Outsourced IT, cloud and supply chains: monitoring and risk management

MONITORING THE OUTSOURCED IT

How to monitor IT service providers ?

• What are the expectations for FINMA for third party service monitoring?
• What are the roles and responsibilities of banks vs their IT service providers?
• What are the key risk areas that need to be taken into account for monitoring activities?
• What are the most common approaches for IT provider monitoring?

MONITORING THE CLOUD PROVIDERS

Outsourcing on the public cloud: security concerns and FINMA’s expectations

• What are the preoccupations and expectations of FINMA?
• What banks are expected to do regarding the cloud providers? How to monitor cloud service providers ?

MONITORING THE SUPPLY CHAINS

Monitoring of supply chains

• Monitoring of nth-party: Regulatory requirements, contractual considerations, challenges and good-practices in the market
• Monitoring of third parties: Managing key and emerging risks stemming from third parties, incl. concentration risk and risks arising from advanced technologies

RISK MANAGEMENT OF OUTSOURCED ACTIVITIES

Less risk for more risk: the outsourcing paradox or how to organise the risk analysis and the risk management of outsourced activities

• The impact of outsourcing: distinguishing the consequences in terms of risk capacity, risk appetite, risk tolerance and overall risk profile.
• Is outsourcing mandatory? Roles and responsibilities of the governing bodies and senior management in assessing the internal organization and the required competencies in light of the institution’s strategy and business model.
• Selection, instruction and supervision of the service provider: what are the governance and organizational challenges when implementing outsourcing arrangements?
• Distinguishing between outsourced expertise and expertise in outsourcing: how can appropriate oversight of a service provider be exercised without being a specialist in the outsourced activities?