Computer Law & Security Report (2005) 21, 500e504

OFFSHORE OUTSOURCING

Outsourcing e Financial Services Authorityreport on offshoring

Tim Wright

Pillsbury Winthrop Shaw Pittman, London, UK

Abstract This article evaluates the 2005 Financial Services Authority report intooffshore outsourcing with specific reference to experience in India. It concludesthat, on the whole, the findings are positive and that UK business methods appearto transfer well.ª 2005 Tim Wright, Pillsbury Winthrop Shaw Pittman. Published by Elsevier Ltd. Allrights reserved.

In its report Offshore Operations: IndustryFeedback published at the end of April, theFinancial Services Authority reaches the ‘‘overallconclusion’’ that offshoring can contribute a mate-rial risk to its objectives of market confidence,reduction of financial crime and consumer pro-tection. But if the regulator did not reach thatconclusion it would not be doing its job. Offshoringis, after all, an inherently risky business due to thecomplexity of achieving ‘‘suitable managementoversight’’ and control from a distance. However,‘‘overall’’ the tenor of the FSA’s report is positiveand (notwithstanding the annoying habit regula-tors have of using the word ‘‘oversight’’ to meanthe total opposite of what it normally means) thereport makes it clear that financial services oper-ators, who would include the likes of Prudential,HSBC, Lloyds TSB and Aviva, have learnt enough sofar, and benefited, from their experiences in Indiato sustain the current appetite in the financial

0267-3649/$ - see front matter ª 2005 Tim Wright, Pillsbury Winthdoi:10.1016/j.clsr.2005.08.008

services sector for offshoring IT and business pro-cesses for the foreseeable future. There arechallenges e but the FSA’s report implies that, ofthe firms that it regulates and which currentlyoffshore to India, most are not only wise but alsoequal to them.

A. Overview

The FSA’s report homes in on India because that iswhere the largest retail groups that the regulatorsupervises are most frequently set up. The FSA’smethodology was to visit 10 operations (somecaptives and some external suppliers) in India,most of which were providing services for the UKoperations of retail banks and insurance compa-nies. Only one wholesale group was included in thereview. The FSA does begin with a warning overthe operational risks of offshoring, but the report

rop Shaw Pittman. Published by Elsevier Ltd. All rights reserved.

Offshore outsourcing 501

as a whole emphasises the need to learn fromexperience. It reads like a checklist of do’s anddon’ts, many of which can be applied to offshoringbusinesses outside the financial services sector.The report even contains top tips for firm’s off-shoring to India, including one particularly usefulfor call centre operations e play English filmscontinuously in the canteen so that staff can getused to regional English accents.

Nevertheless, the report’s introductory remarksdraw attention to the FSA’s two main observationsabout offshoring to India. The first is that there isa high level of staff turnover arising from the factthat it is quite a young industry. The concern isthat this could adversely impact service provision,although the FSA recognises in the body of thereport that firms have factored this into theirrecruitment and training capabilities.

The second relates to business continuity plan-ning (BCP) and the FSA’s finding that in India themarket for warm sites, i.e. alternative facilitiesthat are electronically prepared, equipped andfurnished for operation, is non-existent becausethe cost of such facilities is comparatively high.Firms have had to develop alternative strategies forBCP including repatriation to the UK, developmentof joint sites with other companies/suppliers, and,if the operation is large enough, spreading pro-cesses across more than one site within India.

B. Strategy

The report states that most of the companiesreviewed had a documented strategy for outsourc-ing/offshoring and the decision to move operationsoffshore is mostly ratified or taken by the Board inresponse to a formal proposal. Most companieshave adopted a flexible model for their arrange-ments in India using the build-operate-transfer(BOT) approach. This gives companies access tothird party expertise at the outset with a prospectof converting operations into ‘‘captives’’ in duecourse. This strategy provides a faster and less riskyroute into the market. The FSA notes that a varietyof processes are sent offshore, including call centre(for example, personal banking telephony, inboundand outbound collections, non-FSA regulated sales)and back office processes (for example, servicing ofaccounts, claims first response and verification,insurance renewals). Operators have apparentlybeen ‘‘so happy with the quality of service’’ thatthey are starting to move end-to-end processes toIndia as well as complex processes such as financialresearch and underwriting. The FSA also notes thatthe time difference between the UK and India

works particularly well for back office functions.Nevertheless, the regulator notes that one of thekey safety nets for most companies is that they stillhave the majority of their operations in the UKso that critical functions can be repatriated ifneeded.

