In the third article of our mini-series ‘A Practitioners Guide to IT Outsourcing’, Rhiannon Monahan, an Associate Director within our Governance and Consulting Services Group and former Head of Outsourcing Oversight to a number of financial entities, outlines some practical suggestions on how to reinforce the resiliency of your firm when things go wrong at an IT Service Provider.

Resilience

A firm’s resilience is predicated on both its own abilities, and those of its service providers, to identify and prepare for, respond and adapt to, recover and learn from both digital and operational disruptions. The greater the reliance on its service providers, the more critical the service providers’ business continuity, disaster recovery, and resilience measures are to the firm’s overall stability.

Even with the best will in the world, system glitches, outages and disruptions will happen on occasion. Where an IT Service Provider quickly restores full service within a relatively short period of time, the root-cause and resulting control changes should be reviewed and challenged as part of the firm’s ongoing due diligence programme. If issues are consistent however, or impact critical or important arrangements, the firm may wish to consider more drastic action by either substituting or reintegrating the service.

Service Substitution

If an IT Service Provider has been engaged for some time with no performance issues, it is easy to delay the review of potential alternative providers or forgo conducting a formal request for proposal process. However, without knowing what competitors can offer and at what cost, firms run the risk of selecting an alternative provider who may not represent the best available option, should the need arise.

In addition to identifying credible alternative providers, firms must also assess both the service itself and their relationship with the current IT Service Provider to determine how easy the substitution would be.

• Service: Some services are easier to substitute than others due to their nature. Firms should consider at least the following when assessing the service:
  • The level of automation and volume of data involved.
  • The interconnectivity of systems and the complexity of the processes involved; and
  • The need for specialist expertise and knowledge within the loop.

• Relationship: It is not uncommon to receive multiple non-related services from the same provider, or for the IT Service Provider to be part of the same Group. Should the firm wish to transition a sub-set of services, would the current contract allow for that? Or in a Group scenario, is the IT Service Provider engaged to support a global process that the firm is not expected to deviate from?

Service Reintegration

When assessing how difficult it would be to reintegrate the service, it is important to consider a number of factors, including:

• What has changed since the initial decision to outsource that there is a business-case to bring the service in-house?
• Does the service offering align to the firm’s current operating model and strategy? Will reintegration significantly change how the firm operates?
• Do employees possess the necessary skills to perform the service to the standard required? If not, what additional training and resources are required – are they available and at what cost?
• Is the firm authorised to perform the services in-house?
• How long will it take to have the service up and running?
• How will the market react to a decision to reintegrate? Does the firm have a communication and stakeholder management plan?

Invoking the Exit Strategy

Whether you choose to substitute or reintegrate the service, the firm will need to be a strong position, both contractually and operationally, to exit the arrangement with the incumbent service provider. For each critical or important arrangement, firms are expected to have a viable and clearly documented exit strategy in place covering both distressed and non-distressed scenarios and which includes details of at least the following:

• Who will perform the service in the short and long-term.
• What internal resources will be mobilised to manage the transition.
• What support has been contractually agreed with the incumbent service provider during the transition; and
• What contingency arrangements are in place to limit any disruption caused by the transition.

Each exit strategy must be tested on a periodic basis and approved by the Board. This testing should ensure that the strategy is fit for purpose and reflects the current realities of the arrangement, the firm and the operating environment including any technological advances which might support the service transition. Firms should ensure that all stakeholders to the exit strategy participate in the test and robustly challenge the assumptions and processes therein.

How can we help?

If you would like to discuss any points raised in this article further, please do not hesitate to contact your usual Arthur Cox contact(s), or any member of the Governance and Consulting Services or Technology and Innovation groups to discuss how we can help.