MOTIVES AND RISKS ASSOCIATED WITH OUTSOURCING OF FINANCIAL …mefmi.org/mefmifellows/wp-content/uploads/2016/10/... · Dibbern, J. 2005). This would create a supply chain of financial

BENEFITS AND PERCEIVED RISKS IN OUTSOURCING: AN

ANALYSIS OF KENYAN BANKING SECTOR.

BY

PETER KARIUKI GATERE

SUBMITTED IN PARTIAL FULFILMENT OF MEFMI FELLOWS

PROGRAM WITH THE MACROECONOMIC AND FINANCIAL

MANAGEMENT INSTITUTE OF EASTERN AND SOUTHERN

AFRICA (MEFMI)

1

Table of Contents

ABSTRACT................................................................................................................ 3

1. INTRODUCTION ............................................................................................ 4

2. THEORITICAL FRAMEWORK, LITERATURE REVIEW AND

HYPOTHESE DEVELOPMENT .................................................................. 10

3. RESEARCH METHOD .................................................................................. 18

4. RESULTS ......................................................................................................... 20

5. CONCLUSIONS AND POLICY IMPLICATIONS .................................... 29

6. REFERENCES ................................................................................................. 32

Appendix I............................................................................................................... 36

Appendix II ............................................................................................................. 38

Appendix III ............................................................................................................ 39

Appendix IV............................................................................................................ 46

2

ABSTRACT

This study examines outsourcing in the Kenyan banking sector. In particular, the

study analyses the perceived benefits and risks associated with outsourcing.

A questionnaire was designed and sent to forty commercial banks operating in

Kenya. Descriptive statistics was utilised to analyse the data. The results show

that Automated Teller Machine (ATM) services were the most outsourced

function in the sector while customer account processing was the least

outsourced function. Banks associate outsourcing activities with high

reputational, operational, strategic and contractual risks. Outsourcing benefits

highlighted are: freeing of resources, cost reduction, access to specialised

vendors, focus on core competence, flexibility and improved services.

Results of logistic regression indicate that bank size measured as total asset is

significantly associated with outsourcing decisions. Bank performance measured

as Return on Assets and ratio of Non-Performing Loan (NPL) is not statistically

associated with outsourcing decisions. Similarly, banks’ wage bill and total

operational expenses are not significant determinants of outsourcing decisions.

The findings have regulatory policy implications, and in particular the urgent

need for formulating a guideline to regulate the apparent proliferation of

outsourcing practices in the Kenyan banking sector.

3

1. INTRODUCTION

Outsourcing refers to the procuring of material or services by a firm from outside

the firm (Amiti and Shang 2005). There are two types of outsourcing: domestic or

international. Domestic outsourcing refers to provision of materials and services

by another firm within the national boundaries. International outsourcing also

referred to as offshoring means procuring of services or material by a company

from a source in a foreign country. The concept of outsourcing includes both

intra-firm (where the company providing the services or goods is part of the

group) as well as arm’s length outsourcing (where the goods and services are

provided by a firm or company which is independent of the firm).

Outsourcing for the purpose of this research is defined as supply to a bank

services and facilities that are essential for the provisions of banking services to

customers. The focus of this paper is outsourcing of services both domestically

and internationally by Kenyan banks.

Outsourcing of services has received enormous amount of attention in the media

and political circles in recent times especially in America, USA, Australia and

India (Pujals, G 2004). However, much of the attention by the media on

outsourcing has been due to jobs moving from industrialised countries such

America and Canada to developing countries such as India and Eastern Europe

(Amiti and Shang 2005). The enormous growth in services outsourcing in the

western world countries is a reflection of the benefits from greater division of

labour and trade that have existed in the normal trade of goods from the olden

days.

4

Outsourcing has been part of human life since time immemorial as part of trade.

However, what is causing excitement among stakeholders is the increase in

service outsourcing. In the past, banks were outsourcing peripheral functions

which were not core to the provision of financial service such as payroll

processing, security, cleaning and building maintenance. Currently, banks are

outsourcing core activities such as business processing, internal audit,

information technology (IT), back office, human resources management, cash

handling, ATM services and card processing.

The rapid growth in service outsourcing is being driven by IT. IT plays an

integral role in virtually every business process. Most of the data required to

perform a particular task is now available online and data processing is being

carried using specialised software and online channels (Gewald and Dibbern,

2005). This explains why outsourcing is dominant in business processes in which

IT plays a key role. Examples are; administrative services such as pay role

function in human resources, claims management in finance and warehousing

logistics (Rouse and Corbitt, 2004). One industry that advancement in technology

has dramatically revolutionalised the way business process is carried out is the

banking sector. Almost all the data in the banking sector are available in digital

form and many services are now available through the internet. The balance in a

current account, an international payment or the purchase of mutual funds is

merely an electronic transaction which takes in place in bits and bytes on a

storage system with a corporate data center (Gewald, H and Dibbern J. 2005).

Due to its IT-intensive business processes the potential for outsourcing appears

to be particularly high in the banking industry. It is only a matter of time before

the back office functions are taken over by specialized vendors that could create

significant economies of scale in transactions processing (Gewald, H and

5

Dibbern, J. 2005). This would create a supply chain of financial services like those

being established in other industries such as automobile industry (Tas and

Sunder, 2004).

Purpose of the study

Increasing trends in outsourcing of financial services by banks have raised

serious concerns among the members of the public and supervisors. Outsourcing

is increasingly being used as a means of both reducing costs and achieving

strategic goals. Many regulatory surveys of industry practices indicate that banks

are entering into arrangements with other firms, related firms within a corporate

group and third party service providers to conduct significant parts of the

enterprise’s regulated and unregulated activities (Joint Forum 2004).

In Kenya, outsourcing is on the increase. There are many articles in the local

daily newspapers explaining this phenomenon and in particular emphasizing the

benefits of call centers (Daily Nation, May 2006). While outsourcing is not a new

phenomenon in the banking sector, especially among multinational financial

institutions, local financial institutions are slowly embracing the practice of

outsourcing.

In Kenya outsourcing of financial services is being carried out without proper

risk management frameworks. A recent survey conducted by the Central Bank of

Kenya on risk management practices in the banking sector concluded that in

most of the functional areas, banks lack risk management frameworks and senior

management and board oversight (CBK Risk Management Survey, 2005). In

addition, there is no regulatory framework in place on outsourcing in the sector.

6

Research carried out so far only focuses on outsourcing in developed countries

and there has been limited published research on outsourcing of Africa.

Tas and Saunders (2004) in their conceptual framework, compared the financial

sector with the manufacturing sector industry and came to the conclusion that

the financial industry will follow a trend towards vertical disintegration similar

to that in the product producing industry and the strategy of focusing on the core

competencies will be a major driver for the growth of outsourcing in banks.

Lancelotti , R., Schein, O., Srang, S., and Stadler, V. (2003) interviewed 70 board

level executives of 31 different European banks on their outsourcing practices.

Their main findings are that banks already use the outsourcing option to a

certain extent, and majority intends to increase their level of outsourcing in the

future. Interestingly, the findings also suggest that only 42% of the outsourcing

deals conducted by the banks delivered the expected results. Studies that have

been carried in other jurisdictions include; Survey on the motives of outsourcing

(European Central Bank 2004), offshore outsourcing of data services by Insured

Institutions and associated consumer privacy risks (Federal Insurance

Corporation June 2004), outsourcing financial services activities: industry

practices to mitigate risks (FRBNY October 1999).

To the best knowledge of the researcher, to date, there is no study that has

examined benefits and perceived risks in outsourcing in Kenyan banking sector.

