Finance regulators overlook offshoring in RBS IT failure statements

Data breach concerns

This is a concern to IT professionals in the banking sector as outsourcing and offshoring of critical systems continues apace and it is not just about service unavailability. "The large scale of offshore outsourcing of banking IT worries me a lot. I think outages will be the least of our worries. Security breaches will be the next big issue. The bad guys are smarter and better funded than the good guys and they only need to win once to cause chaos," said one senior IT professional in the banking sector.

"Most of the issues I've seen have been due to human error, equipment failure or in recent years errors made by outsourced firms who are more distant than they were historically. 

"More work has gone abroad as a result of cost pressure and that has led to a drop in standards across the industry. Outsourcing and offshoring development didn't hurt production but now that more production support is both offshore and outsourced, the scope of live problems is much higher than a few years ago. All too often human error by a junior person at a third party somewhere half way round the world who did not understand or follow a process properly."

RBS offshored jobs from Edinburgh that worked on CA-7. These workers were paid ₤250 a day, but RBS wanted a cheaper option.

Litany of banking IT failures

RBS’s problems are not the first in banking, where offshored IT delivery has been described as a significant contributor. Also in 2012, when a rogue trader ay UBS caused losses of over ₤2bn through unauthorised trading, an offshore delivery centre in Hyderabad, India was revealed as playing a role.

When fining the Swiss bank ₤29.7m the UK finance regulator, then the FSA, said: “The computerised system operated by UBS to assist in risk management was not effective in controlling the risk of unauthorised t6rading.” This system was run from  a USB captive in Hyderabad.

A source in India told Computer weekly at the time the reason the rogue trading was missed was because data had been deleted as part of a system upgrade. He said when data was being migrated to a new system it started to slow things down. The person doing the migration deleted data to speed things up, which meant the trading went unnoticed.

In 2009 an IT contractor, who worked for the RBS as a mainframe technician for a number of years, told Computer Weekly business-critical work had been moved to India to cut costs: "RBS started moving the work we were doing to its datacentre in Mumbai, known internally as Indian Datacentre. I had to train Indian workers to do my job."

"This was to cut costs and not about filling a skills shortage. They move the jobs to India because it is cheaper."

Some commentators have called on regulators to investigate the offshoring of banks' IT. RBS is still seeking staff in India to work on its CA-7 batch process scheduler.