Technology Change, Outsourcing and Vendor Management
What this domain tests
The exam tests the change lifecycle from business case to post-implementation review, and the regulatory and commercial controls over outsourcing and vendors - materiality, due diligence, contracts, service levels, exit planning, concentration and ongoing monitoring.
Core rules and concepts
- Change lifecycle: strategy and business case → requirements → RFP and vendor selection → due diligence → contract → design and build → UAT → data migration → parallel run → go-live → post-implementation review and benefits realisation.
- Delivery models: waterfall (sequential, documentation-heavy) versus agile (iterative, user feedback). Regulated firms still need documented requirements, testing evidence and change approval.
- Outsourcing: material outsourcing triggers notification and contractual requirements (SYSC 8 in the UK; DORA in the EU). The firm remains accountable for the outsourced function.
- Contract essentials: scope, SLAs and KPIs, service credits, audit rights, subcontracting approval, data ownership and residency, security, business continuity, termination assistance and exit plan.
- Vendor management: risk rating, ongoing due diligence, performance reviews, concentration and fourth-party risk, and a register of arrangements.
- Cloud: public, private and hybrid; SaaS is usually an outsourcing arrangement, not a procurement shortcut.
Worked example
A firm migrates its OMS to a SaaS vendor with a 99.9% availability SLA. Reasoning: 99.9% allows 0.1% × 8,760 = 8.76 hours of unplanned downtime a year, so the SLA must be read against the impact tolerance for order handling. Due diligence covers financial stability, security certification, data residency, subcontractors and exit feasibility. The contract needs audit rights, breach notification, service credits, termination assistance and a tested exit plan. UAT must cover order flow, allocations and reconciliation, and a parallel run should prove equivalence before go-live with a documented rollback.
Traps that cost marks
Equating licence cost with total cost of ownership; omitting an exit plan; assuming cloud is not outsourcing; accepting an SLA without calculating the downtime it permits; letting scope creep past change control; skipping UAT and parallel runs; failing to monitor vendor performance after go-live.