ARTICLE IN PRESS

International:Journal:of:Information:Management:24:(2004):167180

Risk:management:practices:in:IS:outsourcing:an:investigatio n into:commercial:banks:in:Nigeri a Bunmi:Cynthia:Adeleye,:Fenio:Annansingh,:Miguel:Baptista:Nunes

*
Abstract This:research:work:focuses:on:the:risk:management:practices:adopted:by:Commercial:Banks:in:Nigeria that:are:rela ted:to:the:ou lack:of:studies:addressing:these:problems:in:developing:countries:in:general:and:in:this:country:in tsourcing:of: particular.:The:research:reported:in:this:paper:shows:that:despite:the:globally:increasing:trend:of:IS information: outsourcing:in:the:sector,:Nigerian:commercial:banks:are:lacking:in:both:strategic:and:operational:risk systems: management: (IS).:The:nee practices.:Con andare:vulnerable:to:IS:failure:and:fraud. d:for:the:res sequently,:the research:is:empirically:based:drawing:on:an:extensive:literature:and:case:study:review:as:well:as:an The earch:emerg y:are:especiall extensive:survey:of:banks:in:Nigeria.:The:main:method:of:data:collection:was:a:questionnaire:sent:to:15 ed:from:the y:prone:to:the: commercial:banks,:which:was:aimed:at:respondents:in:three:distinct:categories:executive:management, adoption:inapp systems:managers:and:users.:The:analysis:of:the:data:included:both:a:quantitative:and:an:inductive ropriate:IS:solu qualitative:approach.:The:latter:was:used:to:draw:inferences:on:the:current:situation. tions ndings:revealed:that:managers:of:commercial:banks:understand:the:nature:of:IS:outsourcing:and The that:they:all:agreed:that:adopting:risk:management:practices:is:important.:Nevertheless,:the:situation:is critical.:A:sig nicant:propo strategy:or:poli rtion:of:the:c cy;:consequent also:discove ommercial:ba ly:no:program red:that:con not:formulat nks:have:no: me:or:procedur trary:to:pra ed:substanti r 2004:Elsevier:Ltd.:All:rights:reserved. documented: al:guidance:is: ctice:in:dev ve:guideline Keywords:nformation:systems:outsourcing;:IS:risk:management;:IS:strategic:thinking;:Commercial:bank I and:structure available:at:an eloped:coun s:or:procedu d:outsourcing y:level.:The:stu tries,:the:re ral:rules:to:b dy gulatory:aut e:adopted:n horities:in:N ationally:by: igeria:have commercial: banks.
Department of Information Studies, University of Shefeld, Shefeld, UK

*Corresponding:author. E-mail address: j.m.nunes@shefeld.ac.uk:(M.B.:Nunes). 0268-4012/$-see:front:matter r 2004:Elsevier:Ltd.:All:rights:reserved. doi:10.1016/j.ijinfomgt.2003.10.00 4

ARTICLE IN PRESS
168 B.C. Adeleye et al. / International Journal of Information Management 24 (2004) 167 180

