Introduction

In the past decade, the financial services industry has been an aggressive pioneer of outsourcing. In 2007, the global estimated value of outsourcing contracts was US$23.6 billion (Plunkett Research, 2007). Outsourcing involves the transfer of the management and/or day-to-day execution of an entire business function to an external service provider. The client organization and the supplier enter into a contractual agreement that defines the transferred services. The client agrees to procure the services from the supplier for the term of the contract. Often the supplier acquires people, assets or other resources from the client in order to perform the outsourced function. Business functions typically outsourced include information technology, human resources, facilities, real estate management and accounting. Many organizations also outsource customer support and call centre functions.

Although it is increasingly common for financial institutions to outsource records storage, tape storage and the performance of traditional records management functions, the focus of this chapter is the risks to an institution's records when undertaking a large strategic outsourcing initiative involving a single business function or multiple functions previously performed in-house. In a strategic outsourcing initiative the supplier provides specialized capabilities that supplement existing capabilities in a financial institution's value chain. Such an arrangement produces value within supply chains beyond those benefits achieved through cost economies.

A strategic outsourcing may involve some degree of offshoring. ‘Offshoring’ is the transfer of a business function to another country, regardless of whether the work is outsourced or stays within the original financial institution. With increasing globalization of outsourcing suppliers, the distinction between outsourcing and offshoring will become less clear over time. The globalization of outsourcing operating models has resulted in new terms such as ‘nearshoring’, ‘noshoring’ and ‘rightshoring’ that ref lect a changing mix of business locations.

A scan of daily newspapers would provide ample illustration of the risks to a financial institution's records that can materialize if insufficient attention is paid to the issue of records and information management as part of an outsourcing arrangement. In 2008, for example, the Bangalore Cyber Crime Police arrested an employee of an outsourced electronic data-processing unit of one global bank in a case of data theft and misuse of confidential information. The total loss in this particular case was estimated at UK£2,333,000.