Company Strategy & Vision
Even if the managed services are for just one specific area, it’s crucial that the partner understands and is aligned to the firm’s strategy and goals. In that way, both parties can agree on a vision for the managed services functions.
For example, should the FS firm decide to partner on technology or operations (for example, on IT development, application management, infrastructure management, testing, security operations or other more generic operations like its callcentre or service desk), then both parties should agree on a common vision, with the operating model translated to the partner’s focus area, and with a culture of continuous improvement central to it, including how to improve quality and customer satisfaction.
Both parties must also work as a single team that operates the retained and managed service elements. To that end, it is key that they establish an organisation structure enforcing accountability, communication and transparency from both parties.
Key Drivers
We have identified five drivers that are core to this analytical process of driving forward the FS firm’s managed services agenda: skill complexity; delivery risk; the regulatory landscape; cost efficiency; and automation and innovation. We will tackle each in turn.
Skill complexity
Related skills – or the lack of them – are a challenge in most countries. The GCC is no different, and fast-evolving areas like cyber-security, as one example, face a shortage of specialised skills. That can make it difficult and costly to recruit such staff.
The same holds true for skills in specific languages, or for test automation or in infrastructure management in areas such as the cloud. Determining whether potential partners can provide such skills is a key step, as is validating that the partner has the skills in-house. And should the partner sub-contract such requirements, the FS firm must be sure that its partner has taken end-to-end responsibility and ownership for delivery of its obligations, and that its proposed team has successfully delivered those obligations for other clients.
Delivery risk
It’s crucial to ensure that managed services partners can deliver what they promise, and that’s best achieved by ensuring that they align with global best practices – for example, that at a minimum they meet the ITIL standard for IT service management.
Take security, for example. There are a number of considerations when evaluating a potential managed services partner. In part, these involve ensuring that its security operations centre (SOC) monitors functions properly, and making sure the potential partner adheres to all necessary security protocols: secure internet, for example, or secure virtual private networks (VPNs) if based offsite; account monitoring; cyber-threats; and 24/7 checking and monitoring of services.
Additionally, security considerations at the partner’s premises also include items on this (limited) checklist to determine whether there are robust workplace security measures. For example: ID cards; CCTV; 24/7/365 security personnel at entry and exit points; security checks; fire detection; firewalls; a clean-desk policy; project-specific VLANS; dedicated client hardware; USB/CV-DVD-disabled computers; hard-disk encryption; installed and updated antivirus software; and data- loss prevention measures. Additionally, the FS firm should conduct periodic audits of its partner’s security measures. Ticking these boxes is an important step in ensuring partnering peace of mind.
At the same time, the FS firm must vet potential partners to ensure their business continuity planning (BCP) and disaster recovery procedures meet what it needs. The increased focus on BCP means this is not a one-time exercise, but one that requires continuous validation and testing.
When it comes to a partner providing specialist security services to a client, FS firms in the GCC region can leverage external tools and the skills of their partners. For example, a 24/7 command center that uses AI and other technologies can bring real-time automatic diagnosis of events, with auto-remediation and auto-correction of vulnerabilities. FORFIRM's Manage Detect Response (MDR) platform, for instance, uses analytics and machine-learning to monitor, detect and respond to threats using automations built as industry- and attack-specific plays. This is relevant when a bank or any other FS organisation considers a partner to manage its security operations.
Beyond this, there are a range of other factors that FS firms should consider. The first is to balance concepts like DevSecOps in technology and operations with what will best fit their needs. After all, there is no one-size-fits-all solution.
The second is to manage the transition phase – whether that be from, for example, the FS firm’s in-house team to the partner or from another vendor to the new partner – to ensure there are no interruptions to business as usual, and no decline in service levels during the transition or afterwards. Success here requires upfront agreement of a robust knowledge-transfer plan, which should include the option to retain some of the existing team in place even once the partner has taken over.
The third is to define the SLAs, OLA and KPIs, and agree them jointly in advance and document the same. These should also ensure that FS firms following the managed services path see a marked reduction in costs and risk levels over time, and that they progress along the defined and jointly agreed-upon transformation journey. Firms should bear in mind, too, that there is no such thing as a 100-percent managed services solution – in almost every case, 5-10 percent of the staff involved will be the FS firm’s employees; they will augment what the partner is doing, which means the FS firm will always retain some control over the processes.
Regulatory landscape
The regional and global regulatory landscape has changed significantly in recent years, and our view is that this shift will continue – and even more so in the region with the GCC’s focus on localisation.
When looking to partner on managed services, FS firms must assess existing regulatory requirements in detail, and must keep regulatory changes under review on an ongoing basis to ensure compliance and reduce risks. This includes assessments across different areas – for example, if work is being done offsite, the firm must determine what data can be processed or held offsite.
Other considerations involve visa requirements for partner teams that need to travel onsite or security issues that might arise.
Cost efficiency
Optimising costs is one consequence of managed services – boosting productivity with increased automation or better processes.
But before proceeding, it’s crucial that both parties agree in writing which measures will be taken to optimise costs, and the relevant goals and timelines.
Lowering staff-related costs like recruitment, induction and training can help the FS firm to reduce overheads, while dividing responsibilities lets it focus more on value-added activities. It’s also important that unplanned events and disruptions are reduced over time in the partnering period, as this will also reduce costs.
Given that a key purpose of managed services is to optimise costs and boost efficiencies, the FS firm must ensure its internal team remains lean; after all, there’s little point in running two organisations in parallel. For this reason, internal technology or operations teams should focus on specific areas, including taking the lead on aspects like critical workstreams, quality, governance and vendor management. Yet it’s vital, too, that personnel from both organisations work together as one team.