In relation to preparation, the FSA notes thatmost companies adopt similar strategies as theywould for any major change programme, thesetting up of a new office or a significant out-sourcing initiative. They set up a formal gover-nance framework and the associated authorisationprocess. Due diligence, which is otherwise similarto that of any major initiative, includes theconsideration of country-specific risks and risksrelated to providing and managing operations froma long distance. Companies conduct due diligenceto ensure all associated risks are mitigated andmost of the companies surveyed had documentedall of the processes to be migrated.

All firms with offshore operations have estab-lished service level agreements (SLAs) and usuallyhave a person ‘‘on the ground’’ in India to ensurethat the processes achieve the required operationalperformance levels and comply with policies andregulatory requirements. Firms have learnt thatthey need to make allowance during transition forstabilising the process and on-the-job training andare, therefore, setting performance targets toreflect this which will ramp up over time. Targetsare monitored in much the same way as they are inthe UK and most firms have noted that theperformance to date either meets that achievedin the UK or exceeds it.

C. Change management

The FSA notes that initially, once the process hasbeen migrated, the level of oversight by andassistance from the donor locations is quite signif-icant, but that this diminishes once the offshorestaff gain experience.

Firms tend to choose third party suppliers inIndia that are ISO9001 (quality standard) and CMM(Capability Maturity Model standard) Level 5 cer-tified. Some suppliers are focused on qualitymanagement and use Six Sigma to institute proj-ects for change and continuous improvement.Some firms with captive operations are also adopt-ing these techniques.

Most firms using Indian offshore suppliers havea formal change process which requires the UKoperation to authorise the changes. The FSA saysthat this is particularly important if the sameprocess is still undertaken in the UK especially

502 T. Wright

where there is a deliberate policy to enable cross-country business continuity planning. Of the firmsreviewed which had outsourced, it was found thattheir third party suppliers do not currently performend-to-end processes in India e by having only onepart of the process, the suppliers have been ableto identify problems and rectify them. Smallerprocesses are easier to ‘‘re-engineer’’.

As to recruitment, most companies go for grad-uates, all of whom speak English. Staff tend toundergo a thorough vetting process and all staffundergo induction training to give them an un-derstanding of the company, its culture and poli-cies. The FSA notes that specialist language trainingis typically required for call centre work but not forback office functions. Some firms use externalspecialists, but supplement them with their owntrainingewhich can involve. showing English filmsand television programmes in the canteen.

D. Relationship management andoversight

The FSA notes that most firms have developeda governing body that is charged with the oversightof the offshore operations and also the strategicdecisions involved in deciding which processesshould be migrated. The body usually consists ofthe Heads of the Operational areas involved andkey advisors (risk, compliance, IT and HR). Wherethird party suppliers are used, there tends to be anOffshoring Manager who has oversight of andspecific day-to-day liaison with the operation inIndia. There were instances where the FSA feltthat this key contact posed a ‘‘key person risk’’,but that this is being addressed. Some firms usingthird party suppliers have a team of people on theground which has strengthened the oversightfunction and mitigated key person risk.

The FSAhas found that captive operations tend tobe structured in a similar way to the UK. Some firmshave a few ex-patriot managers employed at theIndian locations. Service levels and performanceare monitored as they are elsewhere in the group.All firms have mechanisms whereby changes in UKregulations are advised and implemented in Indiaand, in most cases, compliance is monitored bothlocally and from the UK, with the UK having overalloversight responsibilities.

Some firms have implemented their risk assess-ment practices, such as Control Self Assessment, inIndia. Depending on the group structure, thegroup, region or UK internal audit functions takeresponsibility for assessing the risk of the Indian

migrations and operations and incorporating themin their audit plans accordingly. The FSA notes thata number of captive operations, having reacheda viable size, have set up a local audit presence,typically reporting to group or UK audit functions.

