Outsourced Payments Platform, Green SLA, and Regulatory Oversight
Meridian Bank outsources its core payments platform to a managed service provider under a contract that auto-renews in 90 days. The SLA promises 99.9% monthly availability; the bank’s board dashboard has shown green for 11 consecutive months. In fact, three severity-one incidents occurred last quarter, each caused by the provider’s change process; one delayed salary payments for 18 hours. The regulator has issued a draft finding that the bank cannot demonstrate effective oversight of the provider. The contract has no exit plan, no right-to-audit clause, and no requirement to notify subcontractor changes. The CIO says the SLA proves performance; the CRO says the incidents are “operational noise.” The board must decide whether to renew, renegotiate, or begin insourcing. The next board meeting is before the renewal deadline.
1. Why is the green SLA dashboard misleading, and which principles and Evaluate–Direct–Monitor activities are missing?
Read the worked answer
The green dashboard is misleading because it measures only contracted availability, not service outcome or control effectiveness. Performance: 99.9% monthly availability can be met while three severity-one incidents cause material harm; the SLA may exclude change-related outages or measure the wrong service. Conformance: no right-to-audit, no subcontractor notification, and no exit plan mean the bank cannot demonstrate regulatory oversight. Responsibility: the board cannot delegate accountability to the CIO or the provider; the CRO’s operational-noise framing misses the regulatory finding. Monitor: the board monitored a supplier metric, not its own risk. Acquisition: auto-renewal without renegotiation compounds lock-in.
The board should treat the draft finding as a governance signal, not a public-relations issue. It should require an independent review of the incidents, the SLA definitions, and the provider’s control environment. The question is not whether the SLA is green, but whether the bank can evidence effective oversight. That is a board responsibility.
2. What board decision and directives should be made before the auto-renewal deadline?
Read the worked answer
Before renewal, the board should direct management to: (1) renegotiate the SLA to include severity-one incident reporting, root-cause analysis, change-failure rate, and service credits tied to customer harm; (2) add right-to-audit, subcontractor-change notification, and regulatory-access clauses; (3) require a tested exit plan and data-portability arrangement; (4) commission an independent options appraisal covering renegotiation, multi-sourcing, and insourcing; (5) establish a provider risk dashboard owned by the CRO and reviewed by the board; (6) withhold renewal until the regulator’s draft finding is remediated or a credible remediation plan is accepted.
The board should not negotiate the contract itself, but it must set the non-negotiable conditions and monitor them. If the provider will not accept audit and exit terms, the board should be prepared to shortlist alternatives. Renewal is a governance decision because it locks in risk for another term.
3. Who remains accountable for regulatory conformance, and how should the board monitor it without taking over management’s role?
Read the worked answer
Accountability for regulatory conformance remains with the bank’s governing body. ISO/IEC 38500’s Conformance principle requires IT use to comply with laws, regulations, and internal policies; outsourcing transfers operations, not accountability. The board should ensure a named executive owns the regulator relationship and that the provider’s controls are included in the bank’s control testing.
It should monitor evidence, not assurances: audit reports, incident root causes, remediation closure, and subcontractor changes. The board should also direct that the regulator’s finding be reported to the full board, not filtered through the CIO. If the provider’s contract prevents adequate access, that is itself a conformance failure. The board’s remedy is to set conditions, escalate, and if necessary change provider. It should avoid a public blame exercise; the test is whether oversight is demonstrable.