Take note of changes to outsourcing legislation

Organisations considering outsourcing in a tight labour market will need to get to grips with the relevant legislation. Shona O’Hea talks us through the current guidance

The increasing digitisation of the workforce, changes in business models, globalisation, and remote working capabilities have led to a new approach to the delivery of services.

These changes, coupled with the pandemic and rising demand for employees, have led to an acceleration of outsourcing solutions.

Organisations typically outsource activities for several reasons. It could be to gain efficiencies, focus on core business activities, a need for specialist expertise, to deal with a business change, or to tackle a problematic delivery cycle.

In all cases, it is helpful to know what requirements are needed when considering going down the outsourcing route.

Updated guidance

The Central Bank of Ireland (CBI) recently published new guidance regarding outsourcing. Issued in December 2021, the Cross-Industry Guidance on Outsourcing (CIGO) aims to equip regulated firms with the knowledge to assess outsourcing risks better.

In essence, regulated entities need to ensure effective governance and risk management processes are established to allow for effective oversight of outsourcing.

CIGO, which supplements existing sectoral legislation and regulations, has come into effect immediately and applies to all regulated financial service providers in Ireland.

Sub-outsourcing and offshoring risk

The guidance outlines the CBI’s expectations on specific risks, such as sub-outsourcing and offshoring, along with key considerations managers should know to mitigate risk when entering into outsourcing arrangements.

The CBI recognises the increasing trend for outsourcing arrangements to be spread across different physical and geographical locations. Offshoring presents great opportunities for regulated entities to expand services and teams.

If not set up and governed correctly, however, offshoring can hinder visibility and a regulator’s super-visibility of the activities that are being performed.

Section 5.5 of the CBI’s guidance outlines the steps required to ensure the most effective and appropriate approach to offshoring.

When considering or engaging in outsourcing to offshore jurisdictions, the CBI expects regulated firms to:

• Evaluate the particular risks associated with the country or countries to which they are planning to outsource activities, ensuring that their outsourcing risk assessments pay sufficient attention to 'country risk' and document the assessment;
• Ensure that contracts for outsourced arrangements, including those which are offshored, stipulate that regulated firms and the CBI must be given access to carry out all necessary quality assurance and supervisory work;
• Ensure that there are minimum standards for risk appetite at the outsourced service provider (OSP). These must be aligned to the regulated firm's risk management expectations and requirements to mitigate reputational risks or regulatory breaches;
• Ensure that country risk assessment issues identified are also considered as part of the regulated first disaster recovery and business continuity management; and
• Pay particular attention to complications that might arise in insolvency (e.g. recovery of data and records, protection of intellectual capital), termination and/or recovery and resolution actions.

Restrictions to offshoring

Restrictions to offshoring may occur where the CBI deems that super-visibility is severely constrained or non-existent.

Other concerns include having a memorandum of understanding, the level of contact with the regulator in the offshoring jurisdiction, the location of the offshoring, and excessive operational risks associated with the offshoring of particular activities.

Understanding and applying outsourcing legislation is essential if your business relies on outsourcing services. It is also worth noting that the CBI may update or amend its guidance or provide supplemental advice. Keeping up to date with these changes is crucial.