IT Service Management and Outsourcing/Vendor Risk
What this domain tests
How IT services are delivered and controlled, and how outsourcing risk is managed across the lifecycle. Expect ITIL terminology, SLA/OLA, incident and problem management, change control, and RBI outsourcing expectations.
Core rules
- ITIL practices include service desk, incident management (restore service), problem management (root cause), change enablement (risk-assessed approval), release, configuration management (CMDB), availability, capacity and service level management.
- An SLA defines service targets; OLAs support internal dependencies; underpinning contracts cover vendors. Metrics should measure customer impact, not just ticket closure.
- Outsourcing does not transfer accountability: the bank remains responsible to customers and regulators. Before outsourcing, assess materiality, vendor financial and security posture, concentration risk, sub-outsourcing, data location and exit.
- Contracts need service levels, audit rights, security and confidentiality, incident notification, data return/deletion, business continuity, subcontracting approval, termination assistance and liability.
- Ongoing monitoring includes performance reviews, independent assurance (SOC reports/ISO 27001 certificates), issue tracking and periodic risk reassessment.
Worked example
A bank outsources card management to a processor. The vendor hosts card data and connects to the card network. Correct approach: classify as material outsourcing, perform due diligence, require RBI-compliant data localisation, include audit rights and exit assistance, test the vendor's DR with the bank's switch, and monitor SLA and security metrics monthly. Relying only on the vendor's ISO 27001 certificate and annual self-assessment is insufficient because certification scope may exclude the bank's dedicated environment.
Traps that cost marks
- Thinking outsourcing transfers regulatory responsibility.
- Omitting exit and data-deletion clauses.
- Reviewing SLAs only at renewal.