In addition, there is little knowledge on outsourcing among the bank supervisors

in Kenya. Given the general dearth of research in the Kenyan context, the

exploratory and empirical nature of the study demonstrates its importance to the

banking industry, and in particular the regulator in designing the appropriate

7

framework for regulating associated risks. Thus, this research attempt to address

two related questions:

1. What are the perceived risks and benefits of outsourcing by banks?

2. What factors explains outsourcing in the Kenyan banking sector?

The study focuses on the Kenyan banking industry because of the following:

a) Outsourcing has been identified as a key regulatory concern in the ongoing

review of the Banking Act (Central Bank of Kenya). Thus, in its explanatory

nature, this research will explore benefits and risks associated with

outsourcing in the banking sector.

b) There is a strong competition in the Kenyan banking industry. Outsourcing

is seen to be a strategic cost cutting measure to improve profitability. While

cost cutting is an obvious benefit, there certainly risks associated with use of

third party in banking transactions. Banks in Kenya are facing severe

competition and one of the options of improving their profitability is

through cost cutting. This will force them to formulate alternative ways of

business processing and governance.

c) There is a trend towards outsourcing as a major strategic initiative in the

Kenyan Banking sector.

8

Objectives of the study

The aims of the study are to:

(i) Identify the benefits that motivate banks to outsource businesses

processes.

(ii) Identify perceived risks in outsourcing

(iii) Draft a regulatory framework to be used in regulation of outsourcing

arrangements by Central Bank of Kenya.

Importance of the Study

The findings of the study would be useful to:

(i) The regulators, who need to understand the attitude of banks towards

outsourcing.

(ii) The management of banks who are concerned with the risks associated with

outsourcing.

(iii) The regulators in designing appropriate guideline to regulate outsourcing

in the banking industry.

(iv) The guideline on outsourcing will be useful to bank examiners as a means

to evaluating associated risks.

The structure of Kenya of Kenyan Banking Sector

There were 41 commercial banks, 1 non-bank financial institutions

(NBFIs), 2 mortgage finance companies, and 1 building society in

Kenya as at the end of December 2005 as shown in the diagram 1.

9

Diagram 1

Central Bank of Kenya

Public Financial Institutions Private Financial Institutions

• National Bank of Kenya • Consolidated Bank of

Kenya • Development Bank of

Kenya

Local Foreign

• Commercial Banks (11) • Commercial Banks (27)

• Mortgage Fin. Inst. (2) • Building Society (1) • Financial Institution (1)

Source: Banking Supervision Annual Report (2005)

2. THEORITICAL FRAMEWORK, LITERATURE REVIEW AND

HYPOTHESE DEVELOPMENT

Introduction

This section of the research paper document the conceptual theoretical

framework utilized in this study, as well as the literature review as the basis for

developing hypotheses to be tested. The first part outline the theories used.

10

Theoretical Framework

The risk benefit analysis in decision theory compares the risks associated with

and the benefits expected of a decision that is made, in order to achieve an

optimal result. This concept has been discussed by Jurison (1995). When the

concept is applied to outsourcing, it means that the manager or decision maker

has to assess all the potential risks and benefits that may arise from outsourcing

process.

Perceived risk theory analyses the risk a person subjectively associates with the

consequences of a decision and its impact on the intention to close a transaction

(Bauer 1967). This theory is grounded on the fact that as long as the perceived

benefits outweigh the perceived risks, the person in charge will have a positive

attitude towards a particular decision. Potential risk can be explained as a risk

inherent in a transaction which may lead to desired or planned outcome not

being achieved. In information system research, perceived risk inherent in a

transaction plays a critical role especially in adoption of technology. For example,

Feartherman (2001) found that the overall potential risk may reduce the

usefulness of an activity. Also, Pavlou (2001) noted that potential risk reduces

individual intentions to conclude a deal.

It is apparent that the individual perception towards outsourcing could either be

positive or negative. Negative perceptions of outsourcing are often equated with

risks of outsourcing, ie the possibility of outsourcing failure (Aubert, et al., 1998;

Earl, M.J 1996). Similarly, there are a number of outsourcing advantages, which

may be summarized as outsourcing benefits (Dibbern, et al., 2004; ECB 2004). In

this case, the study applies the risk benefit framework to study outsourcing

decision. The framework is in line with decision theory regarding decisions that

involve risk or uncertainty (Friendmann and savage, 1948, Machina, 1987;

11

Tamura, 2005). In outsourcing context, the concept has been discussed by Jurison

(1995, 1998, 2002) who developed a framework analyzing the trade off between

the cost advantages and monetary risks of IT outsourcing. This means that the

decision maker has to assess all the perceived risks and benefits that may arise as

a result of outsourcing. These factors are combined to come up with overall

benefits and overall risks. In line with this theory, one can conclude that the

decision to outsource is positively influenced by perceived benefits of

outsourcing and negatively influenced by perceived risks of outsourcing.

Literature Review

Outsourcing, has acquired the reputation of being risky business (Aubert, et al..,

2002). Empirical evidence shows that many organizations have failed to deliver

the desired results (Lancellotti, et al., 2003.) This means that outsourcing is as

risky as any other uncertain venture (Aubert, et al., 2002). It is therefore natural

that the decision makers carefully analyze the risks associated with the

alternative governance modes before deciding to outsource a business function.

After explaining the concept of perceived risk employed in this study and its

applicability in making outsourcing decision, the next step would be to identify

the individual risks that taken together, would influence the overall decision

making by the management of the bank. In this regard, the perceived risks cited

by the joint Forum (2005) have been adopted. The joint Forum identified the

following risks; strategic risk, reputational risks, compliance risk, operational

risks country risk, counterparty risk, contractual risks, access risk concentration

and systemic risk and exit risks.

12

A survey by Federal Reserve Bank of New York (1999) on industry practices for

outsourcing arrangements suggests that banks outsource financial services

because of the following reasons:

a) Enhanced performance- A third party service provider may provide better

performance at a lower cost than in house providers because of economies of

scales, specialization and tactical focus.

b) Reduced costs – Cost savings may be secured by converting fixed costs to a

variable cost structure to accommodate fluctuations in labour and equipment

needs.

c) Ability to access superior expertise and industry practice – Outsourcing

provide immediate access to expertise and best business practices that may be

too expensive to build internally or hire especially in areas like technology.

d) Desire to devote scarce human resources to core business.

e) Strategic reasons- Financial institutions may outsource for strategic reasons or

to effect organization changes. They may outsource rather than start up a

business internally. It might also be part of an exit strategy for a business that

is about to be divested. Some institutions change their technology

environment by outsourcing their large computer systems and redeploying

in-house resources into newer technology initiatives.

In addition, the study indicates that although there are many benefits derived

from outsourcing of financial services, the arrangement give rise to potential

13

risks. These risks were identified as strategic, reputation, credit, compliance,

transaction and country risk.

Similarly, Federal Reserve Bank of San Francisco (2004) survey on outsourcing by

financial services firms note a number of motives for outsourcing by banks as

follows:

a) Operational efficiency and associated costs that a firm cannot achieve on its

own,

b) Concentrating on core business functions and hence allocate available

resources efficiently.

c) Develop and provide new customer services more quickly and reliably.

Similarly, a survey conducted by European Central Bank (2004) reveals that

although the benefits of outsourcing are evident, in practice, many banks believe

that outsourcing introduces new challenges and risks. The study highlights the

benefits of outsourcing as;

a) Cost reduction- cost reduction was cited by 90% of the respondent banks as

one of the reasons for outsourcing.

b) Access to better technology and infrastructure and strategy of focusing on

core activities.

c) Economies of scale which leads to improvement in synergies achieve

diversification benefits or streamline services.

d) Focusing on core activities.

e) Free scarce resources.

14

f) Quality services brought about by professional management of services.

g) Brings flexibility in the entire organization.

