4. The risks of outsourcing
In all cases, your firm should have appropriate risk-management systems and controls to manage the risks associated with outsourcing.
It is worth noting that firms cannot delegate any part of this responsibility to a third party. The firm is fully responsible and accountable for all the regulatory responsibilities that apply to outsourcing and third-party service arrangements.
If the function could affect the day-to-day running of your business, the delivery of services to your clients, or your firm’s adherence to its FCA regulatory obligations, the risk you encounter when outsourcing that function is higher.
You should conduct a thorough risk assessment before entering into any outsourcing agreement; if the risks outweigh the benefits, you should reconsider if this is the best option.
Regardless of the methods used to assess risk, comprehensive details of your assessment should be documented.
5. Due diligence and the monitoring of ongoing performance
It goes without saying that due diligence is very important on a prospective third-party service provider to ensure they are suitable and a good match for your business and clients.
- Does the business have a good reputation, or has it come suitably recommended?
- Does the business have the ability, capacity and appropriate organisational structure to deliver the outsourced functions reliably and professionally?
- Can the business provide examples of any of their previous work? Has the business worked with similar businesses? Although it is true that outsourcing businesses may not be able to share information about previous projects, it should be able to give you an outline of its previous work and the benefits it has provided its clients.
Take time to compare different third-party service providers and choose the most suitable one for your firm.
You should take necessary steps to ensure this is done thoroughly, and once onboard plan regular meetings with the third party to discuss key performance indicators, risks, opportunities and breaches.
6. Intra-group outsourcing
You do have the option to enter into an outsourcing arrangement with a company in the same group, which includes cross-border outsourcing to parent or sibling companies outside the UK.
Firms with intra-group outsourcing arrangements are required by outsourcing legislation and the FCA rules to meet the same requirements as outsourcing to an external third-party.
Be careful not to assume these types of arrangements are less risky. Any influence should be identified and noted as risks to manage effectively.
Rationale for selecting a third-party service provider, including intra group outsourcing arrangements, needs to be documented and with clear records maintained.
7. Ensure that an appropriate, written agreement is in place
Each firm’s rights and obligations, and those of the relevant service providers, must be clearly allocated and set out within a written agreement.
Your firm must keep your instructions and termination rights, your rights of information and your rights to inspections and access to books and premises.
You should hold regular review meetings with your outsourcer to hold them to delivery of their service-level agreements.
Outsourcing can be a great way to reduce costs and grow your business, but it is important you choose the right third-party service provider for your firm and your clients.
