ATB Financial - Guidelines - Outsourcing of Business Activities

Financial institutions outsource business activities, functions and processes to meet the challenges of technological innovation, increased specialization, cost control, and heightened competition. However, outsourcing can increase an institution’s dependence on third parties, which may increase its risk profile. Many financial sector regulators have responded by introducing guidance related to the management of outsourcing risks.

This Guideline sets out the Minister of Finance’s expectations for ATB Financial when contemplating outsourcing one or more business activities to a service provider. These expectations should be considered prudent practices, procedures or standards that should be applied according to the characteristics of the outsourcing arrangement and the circumstances of ATB Financial.

ATB Financial has the flexibility to configure their operations in the way most suited to achieving its corporate objectives. However, this Guideline operates on the premise that ATB Financial retains ultimate accountability for all outsourced activities. Furthermore, the Minister of Finance’s supervisory powers should not be constrained, irrespective of whether an activity is conducted in-house, outsourced, or otherwise obtained from a third party.

Under this Guideline, ATB Financial is expected to:

evaluate the risks associated with all existing and proposed outsourcing arrangements;
develop a process for determining the materiality of arrangements;
implement a program for managing and monitoring risks, depending on the materiality of the arrangements; and
ensure that the board of directors receive information sufficient to enable them to discharge their duties under this Guideline.

2. TRANSITION PERIOD

ATB Financial will use best efforts to bring material outsourcing contracts into compliance with this guideline as soon as possible. However, it may be difficult to amend existing outsourcing contracts. For this reason, ATB Financial has established a transition period for full compliance with this guideline.

In the transition period, all new material contracts will follow these guidelines as of the date of the Minister of Finance’s approval of the Guideline. All existing material contracts will follow these guidelines upon renewal or renegotiation.

3. DEFINITIONS

3.1 Outsourcing Arrangement
For the purposes of this Guideline, an outsourcing arrangement is an agreement between ATB Financial and a service provider, whereby the service provider performs a business activity, function or process that is, or could be, undertaken by ATB Financial. Examples are provided in Annex 1.

4. APPLICATION OF THE GUIDELINE

This Guideline applies to all the outsourcing arrangements of ATB Financial and its subsidiaries. In addition, in applying this Guideline, ATB Financial is expected to consider the impact on ATB Financial and on its consolidated operations, of outsourcing arrangements entered into by all its subsidiaries and business operations. The Minister of Finance expects ATB Financial to ensure that their subsidiaries follow the guideline when entering into material outsourcing arrangements.

All outsourcing arrangements should be subjected to the materiality assessment that aligns with the requirements set out in Section 6 of the Guideline. The Minister of Finance recognizes that outsourcing arrangements will exhibit varying degrees of materiality and expects that the robustness of ATB Financial’s management of outsourcing risks would be commensurate with the materiality of the arrangement.

Outsourcing arrangements deemed clearly material are expected to follow the risk management program elements detailed in Section 7. However, reduced expectations may be applied, in a manner consistent with Section 4.1 where the material outsourcing arrangement is between ATB Financial and one of its subsidiaries.

Outsourcing arrangements deemed clearly immaterial are not expected to follow the risk management program outlined in this Guideline.

4.1 Material Intra-group Outsourcing Arrangements
At a minimum, the Minister of Finance expects the following to be addressed when ATB Financial or a subsidiary of ATB Financial enters into a material outsourcing arrangement with another subsidiary of ATB Financial:

an outsourcing agreement that details, among other things, the scope of the arrangement, the services to be supplied, the nature of the relationship between ATB Financial and the service provider, and procedures governing the subcontracting of services;
a business continuity plan; and
a process for monitoring and oversight.

As appropriate, ATB Financial may address these expectations within enterprise-wide processes or plans, so long as any specific risks to each subsidiary are dealt with, and the board of directors is able to fulfill its accountabilities. As well, ATB Financial may establish the program and develop and maintain the reporting on behalf of its subsidiaries.

