Outsourcing, Due Diligence and Dependencies

Outsourcing, Due Diligence and Dependencies

 

Outsourcing is, for many organisations, the only way to access some services. Nowadays businesses simply cannot be so integrated that they can do everything themselves. There is a reasonable assumption that some outsourced service providers (OSPs) are best in class and the experts in their fields but…

If any of your key business objectives or any of your customer obligations depend on an outsourced provider, you will need to be as familiar with aspects of that provider as you are with your own organisation.

Some years ago, we were engaged to conduct a risk assessment on a client’s business continuity arrangements. As part of the assessment they looked at their primary customer service objective; they realised that ‘what mattered’ most was availability. Internally, they were well prepared for the risks identified and had, for the most part, credible plans in place to protect their business objectives in the event of any of the envisaged failures.

However, their service depended on a banking system that was externally hosted in a data centre. Their customers utilised the system’s online portals to buy goods and services such as airline tickets, health and general insurance, groceries and also, among other things, to gamble. Successful completion of those transactions depended on the availability of our client’s process. Therefore, communication with the hosting data centre was critical.

Our client had developed a recognised dependency on (and a very good relationship with) the hosting service provider. They had written a four-second response time objective into the service level agreements coupled with a Six Sigma uptime clause and, for three years, performance was satisfactory. During that time not only did our client’s business grow significantly but their dependency on the outsourced provider had grown in parallel.

The business continuity due diligence risk assessment that we conducted on their OSP showed them to be an excellent risk through all of its key aspects until we got to this question:

Their ‘Don’t Know’ answer set off alarm bells within the OSP’s technical community.  The data centre was using two key telecom service providers and our question provoked an internal discussion about the fibre route maps of the connectivity providers in and out of their facility. They had discovered a single point of failure. The different fibre trunks ran within a foot of one another for almost fifty metres underground near the building’s carpark, meaning the backup resilience of their connectivity was compromised and they risked a total service failure from a single ‘Black Swan’ event.

The data centre and its telecoms providers worked quickly to mitigate the risk and reroute the cable ducting to re-establish the standard separation required. But our client, though appreciative of the immediate rectification and the speedy response to the identified risk, made the strategic decision to second-source. They added another data centre to their network and in doing so built resilience into the whole of their business process. While this decision resulted in additional cost, it facilitated further growth and represented their coming to a serious understanding of outsource or third-party dependency risk.

You cannot be naive about the risk outsourced service providers represent to your business. You will always retain the responsibility for any consequences of their failings. Continuous monitoring of your providers is extremely important; keep in touch, understand how they are doing, monitor the detail of your service level agreements. You can do this by measuring KPIs and / or KRI’s, or by any other method that will allow you to understand the level of your exposure. The point is not to worry unnecessarily but it is to be as prepared as possible for a potentially disruptive event – a withdrawal from a market; a major price change; a service interruption; an industrial relations issues; a change in ownership; reduced flexibility; or the ever-increasing risk of skill shortage.

One of the great indicators is how well prepared your key providers are for a business disruption event… Do you know?

For details on how CalQRisk can benefit your organisation, contact us today.

Recent News

CalQRisk Wins Best RegTech Solution at National Fintech Awards

CalQRisk, a leading provider of Governance, Risk & Compliance solutions has won the ‘Best Regtech Solution Award’ at ...
Read More

CalQRisk shortlisted in National Fintech Awards

The CalQRisk solution is shortlisted for ‘Best Regtech Solution Award’ at the inaugural National Fintech Awards. The National ...
Read More

CalQRisk shortlisted in 2023 CIR Risk Awards

Having won ‘Risk Management Product of the Year’ at the 2022 CIR Risk Management Awards, CalQRisk is now ...
Read More

From Risk Capacity to Risk Appetite

Risk Capacity is the maximum amount of risk that an organisation is technically able to assume before breaching ...
Read More

SMT automates their approach to Risk Management with CalQRisk

SuMi TRUST Global Asset Services (“SMT”), a subsidiary of Sumitomo Mitsui Trust Bank Limited, one of the largest ...
Read More

Digital Operational Resilience for the Financial Sector Act (DORA)

The Digital Operational Resilience Act (DORA) entered into force on 16th  January 2023. It outlines EU regulations for information ...
Read More
Database

8 Things to Consider in a Data Breach Response

A data breach can lead to reputational damage, financial losses and much more. By effectively preventing and investigating ...
Read More

The Golden Thread – Governance, Risk & Compliance

A joined-up approach to governance, risk and compliance (GRC) is something all GRC practitioners aspire to – but, ...
Read More

Dark Patterns, Hidden in Plain Sight

If you’ve spent any time on the internet, chances are you will have experienced ‘Dark Patterns’ and may ...
Read More

Over 100 Credit Unions Now Using CalQRisk

CalQRisk now has over 100 credit unions actively using their Governance, Risk Management and Compliance solution across the ...
Read More