Outsourcing
-
Many insurers outsource some parts of the administration of their business to a third party service provider. Insurers should ensure that they retain ultimate control over the outsourced operations and that the division of risks and responsibility is clear and mutually understood.
-
At a minimum, the risk management system for outsourcing must consist of policies and procedures including:
(a) procedures to assess the controls of the service provider;
(b) procedures for entering into outsourcing agreements including:
(i) the formation of a business case outlining the benefits and risks of outsourcing the activity, including: an outline of the processes to be outsourced; the services required; the quality and timeframe requirements; together with detail on how the insurer intends monitoring, measuring and managing the relationship and the intended controls;
(ii) due diligence on the service provider, including: the capacity of the service provider (financial, technical and otherwise) to fulfil duties, deal with disruptions in business continuity and to meet any indemnities or penalties; and
(iii) conflicts of interest.
- All outsourcing arrangements must be undertaken using a written, legally binding agreement. The agreement should:
(a) clearly outline the responsibility of each party to the contract;
(b) set out the ways in which the insurer and the service provider will monitor performance under the agreement;
(c) establish procedures for problem resolution;
(d) include termination clauses (including requirements for the ownership and delivery of records from the service provider to the insurer) and transitional arrangements;
(e) define the consideration together with penalties to be incurred by either party for non-performance; and
(f) set out requirements for the service provider to hold relevant insurance.
- In addition, the insurer must ensure that:
(a) adequate security and confidentiality is provided over sensitive information; and
(b) records held by the insurer and the service provider are adequate for audit trail purposes and that those records held by the service provider are readily available at all times to the insurer and, where APRA considers it necessary, to APRA.
-
The insurer must ensure that adequate contingency plans exist, including back-up facilities if appropriate, to cover a breakdown in the operations of the service provider or in circumstances where the service provider or the insurer exercises a right to terminate the contract. These plans should be tested regularly (annually at a minimum) and the results of these tests should be made available to the insurer.
-
Where the service provider is related to the insurer (for example, part of the same corporate group), the insurer must have in place risk management and control systems similar to those in place for external service providers. In addition, the contingency plan should consider the possibility of accessing external service providers at a similar cost in the case of an inability of the related entity to continue to provide contracted services.