Seal of the Board of Governors of the Federal Reserve System BOARD OF GOVERNORS
OF THE
FEDERAL RESERVE SYSTEM

WASHINGTON, D. C.  20551
DIVISION OF BANKING
SUPERVISION AND REGULATION
SR 00-17 (SPE)
November 30, 2000

TO THE  OFFICER IN CHARGE OF SUPERVISION AND APPROPRIATE SUPERVISORY AND EXAMINATION STAFF AT EACH FEDERAL RESERVE BANK AND TO EACH DOMESTIC AND FOREIGN BANKING ORGANIZATION SUPERVISED BY THE FEDERAL RESERVE

SUBJECT:   Guidance on the Risk Management of Outsourced Technology Services

                     The federal banking agencies recently issued the attached supplemental guidance on the risk management of outsourced technology services.  Banking organizations should consider this guidance within the context of their assessment of the scope and importance of the outsourced services to their enterprise, as well as the risks resulting from those services.  This new guidance contains many of the same sound practices and recommendations set forth in SR letter 00-4, "Outsourcing of Information and Transaction Processing," which was issued by the Federal Reserve on February 29, 2000.  The interagency guidance provides banking organizations with additional specific information that may be useful to consider on topics relevant to their outsourcing risk management practices.

                     The interagency guidance focuses on the risk management process of identifying, measuring, monitoring, and controlling the risks associated with outsourcing technology services.  While outsourcing can improve banking services, help control costs, and provide the technical assistance needed to maintain and expand product offerings, it also introduces additional risks that need to be addressed.  The guidance includes four key elements to address those risks: risk assessment, service provider selection, contract provisions and review, and ongoing service provider monitoring.  The guidance also includes an appendix that provides examples of considerations that may be relevant in the areas of due diligence in selecting a service provider, contracting issues, and ongoing service provider monitoring.

                     This supervisory guidance should be shared with banking organizations.  If you have any questions, please contact Heidi Richards, Manager, Specialized Activities, (202) 452-2598 or Mike Wallas, Supervisory Financial Analyst, (202) 452-2081.


Richard Spillenkothen
Director


Attachment (35 KB PDF)

Cross Reference:  SR 00-4 (SUP)


SR letters | 2000