5. ACCOUNTABILITY AND CONTROL

5.1 Board of Directors Responsibilities
The Board of Directors is ultimately responsible for ATB Financial’s risk-management policies and practices. In exercising its responsibility, the Board usually charges management with developing and implementing risk-management programs and ensuring that these programs remain adequate, comprehensive and prudent. ATB Financial will develop and maintain a risk-management program that will identify and control the risks introduced as a result of outsourcing arrangements.

The Board must have a means of ensuring that material risks related to outsourcing of ATB Financial’s business functions are appropriately managed. This is normally done through periodic reporting by management and an audit function. The reports should provide sufficient information to satisfy the Board that ATB Financial is complying with its risk-management program for outsourcing.

At a minimum, the Board should:

approve or reaffirm the policies that apply to outsourcing arrangements (e.g., risk philosophy, materiality criteria, risk management program and approval limits); and
review a list of all ATB Financial’s material outsourcing arrangements (see Section 7.3.1) and other relevant reports when appropriate.

5.2 ATB Financial Management Responsibilities
Management is responsible for developing outsourcing policies for board approval, implementing the policies and any associated procedures, periodically reviewing their effectiveness, and communicating information pertaining to significant outsourcing risks to the board in a timely manner.

The policies and procedures are expected to include:

Outsourcing risk philosophy
ATB Financial’s outsourcing risk philosophy would generally comprise a statement of principles, the basis for decision making, and the parameters for controlling outsourcing risks. The outsourcing risk philosophy should address the following:
- Integration of outsourcing arrangements, both individually and in aggregate, with overall business and strategic objectives. This could include an identification of any functions that, for strategic or internal control reasons, ATB Financial would not contemplate outsourcing.
- Importance and adequacy of internal expertise and management frameworks to oversee and manage the outsourced activity and the relationship with the service provider.
- Business case for outsourcing a significant business activity. The business case should consider the short- and long-term cost implications and all relevant prudential matters. When the service is being supplied from a foreign jurisdiction, ATB Financial should identify the issues that may arise as a result of the differing and potentially conflicting requirements among jurisdictions. The business case should also consider the cumulative impacts of all outsourcing arrangements on the overall safety and soundness of ATB Financial.
Materiality assessment for outsourcing arrangements
This assessment is expected to identify both the processes for determining the materiality of individual outsourcing arrangements and the underlying materiality factors such as those set out in Section 6.
Outsourcing risk management program that, at a minimum, includes the expectations contained in Section 7 and is applied consistently throughout ATB Financial. The Minister of Finance expects management to pay particular attention to business continuity planning on an enterprise-wide basis.
Limits regarding the level or authority that enables ATB Financial’s officers to approve outsourcing arrangements of varying magnitudes, either individually or in aggregate. This system should be consistent with the outsourcing risk philosophy and materiality criteria.

In addition to the above, ATB Financial management would also be expected to:

ensure that materiality assessment criteria are developed and applied;
ensure that the risk management program is applied; and
within a reasonable time advise the Minister of Finance (either formally or informally) about any events that are likely to have a significant negative impact on the delivery of the service provided for by a material outsourcing arrangement.

6. MATERIALITY ASSESSMENT FOR OUTSOURCING ARRANGEMENTS

Outsourcing arrangements undertaken by ATB Financial will have differing degrees of materiality and may not be readily classified as either material or immaterial. In general, the Minister of Finance expects that ATB Financial will design a risk management program that applies to all its outsourcing arrangements, except those that are clearly immaterial, and that the risk mitigants employed under this program will be appropriate to the particular outsourcing arrangement. As such, the risk management program could be scaled to apply different requirements depending on the type of outsourcing arrangement. Those arrangements deemed clearly material should be subject to, at a minimum, the risk management elements set out in Section 7, unless it is reasonable to conclude that a particular element is not appropriate for the outsourcing arrangement in question. The Minister of Finance may review ATB Financial’s materiality assessment on a case-by-case basis as part of the supervisory review process.

The materiality of an outsourcing arrangement will depend on the extent to which it has the potential to have an important influence – whether quantitative or qualitative – on a significant line of business of the consolidated operations of ATB Financial.

