Critical Outsourcing Concentration and Subcontractor Risk
Harbourline Insurance outsources 68% of motor claims handling to Vendor A. Vendor A subcontracts document processing to a centre in another country; the subcontractor is listed in the contract but was not separately assessed in the third-party risk register. Service levels require 98% of claims acknowledged within two days and 95% settled within ten days; last quarter performance was 91% and 89%. A nine-hour outage at the subcontractor in May stopped document intake; Vendor A reported no customer harm. Attrition at the subcontractor is 28%, and its local power supply has had three failures this year. Harbourline's exit plan was last tested three years ago and assumes 40 in-house staff can absorb work; only 12 are trained. The contract expires in 14 months and has no step-in rights. Vendor A has offered a 7% discount for early renewal and an expanded scope covering home claims. Harbourline's outsourcing policy requires regulator notification of any material service disruption over four hours.
1. Is this outsourcing arrangement within appetite, and should the outage be notified to the regulator? Explain your reasoning.
Read the worked answer
The risk is not within appetite. Three features point to a material outsourcing: 68% concentration in one vendor, a subcontractor that has not been separately assessed, and a nine-hour outage that exceeds the four-hour notification threshold. The service-level misses (91% versus 98%; 89% versus 95%) are persistent, not one-off. The exit plan is not credible because only 12 of 40 assumed staff are trained and it has not been tested for three years. The contract lacks step-in rights. Under the outsourcing policy, the outage should be assessed for regulatory notification; 'no customer harm' reported by the vendor is not sufficient evidence. I would notify the regulator if the policy threshold is met and record the event in the incident system. Expanding scope before remediation would increase concentration and weaken the bank's negotiating position. Early renewal for a 7% discount is not a risk decision; it trades price for lock-in.
2. What conditions would you set before any early renewal or expansion of scope?
Read the worked answer
Conditions before renewal or expansion: complete due diligence on the subcontractor, including financial stability, power resilience, attrition and data controls; require a remediation plan for service-level misses with service credits and executive sponsorship; test the exit plan, including training 40 staff or identifying a credible alternative provider; negotiate step-in rights, audit rights, subcontracting approval, data residency and termination assistance; set a concentration limit and board-approved appetite; obtain a written risk acceptance if any residual gap remains. The renewal should be shortened, not extended, until the exit plan is tested. The expansion should be separated from the renewal and assessed as a new change with its own operational risk assessment. If the vendor will not accept these terms, the insurer should plan to dual-source or insource part of the work. The 7% discount should be weighed against the cost of concentration and the limited exit options.
3. What KRIs and contract changes would you put in place?
Read the worked answer
KRIs: service-level achievement, outage duration, subcontractor attrition, backlog, complaint volume, failed document intake, exit-plan test result, concentration percentage, and number of untrained staff. Contract changes: right to audit the subcontractor, notification of subcontracting changes, business continuity standards, data protection, service credits, step-in, termination assistance, and a requirement for a tested exit plan. Governance: monthly service review with risk and compliance, quarterly board reporting, annual due diligence, and an annual exit-plan test. The risk register should show the subcontractor as a separate dependency, not hidden under the prime vendor. Set escalation triggers so that two consecutive service-level misses or any outage over four hours goes to the Operational Risk Committee. The contract should also require the vendor to notify Harbourline of power, staffing or ownership changes at the subcontractor.