Transcription
Managed servicesA catalyst for transformation in bankingA report by the Deloitte Center for Financial Services
Deloitte Risk and Financial Advisory’s Managed Risk Services brings together people, processes,and technology to provide clients with world-class risk management solutions on an ongoing andlong-term basis, so that business leaders can focus on critical challenges that are core to theirgrowth mission. Leveraging domain expertise, Managed Risk Services delivers scalability, reliability, higher performance, repeatability, and predictable pricing outcomes. The value for our clients:end-to-end solution management, reduced risk, stronger compliance, and a lower total cost ofoperations. Contact the authors for more information.COVER IMAGE BY: MIKE ELLIS
CONTENTSIntroduction 2Traditional outsourcing in the banking industry 4Evolving from traditional outsourcing tomanaged services 5How are managed services different fromtraditional outsourcing? 6Which operations in banking and capital marketscould benefit from managed services? 7Lessons learned: Why one life sciences firm turnedto managed services 11What to look for in a managed services provider 13What are the key considerations inimplementing managed services? 15Forging a path forward with managed services 17Endnotes 18
Managed servicesIntroductionIThis transformation may be especially needed in riskmanagement and regulatory compliance. Accordingto Deloitte Touche Tohmatsu Limited’s (DTTL)most recent global risk management survey (10thedition), risk managers from financial services firmsbelieved “cyber risk” and “regulatory or compliancerisk” would grow the most in importance over thenext two years.2 As regulatory paradigms evolve,many firms will likely continue to prioritize sharpening institutional expertise in risk management,compliance, internal controls, technology integrity,and data management.T may be tempting to imagine that the structuraltransformation banks have undertaken for nearlya decade is giving way to a period of stability. Butthe future will possibly show otherwise. While therehas been more stability in recent years, the industry’s core operating profitability has been far fromimpressive (see figure 1) and needs a boost throughinnovative cost management as well as alternaterevenue streams.1 Spurred by new technologies andan evolving competitive landscape, banks shouldcontinue their ongoing transformation.Figure 1. Banking system profitabilityQuarterly return on assets (ROA)1.5%1.0%0.5%0%-0.5%-1.0%-1.5%2006‘06‘06Q1 Q32007‘07‘07Q1 Q32008‘08‘08Q1 Q32009‘09‘09Q1 Q32010‘10‘10Q1 Q3201120122013201420152016‘11‘11 20122013 20132013 20152015 201620162012 2013Q1 Q3 Q1 Q3 Q1 Q1 Q3 Q3 Q1 Q3 Q1 Q3Source: FDIC Quarterly Banking Profile Time Series. Data for all insured institutions.Deloitte University Press dupress.deloitte.com2
A catalyst for transformation in bankingManaging these business-critical processes requiresvast resources, both internal and external. Takeregulatory compliance, for instance. It now coststhe banking industry nearly 270 billion annually, or 10 percent of operating cost, to meet thedemands of regulatory compliance.3 Much of thisspend is because many of the biggest global bankshave doubled the size of compliance and regulatory teams.4 This expansion in internal complianceresources occurred even as institutions increasedreliance on third-party firms in myriad areas: Banksaround the world have spent nearly 200 billion onconsulting services in the years following the financial crisis.5Managed services arestrategic, experience-driven,outcome-based relationships with high levels ofoperational integration andscalability that leverage thespecialized skills, processes,and technology of anexternal service provider.Amid this period of heavy investment in riskmanagement and regulatory compliance, somefirms are choosing to bridge gaps in internal capabilities and adopt a more holistic and value-basedapproach to outsourcing relationships by usingmanaged services. Managed services are strategic,experience-driven, outcome-based relationshipswith high levels of operational integration and scalability that leverage the specialized skills, processes,and technology of an external service provider.EXPLORING MANAGED SERVICES FOR YOUR ORGANIZATIONWho should care about managed services?Risk and operations decision makers across banking and capital markets firms should closelyobserve the evolution and integration of managed services within the industry’s operating models.Managed services are strategic, long-term relationships by definition, demanding the attention ofsenior leadership spanning the banking organization. And with growing complexity and operationalintegration in relationships between banks and their providers, monitoring the adoption of managedservices could also be an important consideration for bank regulators.Some key questions to evaluateOrganizations should seek to understand several critical issues about the application of managedservices in the context of their overall strategy, culture, and structure. Through this paper, weattempt to answer the following questions to help banks make these assessments: How are managed services different from traditional outsourcing? How can organizations create a framework to determine which activities can benefit frommanaged services? In particular, how could managed services benefit the risk, compliance, andgovernance functions within banks? What are the qualities to look for in a managed services provider? How can managed services helpbalance different stakeholders’ demands? What are the key considerations in implementing managed services? What risks should beevaluated before entering a managed services relationship, and how can these be managed?3
Managed servicesTraditional outsourcing inthe banking industryTO view managed services in the right context,it’s often helpful to understand the evolution and growth of outsourcing in financialservices companies. Historically, banks have used avariety of outsourcing models to maximize resourceefficiency. These models have evolved with changingtimes. A good example of this progression is business process outsourcing (BPO), which has existedfor at least several decades. In 1992, AmericanExpress (Amex) spun off its transaction processingunit, where it already had developed scale andexperience, and partnered with a third-party cardprocessing unit. Amex anticipated the commoditization of the transaction processing business, so itplaced a strategic bet to focus on the growth of thecard issuing business.6includes more than 3,000 financial institutions inover 200 countries.8Outsourcing to third parties is only expectedto increase in the future, especially in areas ofthe enterprise that do not significantly enhancecompetitive differentiation.9 Since the birth ofthe modern corporation, the trade-offs of usingexternal resources vs. internal capabilities havebeen a perennial theme in management strategy.The in-house approach may provide greater control,but impacts time-to-market and diverts management attention away from innovation, both keydeterminants of success. Conversely, the relianceon third parties, although beneficial in cost reduction and other ways, carries risks that may not beapparent up-front, including reputational, contractual, and information security risks.10Cost mutualization, where firms, or divisions withina multi-business organization, collaborate to createa utility-like entity, has been another commonoutsourcing strategy. One example is the KnowYour-Customer (KYC) Registry launched in 2014 bySWIFT, the global provider of financial messagingservices.7 The registry is a centralized utility thatdecreases the burden of banks’ KYC compliancerequirements through cost mutualization andenables industrywide standards in data formats andstructure. From small beginnings, this effort now4
