The Australian Prudential Regulation Authority (APRA) released a draft prudential standard on ‘outsourcing’ in November 2001. This will not be a surprise to anyone in the finance sector — other jurisdictions have had such policies or procedures for several years. Nor will it be a surprise given the recent attention to financial collapses — and the focus on APRA’s role in overseeing HIH.
In fact, regulating or at least issuing policy guidelines in such a key area as where financial institutions hand-over ‘material’ business activities to another entity obviously makes good sense.
What is a surprise, though, is the broad ranging powers APRA has reserved for itself, without giving any indication as to when or how it will exercise them.
The new draft standard applies to authorised deposit-taking institutions (ADIs) — primarily banks, building societies and credit unions. At this stage, it will not apply to the superannuation industry, but APRA has stated that it is a high priority to introduce a standard on outsourcing for this industry when the relevant superannuation legislation is amended to allow it.
Under the current draft standard, APRA has the ability to require information directly from outsourcing suppliers, have audits of the ADI performed on its behalf and even carry out onsite inspections itself. The concern among those who specialise in outsourcing is the extent of coverage and the degree of involvement that APRA appears to reserve under the new draft prudential standard.
How APRA will use these proposed powers is key. A strict interpretation and over-active involvement of APRA would possibly alter the supplier/customer dynamics, add layers of extra costs for suppliers and increase outsourcing complexity.
Obligations
Broadly, these fall into two categories: having defined outsourcing policies and taking steps to manage risk. The standard obliges an ADI:
(a) To notify APRA prior to any material outsourcing and about any significant issues or problems that arise during the outsourcing relationship.
(b) To outline the key risks involved in the outsourcing arrangement and the risk mitigation strategies intended. Not only can additional information be requested from the ADI, but also any potential service provider. APRA can request any information it considers relevant from either party.
(c) To have a formal corporate policy in place with respect to outsourcing — set by the board and fully understood and followed by the entire company. The policy must focus on managing risk and include:
Adequate business case preparation;
Detailed tendering processes;
Selection processes (evaluation/due diligence);
Approval routes/board sign-offs;
Contractual requirements (with applicable legal sign-offs — again using experts if required); and
Transition and exit strategies.
(d) To have contractual commitments. The standard sets out minimum criteria that an outsourcing arrangement must contain in a legally binding contract, including:
A specified period or term;
Precise services to be provided and received;
Service levels (including performance benchmarks) and resultant consequences of failure;
Any rules or limitations or subcontracting by the service provider (including similar standards of security and confidentiality applying to any subcontractor);
Effective monitoring by the ADI (including internal/external auditing);
Disaster recovery in the event of an emergency and maintenance of acceptable service levels during such an event;
Termination events, consequences of termination and hand-over obligations (including transitional arrangements);
Pricing and payment;
Formal dispute resolution mechanisms; and
The extent of liability (including whether negligence is limited) and any indemnity or insurance arrangements.
APRA makes it very clear in the standard that outsourcing does not remove the overall responsibility for regulatory compliance or risk-management from the ADI to the service provider. APRA will continue to hold the ADI accountable for all regulatory obligations, even if it is the service provider who fails to perform.
— Cheng Lim is a partner at Mallesons Stephen Jaques. He was assisted with the preparation of this article by senior associate, Quentin Lowcay.