The assessment of the materiality of an outsourcing arrangement is often subjective and depends on the circumstances faced by ATB Financial. Without limiting the scope of the materiality assessment, factors that should be considered include:

the impact of the outsourcing arrangement on the finances, reputation and operations of ATB Financial, or a significant business line, particularly if the service provider, or group of affiliated service providers, should fail to perform over a given period of time;
the ability of ATB Financial to maintain appropriate internal controls and meet regulatory requirements, particularly if the service provider were to experience problems;
the cost of the outsourcing arrangement; and
the degree of difficulty and time required to find an alternative service provider or to bring the business activity ‘in-house’.

Specific questions ATB Financial might consider in assessing the materiality of outsourcing arrangements are set out in Annex 2.

Outsourcing all or substantially all of a management oversight function should always be considered material, except in circumstances where ATB Financial receives such services from another ATB Financial subsidiary. For the purpose of this Guideline, management oversight functions include:

financial analysis;
compliance;
any internal audit services related to the internal accounting controls, financial systems, or financial statements;
senior management; and
risk management.

For example, a material arrangement could relate to the outsourcing of a significant part of ATB Financial’s information technology function, investment management, or loan processing. Arrangements that likely do not represent material outsourcing include those where there are numerous similar providers in the marketplace and the cost and inconvenience of switching between providers is low.

Significant changes in the volume or the nature of business conducted should cause ATB Financial to reassess an outsourcing arrangement’s materiality. In cases where an arrangement is reassessed as material, it should come into compliance with all aspects of this Guideline at the first opportunity, such as when the outsourcing contract, agreement or statement of work (where applicable) is substantively amended, renewed or extended.

7. RISK MANAGEMENT PROGRAM FOR MATERIAL OUTSOURCING ARRANGEMENTS

In general, the Minister of Finance expects that ATB Financial will design a risk management program that applies to all outsourcing arrangements of ATB Financial and its subsidiaries, except those that are clearly immaterial, and that the risk mitigants employed will be commensurate with ATB Financial’s assessment of the risks associated with the particular outsourcing arrangement.

7.1 Due Diligence Processes
The Minister of Finance expects ATB Financial to conduct an internal due diligence to determine the nature and scope of the business activity to be outsourced, its relationship to the rest of ATB Financial’s activities, and how the activity is managed.

In selecting a service provider, or renewing a contract or outsourcing arrangement, ATB Financial is also expected to undertake a due diligence process that fully assesses the risks associated with the outsourcing arrangement, and addresses all relevant aspects of the service provider, including qualitative (i.e., operational) and quantitative (i.e., financial) factors (see Annex 3 for a list of factors that could be included when performing due diligence of a service provider). If out-of-Canada outsourcing is being contemplated, ATB Financial should pay particular attention to the legal requirements of that jurisdiction, as well as the potential foreign political, economic and social conditions, and events that may conspire to reduce the foreign service provider’s ability to provide the service, as well as any additional risk factors that may require adjustment to the risk management program.

Due diligence processes will vary depending on the nature of the outsourcing arrangement being contemplated. For example, in the case of renewals where no material change has occurred that would affect the viability of the outsourcing relationship, it may not always be appropriate to conduct a thorough due diligence.

ATB Financial may rely on a due diligence review of the service provider that has been performed by an affiliate or home office within the previous 15 months, provided the review addresses the above-noted requirements as well as the risks particular to ATB Financial.

7.2 Policies and Procedures to Manage Risks Associated with Material Outsourcing Arrangements

7.2.1 Contract for Services
The Minister of Finance expects material outsourcing arrangements to be documented by a written contract that addresses all elements of the arrangement and has been reviewed by ATB Financial’s legal counsel. Some of the items identified below may not be applicable in all circumstances; however, ATB Financial is expected to address all issues relevant to managing the risks associated with each outsourcing arrangement to the extent feasible and reasonable given the circumstances, and having regard to the interests of ATB Financial.

a) Nature and Scope of the Service Being Provided
The contract or outsourcing agreement is expected to specify the scope of the relationship, which may include provisions that address the frequency, content and format of the service being provided. The contract or outsourcing agreement is expected to detail where the service provider will provide the service.

