10 Things You Need To Do If You Are Outsourcing an Activity

There is a growing trend towards organisations relying on outsourced service providers (OSPs) to deliver (often key) elements of their overall service. When you surrender service activities to a third party, how can you be certain that the OSP is operating to the standards you require? This can be of particular concern if your organisation is a regulated entity as regulators often demand that certain standards of practice are maintained.

There are many things that you should or could be doing to ensure that OSP performances do not put your service levels at risk. In this blog post, we have picked what we consider to be the ten most important measures that will allow you to quickly assess how your outsourced arrangements are standing up against expected behaviour. For larger organisations, it’s worth noting that pretty much all of the points below can be applied to intra-group outsourcing as well.

What you should know:

  1. Before appointing an OSP, conduct your own careful due diligence on the service providers being considered – we recommend using an industry-standard Due Diligence Questionnaire. Continue to do due diligence throughout the relationship. This is often a regulatory requirement/expectation.
  2. Put a formal written contract in place with the chosen service provider and ensure that it has the approval of the Board / Governing Body and review it periodically.
  3. Be clear about the levels of service and standards that need to be achieved and establish the Key Performance Indicators (KPIs). Be sure to document these in any Service Level Agreements you put in place with your OSP.
  4. Put one person in charge of the relationship with the OSP.
  5. Monitor your service providers on a regular basis against the agreed levels of service and standards.
  6. Conduct periodic reviews of service providers’ operations and processes.
  7. Review your service providers’ business continuity plans, data back-up procedures and data protection arrangements to ensure they are appropriate.
  8. Put a plan in place for responding to a service provider suffering a disruption to their business.
  9. Maintain awareness of alternative service providers who can provide the same service.
  10. Retain a reasonable level of the skills and expertise required to carry out the outsourced activity or function in-house in case the need ever arises for you to take back the activity.

Lastly, you should retain evidence that demonstrates you are doing all of the above.

Good guidance stems from a robust policy.

If you would like to receive an example of an Outsourcing Policy to help get you on the road to better outsourcing, click here.

This webinar focused on the Fundamentals of Third-Party Risk Management. This webinar took place on Aug 26th at 10.30am, 2021 BST.

Recent News

forward thinking imagery

Incident vs Crisis

Not every incident/event is a crisis, but it can have the potential to become a crisis if not ...
Read More
Logging in to attend a CalQRisk webinar

Operational Resilience vs Business Continuity 

At first glance, you might think Operational Resilience is just Business Continuity (BC) by another name, but there ...
Read More
Central bank of ireland building

Assessing your Outsourcing Governance Framework

In March 2022, the Central Bank of Ireland fined BNY Mellon Fund Services €10.78 million for 16 regulatory ...
Read More
laptops on a table doing risk reports

Cybersecurity – What are the risks?

With changes to working culture, and more people working from home than ever, businesses can see the importance ...
Read More
IWD2022 employee spotlight

International Women’s Day Spotlight – Fiona Kiely

It's International Women's Day and today we would like to shine the spotlight on our very own Fiona ...
Read More
risk assessment

10 Key Steps to getting Operational Resilience off the ground

It can seem daunting to begin a brand-new process for your business. However, risk assessments are an easy ...
Read More
CalQRisk and CUMA

CalQRisk at CUMA Spring Conference

CalQRisk will be attending the CUMA Spring Conference & AGM 2022 – “Changing Landscapes” The conference takes place ...
Read More
regtech 100 2022 badge

CalQRisk included in the RegTech 100 List

Now in its fifth edition, the list recognises the world’s most innovative technology solution providers that offer products ...
Read More
risk management cogs and gears of plan

Thematic Review of Risk Management Maturity – Summary of Key Findings

Thematic Review of Risk Management Maturity – Summary of Key Findings Earlier this year, the Central Bank of ...
Read More
Sunday Business Post Logo

Business Post – Improving the Odds

We were delighted to be featured in the Business Post recently. In the article, our CTO discussed the ...
Read More