GUIDANCE ON OUTSOURCING OF BUSINESS FUNCTIONS

Transcription

1 GUIDANCE ON OUTSOURCING OF BUSINESS FUNCTIONS Definitin f Outsurcing An utsurcing arrangement is an agreement between an MGA and a service prvider that perfrms a business activity, functin r prcess that the MGA culd therwise perfrm. Alternatively, the MGA may be the service prvider t an insurer under an agreement. See page 8 fr sme examples f utsurcing and examples f activities that d nt cnstitute utsurcing. Cnsideratins fr MGAs Insurers make inquiries abut an MGA s utsurcing arrangements in the CLHIA Standardized MGA Cmpliance Review Survey in rder t determine whether any such arrangements pse risk t them r their custmers and t ensure that risks are apprpriately managed. OSFI, the primary regulatr fr federally regulated insurance cmpanies and ther financial institutins, issued Guideline B-10 Outsurcing f Business Activities, Functins and Prcesses in It has been thrugh tw rewrites since. While the Guideline des nt apply directly t MGAs, it des prvide imprtant cnsideratins and prcedural guidance fr MGAs that utsurce functins. The fllwing is a summary f Guideline B-10, mdified t apply t an MGA. It is intended t assist MGAs in making decisins abut utsurcing and managing their bligatins, including: Evaluating the risks assciated with existing and prpsed arrangements; Develping a prcess fr determining the materiality f arrangements; Implementing a prgram t manage and mnitr material risks; and Ensuring that the Bard and/r management receive enugh infrmatin t discharge their duties. Why Wuld Outsurcing Matter t an MGA? An MGA that utsurces activities will face added cmplexity in implementing and mnitring its AML, Privacy and Market Cnduct cmpliance prgrams. Additinally, the MGA must ensure that it has the apprpriate kind f errrs and missins insurance that cvers its utsurced activities. Whatever relevant plicies and prcedures yu adpt fr yur cmpliance prgrams shuld als be implemented within the service prvider. By fllwing the OSFI guideline t the extent that is reasnable fr yu t d, yu may be able t ensure that yur cmpliance bligatins can be met. It is critical that yur service prvider perates in a manner that allws yu t cmply with yur cntractual, legal and regulatry cmpliance bligatins. Yu shuld cnsider the service prvider t be part f us rather than they because whatever activity the prvider perfrms is dne n yur behalf. Yu cannt distance yurself frm thse activities and accuntability. Yu shuld make sure that yu have an unbstructed line f sight between yu and the service prvider. At the same time, yu must ensure that when respnding t an insurer s CLHIA Standardized MGA Cmpliance Review Survey, utsurcing arrangements are clearly described. It is acceptable t identify persns within the service prvider wh act in sme capacity fr the MGA including CAILBA 2011 Page 1

2 cntrl functins as lng as the fact that these persns are emplyees f the service prvider is made clear and as lng as the agreement cvers their activities. Accuntability and Cntrl An rganizatin that utsurces an activity, functin r prcess retains full and cmplete respnsibility fr that wrk. 4.1 Bard f Directrs Respnsibilities If the MGA is gverned by a bard f directrs, the Bard shuld ensure that the MGA has apprpriate risk management plicies and practices, which are regularly reviewed. The Bard shuld peridically: Apprve r reaffirm the plicies that apply t utsurcing arrangements (e.g., risk philsphy, materiality criteria, risk management prgram and apprval limits); and Review a list f all the MGA s material utsurcing arrangements and ther relevant reprts. 4.2 Management Respnsibilities 4.2a Develp and implement utsurcing plicies and prcedures, including: 1) An utsurcing risk philsphy cmprised f: a statement f principles, the basis fr decisin making, and the parameters fr cntrlling utsurcing risks, which shuld address the: Integratin f utsurcing arrangements with business and strategic bjectives, including identifying any functins that, fr strategic r internal cntrl reasns, yu wuld nt cntemplate utsurcing. Imprtance and adequacy f internal expertise and management framewrk t versee and manage the utsurced activity and the relatinship with the service prvider. Business case fr utsurcing a significant business activity, which shuld cnsider the shrtand lng-term cst implicatins and the cumulative impacts f all utsurcing arrangements n the verall safety and sundness f the MGA. * Imprtant Nte: This dcument assumes that any activities, functins r prcesses that an MGA utsurces t a service prvider will be utsurced within the MGA s prvince. If this is nt the case, r if the MGA perates in a number f prvinces, yu must ensure that yur utsurcing arrangements cmply with varius prvincial privacy laws, which may prescribe the manner in which infrmatin that is sent ut f prvince must be managed and which may als require certain privacy breach ntificatins. Additinally, in the unlikely event that an MGA utsurces t a prvider utside f Canada, the MGA must review the OSFI Guideline B-10 directly fr infrmatin n additinal elements t cnsider. It is als essential fr any MGA cntemplating an utsurcing arrangement t seek independent legal cunsel in rder t dcument the arrangement and prtect its interests. CAILBA 2011 Page 2