1.7Introductionandbackgroundofstud y In:Nigeria,:all:banks:are:licensed:by:the:Central:Bank:of:Nigeria: (CBN):and:incorporated under:the:companies:and:Allied:Matters:Act:of:1990.:The:intermediation:role:of:banks:i n:a country:with:an:estimated:population:of:120:million:inhabitants:results:in:a:pressing:nee d:to develop:or:acquire,:install,:deploy:and:maintain:top:rated:information:systems: (IS).:The:systems so:deployed:are:expected:to:be:efcient,:effective,:robust:and:uid:in:order:to:respond:and:ad apt to:current:and:future:operational:need s. IS:plays:an:important:role:in:the:business:of:any:bank.:These:systems:are:at:the:core:of:t he information:management:of:the:organisation:and:allow:it:to:operate:efciently:and:mainta in:its competitive:advantage.:According:to:OBrien: (1996,:p.7),:if:information:systems:do:not:properly support:the:strategic:objectives,:business:operations,:or:management:needs:of:an:enterprise,:th ey can:seriously:damage:its:prospects:for:survival:and:success.:This:paper:further:enumerates:thr ee vital:roles:of:I S * Support:of:business:operations * . Support:of:managerial:decision:makin * g. Support:of:strategic:competitive:advantag e. Consequently:and:as:proposed:by:Drucker:(1995),:in:todays:knowledgebased:society information:is:the:framework:around:which:organisations:are:formed.:Banks:are:no:exception :as they:are:expected:to:make:continuous:use:of:the:rapid:changes:in:technology:in:order:to:impr ove customer:service:and:to:handle:new:business:processes.:As:banks:broaden:their:services,:wid en their:customer:base:and:extend:their:services:into:new:geographies,:IS:plays:an:important:role :in this:drive:to:differentiate:and:compete.:Information:systems:provide:better:data:distributi on, integrated:business:processes,:and:networked:communications,:and:enable:banks:to:impro ve customer:relationships,:as:well:as:streamline:overhead:costs.: (Sun:Microsystems,:2001). A:number:of:wellknown:authors:have:stressed:the:critical:nature:of:information:systems:to banks.:Scott:(2000):proposes:that:introducing:computerbased:information:systems:will:enable most:banks:to:cope:with:instability:in:the:business:environment.:Boiney: (1999):noted:that:the:role of:information:systems:is:being:transformed:todays:information:systems:must:truly:add:va lue to:the:organisation:through:the:creation,:capture,:distribution,:application,:and:leveragin g:of knowledge.:On:the:other:hand,:White: (2002):wrote:that:the:advances:in:Information:and Communications:Technology: (ICT):are:no:doubt:bringing:nancial:innovations:that:are undermining,:or:may:soon:undermine,:many:of:the:restrictions:faced:by:most:commercial:ba nks on:clearing:houses:issues.:In:agreement,:Broady-Preston:and:Hayward: (2001):state:that:in:the current:turbulent:business:environment,:quality:information:is:required:to:ensure:that:compan iesachieve:competitive:advantage:by:using:such:information:to:make:decisions:more:rapidly:t han their:rivals.:Similarly,:West: (1996):suggests:that:institutions:should:take:advantage:of:technology so:that:they:will:not:be:left:behind:in:our:market:econom y. Nigerian:Banks:are:no:different:from:other:banks:in:the:world.:They:depend:on:IS:to:guarant ee differentiation:and:competitive:advantage.:However,:IS:design:and:development:lies:outside: the basic:scope:of:core:retail:banking.:Thus,:most:commercial:banks:in:Nigeria:resort:to:outsourci ng for:the:provision:and:maintenance:of:their:IS.:So:the:success:of:the:organisation:itself:of ten

ARTICLE IN PRESS
B.C. Adeleye et al. / International Journal of Information Management 24 (2004) 167 169 180

depends:on:the:ability:of:the:given:organisation:to:manage:the:risks:associated:with:this:proces s:of outsourcing .

