Key Criteria for Choosing an Outsourcing Management Tool

The new regulatory requirements increase the complexity in outsourcing management. A compliance-conformant and effective management of service provider risks according to MaRisk, BAIT, EBA/GL/2019/02, and DORA is no longer feasible with conventional tools. Therefore, the use of a standard solution that out-of-the-box encompasses the entire outsourcing management process, offers automated workflows, and is user-friendly becomes essential. Experience shows that a company should pay attention to the following important criteria when selecting a tool to choose the right tool and especially the right provider.

Compliance & Functionality
‍- The solution meets the current regulatory requirements such as MaRisk, BAIT, EBA/GL/2019/02, and DORA out-of-the-box.
- During the contract phase, the provider independently implements regulatory changes.
- The tool covers the entire outsourcing process (classification, contract management, significance & risk analysis, contract review, due diligence, exit strategy) for all types of external procurement (outsourcing & ICT services and non-ICT services) and sub-contracting.
- The tool includes an automated scenario analysis for determining the risk capital for OpRisk (Third Party Risk).
- The dependencies between services, service providers, sub-services, and sub-providers are automatically mapped.
- The tool offers standard-defined KPIs/KRIs for assessing the risks and performance quality of the service providers, as well as standard reports (ad-hoc and regular).
- Audit-proof regular and ad-hoc updating of the outsourcing behavior including a reminder function is included.
- The control functions are integrated in compliance with regulations, and their approvals are documented in an audit-proof manner.
- Contracts can be assigned to individual facts in an audit-proof manner and stored in a structured way.
The outsourcing and action register and the task management are fully automated.

Provider's Expertise
- The provider has the professional and methodological know-how to successfully implement the tool.
- The provider is capable of conceptually designing and implementing new regulatory changes during the contract duration.
- The provider offers consulting services and training.
- The provider has the necessary expertise to continuously develop the tool.
- Support is provided during the contract duration by professionally suitable personnel from the provider.

Technology & Usability
- The tool is developed with independent technologies like Java and offers the highest flexibility.
- There are no critical dependencies on sub-providers such as low-code or platform solutions.
- The tool offers all common options for integration with internal authorization management.
- The tool ensures consistent data, user-centricity, and clear feedback and is clear, efficient, and easy to use.
- The solution can be used for individual companies as well as for a group with group-wide outsourcing management.

Price & Contract
- The provider offers software and consulting from a single source.
- The implementation of regulatory changes is covered by the provider throughout the entire contract duration.
- The costs are predictable and change little or not at all during the contract duration.
- The provider and its sub-providers meet the relevant requirements for data protection and information security.'
- The degree of fulfillment of the above requirements justifies the price.

It is important to consider various aspects when choosing a suitable tool, especially since compliance issues are involved. The point that the solution is developed and accompanied by professional experts should not be overlooked, as this ensures your company benefits from a practical tool.

‍