3 2) A materiality assessment fr utsurcing arrangements, which shuld identify bth the prcesses fr determining the materiality f individual utsurcing arrangements and the underlying materiality factrs. Outsurcing arrangements can vary in materiality. Yur management f utsurcing risks shuld be cmmensurate with the materiality f the arrangement. If yu determine that yu have material utsurcing arrangements, yu shuld fllw the full risk management prgram recmmended. See page 9 fr specific questins yu might cnsider in assessing materiality f utsurcing arrangements. An utsurcing arrangement s materiality depends n the extent t which it culd have an imprtant financial r qualitative influence n yur peratins. Given the size f the average MGA, it is reasnable t assume that many utsurcing arrangements culd be deemed material. Assessment f materiality is ften subjective and depends n yur circumstances. The assessment shuld include the: Impact f the utsurcing arrangement n the MGA s finances, reputatin and peratins, particularly if the service prvider shuld fail t perfrm ver a given perid f time; MGA s ability t maintain apprpriate internal cntrls and meet regulatry requirements, particularly if the service prvider were t experience prblems; Cst f the utsurcing arrangement; Degree f difficulty and time required t find an alternative service prvider r t bring the business activity in-huse ; and Ptential that multiple utsurcing arrangements prvided by the same service prvider can have an imprtant influence in aggregate n the rganizatin. If the same service prvider prvides multiple utsurcing arrangements that are individually immaterial, yu need t assess the aggregate influence n yur MGA. Accrding t the Guideline, utsurcing all r substantially all f a management versight functin shuld always be cnsidered material, except in circumstances where the rganizatin receives such services frm anther member f its grup. Fr the purpse f this Guideline, management versight functins include: financial analysis; cmpliance; internal audit services fr internal accunting cntrls, financial systems, r financial statements; senir management; and risk management. Outsurcing f a significant part f yur infrmatin technlgy functin culd be material. Nn material arrangements include thse where there are numerus similar prviders in the marketplace and the cst and incnvenience f switching between prviders is lw. Reassessing materiality - Significant changes in the vlume r the nature f business shuld cause yu t reassess an utsurcing arrangement s materiality. In cases where an arrangement is reassessed as CAILBA 2011 Page 3

4 material, yu shuld make effrts t bring the arrangement int cmpliance at the first pprtunity, such as when the utsurcing cntract, agreement r statement f wrk (where applicable) is substantively amended, renewed r extended. When entering int a material utsurcing arrangement with an assciated cmpany, yu shuld have in place: Outsurcing agreement that details the scpe f the arrangement, the services t be supplied, the nature f the relatinship between yu and the service prvider, and prcedures gverning the subcntracting f services; Business cntinuity plan ( BCP ); Prcess fr mnitring and versight. 3) An utsurcing risk management prgram fr material risks that is applied cnsistently thrughut the MGA. Management shuld pay particular attentin t BCP planning n an enterprise-wide basis. Yur risk management prgram shuld apply t all its utsurcing arrangements, except thse that are clearly immaterial. Risk mitigatin emplyed under this prgram must be apprpriate t the particular utsurcing arrangement. It shuld include: i. Due Diligence Prcesses - Cnduct internal due diligence t determine: the nature and scpe f the business activity t be utsurced, its relatinship t the rest f yur activities, and hw the activity is managed. In selecting a service prvider, r substantially amending r renewing a utsurcing agreement, yur due diligence prcess shuld fully assess the risks assciated with the utsurcing arrangement, and address all relevant aspects f the service prvider, including qualitative (i.e., peratinal) and quantitative (i.e., financial) factrs. Due diligence may include, but is nt limited t, examining a service prvider in light f these factrs: Experience and technical cmpetence f the service prvider t implement and supprt the utsurced activity (this culd include a review f the experience and technical cmpetence f significant subcntractrs where feasible); Financial strength (e.g., mst recent audited financial statements and ther relevant infrmatin (t the best f the service prvider s ability). The nus is n yu t ensure that yu btain the relevant infrmatin t assess a service prvider s financial strength. Hwever, if the service prvider is required t cmply with ther legislatin (such as securities legislatin) it might nt be in a psitin t share certain infrmatin with yu; Business reputatin, cmplaints, cmpliance and pending litigatin; Internal cntrls, reprting and mnitring envirnment; The service prvider s business resumptin and cntingency measures, including recvery testing, fr ensuring the cntinuatin f the utsurced business activity in the event f prblems and events that may affect the service prvider s peratin such as a systems breakdwn, natural disaster, an inability f a significant subcntractr t prvide services CAILBA 2011 Page 4

