Outsourcing and compliance risk: do more for less
This posting is a follow up on this post and this post and describes at a very high level how the operational cost related to managing outsource risk can be reduced. Not just by decreasing all budgets by 10%, but by a targeted effort. I came up with this approach during my work for a large international bank (more elaborately described in some articles) and it aims to rationalise the way risk managers/officers should approach their work. The core of the approach requires (senior) risk officers (e.g. operational, compliance) to approach assurance and monitoring more from a financial perspective. The typical risk officer is not used to incorporate the (in)direct costs (operational cost) and potential lost in revenue (opportunity cost) into their considerations when proposing new controls. This results often in expensive assurance mechanisms, like using SAS 70 type II reports for area’s of low risk. By defining a more balanced control strategy which aligns the control requirements with ...