As with the Federal Reserve Bank of New York, the European study also reveals

that outsourcing may bring certain risks to the banking business. These risks are:

a) Operational

b) Legal

c) Strategic risk

d) Country risk

e) Reputational risk

f) Loss of flexibility

g) Loss of control

h) Cultural/ social problems

Pujals, G. (2004) conducted a study on offshore outsourcing in the European

Union financial services industry. Results of the study indicate that banking

institutions may choose to outsource certain activities for various motives. Some

of the motives cited are: cost reduction, access to new technology, focus on core

activities, improvement of quality of services and greater flexibility. In addition,

the study identified the following risks associated with outsourcing of financial

services;

a) Loss of control over service,

b) Operational risks,

c) Loss of internal skills,

d) Loss of flexibility,

e) Cultural and social problems,

15

f) Technical constraints,

g) Decline in quality and competitive advantages.

Michel and Michelle (1999) conclude that the drivers of human resource

outsourcing are rather specific to each type of activity. The transaction-cost

determinants appear to play a particularly important role in the human resource

outsourcing decisions.

Outsourcing decision is an organization decision which takes place at board and

senior management level. The Central Bank of Kenya Corporate Governance

Guideline places the responsibility of managing the bank on the board of

directors and senior management. It means that the board of directors remains

accountable for all operations of the bank whether, they are performed internally

or externally. Therefore, the board of directors can only transfer the function to a

third party but not the risks. Thus, people responsible for outsourcing have to be

sensitive to outsourcing risks.

Hypothesis Development

Three hypotheses, namely, size, cost reduction and profitability are tested as

possible predictors of banks’ decision to outsource certain functional activities.

The hypotheses tested are based on literature review of pertinent studies.

Size

Size of a company portends a number of attributes such as business complexities

and geographical dispersions. Larger firms may benefits from outsourcing

16

decision taking into account the economies of scale that favour such practices

(Love and Ropers 2001, Ono 2003 as cited in Hong, Chin and Liu). Large

companies may be better placed to manage risks associated with information

technological advances (Palvia and Chervany 1995). Thus, this research posits

that size may be associated with outsourcing decision. The following hypothesis

is therefore examined:

HI: Bank size is positively associated with outsourcing decision.

Cost reduction

One of the key motivations for outsourcing certain aspects of business activities

is to save on cost reduction associated with this practice. In this regard,

Kakumanu and Portanova 2006 note; “the main driver in outsourcing is often

cost reduction”(p.2). In an empirical study of outsourcing by UK firms, Girma

and Gorg 2006 concluded that; “high wages are positively related to outsourcing,

suggesting that the cost-saving motive is important” (p.817). Thus, consistent

with prior findings the following hypotheses is tested:

H2: Bank wage ratio is positively associated with outsourcing decision.

Profitability

Banks outsource certain activities to concentrate on the core function of the

banking business. This will enhance an institution’s competitiveness in the

industry and improve earnings. Hence, the following hypothesis is tested:

H3: Bank profitability is positively associated with outsourcing decision.

17

3. RESEARCH METHOD

a) Data Collection

The study used primary data which was collected from a sample of all

commercial banks operating in Kenya in December 2006. A list of all banks

operating in Kenya as at 31st December 2005 showing their net assets, deposits,

capital and profitability is presented as appendix III.

A structured questionnaire consisting of closed ended questions was developed.

The questionnaire is presented as appendix I. A letter of introduction to the

respondents is presented as appendix II. Questionnaires were sent to staff

members of 40 commercial banks who were in charge of finance and strategy

functions. One of the banks was under Central Bank statutory management and

therefore no questionnaire was sent.

Each construct is represented by a set of indicators which form the question in

the survey. The attitude/opinion of the respondents was captured on a positive-

to- negative 5 point Likert scale. Questions regarding the perceived risk- state a

risk and how the respondent rates the risk on the following scale; very high,

high, rather high, neutral, rather low, and very low. Questions on the perceived

benefits- give a statement and ask for the level of agreement on the following

scale: strongly agree, predominantly agree, rather agree, neutral, rather disagree,

predominantly disagree, and strongly disagree.

The questionnaire was discussed independently with staff of supervision,

Research and External payment Departments of Central Bank of Kenya. Based

on their insights acquired in the discussion, the questionnaire was modified and

finalized.

18

The time period for returning the questionnaires was four weeks from 1st

December 2006 to 31st December 2006. However, due to poor response, the

period was extended to 31st January 2007. Overall, 19 questionnaires out of 40

which had been sent out were returned. This represented a response rate of 48%.

The aim of the study was to identify factors that motivate banks to outsource

some of the functions and the perceived risks. On the question of perceived

benefits, respondents answering one 1 or 2 are regarded as positive on the

benefits outlined in the questioned. Any respondent answering 3 can be

regarded as neutral and respondents answering 4 or 5 can be regarded not in

support of the benefits.

In case of perceived risks, respondents answering 1 or 2 can be said to perceive

outsourcing as risky business, respondents answering 3 can be said to be neutral

or undecided, while respondents answering 4 and 5 can be said to perceive

outsourcing as not risky.

The following framework was used to interpret the responses:

Data analysis technique

To analyse the survey data basic statistical tools such as proportions and means

are utilized. This is particularly useful in evaluating banks’ motivation to

outsource as captured on the 5-point Likert scale.

In addition, to further examine determinants of outsourcing practices, logistic

regression analysis is applied in this study. Given the dichotomous attribute of

the dependent variable, logistic regression is suitable over other regressions

19

techniques such as the Ordinary Least Square (OLS) and the Probit regression

(Madalla 2001). The logistic regression model can be defined as:

OUTS (0, 1) = β0 + β1SIZE + β2COST + β3PROFITABILITY + еi

Where:

OUTS (0, 1) Is the dependent variable, 1 is for outsourcing bank and 0

otherwise.

β0 Is the constant

Size Is measured as total assets of a bank as at 31st December 2005

Cost Is measured as ratio of wage to total operating costs

Profitability Is measured as Return on Assets

еi The residual error

4. RESULTS

Descriptive analysis

a) Background of the respondents

The respondents were well educated with 89% holding at least a first degree

and all the respondents occupying management positions. This means that all

the respondents were well versed with the policies and operations of the bank.

Only 28% of the respondents were female, an indication of low female

representation in finance field.

20

Table 8.1Background information

Background Proportion of the

respondents %

Gender

Male 72

Female 28

Total 100

Age(Years)

Under 25 0

26-35 39

36-45 33

46-55 22

Over 55 6

Total 100

Level of Education

Secondary School 6

Degree 6

Postgraduate 50

Total 39

Position in the organization

Executive Management/Head of Department 78

Middle level Management 22

Junior Management 0

Total 100

21

b) Level of Outsourcing

The level of outsourcing was captured by asking the respondents to state

whether the following functions are outsourced or not: (1) The bank already

outsourced the process: (2) Is outsourcing arrangement currently under

consideration: (3) has bank ever decided against outsourcing the function: (4)

has bank ever decided to reintegrate the process to the bank.

Table 8.2 shows the level of outsourcing for each function. Analysis of the section

on the level of outsourcing indicates that ATM function is the most outsourced

function in the banking sector in Kenya with 67% of the respondents indicating

that their banks have already outsourced the function. The high rate of

outsourcing of the function may be explained by high costs of maintaining ATMs

and also, the emergence of private companies offering the services on sharing

basis. Card processing is the second highly outsourced function with 58% of the

respondents confirming that their banks have already outsourced the function.

Customer account processing is the least outsourced function with none of the

respondents indicating that their banks are outsourcing the function. This is

probably explained by the seriousness the banks attach to the principle of

confidentiality and is consistent with global concerns about money laundering

where ‘know you customer’ is the starting point to combat this vice.

Internal audit was cited by 16% of the respondents as one of the function that

banks have at one point thought of integrating back to the main functions of the

bank. This may be explained by critical role the function plays in the whole

business process and if the outsourced firm or individual is not delivering

quality service, the management and the board may have a cause to worry.