E. Contingency planning

All of the operations reviewed have contingencyplans in the event of a serious problem. Largeroperations have already been able to spread tomultiple locations. Some suppliers have a policynot to employ more than 3500/4000 in any onecity. Some firms have offices located in more thanone city. Not only does this attract different skillsets and provide local business continuity oppor-tunities, it also minimises risk through multipledelivery locations. However, the FSA notes thatothers are experiencing significant problems or-ganising local BCP options with the cost of build-ings prohibitively high in comparison to the cost oflabour. Plus there is no external market for warmsites (the equivalent of a SunGard in the UK). Firmsare apparently looking into having joint sites withother companies or developing their own warmsites once their operations reach critical mass.

However, the FSA has noted that most compa-nies still have the capacity in other parts of theworld to pick up critical workloads from Indiashould the need arise. Data storage and mainsystems are all outside India, with data only passedthere if necessary for processing. Nevertheless,the FSA stresses that firms must ensure that staffremain suitably familiar with the processes to beable to fill in. It notes that at least one firm hasa deliberate bi-polar BCP strategy and, like severalother firms, conducts tests at least annually toensure that the UK can undertake work on behalfof India and vice versa.

F. Exit strategies

Most companies in the UK still have the capacityto repatriate the offshored work, if need be,which is particularly important for smaller oper-ations. Some companies have multiple strands totheir exit strategy depending on whether therequirement to exit is due to the operation orsupplier failing and therefore another option off-shore needing to be pursued. Exit requirementssuch as transition support and penalties aregenerally built into contracts with third partysuppliers.

Offshore outsourcing 503

G. Country-specific risks

On the question of staffing, the FSA notes that withapproximately 2.5 million English-speaking gradu-ates a year in India, there is no shortage of suitablerecruits. However, in some cases during the earlystages of offshoring it is seen to be difficult to findacceptable candidates for managerial/seniorposts. This is offset, however, by the fact that asbusiness tenure increases, more and more peopleare being promoted from within.

The biggest problem is staff turnover, particu-larly in third party suppliers. Apart from therelatively young age of those working in theBusiness Process Outsourcing (BPO) and IT sectors,reasons for staff attrition include staff leaving topursue higher full time education and/or marriage.Non-voice processes, such as back office andadministrative tasks, generally have lower attri-tion than voice although, even for voice processes,this tends to settle down with attrition for somecompanies’ voice operations lower than in the UK.To deal with attrition problems, companies arenow ensuring that they have well-documentedprocesses in standard, repeatable training modulesso that as they grow, firms can cross-train existingstaff and back-fill vacancies. Some companies arealso developing retention programmes offeringexchanges to the UK and training trips as a reward.Increasingly alive to the problem, companies areintroducing various other programmes such asmulti-skilling staff in other processes, swappingbetween voice and non-voice to allay boredom,and even moving across companies within a thirdparty supplier. Firms are also encouraging staffsocial activities and some companies offer con-cierge services to staff such as paying bills forthem and purchasing cinema/theatre and trans-port tickets. Most significantly, some firms areentering into ‘‘no poaching’’ agreements witheach other.

NASSCOM, India’s trade body active in thesoftware and BPO arena, is developing a databaseof workers who have served their one month noticeperiod and have been granted a ‘‘leaving certifi-cate’’ from their previous employer. Companiesare abiding by a NASSCOM-promoted Code ofConduct/Ethics whereby they will not employpeople who don’t serve their full notice period orpersistently job-hop.

Otherwise, the FSA is fairly positive on thesubject of staff. The regulator listened to calls atmost locations and was impressed by the calibre ofstaff handling the calls. It noted that call moni-toring is usually done by both Indian and UK

management, either using a call monitoring systemprovided by the third party supplier or directlythrough the UK call monitoring system. The FSAalso notes that the back office processing was, inmost cases, actually exceeding the SLAs set forsimilar operations in the UK.

H. Tax and legal

All IT and BPO work that is for export comes underthe Software Technology Parks of India (STPI),which is effectively the IT industry regulator. TheSTPI Scheme, which is expected to run until 2009,is designed to encourage the industry, for exam-ple, through tax breaks and duty free imports onequipment. On a less positive note, some busi-nesses told the FSA that the tax break only madea difference of 3e5% of costs.

