“Impossible! It doesn’t make sense!” – Léa, Compliance
“How would you even do that?” – Julie, Head of IT
“What are the consequences?” – Karl, Risk
Meet John, an IT Officer at a local Luxembourg AIFM, core member of the IT team, whose primary responsibility is to look after Information and Communications Technology (ICT) outsourcing arrangements. He is the key contact person for all matters relating to outsourcing, both internally and within the Group: Oversight, documentation, review of Key Performance Indicators (KPIs), you name it.
Every month, John meets with the firm’s ICT team and representatives from compliance and risk to lead discussions on outsourcing—the so-called ICT Committee. The internal meeting is chaired by Julie, a member of the senior management and John’s boss.
Today, on a classic Monday morning in Luxembourg, it looks like the monthly ICT Committee meeting gracefully commenced, foreshadowing a marathon of a day, a long week in fact, with the promise of a couple of headaches. None of the members have any idea what is about to unravel.
You see, John has prepared a little surprise. He starts off the meeting by announcing the necessity to urgently terminate the outsourced cloud infrastructure and file server provided by the firm’s Group. “Scandalous! Impossible?! What could have possibly gone through John’s head?” his colleagues are thinking as he speaks—and probably you too, dear reader.
“Why?” interjects Julie, with a surprised look. “Why would we do that!?”
Don’t have time to read the whole blog entry? Then watch our “Blog in 1 minute” video for a quick summary of its main points:
“Oh, not again…” thought John.
This isn’t the first time a specific outsourcing aspect had become a sensitive topic during John’s time at the company.
Now, John found himself once more in an internal discussion regarding the intra-group outsourcing. He takes the floor: “I don’t think this should come as a surprise to anyone. For the past months, I’ve raised several red flags about these services received from our Group’s IT team.”
He continued: “KPIs in the red, if we receive them, repeating incidents… Just two weeks ago we had a whole day of downtime when the server went down, and that was all thanks to a change that they forgot to mention to us! Many of the “solutions” or fixes aren’t working, and our internal policies? They’re more like suggestions at this point, since they aren’t being considered. The regulator is looking right at us. We need to do something, and the sooner the better…or else, we will be on a sinking ship.”
John concludes: “We haven’t taken any action to fix this, therefore the only solution is to exit and find an alternative!”
“Impossible! It doesn’t make any sense!”
John already knows. His previous experience in various companies speak for themselves. A common belief in the market is that when the service provider is part of the Group, it’s by default “impossible” to exit the outsourcing arrangement.
That might appear to be the case because simply exiting from it would mean the end of business for the company. And in most cases it would be difficult to find an alternative solution to provide the outsourced services. But, as one might agree with John, it shouldn’t be the default option. Besides, let’s acknowledge that difficult doesn’t necessarily mean impossible.
Behind the intimidating term “substitutability”, which helps in figuring out whether exiting is an option or not, two important elements are to be considered:
- First, how many alternatives exist in the market—are there a lot of service providers that could offer the same service?
- And second, how easy is it to transition from a current model to a new one?
Most of the time, the hesitation to even imagine a scenario where an entity would have to terminate a Group-provided service to find an alternative arises because the company doesn’t see itself as being a separate entity from the Group.
It’s also up to the Group to select the solutions to be used by their company, either through contracts with third parties, and/or “in-house” solutions. But when you think about it, companies such as John’s are entities on their own. His company is its own “being”, without cutting ties with the Group—akin to a child becoming more independent, while still being part of the family.
Can financial entities exit their Group? Yes. Is that something that’s actually done? That depends. So, is it still impossible? It’s time for John to find the go-to solution and see whether exit is the right way forward for the company.
“It’s time to take action!” – Someone please tell Julie we have to do something!
Back to the meeting, it’s 9:55am. That’s when big news hits the corridors: A major client of the firm has decided to terminate the contracts with John’s firm. The client pointed out the recurrent disruptions, slow services and challenges in digitally reaching their contact person as the primary reasons for the decision.
When a colleague asks John if the termination could be related to the issues with the services provided by the Group, there is no doubt for him, it is related. And so, he calls a meeting for the same day.
After grabbing a quick sandwich, John goes back to his desk. He only has the afternoon to prepare a plan before the call, which isn’t enough time to do it properly, but he knows it isn’t rocket science either.
He starts to gather some pieces of information and answer some questions:
“Isn’t there another way? Shall we actually exit straight away or consider some other solutions? I believe exit might be probably the last resort.”
“Well, here we go again”
The meeting continues. Karl, from Risk, looks jittery and even has goosebumps, and not because it generally gets darker and colder outside at this time of the day in Luxembourg. He is thinking, “How would the Group even react if we decide to exit?”
John ignores this and instead takes the lead by saying: “Okay, look. We’ve all heard the news today about our client leaving. And I’m willing to bet I’m not the only one who can make the connection with our earlier discussion this morning, and over the past few weeks. We simply can’t move forward and expect success, if we continue to rely on such unstable services.”
He pauses, the room is silent. “I’ve spent the entire afternoon thinking about it, and if we all work together, we may be able to sort this out faster and more easily than we think. But we don’t have many options. We can’t simply discontinue this service, but having our own internal solution is probably too complicated, not to mention risky for us at this stage.”
Julie asks: “John, please tell me that there is another way?!”
John smirks and answers calmly: “I believe we should still draft our exit strategy and relevant plan, Julie. However, first, we need to address the issues by collaborating with our colleagues from the Group’s IT service provider. Let’s investigate together to find a solution before resorting to our last option, which would indeed be an exit.”
Everyone sighs in agreement.
“What are the next steps?” intervenes Julie, raising her eyebrows.
John: “We need to present the situation to the Board ASAP and get their opinion on it. This is critical and things can’t continue this way. We must bring them a solution they find acceptable, feasible and ultimately, for our own good”.
“Finally!” The curtain falls.
The meeting comes to an end, as does this endless day. Everyone finally agrees that the circumstances are serious enough to be brought to the Board for a decision. Game plan for all: Julie will give them a heads-up. John will coordinate the drafting of the exit plan as well as the remediation plan to commence as swiftly as possible, supported by his team, and will present it to the Board in an extraordinary meeting taking place in two weeks.
“What are the consequences?” – Learning from experience
This question was raised at the beginning of the very first meeting. And it will very likely be asked again at the Board meeting.
John will clearly have to justify why an exit was not the right direction and that a joint investigation of both parties might be a first remedy to help the continuing issue. His actions will open the doors to reviewing and improving processes and the quality of services, fostering greater trust from clients.
And of course, if one day, John’s company has to exit the group relationship, an alternative will need to be found, but that’s for the next time, dear reader…
What we think
Establishing exit strategies and plans is often challenging, but getting better acquainted with the process for your outsourcing arrangements will also help you to better prepare for your DORA journey.
Cécile Liégeois, Clients & Markets Leader at PwC Luxembourg
Regardless of the service provider, an exit plan is essential for any critical outsourcing arrangement.
Vojtech Volf, Manager, ICT Regulatory and Compliance, PwC Luxembourg
