美国FFIEC技术服务外包IT检查手册英文版.doc

?IT Booklets：Outsourcing Technology Services （美国FFIEC技术服务外包IT检查Introduction The financial services industry has changed rapidly and dramatically. Advances in technology enable institutions to provide customers with an array of products, services, and delivery channels. One result of these changes is that financial institutions increasingly rely on external service providers for a variety of technology-related services. Generally, the term outsourcing is used to describe these types of arrangements. The Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbook (IT Handbook) Outsourcing Technology Services Booklet (booklet) provides guidance and examination procedures to assist examiners and bankers in evaluating a financial institutions risk management processes to establish, manage, and monitor IT outsourcing relationships. The ability to contract for technology services typically enables an institution to offer its customers enhanced services without the various expenses involved in owning the required technology or maintaining the human capital required to deploy and operate it. In many situations, outsourcing offers the institution a cost effective alternative to in-house capabilities. Outsourcing, however, does not reduce the fundamental risks associated with information technology or the business lines that use it. Risks such as loss of funds, loss of competitive advantage, damaged reputation, improper disclosure of information, and regulatory action remain. Because the functions are performed by an organization outside the financial institution, the risks may be realized in a different manner than if the functions were inside the financial institution resulting in the need for controls designed to monitor such risks. Financial institutions can outsource many areas of operations, including all or part of any service, process, or system operation. Examples of information technology (IT) operations frequently outsource