To benefit under the STPI, companies need to be‘‘registered’’ and must meet basic criteria, such asthe requirement that a company has to export fivetimes the value of imports over a five-year period.Companies also have to meet specific obligations,such as filing ‘‘softex returns’’ annually. There arealso quarterly and monthly returns which monitorhow much a company imports and exports. Alloverseas equipment bought under the duty freescheme is ‘‘bonded’’ to the building that thecompany occupies. This is less of a problem thanit would seem, however, as equipment can be soldvia a ‘‘debonding’’ process. At the time of sale,the duty has to be paid on the written down valueof the piece of equipment.

VAT is likely to be introduced in India later thisyear, but as this will replace the current sales tax,the net effect should be minimal. The decision toimplement VAT has so far been taken in 21 of 28Indian states.

I. Security

The FSA is generally impressed with the level ofsecurity in operation in Indian suppliers. Most thirdparty suppliers that firms choose to use in India areBS7799 (British Standard for Information Security)certified. In all companies reviewed, data arestored onshore in the UK and transferred to Indiaas necessary where it is accessed via ‘‘greenscreens’’. Some firms recorded a percentage ofcalls in India for quality assurance and trainingpurposes. The FSA appears satisfied that there areadequate control procedures around the systemand that calls are deleted after a suitable time

504 T. Wright

period. The upbeat conclusion is that, notwith-standing recent well publicised security breaches,there is no evidence to suggest that consumer dataare at greater risk in India than in the UK.

J. Location in India

The FSA notes that India has several advantages asa leading offshore destination:

� low cost e although staff costs are rising, firmscommented that this has been compensated bydecreasing costs elsewhere (e.g. telecommu-nications);

� established destination for outsourcing;� large pool of English-speaking graduates;� low-cost data transmission capabilities;� Indian suppliers offer near-shore services (i.e.have a UK presence);

� Indian vendors are expanding organically andinorganically to establish a multi-locationpresence in India, to de-risk their business; and

� Indian governmentbacking andencouragement,e.g. to improve the technical infrastructure andeducation systems to meet the demand.

A number of cities featured in most firms’ short-lists of prime locations. Aside from Mumbai andBangalore, the two most used, these include Pune,Chennai, Delhi, Kolkata, Hyderabad, Mangalore andGoa. The FSA noted that there are no real differ-ences between Bangalore and Mumbai, apart fromsome infrastructure issues. Bangalore apparentlyfrequently experiences blackouts, but each compa-ny has its own generator and back-up options toavoid downtime.

K. Availability of suppliers

The same few suppliers appeared on everyone’sshortlists. The FSA says that there was an observ-able difference between the two or three estab-lished suppliers and the newer and smaller ones.Nevertheless, there appears to be plenty of suit-able suppliers to choose from. Supplier choicetends not to be the issue for firms considering

whether to develop a captive or use a third partysupplier. If the firm already has experience inoverseas markets then it is more likely to pursuethe captive option. Firms that require a fasterentry into the market tend to go for third partysuppliers who have the experience in the functionsbeing outsourced.

L. Political risk

The FSA report deals very briefly with the subjectof political risk in the UK. It notes the mediabacklash about worker’s job security in relation tooffshoring, but suggests that more recent coverageof US-based analysis indicate that both donor andrecipient countries of offshoring arrangements arenet beneficiaries in GDP terms. In the UK, jobs lostto offshore suppliers are met ‘‘through redeploy-ment and natural turnover’’. The message fromfirms is that, as all or part of their existing jobsmove offshore, often UK staff are ‘‘freed up’’ toundertake other ‘‘fulfilling’’ roles.

M. Comment

All in all a very positive report from the FSAwhich may feel that it was misrepresented bypress coverage that went no further than themain conclusion that offshoring carries with itoperational risk. From the rest of the report itappears that the sector is coping admirably andthe lack of any real gripe from the FSA, otherthan perhaps highlighting issues like key personrisk, testifies to this. Even then, operators al-ready appear to be gearing up to deal with keyperson risk efficiently. Additionally, businessmethods deployed in the UK appear to transferwell and in this respect there are signs that Indiacan reciprocate. Perhaps the most disconcertingaspect of the report comes from the notion thatfirms are foisting Eastenders, Corrie and Hol-lyoaks on unsuspecting Indian staff.

Tim Wright, Partner Pillsbury Withrop Shaw Pittman LLP. E-mailaddress: tim.wright@pillsburylaw.com