Paper on outsourcing activities in financial service providers published

• Significant increase in reliance on outsourcing of activities by financial service providers observed.
• Serious deficiencies found in board awareness and understanding of the extent of reliance on outsourcing.
• Major weaknesses identified in relation to risk management controls and processes, and business continuity planning around outsourcing.

The Central Bank of Ireland has today published a paper “Outsourcing – Findings and Issues for Discussion”. This two-part paper uses findings and observations from supervisory engagements combined with results of a survey issued to a sample of regulated firms to assess industry practice.

(i) Part A of the paper emphasises the most obvious and minimum supervisory expectations around the management of outsourcing risks; and

(ii) Part B highlights some of the key risks and evolving trends associated with outsourcing and invites feedback and discussion on these matters.

In recent years, the Central Bank has observed an increasing reliance by regulated firms on outsourcing. In light of the evolving financial services landscape, growing international focus on outsourcing and increasing concerns in relation to outsourcing practices, we undertook a review of outsourcing across the Irish financial services sector. On a widespread basis, governance, risk management and business continuity practices remain far below expected levels. This paper, therefore, is a summary of the key issues and risks identified that require urgent attention.

The Central Bank will hold an outsourcing industry conference in Q1 2019. The feedback we receive on this paper and at the conference will inform ongoing discussions around outsourcing trends, key issues and the appropriate regulatory response.

Gerry Cross, Director of Policy and Risk, said: “As the management of outsourcing risk remains the responsibility of the Board of Directors for individual firms, the Central Bank fully expects that firms will analyse this paper and take appropriate steps to address issues relevant to their outsourcing practices. Furthermore, firms can expect that supervisors will seek evidence of updates to risk management frameworks to ensure that the paper was considered and an examination of outsourcing was conducted.

“The findings in this important report are disappointing. Significant action is required by boards and senior management to meet our minimum supervisory expectations on outsourcing governance arrangements, risk management controls and business continuity practices. This is necessary to ensure these activities do not compromise firms’ operational resilience.”