and ongoing viability, returning to the latest financial statements and annual report for capital strength, liquidity, operating results and outstanding commitments. Where a provider leans heavily on subcontractors, its controls and due diligence over them should be reviewed too.

Internal controls. For significant relationships the bank judges the provider’s control environment, using available audits and reports such as the Service Organization Control 2 report of the American Institute of Certified Public Accountants. For technology services, the bank can obtain the FFIEC Technology Service Provider examination report from its primary federal regulator. A security incident at the provider may itself justify closer monitoring.

Escalation of oversight. Risk processes should include triggers that raise oversight when a provider falls short on performance, compliance, controls or viability. Escalation means tighter and more frequent monitoring, chasing the issues found, reviewing controls on site, and deciding when to use the right to audit the provider’s compliance with the agreement. The bank should also set criteria for switching to other arrangements and ending the contract if problems are not fixed in good time.

F. Business continuity and contingency

A provider can stop delivering because of poor performance, an operational disruption, financial difficulty, or contingency plans that fail when a disruption or natural disaster arrives. The bank’s contingency planning should concentrate on critical services from providers and include alternatives if a provider cannot perform; the FFIEC Business Continuity Booklet of March 2008 gives more detail. In preparing those plans the bank should:

• confirm that a disaster recovery and business continuity plan exists for the contracted services and products;
• judge whether the provider’s plan is adequate and effective and fits the bank’s own plan;
• document who maintains and tests the provider’s plans, and test them periodically; and
• keep an exit strategy, including a pool of comparable providers that could take over.

The exit strategy turns concentration risk into a managed risk: a bank that has already identified substitutes can move a service in an orderly way rather than scrambling after a failure.

G. Additional risk considerations

Suspicious activity reporting. Suspicious Activity Report (SAR) filings are confidential, which makes outsourcing any SAR-related function harder. A bank using providers for parts of this work must identify and monitor the risks while staying compliant with the Bank Secrecy Act (BSA), and management should understand those risks and any BSA-specific guidance.

Foreign-based providers. The bank should make sure foreign providers comply with U.S. laws, regulations and guidance. It may also check whether the provider’s home country rules allow the bank to review operations on site, and whether home country supervisors could reach the bank’s customer information while examining the provider.

Internal audit. When outside accountants take over work traditionally done by internal auditors, the bank should follow SR 13-1 and SR 03-5, which treat institutions covered by the annual audit and reporting rules in Section 36 of the FDI Act differently from those that are not. The Sarbanes-Oxley Act of 2002 also bars a registered public accounting firm from providing certain non-audit services to a public company whose financial statements it audits.

Risk management activities. Banks may outsource parts of risk management itself, such as elements of interest rate risk or model risk management. The bank should require developmental evidence describing the product’s components, design and intended use, so that it can decide whether the product suits its own exposures. A provider that validates models or offers other model risk services should work consistently with existing model risk guidance, SR 11-7.