2.7ISoutsourcin g Generically:outsourcing:can:be:dened:as:the:transfer:of:previously:inhouse:activities:to:a third party (Lonsdale 1999) De Looff (1997 p. 30 dene IS outsourcin as the , . , ) d g commissioning:of:part:or:all:of:the:information:systems:activities:an:organisation:needs,:a nd/ or:transferring:the:associated:human:and:other:IS:resources,:to:one:or:more:external :IS suppliers.:From:reviewed:literature,:the:idea:of:outsourcing:IS:seems:to:have:started:in:19 89 when:Eastman:Kodak:turned:over:its:entire:data:centre,:network:and:microcomputer:operat ion to:three:IS:external:parties:(Loh: &: Venkatraman,:1992).:However,:Willcocks:and:Lacity: (1998) are:of:the:view:that:the:nature:of:information:systems:outsourcing:has:since:evolved.:T hey distinguished:complete:outsourcing,:facility:management,:systems:integration,:timesharing, rental,:installation:and:procurement,:and:maintenance:and:programmi ng. More:concisely,: (Mylott,:1995;:Pearlson,:2001;:Butler:et:al.,:2001):distinguished:two:forms:of outsourcing,:namely:full:outsourcing:and:selective:outsourcing.:In:full:outsourcing,:all: the services:are:outsourced:to:the:vendor.:This:is:an:extreme:outsourcing:strategy:because:the:ent iredepartment:information:systems:duties:are:assigned:to:the:outsourcing:partner:as:in:the:cas e:of Eastman:Kodak.:This,:according:to:Pearlson: (2001),:happens:when:an:organisation:does:not:see IT:as:a:strategic:advantage:that:should:be:developed:internally.:Arguments:for:full:outsour cing usually:involve:the:allocation:of:organisational:resources:to:areas:that:can:add:greater:value:to :the organisations:value:chain:or:reduce:cost:per:transaction:due:to:economies:of:scale.:In:select ive outsourcing,:only:a:range:of:services:is:selectively:outsourced:or:contracted:to:a:third:party .:It often:results:in:greater:exibility:and:better:services: (Pearlson,:2001).:The:decision:to:outsource:an organisations:activities:often:results:from:a:careful:study:of:the:supply:chains:Lonsdale: (1999). The problem:of:what:to:outsource:is:the:most:critical:decision:an:organisation:has:to:mak e:in relation:to:IS . The need:for:outsourcing:has:grown:over:the:last:two:decades:due:to:numerous:factors.:Th ese include:an:increase:i n * global:competition * , downsizing * , the:move:to:atter:organisation * s, the:need:to:reduce:cost * , improved:quality,:service:and:delivery * , improved:organisational:focus,:an * increase:exibility:which:facilitate:change:and:the:emphasis:on:core:competencies: d (Atkinson, 1985;:Dyer: &: Ouchi,:1993;:Huber,:1993;:Fan,:2000). In:the:banking:sector,:outsourcing:has:been:a:common:practice:in:the:last:20:years.:Fleck: (2002) argues:that:some:of:the:Swiss:banks:have:realised:the:demand:and:are:attempting:to:do:what :will give:them:a:better:chance:to:serve:clients,:outsourcing:asset:management:and:allocation.:Re cent xamples:are:the:outsourcing:facilities:management:at:Sovereign:Bank: e (USA),:human:resource

ARTICLE IN PRESS
170 B.C. Adeleye et al. / International Journal of Information Management 24 (2004) 167 180

outsourcing:in:Bank:of:America: (USA),:the:outsourcing:agreement:between:AT&T:and:IBM:at Bank:One:and:the: $44:million:outsourcing:agreement:between:Coop:Bank:and:Computer:Science Corporation:also:in:Switzerland: (CSC,:2000). Despite:the:optimism:about:benets:associated:with:outsourcing,:there:is:evidence:that: this process:may:incur:some:signicant:risks:(McFarLan: &: Nolan,:1995;:Lacity: &: Hirschheim,:1993).

3.7RisksassociatedwithISoutsourcin g Risks:and:costs:involved:in:outsourcing:are:often:forgotten:when:considering:the:more:obvio us benets.:These:risks,:however,:must:be:understood:in:order:to:make:informed:decisions:whi ch may:be:of:crucial:importance:for:the:success:of:the:organisation.:This:awareness:of:the:possi ble risks:incurred:when:outsourcing,:will:enable:decision:makers:and:stake:holders:to:take:inform eddecisions:and:draw:contingency:and:mitigation:strategies.:Management:needs:to:assess: and evaluate:the:risks:and:their:impact:at:strategic,:tactical:and:operational:levels:in:a:consistent :way (Ward: &: Grifths,:2001).:The:process:of:risk:assessment:in:outsourcing:is:focused:on:the probability:of:the:occurrence:of:adverse:events:such:a s * not:achieving:the:planned:benet * s, not:meeting:agreed:deadline * s, using:more:resources:than:initially:foresee * n, change:in:functional:and:procedural:requirement * s, budget:overrun,:an * d decient:change:over:of:systems:and:nally:problems:associated:with:the:operation: and maintenance:of:these:system s. If:the:outsourcing:process:is:not:preceded:by:careful:strategic:planning:and:thorough:ri sk assessment:it:may:result:in:considerable:nancial:loss,:decreased:shareholder:value,:dama ged company:reputations,:the:dismissal:of:senior:management,:and:in:some:cases:the:destructio n:of the:business:itself: (DeLoach,:2000).:Vital:to:the:organisations:success:and:survival:are:active assessment:and:monitoring:of:risks,:the:organisations:ability:to:exibly:respond:to:the:occurren ce of:these:adverse:events:and:its:ability:to:mitigate:these:risks: (DeLoach,:2000). 4.7Thestud y There:is:little:or:no:formal:research:work:or:body:of:literature:related:to:IS:outsourcing:tren ds in:Nigeria.:This:does:not:in:any:way:prevent:organisations:in:the:country:from:actu ally outsourcing:some:of:their:operations,:and:there:is:sufcient:evidence:that:outsourcing:is :an emerging:way:of:undertaking:business:operations:in:the:country.:Service:offers:by:reputab le multinationals:in:Nigeria,:such:as:PricewaterhouseCoopers: (PwC),:Phillips:Consulting,:Andersen Consulting:and:Aptech,:often:mention:outsourcing:as:one:of:their:key:deliverabl es. Banks:in:Nigeria:have,:for:a:very:long:time,:wholly:or:partly:outsourced:services:such: as training,:security:services,:marketing:and:Information:Technology.:Schlumberger:Omnes,:Briti sh Telecommunications,:and:21st:Century:Technologies:Ltd.:are:only:a:few:of:the:current:vendors :of