b) Performance Measures
Performance measures should be established that allow each party to determine whether the commitments contained in the contract are being fulfilled.

c) Reporting Requirements
The contract or outsourcing agreement is expected to specify the type and frequency of information ATB Financial receives from the service provider. This would include reports that allow ATB Financial to assess whether the performance measures are being met and any other information required for ATB Financial’s monitoring program (see Section 7.3). In addition, the contract or outsourcing agreement is expected to include procedures and requirements for reporting events to ATB Financial that may have the potential to materially affect the delivery of the service.

d) Resolution of Differences
The Minister of Finance expects the contract or outsourcing agreement to incorporate a protocol for resolving disputes. The contract or outsourcing agreement should specify whether the service provider must continue providing the service during a dispute and the resolution period, as well as the jurisdiction and rules under which the dispute will be settled.

e) Defaults and Termination
A contract or outsourcing agreement is expected to specify what constitutes a default, identify remedies, and allow for opportunities to cure defaults or terminate the agreement. ATB Financial is expected to ensure that it can reasonably continue to process information and sustain operations in the event that the outsourcing arrangement is terminated or the service provider is unable to supply the service. Appropriate notice should be required for termination of service and ATB Financial’s assets should be returned in a timely fashion. In particular, data and records relating to data processing outsourcing arrangements should be returned to ATB Financial in a format that would allow ATB Financial to sustain business operations without prohibitive expense.

f) Ownership and Access
Identification and ownership of all assets (intellectual and physical) related to the outsourcing arrangement should be clearly established, including assets generated or purchased pursuant to the outsourcing arrangement. The contract or outsourcing agreement should state whether and how the service provider has the right to use ATB Financial’s assets (e.g., data, hardware and software, system documentation or intellectual property) and ATB Financial’s right of access to those assets.

g) Contingency Planning
The contract or outsourcing agreement should outline the service provider’s measures for ensuring the continuation of the outsourced business activity in the event of problems affecting the service provider’s operation, including systems breakdown and natural disaster and other events. ATB Financial should ensure that the service provider regularly tests its business recovery system and notifies ATB Financial of the test results. In addition, ATB Financial should be notified in the event that the service provider makes significant changes to its business resumption and contingency plans, or encounters other circumstances that might have a serious impact on the service.

h) Audit Rights
The contract or outsourcing agreement is expected to clearly stipulate the audit requirements and rights of both the service provider and ATB Financial. At a minimum, it should give ATB Financial the right to evaluate the service provided or, alternatively to cause an independent auditor to evaluate, on its behalf, the service provided. This includes a review of the service provider’s internal control environment as it relates to the service being provided.

i) Subcontracting
The contract or outsourcing agreement is expected to set out any rules or limitations to subcontracting by the service provider. In particular, security and confidentiality standards should apply to subcontracting or outsourcing arrangements by the primary service provider. Consistent with the principles of this Guideline, the audit and inspection rights of ATB Financial should continue to apply to all significant subcontracting arrangements.

j) Confidentiality, Security and Separation of Property
At a minimum, the contract or outsourcing agreement is expected to set out ATB Financial’s requirements for confidentiality and security. Ideally, the security and confidentiality policies adopted by the service provider would be commensurate with those of ATB Financial and should meet a reasonable standard in the circumstances. The contract or outsourcing agreement should address which party has responsibility for protection mechanisms, the scope of the information to be protected, the powers of each party to change security procedures and requirements, which party may be liable for any losses that might result from a security breach, and notification requirements if there is a breach of security.

The Minister of Finance expects appropriate security and data confidentiality protections to be in place. The service provider is expected to be able to logically isolate ATB Financial’s data, records, and items in process from those of other clients at all times, including under adverse conditions.

k) Pricing
The contract or outsourcing agreement should describe fully the basis for calculating fees and compensation relating to the service being provided.

l) Insurance
The service provider should be required to notify ATB Financial about significant changes in insurance coverage and disclose general terms and conditions of the insurance coverage.

