Remediation of the outsourcing control framework

SUMMARY

In 2021, an internal systemic Bank launched a holistic risk assessment of its Depositary Bank (DB) business.

As part of this review, Avantage Reply performed a review of DB exposure to risks related to outsourcing arrangements including the effectiveness of controls to mitigate associated risks.

The assessment involved reviewing the processes, risks and controls related to the outsourcing activities and led to four critical recommandations. As a result, our client needed assistance with the implementation of the remediation actions:

1. Identify and document DB risks linked to outsourced processes
2. Identify all related mitigating controls to achieve an accurate residual risk assessment
3. Update the Risk Control Self Assessment (RCSA) with relevant critical controls
4. Update the framework of risk monitoring
5. Assess whether the national regulations have been adequately taken into account

CUSTOMER GOALS

Following a holistic review of its control framework, the Bank had to remediate its internal control shortfalls, lower its residual risk, and ensure its compliance with the new outsourcing regulation.

CHALLENGES

In order to successfully perform the assessment and to execute the remediation actions, Avantage Reply had to mobilise, within a short period of time, the resources with the specific knowledge and experience. 

Furthermore, the internal control framework is considered a critical and transversal part of financial institutions; its update requires an approval from multiple stakeholders.

SOLUTION

The following 4-phases approach has been followed to deliver the solution:

• Risk assessment: based on the proportionality principle in line with the EBA outsourcing guideline, a throughout risk assesment per process has been performed
• Controls assessment: The bank and its third-party(service provider)-related controls have been identified, evaluated and redesigned when required. An implementation roadmap has been developed with the support and acknowledgement of relevant stakeholders.
• Outsourcing controls framework: validated by leveraging on the work performed during the review of the outsourcing control framework
• Additional crosscheck against the national regulation to consider the residual aspects.