When City regulator Michael Foot warned financial services companies against abandoning control of outsourced IT last week, he did not want to name the organisations that were causing him worry.
But in an interview with Computer Weekly this week, one organisation he did name was the London Stock Exchange. This was the only one of several cases concerning him where problems had become public knowledge.
The stock exchange's systems went into meltdown on 5 April after a delay in overnight data processing hit daytime trading systems. IT at the stock exchange is outsourced to Andersen Consulting.
Foot is managing director and head of financial supervision at the Financial Services Authority (FSA), which has the power to close companies down. He said he was worried that companies were not keeping enough expertise in-house to manage the outsourcer.
Foot reiterated two points from FSA guidance on outsourcing:
"Foot is absolutely correct to worry," said Robert Morgan, chief executive of outsourcing consultancy Morgan Chambers.
In his view, outsourcing is plagued by companies that do not have a sourcing strategy. These businesses fail to prepare and define service standards and protocols. They put little or no thought into maintaining control of the supplier. They do not allocate dedicated management or funds to keeping control and merely trust in the service provider's ability to do their job.
"A major disaster is inevitable," Morgan said.
He sees the financial industry as having a worse outsourcing record than others because of its conservatism.
"Many of the major banks are still very hierarchical and have their feet in the past. Generally they believe their internal processes are robust enough to handle the complexities of outsourcing IT - but frankly they are not."
Morgan regards banking procurement staff as very good at buying in hardware and software and quite good at turnkey application development, but not so good at buying in intangible services.
It is not just in-house incompetence that is a danger.
"Vendors are desperate to move into the financial market because of its size and the profits to be made in replacing old systems to face up to e-business. Suppliers will take a much higher risk than normal to gain financial market share," Morgan said.
To make matters worse, in-house staff with knowledge of the outsourcing contract and process often leave because they feel they have no prospects in the client company. Either that or they are headhunted to work for clients who feel it is important to have in-house expertise.
Morgan advises companies to make a board director ultimately responsible for the outsourced service. He also recommends that the salaries of the remaining in-house IT staff be freed from pay scale restrictions, that they be given plenty of training and a vision of their future in the company to make them stay.
Maintaining in-house expertise means more than keeping the IT director on. In fact, the IT director will probably not have the contract management needed and will be tempted to carry on managing staff rather than concentrating on strategy and service levels. Companies need to appoint someone who has this additional contract management experience or offer training in commercial skills.
One person who has taken on the role of managing outsourced services provided by Cap Gemini is John Hetherington, head of strategic contracts at the Thomas Cook Group and formerly a consultant with Morgan Chambers and outsourcing executive at the Sema Group.
Hetherington backs the regulator's comments to the hilt. In his view, failures of control have been most prevalent in contracts where cost was the main driver for outsourcing. Where outsourcing took place as a result of a company's decision to focus on its core competencies, it was more likely to retain the in-house expertise needed for a partnership with the outsourcer.
Roger Bickerstaffe, partner in the IT group at law firm Bird & Bird, says outsourcing the entire IT function is becoming rarer at the solicitors' investment banking clients. Instead, firms are contracting out particular functions which are easier to control.
He has seen customer relief at getting IT off their hands, but says "an intelligent customer function" is essential.
This could mean just keeping two or three people out of a department of 100 when outsourcing, Hetherington said. Selective outsourcing could increase management costs, but allowed the client to pick best-of-breed outsourcers for particular functions.
Meanwhile, Foot is taking his message on the need to maintain control over outsourcing to discussions with his counterparts in other European Union member states. He hopes that they too will ensure that financial services companies regulated in their jurisdictions will be required to maintain some strategic in-house expertise and inspection rights.
With cross-border trading in financial services increasing, the need for sophistication in the internal control of outsourcing is unlikely to diminish.
FSA guidance on outsourcing is available.