ARTICLE IN PRESS
B.C. Adeleye et al. / International Journal of Information Management 24 (2004) 167 171 180

IS:and:platforms:outsourced:by:commercial:banks.:It:is:expected:that:this:trend:will:continue :to prevail:in:the:near:future.:This:means:that:developing:countries,:like:Nigeria,:are:following:tre ndsemerging:from:different:social:and:economic:contexts:without:the:benet:of:formalise d:or organised:national:support:structures,:policies:and:guideline s. This:need:for:regulation,:strategic:thinking:and:guidelines:is:particularly:importan t:in a:country:as:populous:as:Nigeria: (around:126:million:people),:where:both:IS:and:banking are:listed:on:the:Stock:Exchange:as:two:vibrant:industry:sectors: (The:Nigerian:Stock Exchange,:2001) . The Central:Bank:of:Nigeria: (CBN):is:the:national:organisation:that:licenses:all:banks:that meet:stipulated:conditions.:The:role:of:CBN:is:primarily:formulating:and:monitoring:the:bank ing systemto ensure tha operatorscomply wit monetary credit, an foreign exchang t h , d e guidelines There is also th Nigerian Deposit Insuranc Corporation (NDIC) tha . e e t insures:the:deposits:of:banks:customers:and:also:carries:out:periodic:reviews:to:ensure:t he solvency:of:banks.:Nevertheless,:the:banking:system:in:Nigeria:is:fairly:open.:There:are:over:12 0 banks:in:Nigeria:in:three:categories:Commercial,:Merchant,:Industrial:or:Development:Ban ks. Currently,:there:is:a:trend:towards:Universal:Banking.:This:allows:any:interested:bank :to substitute:its:license:for:a:universal:banking:license,:which:enables:it:to:provide:full:range :of banking:and:nancial:service s. Due:to:economic:instability:and:despite:Nigeria:being:the:6th:largest:world:producer:of:oil,:t he banking:industry:is:facing:some:important:problems.:Jason: (1998):states:that:fewer:than:50:of:the over:120:banks:are:solvent.:Five:have:been:liquidated:and:a:further:fortytwo:are:in:serious difculties.:Another:26:were:slated:for:liquidation:when:the:government:changed:its:mi nd. Consequently,:bank:watchers:say:that:the:future:of:banking:in:Nigeria:will:be:tough: and competitive Technolog will be th driving an differentiatin force, as reported by . y e d g Baranshamaje:et:al.: (1995):The:information:revolution:offers:Africa:a:dramatic:opportunity ]:If:Africa to:leapfrog:into:the:future,:breaking:out:of:decades:of:stagnation:or:declin y e:[ n Countries:cannot:take:advantage:of:the:Information:Revolution:and:surf:this:great:wav e:of technological:change,:they:may:be:crushed:by:it . 4.1. Aims and objectives Despite:these:facts,:the:vibrancy:and:competitive:nature:of:the:banking:sector:and:the:trend :for IS:outsourcing:in:the:sector,:there:is:no:evidence:of:signicant:literature:or:theoretical:discuss ionon:the:risks:involved:in:this:practice.:This:research:behind:this:paper:aimed:at:identifyi ng, understanding:and:criticising:the:practices:adopted:by:Nigerian:commercial:banks:wh en outsourcing:there:IS . Explicitly,:this:study:aimed:at:accomplishing:a:number:of:goals:specically:intende d:to
* acquire:a:deeper:understanding:of:the:current:status:of:IS:outsourcing:in:commercial:bank s:in igeria; N * identify:whether:policies:and:guidelines:for:risk:management:are:available:and:are:follow * ed; identify:how:the:risks:associated:with:IS:outsourcing:are:managed:and:mitigated;: * and contribute:to:the:limited:body:of:research:literature:on:IS:outsourcing:available:in:Niger ia.