On the technology and operations note, it’s worth bearing in mind the status in GCC countries of the cloud – just one aspect of technology and operations that firms need to consider. Currently, cloud as a subject is not fully ready, and though this will inevitably happen – perhaps through private cloud solutions or hybrid architecture – FS firms should factor in what a partner can bring on this front. In some countries, for instance, smaller banks are considering managed private cloud offerings, which frees up capital, reduces the need for investment, and means they can run state-of-the-art IT architecture as they grow and innovate.
In any event, it’s important that FS firms can leverage the synergies involved to boost productivity. On top of that, firms should, for example, expect further productivity increases and cost reductions as their partners incorporate other solutions – better infrastructure could cut the mean time required to resolve incidents, for instance, while chatbots could deflect a greater proportion of calls. All of these technological improvements should bring further efficiency and cost gains down the years.
Automation & Innovation
That links to the next driver, which is that managed services should support the FS firm’s culture of promoting innovation, and should future-proof back-office activities. And, given that the partner should be leveraging the latest technologies, a managed services solution should bring a competitive advantage.
At this point, firms should, for instance, ask whether their prospective partner commits to delivering continuous improvements and sustainable excellence – even after they leave and, if needed, when such work is brought back in-house (if required). During the period of the agreement, it’s crucial that the partner works on a model to bring the service back in-house when needed – whether that be the capability development or the tools. When it comes to those tools, the firm should ensure those aren’t all proprietary to the partner, otherwise it could face steep licensing fees should those services be brought back in-house.
There are two final points worth making. The first is that FS firms should consider specific co-innovation programmes that can be undertaken during the tenure of the managed services agreement, with those based on business outcomes. The second relates to a broader point: partnering ought also to be about embedding a culture of innovation in the FS firm – one that leverages the partner’s ways of working in terms of design and innovation. After all, doing things in a different and better way tends to be infectious, and it’s likely that other departments within the firm will want to emulate such practices when they see them in action.
Decision Criteria
There are two areas to focus on when it comes to the decision criteria: the time horizon and finding the right partner.
Time horizon
In our experience, it’s difficult to see all benefits on a managed services contract in less than a year; a timeline of two to three years provides a much better indication. That said, the FS firm should be able to see some improvements immediately after the transition phase.
FS firms should also keep in mind that the first few months are typically spent on transition and stabilisation; after that comes the focus on cost reduction and increased productivity, and only later are the benefits of innovation, increased automation and transformation apparent.
Right partner
Finding the right partner sounds obvious, but FS firms should consider that success might require more than one – with different partners leveraged for different areas.
Delivery & Outcomes
For this final aspect, FS firms should consider two broad areas: transformational outcomes, and risk and delivery-based compensation.
Transformational outcomes
Although staff augmentation is important, it’s essential that the partner works with the firm towards a common goal linked to the company’s overall strategy. In other words, selecting the right partner is as much about ensuring they share, for instance, the FS firm’s vision as it is about their ability as a service provider.
It’s also important that the partner is committed to investing in its own services – for example, improving its delivery centres and innovation laboratories to benefit its clients. In determining the outcomes for, say, technology or operations, FS firms should focus.
In determining the outcomes for, say, technology or operations, FS firms should focus on the following:
• Testing: The focus should go beyond simply ensuring a strong foundation based on robust processes and governance, and should look at automation as one of the key areas. For example: converting manual test cases to automated scripts; reducing cycle times through tight integration with test data, the environment and DevSecOps; and generating insightful analytics and decisioning to mine patterns of data to improve agility and reliability.
• IT development and application management: If the purpose is to leverage and embed DevSecOps, then it’s crucial to create a culture of innovation and continuous improvement. The partner should be able to: embed security into an application’s lifecycle; bridge the silos between business, development and operations teams; use cutting-edge automation and tools to build better, smarter solutions; identify quality-control concerns early; reduce defects across the lifecycle; stabilise and secure the operational state; and make changes that are systematically auditable. DevSecOps is a good example of an area where success requires more than the partner being ready to implement the changes and the FS firm being ready for that process to begin. It also requires more than just bringing in the right tools and automation solutions. Instead, it means making changes to the operating model, to the people involved and to the organisation itself. In short, success is not just a matter of “lift and shift”.
• The same holds true for infrastructure. The first step is to build a strong foundation; after that the focus should be on DevSecOps, if relevant. Or it could be on accelerating innovation with the use of chatbots; bringing in data-centre automation; innovating to generate real-time insights and intelligence; or providing service predictability analytics.
• Firms can also consider using managed services to run their SOC and cyber-security activities, and leverage on AI to further increase security (as mentioned earlier).
• Regardless of the partner’s expertise, it’s key that they commit to aspects like the FS firm’s KPIs. SLA performance should be a given, with the transformational outcomes achieved over and above those listed.
Risk and delivery-based compensation
It’s key to agree the SLA up-front, and to incorporate the option of penalties if certain key aspects of the SLA are breached. That keeps both parties focused and committed to the service levels outlined.
Equally important is that the SLA doesn’t become a point of dispute – that, instead of being wielded as a stick, it is used as a motivational tool. Avoiding a blame game requires clear alignment on the aspects that each party is accountable for and the elements that those aspects depend upon.
Extending the motivational element, the FS firm could agree that the managed service partner benefits from credits should it exceed a certain service level.
Finally, when it comes to delivery-based compensation, the main priority of the partner must be service-delivery excellence; however, it’s also important to recognise how it generates positive transformational change in the firm, how it improves ways of working, how it builds capabilities in the firm’s team, and how it drives aspects like innovation and culture.