The Supervision and Management of Banking Outsourcing

將銀行作業與服務委託予他人代為處理已是銀行為節省成本及改善作業與服務流程的最佳工具之一。目前的銀行愈來愈依賴各種委外模式，尤其是近年來美國與歐洲國家銀行委外大幅的成長，也帶動亞洲國家銀行競相仿效此一模式來促進經營效率與整體生產力，惟在享受委外的優點與利益之時，卻也帶給銀行諸如網路、交易、信譽等多種風險，本文舉出銀行於作業與服務委外過程中實際所發生的風險，讓銀行能更瞭解將作業與服務委外給委外供應者後可能面臨的重大風險。 隨著委外的趨勢、種類、對象、地區等愈趨多樣化，單純僅靠契約的管理是不足的，銀行管理階層需視自身的業務規模、財務、人力、及委外複雜性，利用契約管理系統、合格供應者排序管理的內部網站、採購至付款系統、勞務標準協定、主要承包商或委外供應者內部間作業協定的使用等管理工具，來協助做委外的管理。 藉由各國際金融組織與美國、英國、德國、新加坡等各國監理機關發布的監理與管理原則及國際大型金融機構的管理實務介紹，銀行對於作業與服務委外的監理與管理重點應聚焦於銀行董事會或相當層級的單位應負責核定周詳的委外作業與服務規章並承擔起相關責任；銀行應遵守監理機關禁止委外的事項；重要的業務委外時應慎重考量，並充分通知監理機關且獲得核准；應制定政策以管理整個委外過程及委外相關風險；委外應該遵照正式且週延的契約來進行及確保將勞務標準協定納入，並應要求委外供應者必須遵守保護機密資訊的責任；及應建立監理機關可由委外供應者處取得相關資料的管道與有對委外供應者執行實地檢查的權利。 在海外地區委外及內部稽核功能委外兩個比較特殊的課題上，海外地區委外要注意國家風險及法令遵循風險等獨特的風險，務必做到母國監理機關可保有監理的權利；內部稽核功能委外要避免獨立性被質疑的問題，簽訂委外契約時應注意做到委外供應者不能執行銀行的管理功能與作管理決策，或行為如同銀行的員工。 透過美國銀行作業與服務委外監理實務的介紹，委外業務監理的重點應放在確認妥適的檢查範圍、評估銀行委外安排的風險大小、評估銀行風險管理品質、溝通缺失並討論導正措施、委外需求定義、審慎查核、委外契約、及監督委外供應者關係等檢查目標上。 最後，為了從激烈的金融競爭環境中脫穎而出，銀行董事會及高階管理階層應從確認委外需求、辨識委外風險、慎選委外供應者、至妥適管理委外供應者的每一階段都審慎以對；監理機關則應以風險導向的監理方式來檢視銀行的作業與服務委外，尤其應特別注意消費者保護及資訊保密的議題，如此方能創造成功的銀行作業與服務委外。Outsourcing arrangements can help banks manage costs, obtain necessary expertise, expand customer product offerings, and improve services. While outsourcing to affiliated or nonaffiliated entities, it also introduces risks that financial institutions should address. On supervising or managing outsourced activities of bank, regulator and bank should focus on the board of directors and senior management are responsible for understanding the risks associated with outsourcing arrangements and ensuring that effective risk management practices are in place. Once the bank has completed its risk assessment, management should evaluate service providers to determine their ability, both operationally and financially, to meet the institution’s needs. Contracts should be clearly written and sufficiently detailed to provide assurances for performance, reliability, security, confidentiality, and reporting. Banks should implement an oversight program to monitor each service provider’s controls, condition, and performance. On offshore outsourcing, the bank should conduct adequate due diligence, manage risks appropriately, comply with applicable laws, and ensure access to critical information with respect to the services being provided by a foreign-based third party. Examination focus should be on the results of the bank’s due diligence, risk assessment, and ongoing oversight program as well as the internal and/or external audits arranged by the service provider or the bank. If warranted, the regulator may examine a bank’s outsourcing arrangement with a foreign-based service provider. If the provider is a regulated entity, then the regulator may arrange through the appropriate foreign supervisor(s) to obtain information related to the services provided to the bank, if significant risk issues emerge, to examine those services. Work traditionally carried out by internal auditors of the bank is now done by independent public accounting firms and other outside professionals on audit outsourcing arrangement. However, potential conflicts of interest may arise if the outsourced auditing firm performs audit functions in addition to other audit services, such as providing the independent financial statement. To avoid this, accounting firms and other outside professionals should not act or appear to act in a capacity equivalent to a member of the client’s management or as a client employee. On United States examination practice of outsourcing, key points of examination objectives are that determine the appropriate scope for the examination, evaluate the quantity of risk present from the institution’s outsourcing arrangements, evaluate the quality of risk management, discuss corrective action and communicate findings, determine requirements definition, due diligence, service contract, and monitoring service provider relationship(s)