Account for how outsourcing to third-party service providers gives rise to risk, and set out the features of an effective outsourcing risk management program.
The idea
Outsourcing means a bank pays a third party to perform an activity it could perform itself. The bank keeps full responsibility to customers and supervisors, because the contract moves the work, not the accountability. Risks that arise include operational failure at the provider, compliance breaches, strategic misalignment, reputation damage, and credit or counterparty weakness of the provider. They also include country risk when services or data sit abroad, and concentration when many critical functions depend on one provider or on a few providers sharing the same infrastructure. An effective program is board-approved and risk-based. Policies are set by senior management, with a risk assessment before each decision, due diligence, a written contract, ongoing monitoring, contingency and exit plans, documentation, and independent review. Oversight intensity scales with criticality, not with the fee. The exam trap is believing that indemnities or insurance transfer the risk.
A practice question
A bank outsources its loan servicing to a third-party provider under a detailed written contract. Which statement best describes who remains accountable for the outsourced activity?
- Responsibility passes to the provider once the contract is signed, because the provider now performs the work.Why not: Confuses delegating the work with transferring accountability; a contract does not remove the bank's responsibility.
- The bank remains responsible to its customers and supervisors for the activity and must manage it as if it were performed in-house. - correct
- The bank keeps responsibility for credit losses on the loans, while the provider is accountable for all operational and compliance failures.Why not: Wrongly splits accountability by risk type; the bank stays answerable for operational and compliance failures too.
- If the provider is itself a regulated entity, its own supervisor becomes the party answerable for the service delivered to the bank.Why not: Ignores that the bank's supervisors hold the bank accountable regardless of the provider's regulatory status.
Outsourcing moves the performance of a task, not the accountability. The bank must apply the same standards of safety, soundness and legal compliance as if it ran the activity itself.
A harder one
Over five years a bank has moved payments, card processing and loan servicing to the same cloud-based provider to save fees. Which risk has increased most, and what is the appropriate response?
- Concentration risk; the bank should assess its aggregate dependency and maintain contingency and exit plans, including alternative providers. - correct
- Country risk; the bank should move all processing back onshore regardless of the provider's resilience, and treat the dependency on a single provider as a secondary matter that can be left to the next annual review.Why not: Mislabels the exposure: the key issue is dependency on one provider, not the location, and a blanket reversal is not a risk-based response.
- Credit risk; the bank should obtain a parent guarantee, which removes the dependency.Why not: A guarantee covers financial default only and does not restore service or reduce the operational dependency.
- Strategic risk; the bank should end outsourcing entirely because cost savings are never worth the risk.Why not: Overreacts: the guidance requires managing and monitoring outsourcing risk, not prohibiting outsourcing.
Several critical functions sharing one provider means a single failure can disrupt many processes. The response is aggregate assessment, contingency planning and viable alternatives, not blanket exit.
The hardest tier
A bank has three providers. A: facilities maintenance, annual fee USD 4 million. B: core payments processing, annual fee USD 1.5 million. C: a marketing mailer that holds customer personal data, annual fee USD 0.5 million. Which approach to oversight is most consistent with an effective outsourcing risk management program?
- Tier oversight by criticality and inherent risk: most rigorous for B, strong data-protection controls for C, and a lighter regime for A. - correct
- Rank oversight by fee: A receives the most intensive oversight and C the least.Why not: Uses spend as the measure of risk; the guidance ties intensity to criticality and risk, not contract value.
- Apply the same full program to all three providers to ensure consistency, on the basis that uniform treatment is simpler to administer, easier to audit and avoids debates over which provider is critical.Why not: Ignores proportionality; identical treatment wastes resources on low-risk activities and does not focus on critical ones.
- Exempt B from detailed oversight because the payments provider is itself supervised by a regulator.Why not: Assumes provider regulation replaces the bank's own responsibility to oversee a critical service.
Intensity should follow criticality and risk. B supports a critical function, C carries data-confidentiality risk, and A, though the largest fee, is the least critical. Fee size is the classic trap.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →