Definition[]
An outsourcing agreement is an agreement between a vendor of outsourcing services and a customer under which certain business functions of the customer are performed by the vendor.
Overview[]
Contracts between the institution and service provider should take into account business requirements and key risk factors identified during the risk assessment and due diligence phases. Contracts should be clearly written and sufficiently detailed to provide assurances for performance, reliability, security, confidentiality, and reporting. Management should consider whether the contract is flexible enough to allow for changes in technology and the financial institution's operations. Appropriate legal counsel should review contracts prior to signing.
Institutions may encounter situations where service providers cannot or will not agree to terms that the institution requests to manage the risk effectively. Under these circumstances, institutions should either not contract with that provider or supplement the service provider's commitments with additional risk mitigation controls.
Source[]
- "Overview" section: FFIEC Guidance on Risk Management of Outsourced Technology Services, at 2-3.