5 relevant t the utsurced activity, and situatins where extrardinary demands are placed n a service prvider. Reliance n and success in dealing with sub-cntractrs; Insurance cverage; and Business bjectives, human resurce plicies, service philsphies, business culture, and hw they fit with thse f yur MGA. If an agreement is up fr renewal and there is n material change that wuld affect the viability f the utsurcing relatinship, yu might cnduct mre streamlined due diligence. Yu may rely n a due diligence review f the service prvider that has been perfrmed by an affiliate r hme ffice within the previus 15 mnths, prvided the review addresses the abve-nted requirements as well as yur particular risks. ii. Plicies and Prcedures t Manage Risks Assciated with Material Outsurcing Arrangements a) Cntract fr Services Material utsurcing arrangements need t be dcumented by a written agreement that cvers all f the arrangement s elements and has been reviewed by yur legal cunsel. Sme f the items identified belw may nt apply in all circumstances but yu shuld address all issues relevant t managing the risks assciated with each utsurcing arrangement t the extent feasible and reasnable. 1) Nature and Scpe f the Service Being Prvided Specify the scpe f the relatinship, including prvisins that address the frequency, cntent and frmat f the service being prvided and detail the physical lcatin where the service prvider will prvide the service. 2) Perfrmance Measures Establish perfrmance measures that allw each party t determine whether the cmmitments cntained in the cntract are being fulfilled. 3) Reprting Requirements Specify the type and frequency f infrmatin yu receive frm the service prvider, including reprts that allw yu MGA t assess whether the perfrmance measures are being met and any ther infrmatin required fr yur mnitring prgram. Include prcedures and requirements fr the service prvider t reprt events t yu that may have the ptential t materially affect the delivery f the service. 4) Reslutin f Differences Incrprate a prtcl fr reslving disputes and specify whether the service prvider must cntinue prviding the service during a dispute and the reslutin perid, as well as the jurisdictin and rules under which the dispute will be settled. CAILBA 2011 Page 5

