Many organisations choose to outsource critical functions or services to third parties/contractors. However, outsourcing the work does not outsource the responsibility. Globally, in many industries, regulators have now taken a keen interest in how organisations manage outsourced activities that are seen as “critical”. Below, we’ve listed 10 things you should be asking when outsourcing a critical function and/or choosing a new supplier.
- Policies & Procedures – does the supplier have appropriate policies and procedures in place? This may be dependent on the nature of the service, but you should be checking if the organisation has key policies in place such as information security, health & safety, etc.
- Data / Information Security – what data protection/information security controls are in place? Regardless of the information to be shared, all organisations should have adequate cyber security controls in place. Where will the information be stored/processed?
- Disaster Recovery/Incident Response – if a disaster were to happen, what would happen to the supplier’s service levels? You should check their disaster recovery/business continuity plans to ensure the recovery time objectives are acceptable. Does the supplier have a formal incident response plan that is reviewed and tested on an annual basis? Does the plan include specific actions to respond to a cyber incident?
- Insurance – does the supplier have adequate insurance coverage and can they demonstrate this?
- Track record – can the supplier provide references of similar organisations that use their service/offering? This helps demonstrate that the supplier has the adequate skills/expertise to deliver on their service levels. How financially sound is the service provider? What percentage of their business does the work they will be doing for you represent?
- Reporting – can the supplier provide periodic reports on service levels? For example, you might want to know uptime/downtime if it’s an IT supplier.
- Regulatory change – what happens if there’s a regulatory change that impacts the service? Will this be covered in the existing service offering or will the organisation need to pay extra for a new/additional service? Is the supplier regulated – if so, can they demonstrate compliance with the required regulation, etc.?
- Key People – Who will be managing/delivering the service on your behalf? What experience and competence do these people have? Are there enough of them?
- Concentration – How many critical functions are you outsourcing to this supplier? Would a failure of the supplier mean serious damage to your organisation?
- Sub-Outsourcing – Does the supplier intend to sub-outsource some element of the service? Is this acceptable? Will the service be performed in a country that is acceptable in terms of compliance and quality?
Once you’ve chosen a new supplier/outsourced function, the supplier should become part of your ongoing due diligence/monitoring programme depending on their criticality.
For more information on how CalQRisk can assist with your supplier/outsourcing risk management efforts, click here.
Recent News
CalQRisk Wins Best RegTech Solution at National Fintech Awards
CalQRisk, a leading provider of Governance, Risk & Compliance solutions has won the ‘Best Regtech Solution Award’ at ...
Read More CalQRisk shortlisted in National Fintech Awards
The CalQRisk solution is shortlisted for ‘Best Regtech Solution Award’ at the inaugural National Fintech Awards. The National ...
Read More CalQRisk shortlisted in 2023 CIR Risk Awards
Having won ‘Risk Management Product of the Year’ at the 2022 CIR Risk Management Awards, CalQRisk is now ...
Read More From Risk Capacity to Risk Appetite
Risk Capacity is the maximum amount of risk that an organisation is technically able to assume before breaching ...
Read More SMT automates their approach to Risk Management with CalQRisk
SuMi TRUST Global Asset Services (“SMT”), a subsidiary of Sumitomo Mitsui Trust Bank Limited, one of the largest ...
Read More Digital Operational Resilience for the Financial Sector Act (DORA)
The Digital Operational Resilience Act (DORA) entered into force on 16th January 2023. It outlines EU regulations for information ...
Read More 8 Things to Consider in a Data Breach Response
A data breach can lead to reputational damage, financial losses and much more. By effectively preventing and investigating ...
Read More The Golden Thread – Governance, Risk & Compliance
A joined-up approach to governance, risk and compliance (GRC) is something all GRC practitioners aspire to – but, ...
Read More Dark Patterns, Hidden in Plain Sight
If you’ve spent any time on the internet, chances are you will have experienced ‘Dark Patterns’ and may ...
Read More Over 100 Credit Unions Now Using CalQRisk
CalQRisk now has over 100 credit unions actively using their Governance, Risk Management and Compliance solution across the ...
Read More