22

Table 8.2 Level of outsourcing

ATM Card

processing

%

%

Internal

Audit

%

Human

Resources

%

Sales/

Marketing

%

Information

Technology

%

Debt

Collection

%

Customer

account

processing

%

Already

outsourced

79 58 11 26 21 32 32 5

Under

consideration

0 11 0 11 16 11 5 5

Decided

against

0 11 16 0 0 5 5 5

Reintegrate

the function

11 5 21 11 0 11 16 11

23

c) Perceived benefits of outsourcing

The results of the questionnaire responses on perceived benefits of outsourcing

are shown in on table 8.3. The respondents are generally in agreement that

outsourcing process brings benefits to a bank. Focus on the core business was

cited by all the respondents as one of the benefits derived from outsourcing

arrangement. Freeing of resources to other functions of the bank, was rated

lowest with only 45% of the respondents citing it as one of the benefits that is

derived from outsourcing function. Access to specialized vendors was also

positively identified as the benefit that accrues to a bank. This is especially true

in IT field where the banks would prefer to outsource due to rapid changes in

technology.

24

Table 8.3: Perceived benefits

Strongly

agree

Agree% % Neutral % Disagree % Strongly

disagree

% Total

%

Mode

1 2 3 4 5

Cost reduction 14 67 5 24 2 10 0 0 0 0 100 1

Focus on core 11 61 7 39 0 0 0 0 0 0 100 1

Access to specialized 9 45 10 50 1 5 0 0 0 0 100 1

Improved services 10 53 7 37 2 11 0 0 0 0 100 1

Free resources 4 18 6 27 7 32 0 0 5 23 100 2

Provide flexibility 5 26 9 47 5 26 0 0 0 0 100 2

Others 2 50 2 50 0 0 0 0 0 0 100 2

25

d) Perceived risks in outsourcing

Table 8.4: - Perceived risks

Risks Very

high

% High % Neutral % Low % Very

low

% Total

%

Mode

1 2 3 4 5

Strategic risks 4 21 6 32 4 22 5 26 0 0 100 2

Reputational risk 6 32 9 47 1 5 2 11 1 5 100 2

Compliance risk 3 16 5 26 6 32 4 21 1 5 100 3

Operational risk 1 5 10 53 3 16 4 21 1 5 100 2

Country risk 0 0 2 11 8 42 6 32 3 16 100 3

Counterparty risk 0 0 9 47 7 37 1 5 2 11 100 2

Contractual risk 3 16 7 37 4 21 3 16 2 12 100 2

Access risk 0 0 7 37 5 26 6 32 1 5 100 2

Concentration 1 5 4 21 7 37 6 32 1 5 100 3

Systemic risk 5 7 37 6 32 3 16 2 11 100 2

Exit 0 0 6 32 7 37 4 21 2 11 100 3

26

Respondents cited reputational risk, strategic risk, operational risk and

contractual risk as the most likely risks in outsourcing, with 79%, 53%, 58% and

53% respectively of the respondents ranking the risks as very high or high.

Reputational risk is perceived as high or very high given the fact the quality of

service being offered by the contracted third party may not meet banks’

expectations, thereby damaging the reputation of the bank. Country risk is not

considered as a high risk in outsourcing with 89% of the respondents ranking the

risk neutral and below and only 11% of the respondents perceive the risk as high.

This can be explained by the fact that, all the outsourcing business taking place is

done within the country. The results of the survey shows that both the risks

under the control of the banks (strategic, compliance,etc) and the service

provider (reputational, operational, counterparty) are equally important. This is

inconsistent with prior findings, for instance Gewald,H and Dibbern J.,2005

found that risks in the area of responsibility controlled by bank as high and more

important than risks in area of responsibility controlled by the service provider.

Correlation Matrix

Table 8.5 presents correlations among the dependent variables: Size, Cost and

Profitability. The result suggests that mullticollinearity is not of concern as to

affect further multivariate test. It is generally accepted that a correlation

coefficient not greater than 0.80 is not considered harmful in a regression

analysis (see for example Olusegun, Naser and Mora 1994). Thus,

multicollinearity is not a serious issue that may affect results of logistic

regression.

27

Table 8.5 Pearson correlation matrix

Dependent Variables Size Cost Profitabilty

Size

Cost

Profitability

1.000

-0.074

1.000

0.308

-0.560*

1.000

* p < 0.01, two-tailed

Logistic Regression analysis

Table 8.6 presents results of the Logistic regression analysis. Findings indicate

size1 of bank is strongly and positively associated with outsourcing practices.

Thus, hypothesis H1 is supported. This suggests that, the larger the bank, the

higher the likelihood of a financial institution to outsource some of its functional

activities. Surprisingly, other predictor variables, namely, cost and profitability

are not statistically significantly associated with outsourcing decisions. Thus,

hypothesis H2 and H3 are not supported.

Table 8.6

Independent

variables

Predicted

sign

Coefficient Wald

Statistics

p-value

Constant -7.601 5.178 0.023

Size + 0.927 6.041 0.010

Cost + -1.539 0.144 0.705

Profitability + -0.164 0.324 0.569

1 Other measures of size: employee number and branch network yield similar results.

28

5. CONCLUSIONS AND POLICY IMPLICATIONS

The primary purpose of this study is to explore outsourcing practices in the

Kenyan banking sector. In particular, the study examine, based on a

questionnaire to banks the perceived benefits and risks associated with

outsourcing activities.

One interesting and disturbing finding is the large number of financial

institutions (nearly 50%) involved in outsourcing of certain banking functions, in

an environment without a regulatory framework. This therefore calls for urgent

measures to institute a regulatory framework in place in the form of an

outsourcing guideline to the banking sector. Thus, in meeting this immediate

need, this study as contained in Appendix IV incorporated a draft regulatory

guideline for adoption by the Central Bank of Kenya. Further, the guideline is

relevant and applicable to other MEFMI member countries.

ATM and card processing are the major activities currently outsourced in the

banking industry. Customer account processing is least outsourced activity. This

is consistent with global concerns about money laundering where ‘know you

customer’ is the starting point to combat this vice. However, as shown in Table

8.2 some banks are considering outsourcing of customer account processing and

this pose significant challenge in the regulatory environment, and especially with

respect to fighting money laundering where a third party is involved.

Banks cite, cost reduction, focus on core competencies and improved services as

the main benefits of outsourcing. Whereas, reputational risks, operational risks,

contractual risks and strategic risks are the main risks associated with

outsourcing practices. While this study may not have covered this aspect, its of

interest to the regulatory authorities to examine how banks achieve a balance in

29

risks and benefits associated with outsourcing taking into consideration interests

of other stakeholders such as depositors.

Results of multivariate analysis indicate that bank size is positively associated

with outsourcing decisions. Whereas cost saving and profitability are not

significant predictors of outsourcing practices in the Kenyan banking sector. That

size is a significant determinant of outsourcing decisions has regulatory

implication. From a regulation vantage point it is imperative to note that larger

financial institutions are likely to outsource, and therefore on aggregate scale, the

industry could be highly exposed to outsourcing risks and the contagion effect in

the event of third party default is difficult to predict given the interrelationship

and interdependences in the sector.

Study limitations

As with other research studies, the findings of this study should be viewed in

light of a few limitations. The use of questionnaire to gather relevant information

on the perceived benefits and risks on outsourcing must be noted. The richness

and depth of this research can be enhanced by use of interviews and

observations. In addition, a pragmatic review and analysis could have benefited

more by use of internal bank documents like board minutes, policies and

procedures which could have provided more insight into the operations and

strategic thinking of the management. The study is limited to the extent that its

focus is on a specific country and industry, Kenya and banking respectively.

Thus, the findings may not be generalisable to other MEFMI member countries

and other non-banking industries.

30

Future Research.

An important extension of this study is to replicate this research to other MEFMI

member countries. This is useful to Central Banks in the region on the potential

risks associated with this emerging trend of outsourcing services from third

parties by financial institutions. Such a region-wide study will provide for

knowledge sharing and generalisability of research findings across members

countries. Thus, enabling a consistent, and unified development of a framework

to regulate outsourcing practices in the banking sector of MEFMI member

countries.