7.2.2 Business Continuity Plan
ATB Financial’s business continuity plan should address reasonably foreseeable situations (either temporary or permanent) where the service provider fails to continue providing service. The business continuity plan and back-up systems should be commensurate with the risk of a service disruption. In particular, ATB Financial’s business continuity plan should ensure that ATB Financial has in its possession, or can readily access, all records necessary to allow it to sustain business operations, meet its statutory obligations, and provide all information as may be required by the Minister of Finance to meet its mandate, in the event the service provider is unable to provide the service.

7.2.3 Outsourcing in Foreign Jurisdictions
If the material outsourcing arrangement results in services being provided in a foreign jurisdiction, ATB Financial’s risk management program should be enhanced to address any additional concerns linked to the economic and political environment, technological sophistication, and the legal and regulatory risk profile of the foreign jurisdiction(s).

7.3 Monitoring and Oversight of Material Outsourcing Arrangements
ATB Financial must develop, implement and oversee procedures to monitor and control outsourcing risks in accordance with its outsourcing risk-management policies. The sophistication of the procedures should be commensurate with the size and complexity of the outsourcing arrangement(s) and with the expectations of this Guideline. Management is expected to prepare reports based on ATB Financial’s monitoring and oversight activities. These reports may outline the success of the outsourcing arrangement and the effectiveness of the risk management program and may be reflected in the documentation delivered to ATB Financial’s board of directors.

7.3.1 Centralized List of All Material Outsourcing Arrangements
ATB Financial should maintain a centralized list of all its material outsourcing arrangements. ATB Financial may maintain the list on behalf of its subsidiaries. The list should contain information pertaining to the name of the service provider and location where the service is provided, the expiry or renewal date of the contract or outsourcing agreement and the value (dollar amount) of the contract or outsourcing agreement. The list should be updated on an ongoing basis and should form part of the documentation delivered to ATB Financial’s board of directors. The Minister of Finance should, upon request, have access to the list at any time.

7.3.2 Monitoring the Outsourcing Arrangement
ATB Financial should monitor all material outsourcing arrangements to ensure that the service is being delivered in the manner expected and in accordance with the terms of the contract or outsourcing agreement. Monitoring may take the form of regular, formal meetings with the service provider and/or periodic reviews of the outsourcing arrangement’s performance measures. Within a reasonable time ATB Financial should advise the Minister of Finance (either formally or informally) about any events that are likely to have a significant negative impact on the delivery of the service.

ATB Financial should review its material outsourcing arrangements to ensure compliance with its outsourcing risk policies and procedures and with the expectations of this Guideline. Reviews of material outsourcing arrangements should be periodically undertaken by ATB Financial’s internal audit department or another independent review function either internal or external to ATB Financial, provided it has the appropriate knowledge and skills. ATB Financial’s board of directors will always retain overall accountability for the outsourcing arrangement.

Reviews should test ATB Financial’s risk-management activities for outsourcing in order to:

ensure risk-management policies and procedures for outsourcing are being followed;
ensure effective management controls over outsourcing activities;
verify the adequacy and accuracy of management information reports; and
ensure that personnel involved in risk-management for outsourcing are aware of ATB Financial’s risk-management policies and have the expertise required to make effective decisions consistent with those policies.

Management should adjust the scope of the review depending on the nature of the outsourcing arrangement.

7.3.3 Monitoring the Service Provider
At least annually, ATB Financial should review the service provider to ascertain its ability to continue to deliver the service in the manner expected. This review could include an assessment of the service provider’s circumstances including its financial strength, prospects, and technical competence.

8. DATA PROCESSING IN FOREIGN JURISDICTIONS

ATB Financial is expected to ensure that all material data processing outside Canada arrangements which involve outsourcing as defined in Section 3.1 of this Guideline comply with the relevant aspects of this Guideline. In cases where the data is processed by a third party, factors the Board of Directors may take into consideration in determining whether the arrangement warrants approval include whether the expectations set out in Sections 7.1, 7.2 and 7.3.1 of this Guideline are met.

The scope of the outsourcing arrangement to the foreign jurisdiction (information and/or business processes) is to be outlined in the application materials. Where the applicant wishes to materially expand the scope of the foreign processing beyond that contemplated in any previous application, a new application is required.