6 5) Defaults and Terminatin Specify what cnstitutes a default, identify remedies, and allw fr pprtunities t cure defaults r terminate the agreement. Yu shuld ensure that it can reasnably cntinue t prcess infrmatin and sustain peratins if the utsurcing arrangement is terminated r the service prvider is unable t supply the service. Apprpriate ntice shuld be required fr terminatin f service and yur assets shuld be returned in a timely fashin. In particular, data and recrds relating t data prcessing utsurcing arrangements shuld be returned t yu in a frmat that wuld allw yu t sustain business peratins withut prhibitive expense. The utsurcing agreement shuld nt cntain wrding that precludes the service frm being cntinued in situatins where the MGA is in liquidatin. 6) Ownership and Access Identificatin and wnership f all assets (intellectual and physical) related t the utsurcing arrangement shuld be clearly established, including assets generated r purchased pursuant t the utsurcing arrangement. State whether and hw the service prvider has the right t use yur assets (e.g., data, hardware and sftware, system dcumentatin r intellectual prperty) and yur right f access t thse assets. 7) Cntingency Planning Outline the service prvider s measures fr ensuring the cntinuatin f the utsurced business activity in the event f prblems and events that may affect the service prvider s peratin, including systems breakdwn and natural disaster, and ther reasnably freseeable events. Yu shuld ensure that the service prvider regularly tests its business recvery system as it pertains t the utsurced activity, ntifies yu f the test results, and addresses any material deficiencies. Yu shuld be ntified if the service prvider makes significant changes t its business resumptin and cntingency plans, r encunters ther circumstances that might have a serius impact n the service. 8) Audit Rights Clearly stipulate the audit requirements and rights f bth the service prvider and yu. At a minimum, it shuld give yu the right t evaluate the service prvided r, alternatively t cause an independent auditr t evaluate, n yur behalf, the service prvided. This includes a review f the service prvider s internal cntrl envirnment as it relates t the service being prvided. 9) Subcntracting Set ut any rules r limitatins t subcntracting by the service prvider. In particular, security and cnfidentiality standards shuld apply t subcntracting r utsurcing arrangements by the primary service prvider. 10) Cnfidentiality, Security and Separatin f Prperty At a minimum, set ut yur requirements fr cnfidentiality and security. The security and cnfidentiality plicies adpted by the service prvider shuld be cmmensurate with yurs and shuld meet the insurers standards. The utsurcing agreement shuld address CAILBA 2011 Page 6

7 which party has respnsibility fr prtectin mechanisms, the scpe f the infrmatin t be prtected, the pwers f each party t change security prcedures and requirements, which party may be liable fr any lsses that might result frm a security breach and ntificatin requirements if there is a breach f security. Security and data cnfidentiality prtectins must be in place. The service prvider is expected t be able t lgically islate yur data, recrds, and items in prcess frm thse f ther clients at all times, including under adverse cnditins. 11) Pricing Fully describe the basis fr calculating fees and cmpensatin relating t the service being prvided. 12) Insurance Require the service prvider t ntify yu abut significant changes in insurance cverage and disclse general terms and cnditins f the insurance cverage. b) Business Cntinuity Plan ( BCP ) Yur BCP shuld address reasnably freseeable situatins (either temprary r permanent) where the service prvider fails t cntinue prviding service. The BCP and back-up systems shuld be cmmensurate with the risk f a service disruptin. In particular, yur BCP shuld ensure that the MGA has in its pssessin, r can readily access, all recrds necessary t allw it t sustain business peratins and meet its statutry bligatins. iii) Mnitring and Oversight f Material Outsurcing Arrangements Every MGA engaged in material utsurcing shuld develp, implement and versee prcedures t mnitr and cntrl utsurcing risks in accrdance with its utsurcing risk-management plicies. The sphisticatin f the prcedures shuld be cmmensurate with the size and cmplexity f the utsurcing arrangement(s). Management shuld prepare reprts based n yur mnitring and versight activities. These reprts may utline the success f the utsurcing arrangement and the effectiveness f the risk management prgram and may be reflected in the dcumentatin delivered t yur Bard. a) Centralized List f All Material Outsurcing Arrangements Yu shuld maintain a centralized list f all material utsurcing arrangements, which cntains the name f the service prvider, the lcatin where the service is prvided, the expiry r renewal date f the utsurcing agreement and the estimated dllar value f the utsurcing agreement. A template f a centralized list yu can use is prvided in OSFI Guideline B-10, Appendix 3 in Reference Materials. The list shuld be updated n an nging basis and frm part f the dcumentatin delivered t yur Bard r management. CAILBA 2011 Page 7