In additions, given the changes that are taking place globally and enactment of

rules and laws, on corporate governance, it would be necessary to carry out

research on the role of board members in outsourcing. As it has been the

tradition, the board is the key internal governance mechanism, and it would be

interesting to understand the board-room dynamics in making decisions to

outsource of certain banking services. Interviewing board members on this vital

and emerging practice will provide a rich textual and thematic understanding of

boards’ evaluation of risks and benefits as well as prioritisation of services to be

outsourced. The findings are useful to further refine the already existing

Corporate Guideline with respect to the role of the board in considering

outsourcing of certain banking services from a third party.

Further, due to advancement in technology, one would be interested in studying

the aspects of risk sharing between banks and service providers. Similarly, the

one may wish to research on the implications of outsourcing on the performance

of the banks in Kenya.

31

REFERENCES

1. Aubert,B.A., Patry,m., and Rivard,S. 1998, ‘’Managing the risk of IT outsourcing,

‘‘ Proceedings of the 32nd Hawii International Conference on System Sciences.

2. Aubert, B.A., Patry, M., and Rivard, S. 2002, ‘‘ Managing IT Outsourcing Risk:

Lessons Learned’’, In Information Systems Outsourcing-Enduring Themes,

Emergent Patterns and Future Directions, R.Hirchheim, A. Heinzl, and J.

Dibbern (eds), Springer, Berlin, pp. 155-176.

3. Amiti.M and Shang-Jin Wei. 2005, ‘’Fear of services outsourcing: is it justified?’’,

IMF working paper, no. 186.

4. Bauer, R. 1967, ‘‘ Consumer Behaviour as Risk Taking’’in: Cox,D.F.(ED.); Risk

Taking and Information Handling in Consumer Behaviour, Havard University

Press, Cambridge,MA,USA.

5. Central Bank of Kenya. 2005, Risk Management Survey, November 2005, Central

Bank of Kenya, Nairobi.

6. Central Bank of Kenya 2005, Bank Supervision Annual report 2005, Central Bank of

Kenya, Nairobi. Available online: http://www.centralbank.go.ke

7. Daily Nation. May 20, 2006, ‘’Training Kenyans for outsourcing’’.

8. Dibbern J., Gols,T., Hirschheim,R., and Jayatilaka,B. 2004, Information systems

outsourcing: A Survey and Analysis of the Literature’’, The DATA BASE for

advances in information Systems.

9. Earl, M.J. 1996, ‘’The Risks of Outsourcing IT’’. Sloan Management Review

(spring), pp. 26-32.

32

http://www.centralbank.go.ke/

10. ECB. 2004, ‘’Report on European Union banking structure’’.

11. Featherman, M.S., and Pavlou. P.A. 2001, ‘’Predicting e-services Adoption: A

perceived risks ‘’Extending the technology Acceptance Model by Inclusion of

Perceived Risk.’’ Proceedings of the Seventh Conference on Information Systems,

Boston, MA, UAS.

12. Federal Insurance Corporation. 2004, ‘’Offshore outsourcing of data services by

insured institutions and associated consumer privacy risks, June 2004’’.

13. Federal Reserve Bank of New York. 1999, ‘’Outsourcing financial services

activities: industry practices to mitigate risks’’.

14. Federal Reserve Bank of San Francisco. 2004, ‘’Economic letter: outsourcing by

financial services firms; The supervisory response, November’’.

15. Friedmann,M., and Savage,L.J. 1948, ‘‘The utility of choices involving Risk’’, The

Journal of Political Economy (LV;4), pp.279-304.

16. Gewarld, H and Dibbern,J. 2005, ‘‘The influential role of perceived risks versus

perceived benefits in the acceptance of business process outsourcing: Empirical

evidence from the German Banking Industry’’. E-Finance Lab, working Paper

Nr.2005-9.

17. Girma, S. and Gorg, H. 2004, “Outsourcing, foreign ownership and productivity:

Evidence from UK establishment-level data”, Review of International Economics,

Vol. 12. Iss. 5. pp. 817-832.

33

18. Hong J., Chin, A. T. H., and Liu, B. 2004, “Firm-specific characteristics and

logistic outsourcing by Chinese manufacturers”, Asia Pacific Journal of Marketing

and Logistics, Vol. 16 Iss. 3, pp. 23 – 36.

19. Joint Forum. 2004, ‘’ Outsourcing in Financial Services’’, Bank for International

Settlements, Basel Committee on Banking Supervision, 2004.

20. Jurison,J. 2002, ‘’Applying Traditional Risk-Return Analysis to Strategic IT

Outsourcing Decisions’’, In Information Systems Outsourcing,R Hirscheim, A.

Heinzel and J. Dibben(eds.), Springer, Heidelberg, pp.177-186,

21. Kakumanu, P., and Portanova, A. 2006, “Outsourcing: Its benefits, drawbacks

and other related issues”, Journal of American Academy of Business, Vol. 9. Iss 2. pp.

1 -7

22. Lancellotti, R., Schein,O., Sprang, Sand Standler,V. 2003 ‘’ICT and Operational

Outsourcing in Banking’’, Wirtschatftsinformatik (45:2).

23. Madalla, G. S. 2001. Introduction to econometrics, 3th edn. John Wiley. New York.

24. Micelp, Michel T, Paul L, and Michelli L,. 1999, ‘Why firms outsource their

human resources activities: An empirical analysis’.

25. Olusegun, R. S., Naser, K., and Mora, A. 1994, “The relationship between the

comprehensiveness of corporate annual reports and firm characteristics in

Kenya”, Accounting and Business Research, Vol. 25, Iss. 97. pp. 41 -53

26. Palvia, S. C., and Chervany, N. L. 1995, “An experimental investigation of factors

influencing predicted success in DSS implementation”, Information and

Management, Vol. 29, Iss 1. pp. 43 – 45.

34

27. Pavlou, P.A. 2001, ’’ Integrating Trust in Electronic Commerce with the

Technology Acceptance Model: Model Development and Validation,’’

Proceedings of the 7th Americas Conference on Information Systems, Boston,

M.A, USA, 2001.

28. Pujals, G. 2004, ‘Offshore outsourcing in the European Union Financial services

industry, OFCE’.

29. Rouse, A.C.. And Corbitt, B. 2004, ‘’IT- supported business process outsourcing

(BPO): The good,the bad and ugly, ‘’ Proceedings of the 8th Pacific Asia

Conference on Information Systems, Shangai.

30. Tas, J. and Sunder, S. 2004, ‘’Financial Services business process outsourcing’’,

Communications of the ACM (47:5), pp.50-52.

35

Appendix I

Total Net Assets

No Name of institution Total net assets

1 African Banking Corporation 5,145

2 Bank of Africa Ltd 5,349

3 Bank of Baroda 9,266

4 Bank of India 7,206

5 Barclays Bank of Kenya Ltd 104,522

6 CFC Bank Limited 20,896

7 Charterhouse Bank Limited 4,221

8 Chase Bank Limited 2,623

9 Citibank, N.A. 30,928

10 City Finance Bank 510

11 Commercial Bank of Africa 29,667

12 Consolidated Bank of Kenya 2,909

13 Co-operative Bank of Kenya 51,835

14 Credit Bank Limited 2,798

15 Development Bank of Kenya 2,768

16 Diamond Trust Bank Kenya 16,234

17 Dubai Bank Limited 1,152

18 EABS Bank 8,857

19 Equatorial Commercial Bank 3,671

20 Equity Bank Limited 11,453

21 Fidelity Commercial Bank 1,666

22 Fina Bank Limited 6,215

23 Giro Commercial Bank 4,904

36

24 Guardian Bank 4,451

25 Habib AG Zurich 4,743

26 Habib Bank Limited 2,887

27 Imperial Bank Limited 7,773

28 Investment & Mortgages Bank 18,042

29 Kenya Commercial Bank Ltd 74,338

30 K-REP BANK 3,781

31 Middle East Bank of Kenya 4,051

32 National Bank of Kenya Ltd 32,584

33 National Industrial Credit Bank 20,630

34 Oriental Commercial Bank 1,379

35 Paramount-Universal Bank 1,491

36 Prime Bank Limited 7,154

37 Southern Credit Banking Corp. 4,221

38 Stanbic Bank Kenya Limited 15,015

39 Standard Chartered Bank Ltd 72,970

40 Transnational Bank Limited 1,979

41 Victoria Commercial Bank Ltd 4,217

616,501

Source: Banking Supervision Annual Report 2005

37

Appendix II

Letter of introduction

Peter Kariuki Gatere

Po Box 58332-00200

Nairobi, Kenya

Cellphone-0721341237

Dear Sir,

RE: OUTSOURCING SURVEY

I am an employee of Central Bank of Kenya working in the Banking Supervision

Department. Currently, I am conducting a research project titled: Perceived

benefits and risks in outsourcing: An analysis of Kenyan banking sector. You

have been selected to participate in this study.