ARTICLE IN PRESS PRESS

172 B.C. Adeleye et al. / International Journal of Information Management 24 (2004) 167 180

be:based:on:integrated:banking:solutions:such:as:GLOBUS,:PHOENIX,:BANKMASTER:R 4.2. Research S, methodology FINACLE,:MIDAS:EQUATIONS,:as:illustrated:in:Fig.:1.:The:outsourcing:practices:by:bank s This:research:was:undertaken:to:study:the:view:of:commercial:banks:on:risks:managem involve:considerable:amounts:of:risks:and:resources:and:seem:to:be:based:on:an:Evere practices:in:their:outsourcing:activities,:outsourcing:strategies,:role:of:users,:and:disaster:recove st ent Syndrome:type:approach.:This:refers:to:the:attitude:among:managers:that:IS:solutions:are:to ry:be procedures.:The:main:objective:of:the:research:was:to:explore:the:risks:involved:in:outsourci acquired:and:used:for:the:same:reason:the:British:climber:George:Mallory:gave:in:1924:when: nganthe:management:of:these:risks.:In:order:to:achieve:these:objectives,:a:questionnairehe wasasked:why:he:wanted:to:climb:Mount:Everest Because it is This:is:probably:a:direc d based survey:research:methodology:was:used.:These:questionnaires:explored:a:broad:spectrum: there. t consequence:of:another:nding:from:this:study:only:the:executive:management:or:boar of questions.:The:research:was:conducted:in:two:phase d:of directors:make:the:decisions:that:usher:any:process:of:outsourcin s. Therst:phase:involved:preliminary:face-tog.Given:the:level:of:IS:implementation:in:Nigerian:banks:and:the:generally:adopted:practic from:30:best:of:the:banks:in:the:Agusto: &: Co: e:offace:discussions:with:about:20:bank:executives, outsourcing,:it:was:surprising:to:nd:that:six:of:the:banks:surveyed:do:not:have:expli (2001):ranking.:These:interviews:aimed:to:explore initial:assumptions:and:ascertain:institutional:willingness:to:participate:in:the:survey.:The:i cit outsourcing:strategies.:Even:for:the:one:bank:that:did:have:such:strategies,:it:was:obvious:t nitial interviews:were:then:analysed:and:15:suitable:banking:institutions:were:selected.:The:sec hat these:were:only:scarcely:documented:and:still:in:the:process:of:being:developed.:More:curiousl phase:involved:the:preparation:and:deployment:of:the:main:questionnaires.:These:were:desig y, ne:executive:manager:from:another:bank:declared:the:existence:of:such:guidelines,:but:neit o ond nedusing:the:results:of:the:preliminary:interviews:and:the:available:literature:on:IS,:risk,:ri her the:IS:manager:nor:the:user:were:aware:of:it.:However,:43%:intend:to:put:in:place:an:outsourci management:and:outsourcin ng sk strategy,:while:33%:have:no:idea:whether:they:would:be:adopting:such:strategies:and:24%:sta ting g.The core:data:of:this:study:were:obtained:by:mailing:questionnaires:in:July:2002:to:the that:they:have:no:intention:of:doing:so: :15 banks:selected.:The:target:respondents:were:chosen:to:encompass:a:wide:range:of:decision:mak (Fig.:2).:Nonetheless,:when:asked:if:they:intend:to outsource:new:systems:in:the:near:future:all:respondents:answered:ye ers in:the:three:broad:categories:of:executive:and:senior:management,:IS/IT:managers:and:IS:us s. 40 ers. Seven:(7):out:of:the:fteen:(15):banks:responded:appropriately:to:the:survey: (response:rate:of 46.6%),:including:twenty:one:(21):individual:responses: 35 (three:per:bank). The questionnaire:used:in:this:study:was:divided:into:six:sections:containing:closed ended:and opened 30 ended:questions,:allowing:for:data:triangulation:and:validation:and:hopefully:avoiding biased:and:top-of-theResponse mind:choices.:The:purpose:of:the:rst:two:sections:was:to:understand:the specic:outsourcing:strategies:and:the:impacts:of:outsourcing:in:the:banks.:The:third:sect 25 ion (%) investigated:the:roles:of:users:and:stakeholders:in:the:decision:making:process.:The:next:t wo sections:aimed:to:identify:risk:management:procedures:and:guidelines:and:investigate: 20 how outsourcing:risks:are:managed:in:these:banks.:The:last:section:investigated:the:disaster:recov ery practices:that:are:adopted:by:the:respondent:bank 15 s. Each:questionnaire:was:sent:with:a:covering:letter:explaining:the:purpose:of:the:study.: The 10 length:of:the:questionnaire:was:taken:into:consideration:and:the:terms:used:in:the:questionn aires were:not:technical,:so:no:explanations:were:neede 5 d. 4.3. The 0 ndings SAP Bankmaster Globus Finacle Phoneix Others 4.3.1.Outsourcing Fig.:1.:Banking:software:currently:being:used. strategies From:the:responses:to:the:questionnaire:it:became:apparent:that:all:seven:banks:were:usi ng computer:based:IS:since:they:commenced:operations:and:that:all:of:them:were:engaged:i n:IS outsourcing.:However:the:unique:nature:of:Nigeria:has:lent:a:different:character:to:these:sa me practices.:In:fact,:as:emerged:quite:clearly:from:the:responses,:the:two:key:regulatory:agencies: forbanks:in:the:country:are:very:slow:at:keeping:up:with:international:standards:and:best:practic es,notwithstanding:the:increasing:globalisation:of:nancial:markets:and:institutions.:The:cou ntry also:lacks:necessary:policy:and:institutional:frameworks:from:the:regulatory:authoriti es. At:rst,:outsourcing:practice:seemed:to:consist:of:the:reactive:acquisition:of:off-theshelf generic:software:to:resolve:particular:needs.:Current:practice:has:since:evolved:and:seems:now: to

