CBI Discussion Paper 8 – Outsourcing – CBI ups the ante on outsourcers in financial services sector

Anecdotal Myths of OSP Projects

“Lift & Shift”

1. • Work is easy to transfer from donor locations and embed into OSPs.
     Some firms do not undertake a real due diligence of their activities and measurement of cycle times to really assess if the work, – especially if it is partially migrated to the new centre leaving behind a split model – can be serviced efficiently in the target state model across two locations

1. • Staff of new OSP will learn faster than assumed.
     Many business cases use a ratio of c. 1:1.3-1.5 to staff their new operations to allow for additional resources to provide buffer in the early years to allow for productivity deficits. However, some firms do not make these assumptions and struggle on the initial transitions where staff shortages cannot service backlogs or peak periods where the bottlenecks are not fully resourced until a normal business process operation finds its feet which can in many cases take up to 2 years post migration.

Cultural Homogeneity

1. • Operational teams are made up of people who, quite rightly, have great pride in their legacy business and processes to deliver in an imperfect environment. No company has perfect processes and many manual workarounds exist to make up for the deficiencies of technology or lack of funding over many years

1. • When the decision is made to move activity to an OSP, great care and sensitivity is needed to get people on board, to effectively make the transition happen. Real thought is needed to think through the communication strategy to convince the key onshore players that offshoring is a viable business case. In many cases, the decision is only seen as a financial “quick win” without understanding many of the indirect costs associated with what is a longer journey especially managing across the cultural divide that exists. There have been examples where activity moved only 200 miles between cities in in the same country and same firm that have created internal tensions and required a real commitment amongst parties to make it work.

1. • When offshoring to another country where language and cultural are very different, it can take years to really develop a partnership and mutual understanding of each other. There have been many great examples of offshoring working well while there have been other instances where the work has been re-shored because of language and cultural barriers were deemed too high to overcome to ensure seamless service to clients. Those that have been more successful had real champions embedding the training and motivating the teams to learn from their mistakes and keep working in making the model work better or choosing a partner OSP and location that had a better cultural fit.

1. • Where offshoring is mandated by Head office of a large company, there are times when ownership is not in place at the branch level charged with implementation of the strategy. These situations can lead to a “them and us” approach unless the senior management steps in and manages the transition and develops cultural understanding between onshore and offshore teams. Some successful projects have empowered and assigned management from the donor location to drive the project or in some cases to fully relocate to the hub to embed and manage the ongoing operations post -migration. Doing so will ensure a successful transition but will dilute the business case economics, trade-offs that need to be carefully understood up front.

Economics & Client Service

1. • The original business case for offshoring is a key document used to ultimately inform the decision at the board level to commit to a strategy which has significant implications for the company. In many cases, the ongoing indirect costs to service the business in terms of – retained management layers, business continuity, central bank inspections, training, loss of service, additional communication layers – can erode the original value of the business case

1. • Clients, in general, are agnostic to offshoring provided the service provider has the controls in place and their service is not diluted in any capacity. However there have been cases in the funds services sector where clients have clearly requested their service model be ring-fenced and they put a higher value on retaining a higher onshore presence. We are still seeing some service providers re-shore activities as a result of client noise around quality of service.

1. • What is becoming apparent now is that some business cases were not stacking up post-implementation as the pure net arbitrage was eaten away by the indirect costs arising from offshoring outlined above. CFOs were left wondering how overall net headcount was higher when the projects were completed. While in some cases, headcount reduction had been avoided through some creative accounting where resources were re-deployed into other initiatives or cost centres left supporting offshoring remotely (under various guises – Operational oversight, PMO, Risk Mgt., Governance committees etc). We are seeing some situations where this anomaly is now being addressed and hiring freezes/layoffs are happening in some of the larger banks to redress these deficits.

The CBI DP8 is a very relevant and timely document and I believe really tightens the responsibility on the board of the regulated firm to ensure they look-through their outsourcing arrangements holistically. The median number of outsourcing arrangements across all regulated firms in Ireland surveyed is approximately 15 per regulated firm; however, this varies from 41 in banking to 12 in asset management sector firms. The range of outsourcing arrangements across regulated firms is extensive, with a small number of regulated firms having reported maintaining in excess of 1,000 outsourcing arrangements. Moreover, it is expected that the level of outsourcing will continue to increase, with 40% of regulated firms surveyed by the CBI planning to undertake additional outsourcing activity over the next 12-18 months.

The key areas highlighted in the CBI paper include:

Governance

• CBI noted an increase in complexity of outsourced arrangements and a lack of awareness at board level of the consequent level of third-party dependencies on those firms.
• Contractual clauses could be further tightened around onward “chain outsourcing” by the OSP
• Management of Contracts was not helped by poor development, documenting and monitoring of key performance indicators (KPIs) that the OSP is or should be measured against. 40% of respondents reviewed SLAs more than every 12 months and in 17% of cases between 3-5 years.

Risk Management

• Inspections should be more frequent with overall 65% of respondents performing formal inspections annually
• Cloud Services arrangements should be better understood especially around the treatment and handling of sensitive data
• Classification by firms of the outsourced activities was not aligned with the risk profile and criticality of the activities themselves
• In the analysis of Business Continuity Testing, 40% of firms did not test or review the OSP BCPs and where firms did conduct BCP testing with OSP, 20% of the tests failed to meet the BCP objective of firms.
• 56% of contracts for outsourcing arrangements do not have an exit strategy in place in the event of a failure of OSP to provide continuity of service

Cloud Services and Sensitive Data

• The increased focus on the handling of personal data requires expertise to better understand across the regulated firm how data is being managed securely within Cloud Service Providers (CSP)
• Contractual clauses need to be robust to ensure data standards and  data security across OSPs meet the requirements of Irish and EU laws on Data Protection especially when data is being transferred to non-EEA countries

Concentration Risk

• CBI are clearly concerned about the level of concentration risks across insurance and asset management firms where in one example 21 respondents from across asset management sector firms and insurance have 202 arrangements with the same OSP
• In a shift on their focus, CBI will expect regulated firms’ risk management frameworks to include their approach to concentration risk identification, management, and reporting which are appropriate in the context of the nature, size, and complexity of the firm

The CBI is inviting responses and will hold an outsourcing conference in Q1 2019.

Conclusion

The paper highlights the need for firms to invest even more in their internal outsourcing infrastructure on top of the other indirect and intangible operational costs outlined involved in outsourcing. I believe that we will see more and more firms weigh up offshoring arrangements in a more considered manner given the increasing costs of compliance outlined in DP8 and empirical and anecdotal evidence of the hidden costs of these projects on the overall business case profitability.