I kindly request your assistance by completing the attached questionnaire. The

information collected is purely for the purpose of the research project and all

responses are treated with strict confidentiality. Key findings of the research will

be availed to you upon request.

Thank you for your cooperation.

Yours faithfully,

Peter K. Gatere

38

Appendix III

Research questionnaire

Section A- Level of outsourcing

Please indicate whether or not the processes/functions stated below are

outsourced or not.

Yes No

Has the bank already outsourced the

process?

Is outsourcing arrangement currently

under consideration?

Has the bank ever decided against

outsourcing the function?

1

ATM services

Has the bank ever decided to reintegrate

the process to the bank?


Process?





3 Card processing



39


Process?





4 Internal audit




Process?





5 Human

Resources/payroll

processing




Process?





6 Sales/Marketing



7 Information

technology


Process?

40








Process?



8 Debt collection




Process?





9 Customer account

processing



41

Section B-Perceived benefits

Please rate the following items in their order of importance to your institution

by ticking benefits listed below:

Strongly

agree

Agree Neutral Disagree Strongly

disagree

Cost reduction

Focus on core

competence

Access to specialized

vendors

Improved services

Free resources

Provide flexibility

Other – please specify

42

Section C- Perceived risks

With respect to outsourcing, please rate the following risks as they relate to your

institution.

Very high High Neutral low Very low

Strategic risk

Reputational risk

Compliance risk

Operational risk

Country risk

Counter party risk

Contractual risk

Access risk

Concentration risk

Systemic risk

Exit risk

Other – please specify

Section D

Background Information

Information solicited in this section is useful in general analysis of demographic

characteristics of respondents e.g. gender proportion of respondents. All

information will be treated with strict confidentiality.

43

Gender:

Male

Female

Age (Years)

Under 25

26-35

36-45

46-55

Over 55

Which of the following best describes your level of education?

Secondary

High School

Degree

44

Postgraduate

Which of the following best describes your position in the organization

Executive management/ Head of Department

Middle level Management

Junior management

Name of the organization

…………………………………………………………………………………………

45

Appendix IV

Guideline on outsourcing of financial services

1. Introduction

The world over, banks are increasingly using outsourcing, as a means of both

reducing cost and accessing specialist expertise, not available internally and

achieving strategic aims. Outsourcing may be defined as a bank's use of a third

party (either an affiliated entity within a corporate group or an entity that is

external to the corporate group) to perform activities on a continuing basis that

would normally be undertaken by the bank itself, now or in the future.

This guideline sets out Central Bank of Kenya expectations of a financial

institution that has entered into outsourcing or is planning to outsource its

activities to a service provider. The guideline is intended to provide direction

and guidance to financial institutions in adopting sound and responsive risk

management practices for effective oversight, due diligence and management of

risks arising from such outsourcing activities. This guideline is applicable to

outsourcing arrangements entered into by institutions licensed under the

Banking Act. The main objective of this guideline is to set out a broad framework

for financial institutions that have entered into outsourcing or are planning to

outsource their business activities to service providers. The underlying principles

behind this guideline are that the regulated entity should ensure that

outsourcing arrangements neither diminish its ability to fulfill its obligations to

customers and Central Bank nor impede effective supervision by Central Bank.

Banks therefore have to take steps to ensure that the service provider employs

the same high standard of care in performing the services as would be employed

by the banks if the activities were conducted within the banks and not

outsourced. Accordingly banks should not engage in outsourcing that would

46

result in their internal control, business conduct or reputation being

compromised or weakened.

While outsourcing can bring cost and other benefits, it may increase the risk

profile of an institution. Some key risks in outsourcing are Strategic Risk,

Reputation Risk, Compliance Risk, Operational Risk, Exit Strategy Risk,

Counterparty Risk, Country Risk, Contractual Risk, Access Risk Concentration

and Systemic Risk. The failure of a service provider in providing a specified

service, a breach in security/ confidentiality, or non-compliance with legal and

regulatory requirements by either the service provider or the outsourcing bank

can lead to financial losses/reputational risk for the bank and could also lead to

systemic risks within the entire banking system in the country. It would therefore

be imperative for the bank outsourcing its activities to ensure effective

management of these risks

Financial institutions are required to seek prior approval from Central Bank for

outsourcing of material activities. However, financial institutions will not be

required to seek approval for non -material activities. In such cases, financial

institutions are required to keep the Central Bank informed of all the activities

outsourced by them.

2. Activitities that should not be outsourced.

Financial Institutions cannot outsource core management functions like

corporate planning, organization, management and control and decision-making

functions like determining compliance with applicable laws and regulations,

decision to grant loans and management of investment portfolio.

47

3. Definitions

In this guideline, unless the context otherwise requires:

'Outsourcing' means use of a third party (either an affiliated entity within a

corporate group or an entity that is external to the corporate group) to perform

activities on a continuing basis that would normally be undertaken by the bank

itself, now or in the future.

‘‘Financial institutions’’ means any bank or institution licensed under the

banking Act (Cap. 487).

‘‘Service provider’’, refers to an entity that is undertaking the outsourced activity

on behalf of the financial institution and includes a member of the group to

which the institution belongs, unrelated company whether located in Kenya or

outside.

‘’Offshoring’’ means outsourcing activities beyond national boarders.

4. Material outsourcing

Material outsourcing arrangements are those, which if disrupted, have the

potential to significantly impact the business operations, reputation or

profitability. An institution should assess the degree of materiality in an

outsourcing to the institution. Materiality of outsourcing would be based on:

a) The level of importance to the bank of the activity being outsourced

48

b) The potential impact of the outsourcing on the bank on various

parameters such as earnings, solvency, liquidity, funding and capital and

risk profile;

c) The likely impact on the bank’s reputation and brand value, and ability to

achieve its business objectives, strategy and plans, should the service

provider fail to perform the service;

d) The cost of the outsourcing as a proportion of total operating costs of the

bank;

e) The aggregate exposure to that particular service provider, in cases where

the bank out source various functions from the same service provider.

An institution should undertake periodic reviews of its outsourcing

arrangements to identify new material outsourcing risks as they arise. An

arrangement which was previously not material may subsequently become

material from incremental activities outsourced to the same service provider or

an increase in volume or nature of the activity outsourced to the service

provider. Material outsourcing risks may also arise when the service provider in

a material outsourcing plans to sub-contract the service or makes significant

changes to its sub-contracting arrangements.

5. Legal obligations, regulatory and supervisory requirements.

The outsourcing of any activity by bank does not diminish its obligations, and

those of its Board and senior management, who have the ultimate responsibility

for the outsourced activity. Banks would therefore be responsible for the actions

of their service provider including recovery agents and the confidentiality of

information pertaining to the customers that is available with the service

provider. Banks should retain ultimate control of the outsourced activity.

49

It is imperative for the bank, when performing its due diligence in relation to

outsourcing, to consider all relevant laws, regulations, guidelines and conditions

of approval, licensing or registration.

