• Outline of the Guidelines
• Scope of the Guidelines
• How are the Guidelines Structured?
• When Should the Guidelines be Used?
• Regulatory Considerations

Outline of the Guidelines

Whether purchasing off the shelf software packages from ISVs and/or outsourcing elements of IT service provision, selecting and entering into contractual agreements with service providers demands rigorous consideration to ensure that the related operational risks are adequately managed. For some organisations, particularly small and medium sized firms, this represents a significant challenge. Firms may have little or no experience of procuring and implementing software, or outsourcing IT services. This can result in:

- Selecting inappropriate packages;
- Failing to properly consider the contractual arrangements; and
- Misjudging the total costs of implementation and maintenance.

In recognition of these issues, the FOA commissioned PricewaterhouseCoopers to prepare guidelines to address these challenges, with particular emphasis on providing guidance for:

- The necessary due diligence for selecting a supplier;
- The key elements of entering into contractual arrangements with a supplier; and
- Fulfilling related regulatory obligations.

The guidelines include practical considerations for firms throughout the lifecycle of a procurement project or outsourcing contract, from inception, implementation and thereafter, to ongoing service management and termination.

Scope of the Guidelines

It should be noted that the approach that has been adopted in producing the guidelines has been to focus on developing relatively generic guidance to assist with the following types of 'sourcing' projects:

Procurement of IT Systems - ie the purchase and implementation of packaged software from an ISV, applicable to:
- Specific software for derivatives exchanges; and
- Other 'back office' software, such as clearing & settlement, client acounting systems.

Outsourcing of IT Services - ie the process of buying a defined and measurable IT service, at agreed service levels, cost formula and period, for the following areas:

- Systems development;
- Software maintenance and support;
- IT operations; and
- Hosting of web sites.

Where a service is outsourced, the third party supplier is responsible for the ongoing provision of that service under contract to the purchaser, unlike procurement where the purchaser assumes responsibility for determining fitness for purpose and for the deployment and use of the product or package.

Since a smaller firm's requirements for assistance with the procurement and outsourcing of IT services are often likely to differ greatly to those of a larger organisation, the guidelines have been provided at different levels of detail. They start at the highest level, with a high level route map, which depicts the key processes to be conducted and also include detailed guidelines to help organisations undertake particular activities.

Some projects may involve both procurement of a particular IT commodity and outsourcing of services. For instance, when purchasing a new software package, the firm may consider outsourcing the ongoing operation of the application to the software provider.

The relative scale of a procurement or outsourcing project will also affect the extent to which the guidelines suggested actions or processes will be required. In some cases particular actions will not be appropriate, whereas in others additional processes may be required to cater for particular regulatory demands or other business complexities. For this reason the guidelines are not intended to represent, and should not be regarded as, a definitive statement of best practice. The guidelines are not intended to constitute professional advice or a substitute for professional advice, and should not be relied on in relation to any business or other decisions or otherwise and is not intended to replace the expertise and judgement of your independent accounting, tax, legal or other professional adviser.

How are the Guidelines Structured?

The guidelines are structured around 8 key steps in the lifecycle of sourcing projects ('The Routemap'), namely:

- Business Strategy (setting the project scope);
- Requirements Definition;
- Supplier Selection;
- Finalising the Contract;
- Implementation;
- Ongoing Service Management;
- Realisation of Business Benefits; and
- Termination of the Contract.

When Should the Guidelines be Used?

The guidelines are applicable to firms embarking on a new sourcing project, as well to firms that are already mid-way through the selection or purchase of IT services. In the latter case they can be used, for example, to assess:

- How well the requirements have been defined;
- Whether the criteria being using to assess potential suppliers are valid;
- Whether there are any omitted selection criteria;
- What level of service is required for ongoing maintenance and support; and
- Whether legal and regulatory matters have been sufficiently addressed.

Similarly, for organisations that have already purchased software or entered into an outsourcing arrangement, the guidelines can help assess:

- How well the implementation was planned;
- Whether the anticipated benefits are being realised; and
- Whether the supplier is performing to agreed service levels.

Regulatory Considerations

The guidelines use the Financial Services Authority's regime as the benchmark for regulatory requirements throughout. Some members, however, may have cross-border transactions impacting other regulatory jurisdictions.

The FSA has made it clear in its guidance on systems and controls that a firm cannot delegate or outsource its regulatory obligations and has established detailed rules and recommendations for outsourcing. At the moment, these detailed rules formally apply only to banks and building societies. For broker-dealers and investment firms, the FSA has not yet stipulated equivalent detailed rules. It is expected that the rules in this area already in place for banks and building societies will be extended to these firms when the Integrated Prudential Sourcebook is introduced. The regulatory considerations set out in the guidelines have been based on the existing rules that apply to banks and building societies.