8 b) Mnitring the Outsurcing Arrangement Yu shuld mnitr all material utsurcing arrangements t ensure that the service is delivered in the manner expected and in accrdance with the terms f the utsurcing agreement. Mnitring may take the frm f regular, frmal meetings with the service prvider and/r peridic reviews f the utsurcing arrangement s perfrmance measures. Yu shuld review yur material utsurcing arrangements t ensure cmpliance with yur utsurcing risk plicies and prcedures. c) Mnitring the Service Prvider Yu shuld review the service prvider at least annually t ascertain its ability t cntinue t deliver the service in the manner expected. This review wuld be cmmensurate with the level f risk invlved and culd include an assessment f the service prvider s circumstances including its financial strength, prspects (except in cases invlving the parent r hme ffice f a Canadian subsidiary r branch), technical cmpetence, and use and perfrmance f significant subcntractrs. d) Apprval limits regarding the level r authrity that enables the MGAs fficers t apprve utsurcing arrangements f varying magnitudes, cnsistent with the utsurcing risk philsphy and materiality criteria. 4.2.B Peridically review the effectiveness f plicies and prcedures The scpe f the review depends n the nature f the utsurcing arrangement. Reviews shuld test yur risk-management activities fr utsurcing in rder t: ensure risk-management plicies and prcedures fr utsurcing are being fllwed; ensure effective management cntrls ver utsurcing activities; verify the adequacy and accuracy f management infrmatin reprts; and ensure that persnnel invlved in risk-management fr utsurcing are aware f yur risk management plicies and have the expertise required t make effective decisins cnsistent with thse plicies. 4.2.C Cmmunicate infrmatin pertaining t significant utsurcing risks t the bard r management in a timely manner. Examples f Outsurcing Arrangements Infrmatin system management and maintenance (e.g., data entry and prcessing, data centres, facilities management, end-user supprt, lcal area netwrks, help desks); Dcument prcessing (e.g., cheques, credit card slips, bill payments, bank statements, ther crprate payments); Applicatin prcessing (e.g., insurance plicies, lan riginatins, credit cards); Plicy administratin (e.g., premium cllectin, plicy assembly, invicing, endrsements); Claims administratin (e.g., lss reprting, adjusting); Lan administratin (e.g., lan negtiatins, lan prcessing, cllateral management, cllectin f bad lans); Investment management (e.g., prtfli management, cash management); CAILBA 2011 Page 8

9 Marketing and research (e.g., prduct develpment, data warehusing and mining, advertising, media relatins, call centres, telemarketing); Back ffice management (e.g., electrnic funds transfer, payrll prcessing, custdy peratins, quality cntrl, purchasing); Real estate administratin (e.g., building maintenance, lease negtiatin, prperty evaluatin, rent cllectin); Prfessinal services related t the MGA s business activities (e.g., accunting, internal audit, actuarial); and Human resurces (e.g., benefits administratin, recruiting). Guideline B-10 generally wuld nt apply t the fllwing: Curier services, regular mail, utilities, telephne; Prcurement f specialized training; Discrete advisry services (e.g., legal pinins, certain investment advisry services that d nt result directly in investment decisins, independent appraisals, trustees in bankruptcy); Purchase f gds, wares, cmmercially available sftware and ther cmmdities; Independent audit reviews; Credit backgrund and backgrund investigatin and infrmatin services; Market infrmatin services (e.g., Blmberg, Mdy s); Independent cnsulting; Services the MGA is nt legally able t prvide; Printing services; Repair and maintenance f fixed assets; Supply and service f leased telecmmunicatin equipment; Travel agency and transprtatin services; Crrespndent banking services; Maintenance and supprt f licensed sftware; Temprary help and cntract persnnel; Fleet leasing services; Specialized recruitment; External cnferences; Clearing and settlement arrangements between members r participants f recgnized clearing and settlement systems; Sales f insurance plicies by agents r brkers; Ceded insurance and reinsurance ceded. Sample Questins t Assess the Materiality f Outsurcing Arrangements In assessing the materiality f a specific utsurcing arrangement, yu may want t cnsider the fllwing questins, amng thers: CAILBA 2011 Page 9

10 What is the relatinship between the business activity and ur cre business? What is the utsurcing arrangement s ptential impact n: earnings, slvency, liquidity, funding, capital, reputatin, internal expertise and the MGA s capacity, brand value, r system f internal cntrls? What is the utsurcing arrangement s imprtance t achieving and implementing business bjectives, the business strategy and business plans? What is ur aggregate expsure t a particular service prvider? Are we expsed t additinal utsurcing risk as a result f multiple utsurcing arrangements with a service prvider? What is the size f cntractual expenditures as a share f ur nn-interest expenses? If the service prvider is unable t perfrm the service ver a given perid f time: a. What is the expected impact n ur insurers, prducers and their custmers? b. What is the likely impact n ur reputatin? c. Wuld it have a material impact n ur risk prfile? d. Wuld we be able t engage an alternative service prvider? Hw lng wuld it take and e. What csts wuld be invlved? CAILBA 2011 Page 10