Every institution should conduct its business with integrity and competence.

Institutions should not engage in outsourcing that result in its internal control,

business conduct or reputation being compromised or weakened. An institution

has to take steps to ensure that the service provider employs a high standard of

care in performing the services as if the activity were not outsourced and

conducted within the institution. The institution also needs to maintain the

capability and appropriate level of monitoring and control over outsourcing,

such that in the event of disruption or unexpected termination of the service, it

remains able to conduct its business with integrity and competence.

Outsourcing arrangements should not affect the rights of a customer against the

bank, including the ability of the customer to obtain redress as applicable under

relevant laws. Since the customers are required to deal with the service providers

in the process of dealing with the bank, banks should reveal to their customers in

the product brochures/agreements etc., the role of the service provider and their

obligation towards the customers

Outsourcing, whether the service provider is located in Kenya or abroad should

not impede or interfere with the ability of the bank to effectively oversee and

manage its activities or impede the CBK in carrying out its supervisory functions

and objectives.

Banks need to have a robust grievance redressal mechanism, which in no way

should be compromised on account of outsourcing.

50

6. Risk management practices for outsourced financial services.

6.1 Outsourcing Policy

A bank intending to outsource any of its financial activities should put in place a

comprehensive outsourcing policy, approved by its Board, which incorporates,

inter -alia;

a) strategic goals, objectives and business needs of a financial institution in

relation to outsourcing;

b) clear definition of the range of activities that may be outsourced and those

core activities which cannot be outsourced;

c) steps that should be taken in evaluating whether a particular activity is

appropriate for outsourcing;

d) criteria for determining material outsourcing;

e) processes for evaluating risks associated with an outsourced activity;

f) criteria for evaluating outsourcing relationships (with service providers)

including necessary controls and reporting processes on an ongoing basis;

g) eligibility criteria for selecting service providers taking into account any

relation, directly or indirectly, with the latter;

h) issues addressing risk concentrations and risks arising from outsourcing

multiple activities to the same service provider;

i) steps that should be taken to ensure compliance with legal and regulatory

requirements in both home and host countries; and

j) contingency plan in case of business disruptions.

51

6.2 Role of the Board.

The Board and senior management of an institution retain ultimate responsibility

for effective management of risks arising from outsourcing. While an institution

may delegate its day-to-day operational duties to the service provider, the

responsibilities for effective due diligence, oversight and management of

outsourcing and accountability for all outsourcing decisions, continue to rest

with the institution, its board and senior management. The board or a committee

delegated by it, should be responsible inter alia for:-

a) Approving a framework to evaluate the risks and materiality of all existing

and prospective outsourcing and the policies that apply to such

arrangements;

b) Laying down appropriate approval authorities for outsourcing depending on

risks and materiality.

c) Undertaking regular review of outsourcing strategies and arrangements for

their continued relevance, and safety and soundness and

d) Deciding on business activities of a material nature to be outsourced, and

approving such arrangements.

6.3 Role of Senior Management

a) Evaluating the risks and materiality of all existing and prospective

outsourcing, based on the framework approved by the board;

b) Developing and implementing sound and prudent outsourcing policies and

procedures commensurate with the nature, scope and complexity of the

outsourcing;

52

c) Reviewing periodically the effectiveness of policies and procedures;

d) Communicating information pertaining to material outsourcing risks to the

board in a timely manner;

e) Ensuring that contingency plans, based on realistic and probable disruptive

scenarios, are in place and tested; and

f) Ensuring that there is independent review and audit for compliance with set

policies.

g) Undertaking periodic review of outsourcing arrangements to identify new

material outsourcing risks as they arise.

6.4 Evaluation of the Risks

To satisfy themselves that an outsourcing does not result in the internal control,

business or reputation of an institution being compromised or weakened, its

board and senior management would need to be fully aware of and understand

the risks in outsourcing and their impact on the institution. A framework for

systemic risk evaluation should be established and it should include the

following steps:-

a) Identification of the role of outsourcing in the overall business strategy and

objectives of the institution, and its interaction with corporate strategic goals;

b) Comprehensive due diligence on the nature, scope and complexity of the

outsourcing to identify the key risks and risks mitigation strategies;

c) Analysis of the impact of the arrangement on the overall risk profile of the

institution, and whether there are adequate internal expertise and resources

to mitigate the risks identified; and

53

d) Analysis of risk-return on the potential benefits of outsourcing against the

vulnerabilities that may arise, ranging from the impact of temporary

disruption to that of an unexpected termination in the outsourcing, and

whether for strategic and internal control reasons, the arrangement should be

entered into.

Such evaluations should be performed when an institution is planning to enter

into outsourcing arrangements, as a part of the outsourcing approval and

strategic planning or review processes of the institution.

The key risks in outsourcing that need to be looked into by the banks include: -

a) Strategic Risk – The service provider may conduct business on its own behalf,

which is inconsistent with the overall strategic goals of the bank,

b) Reputation Risk – Poor service from the service provider, its customer

interaction not being consistent with the overall standards of the bank,

c) Compliance Risk – Privacy, consumer and prudential laws not adequately

complied with,

d) Operational Risk – Arising due to technology failure, fraud, error, inadequate

financial capacity to fulfil obligations and/or provide remedies,

e) Exit Strategy Risk – This could arise from over–reliance on one firm, the loss

of relevant skills in the bank itself preventing it from bringing the activity

back in-house and contracts entered into wherein speedy exits would be

prohibitively expensive,

54

f) Counterparty Risk – Due to inappropriate underwriting or credit

assessments,

g) Country Risk – Due to the political, social or legal climate creating added risk,

h) Contractual risk – arising from whether or not the bank has the ability to

enforce the contract,

i) Concentration and Systemic Risk – Due to lack of control of individual banks

over a service provider, more so when overall banking industry has

considerable exposure to one service provider.

6.5 Evaluating the Capability of the Service Provider

In considering or renewing an outsourcing arrangement, appropriate due

diligence should be performed to assess the capability of the service provider to

comply with obligations in the outsourcing agreement. Due diligence should

take into consideration qualitative and quantitative, financial, operational and

reputational factors. Banks should consider whether the service providers'

systems are compatible with their own and also whether their standards of

performance including in the area of customer service are acceptable to it. Where

possible, the bank should obtain independent reviews and market feedback on

the service provider to supplement its own findings.

Due diligence should involve an evaluation of all available information about the

service provider, including but not limited to:-

55

a) Past experience and competence to implement and support the proposed

activity over the contracted period;

b) Financial soundness and ability to service commitments even under adverse

conditions;

c) Business reputation and culture, compliance, complaints and outstanding or

potential litigation;

d) Security and internal control, audit coverage, reporting and monitoring

environment, Business continuity management;

e) External factors like political, economic, social and legal environment of the

jurisdiction in which the service provider operates and other events that may

impact service performance.

f) Ensuring due diligence by service provider of its employees.

Due diligence undertaken during the selection process should be documented

and re-performed periodically as part of the monitoring and control processes of

outsourcing. The due diligence process can vary depending on the nature of the

outsourcing arrangement e.g reduced due diligence may be sufficient where no

developments or changes have arisen to affect an existing outsourcing

arrangements or where the outsourcing is to a member of the group. An

institution should ensure that the information used for due diligence evaluation

is current and should not be more than 12 months old.