A catalyst for transformation in bankingEvolving from traditionaloutsourcing to managedservicesDservices to address deficiencies in internal talent,improve process quality, and adopt technologies tokeep up with market trends. Ultimately, such relationships often refocus managers on growth, innovation, and bolstering the competitiveness of theircore business.TTL’S 2016 Global outsourcing survey ofexecutives from firms representing 26sectors found that “respondents [acrossindustries] increasingly see outsourcing as a vitalway to drive innovation into the enterprise. . . . Itis becoming a means of potentially attaining andmaintaining a competitive advantage—and notjust a way to cut costs.” Academic research supportsthis viewpoint, showing how strategic outsourcingdrives value to firms.11To frame our perspectives on this topic, we relied notonly on existing academic literature and the experiences of Deloitte professionals, but also on discussions with business executives. Twelve C-suite executives from a range of industries, including financialservices, shared their views on the topic of managedservices, with a particular focus on compliance orrisk management functions.As firms’ expectations of providers increase, thescope of outsourcing is widening. Managed servicescould be the next stage in this evolution. Banks canproactively limit enterprise risk and strengthencompliance by using well-designed managed5
Managed servicesHow are managedservices different fromtraditional outsourcing?TThink about cybersecurity, a function typicallymanaged in-house. In 2016, financial servicesindustry firms incurred an average cybercrime costof 16.5 million, the highest across all industries.14This functional area not only poses a high degree ofenterprise risk, but is also growing in complexity. Ina letter about its customer security program sent toits customers late last year, SWIFT noted that there“are likely to be multiple groups of cyberattackersattempting to compromise customer environments.”SWIFT also noted that “there has been an evolutionin the modus operandi, signifying that attackers arefurther adapting their methods.”15 The problem isoften compounded by the challenge of acquiringand retaining qualified talent that demonstrates aconfluence of “technical, business know-how, andstrategic thinking capabilities to implement cyberrisk initiatives quickly and effectively,” as pointedout in the Deloitte Center for Financial Services’(DCFS) study on cyber risk management in financial services last year.16RADITIONAL outsourcing applications spana wide spectrum. IT outsourcing and BPOmodels include staff augmentation contracts,infrastructure-as-a-service, and subscription-basedsoftware-as-a-service models. Cost mutualization,also a form of outsourcing, is common in the industry; examples include custodial entities in thefinancial markets, or internal shared services organizations in large global banks with differentbusiness lines.Cost management has historically been the primarymotive for outsourcing.12 This still holds true:DTTL’s 2016 Global outsourcing survey showed thatcost remains the top driver of outsourcing decisionstoday.13 But firms are now also looking for specialized knowledge at scale to solve complex problems.Many are seeking relationships with long time horizons instead of short-term, transactional exchanges.A specific characteristic of such relationships—thesharing of risk in outcomes—is increasingly attractive to many organizations.Clearly, banks aspire and need to achieve strongercyber risk management capabilities. Money doesn’tseem to be an object—the DCFS study found thatcybersecurity budgets have risen dramatically.17But keeping up with the growing number and complexity of threats, managing legacy infrastructure,framing a proactive cyber strategy, and dealing withtalent challenges are serious hurdles. Could firmsappropriately access knowledge and experience thatexists outside their organizations to limit risk whileovercoming these challenges?Firms are now also lookingfor specialized knowledgeat scale to solve complexproblems. Many areseeking relationshipswith long time horizonsinstead of short-term,transactional exchanges.The use of traditional, cost-focused BPO in such acritical activity, one might argue, is suboptimal. At6
A catalyst for transformation in bankingfirst glance, there would be the lack of available, highquality expertise at adequate scale. Next, the natureof the cybersecurity function demands extremelyclose integration with an external provider, something that can be difficult to achieve in contractbased outsourcing, which tends to become transactional. Outsourcing service agreements nowgenerally include curative provisions and clawbacksfor process failures,18 yet the nature and degree offailures are different compared to a cyber incident,for instance. Instead of reduced systems availabilityin IT outsourcing, customers’ personally identifiable information and company trade secrets may becompromised due to weak cybersecurity safeguards.The costs of such a failure can be hard to measureand may pose existential risk to the institution.approaches. While this provider would be chargedwith notifying the firm about a potential breach ofsecurity, it also brings to the table a wider tool-set,including threat intelligence and analytics, threatresponse, breach remediation, identity management, cyber strategy design and governance, thirdparty cyber risk exposure limitation, and vulnerability assessments. Often critical to this capability isa talent pool that possesses the relevant functionalskills and can adapt to a rapidly growing knowledgebase. Providers in such long-term and outcomebased relationships also typically have “skin-inthe-game” to invest their full resources, capabilities,and institutional expertise to achieve the desiredoutcomes for their clients.For banking and capital markets, governance, risk,regulation, and compliance are some key challengeswhere managed services are immediately relevant.We will now narrow ou
Deloitte Risk and Financial Advisory’s Managed Risk Services brings together people, processes, and technology to provide clients with world-class risk management solutions on an ongoing and long-term basis, so that business leaders can focus on critical challenges that are core to their