ANNEX 1

EXAMPLES OF OUTSOURCING ARRANGEMENTS

The outsourcing domain is diverse and growing. Some examples may include:

Information system management and maintenance (e.g., data entry and processing, data centres, facilities management, end-user support, local area networks, help desks);
Document processing (e.g., cheques, credit card slips, bill payments, bank statements, other corporate payments);
Application processing (e.g., insurance policies, loan originations, credit cards);
Policy administration (e.g., premium collection, policy assembly, invoicing, endorsements);
Claims administration (e.g., loss reporting, adjusting);
Loan administration (e.g., loan negotiations, loan processing, collateral management, collection of bad loans);
Investment management (e.g., portfolio management, cash management);
Marketing and research (e.g., product development, data warehousing and mining, advertising, media relations, call centres, telemarketing);
Back office management (e.g., electronic funds transfer, payroll processing, custody operations, quality control, purchasing);
Real estate administration (e.g., building maintenance, lease negotiation, property evaluation, rent collection);
Professional services related to the business activities of ATB Financial (e.g., accounting, internal audit, actuarial); and
Human resources (e.g., benefits administration, recruiting).

This Guideline generally would not apply to the following:

Courier services, regular mail, utilities, telephone;
Procurement of specialized training;
Discrete advisory services (e.g., legal opinions, certain investment advisory services that do not result directly in investment decisions, independent appraisals, trustees in bankruptcy);
Purchase of goods, wares, commercially available software and other commodities
Independent audit reviews;
Credit background and background investigation and information services;
Market information services (e.g., Bloomberg, Moody’s);
Independent consulting;
Services ATB Financial is not legally able to provide;
Printing services;
Repair and maintenance of fixed assets;
Supply and service of leased telecommunication equipment;
Travel agency and transportation services;
Correspondent banking services;
Maintenance and support of licensed software;
Temporary help and contract personnel;
Fleet leasing services;
Specialized recruitment;
External conferences;
Clearing and settlement arrangements between members or participants of recognized clearing and settlement systems;
Sales of insurance policies by agents or brokers;
Ceded insurance and reinsurance ceded; and
Syndication of loans.

ANNEX 2

SAMPLE QUESTIONS TO ASSESS THE MATERIALITY OF OUTSOURCING ARRANGEMENTS

In assessing the materiality of a specific outsourcing arrangement, ATB Financial may want to consider, among others, these questions:

Is the business activity important in relation to ATB Financial’s core business? Is a significant share of revenue derived from that particular activity?
What is the outsourcing arrangement’s potential impact on earnings, solvency, liquidity, funding, capital, reputation, brand value, or system of internal controls, or its importance to achieving and implementing business objectives, business strategy and business plans?
What is ATB Financial’s aggregate exposure to a particular service provider? Does the organization outsource a variety of activities to the same service provider?
What is the size of contractual expenditures as a share of non-interest expenses of ATB Financial or line of business?
If the service provider is unable to perform the service over a given period of time:
1. What is the expected impact on ATB Financial’s customers?
2. What is the likelihood that it would harm ATB Financial’s reputation?
3. Would it have a material impact on ATB Financial’s risk profile?
4. Would ATB Financial be able to engage an alternative service provider? How long would it take and what costs would be involved?

ANNEX 3

DUE DILIGENCE OF SERVICE PROVIDERS

The due diligence of service providers addressed in Section 7.1 may include, but is not necessarily limited to, examining a service provider in light of these factors:

Experience and technical competence to implement and support the proposed activity;
Financial strength (e.g., most recent audited financial statements and other relevant information (to the best of the service provider’s ability));
Business reputation, complaints, compliance and pending litigation;
Internal controls, reporting and monitoring environment;
Business resumption and contingency plans including technology recovery testing;
Reliance on and success in dealing with sub-contractors;
Insurance coverage; and
Business objectives, human resource policies, service philosophies, business culture, and how they fit with those of ATB Financial.

For more information, call 1-800-332-8383, or visit any branch of ATB Financial. To locate the branch nearest to you, please use our Branch Locator.