6.6 The Outsourcing Agreement

The terms and conditions governing the contract between the bank and the

service provider should be carefully defined in written agreements and vetted by

a competent authority on their legal effect and enforceability. Every such

agreement should address the risks and risk mitigation strategies identified at

56

the risk evaluation and due diligence stages. The agreement should be

sufficiently flexible to allow the bank to retain an appropriate level of control

over the outsourced activity and the right to intervene with appropriate

measures to meet legal and regulatory obligations. The agreement should also

bring out the nature of legal relationship between the parties – i.e. whether agent

principal or otherwise. Some of the key provisions of the contract would be

a) The contract should clearly define what activities are going to be outsourced

including appropriate service and performance standards.

b) The bank must ensure it has the ability to access all books, records and

information relevant to the outsourced activity in the service provider

c) The contract should provide for continuous monitoring and assessment by

the bank of the service provider so that any necessary corrective measure can

be taken immediately.

d) A termination clause and minimum periods to execute a termination

provision, if deemed necessary, should be included.

e) Controls to ensure customer data confidentiality and service providers'

liability in case of breach of security and leakage of confidential customer

related information.

f) Contingency plans to ensure business continuity

g) The contract should provide for the approval by the bank of the use of

subcontractors by the service provider for all or part of an outsourced activity

h) Provide the bank with the right to conduct audits, on the service provider

whether by its internal or external auditors, or by agents appointed to act on

its behalf and to obtain copies of any audit or review reports and findings

made on the service provider in conjunction with the services performed for

the bank.

57

i) Outsourcing agreements should include clauses to allow the CBK or persons

authorised by it to access the bank’s documents, records of transactions, and

other necessary information given to, stored or processed by the service

provider within a reasonable time. The Agreement should further provide

that in the event these are not made accessible to CBK within a reasonable

time, the bank would be liable to pay supervisory fees to CBK.

j) Outsourcing agreement should also include clause to recognise the right of

the CBK to cause an inspection to be made of a service provider of a bank and

its books and account by one or more of its officers or employees or other

persons.

6.7 Confidentiality and Security

As public confidence in financial institutions is a cornerstone in the stability and

reputation of the financial industry, it is vital that an institution satisfies itself

that the service provider’s security policies, procedures and controls will enable

the institution to protect confidentiality and security of the customer

information. An institution should take the following steps as minimum to

ensure that the issue of customer confidentiality is addressed:-

a) Access to customer information by staff of the service provider should be

limited to those areas where the information is required in order to perform

the outsourced function.

b) The bank should ensure that the service provider is able to isolate and clearly

identify the bank’s customer information, documents, records and assets to

protect the confidentiality of the information.

58

c) Review and monitor the security practices and control processes of the

service provider on a regular basis and require the service provider to

disclose security breaches.

d) The bank should immediately notify CBK in the event of any breach of

security and leakage of confidential customer related information. In these

eventualities, the bank would be liable to its customers for any damage.

6.8 Business Continuity and Management of Disaster Recovery Plan

An institution should ensure that its business continuity preparedness is not

compromised by outsourcing. The institution should take steps to evaluate and

satisfy itself that the interdependency risk arising from the outsourcing

arrangement can be adequately mitigated such that the institution remains able

to conduct its business with integrity and competence in the event of disruption,

or unexpected termination of the outsourcing or liquidation of the service

provider. The steps should include:-

a) A bank should require its service providers to develop and establish a robust

framework for documenting, maintaining and testing business continuity and

recovery procedures. Banks need to ensure that the service provider

periodically tests the Business Continuity and Recovery Plan and may also

consider occasional joint testing and recovery exercises with its service

provider.

b) In order to mitigate the risk of unexpected termination of the outsourcing

agreement or liquidation of the service provider, banks should retain an

appropriate level of control over their outsourcing and the right to intervene

59

with appropriate measures to continue its business operations in such cases

without incurring prohibitive expenses and without any break in the

operations of the bank and its services to the customers.

c) In establishing a viable contingency plan, banks should consider the

availability of alternative service providers or the possibility of bringing the

outsourced activity back in-house in an emergency and the costs, time and

resources that would be involved.

d) Outsourcing often leads to the sharing of facilities operated by the service

provider. The bank should ensure that service providers are able to isolate the

bank’s information, documents and records, and other assets. This is to

ensure that in adverse conditions, all documents, records of transactions and

information given to the service provider, and assets of the bank, can be

removed from the possession of the service provider in order to continue its

business operations, or deleted, destroyed or rendered unusable.

6.9 Monitoring and Control of Outsourced Activities

The bank should have in place a management structure to monitor and control

its outsourcing activities. Such a structure will vary depending on the nature,

scope and complexity of the outsourced activities. As outsourcing relationships

and interdependence increase in materiality and complexity, a more rigorous

risk management approach should be adopted. An institution also has to be

more proactive in its relationship with the service provider. The agreement

should ensure that outsourcing agreements with the service provider contain

provisions to address their monitoring and control of outsourced activities.

60

A structure for effective monitoring and control of material outsourcing would

comprise the following:-

a) A central record of all material outsourcing that is readily accessible for

review by the board and senior management of the bank should be

maintained. The records should be updated promptly and form part of the

corporate governance reviews undertaken by the board and senior

management of the bank.

b) Regular audits by either the internal auditors or external auditors of the bank

should assess the adequacy of the risk management practices adopted in

overseeing and managing the outsourcing arrangement, the bank’s

compliance with its risk management framework and the requirements of

these guidelines.

c) Banks should at least on an annual basis, review the financial and operational

condition of the service provider to assess its ability to continue to meet its

outsourcing obligations. Such due diligence reviews, which can be based on

all available information about the service provider should highlight any

deterioration or breach in performance standards, confidentiality and

security, and in business continuity preparedness.

7. Approval by Central Bank of Kenya

Proposals to outsource material function must be submitted to CBK in writing

well in advance of the date on which it is intended that the outsourcing will

commence. A bank that has entered into or is planning material outsourcing, or

is planning to vary any such outsourcing arrangements, should notify CBK of

61

such arrangements. The degree of detail of the proposal will depend on the

functions that the bank proposes to outsource and the service provider to be

used. The proposal should include details of the rationale for the outsourcing,

details relating to the proposed service provider, draft outsourcing agreement

between the parties involved and a description of the methods that the bank will

employ to ensure that it retains its ability to control and monitor the outsourced

functions. An institution should not enter into any outsourcing arrangement of

material function before getting approval from CBK.

8. Off-shore outsourcing of financial services.

The engagement of service providers in a foreign country exposes a bank to

country risk - economic, social and political conditions and events in a foreign

country that may adversely affect the bank. Such conditions and events could

prevent the service provider from carrying out the terms of its agreement with

the bank. To manage the country risk involved in such outsourcing activities, the

bank should take into account and closely monitor government policies and

political, social, economic and legal conditions in countries where the service

provider is based, during the risk assessment process and on a continuous basis,

and establish sound procedures for dealing with country risk problems. This

includes having appropriate contingency and exit strategies. In principle,

arrangements should only be entered into with parties operating in jurisdictions

generally upholding confidentiality clauses and agreements. The governing law

of the arrangement should also be clearly specified.

The activities outsourced outside Kenya should be conducted in a manner so as

not to hinder efforts to supervise or reconstruct the Kenyan activities of the bank

in a timely manner. Specifically, a bank should not outsource to jurisdictions

62

63

where unfettered access to information by CBK or its authorised person, and the

internal and external auditors of the bank, may be impeded by legal or

administrative restrictions. CBK may communicate directly with the home or

host regulator of the bank or the service provider, as the case may be, to seek

confirmation relating to these matters.

A bank should notify CBK if any overseas authority were to seek access to its

customer information. If such access seems unwarranted CBK would require the

bank to take steps to make alternative arrangements for the outsourced activity.

9. Outsourcing within a group/conglomerate

The risk management practices expected to be adopted by a bank while

outsourcing to a related party (i.e party within the Group/ Conglomerate) would

be identical to those specified in Para 6 of this guideline.

10. Self assessment of existing/proposed outsourcing arrangements

Banks may conduct a self-assessment of their existing / proposed outsourcing

arrangements, viewed in the light of this guidance note and rectify

deficiencies/shortcomings if any observed in this regard.

Documents

MOTIVES AND RISKS ASSOCIATED WITH OUTSOURCING OF FINANCIAL …mefmi.org/mefmifellows/wp-content/uploads/2016/10/... · Dibbern, J. 2005). This would create a supply chain of financial