Top 10 op risks 2019: outsourcing and third-party risk

Perfecting internal controls is meaningless when lax oversight of outsourcing offers back-door vulnerability

If you could pay someone to worry about something for you, would you? Outsourcing key infrastructure or services to third parties is a tantalising prospect for many of the world’s largest firms. The incentive is to harness the expertise of specialist providers, or to save costs. Or, ideally, a combination of the two.

The trade-off for many risk managers is a lingering concern about losing oversight of vital business functions. The prevalence of breaches via third parties and growing regulator