B.C. Adeleye et al. / International Journal of Information Management 24 (2004) 167 173 180

33% 43%

Yes No Do not know 24%

Fig.:2.:Banks:intending:to:put:in:place:an:outsourcing:strategy.

ARTICLE IN PRESS
174 B.C. Adeleye et al. / International Journal of Information Management 24 (2004) 167 180
Training and education

0% 3% 3% 19% 0% 0% 24%
Data communication networks Support operations (equipment maintenance/ service) Disaster recovery Software development Software maintenance

16%
Telephone support of customers

19% 16%
Development of a fully integrated system (hardware, software or networking) Data centre (computer) operation Other (please describe)

Fig.:3.:IS:functions:currently:being:outsourced.

This:survey:also:identied:that:from:all:respondents:who:stated:that:they:were:outsourci ng, 96%:stated:they:were:doing:it:selectively,:while:4%:do:third:party:maintained.:This:can :be considered:as:very:good:practice,:since:selective:outsourcing:often:results:in:greater:exibility:a nd better:services.:Fig.:3,:shows:how:different:IS:functions: (that:is:software:development,:software maintenance,:data:communication:networks,:support:operations,:training:and:education) :are distributed:in:terms:of:outsourcing:training:and:education:(24%),:software:development: (16%), software:maintenance: (16%),:and:both:support:operations:and:data:communication:networks (19%).:By:contrast:telephone:support:of:customers:and:disaster:recovery:rank:as:the:lowest: (3%). This:comes:as:no:surprise:since:customer:support:is:paramount:to:guarantee:customer:satisfacti on acceptance:and:constitutes:a:core:competence:of:the:organisation.:Similarly,:disaster:recov an ery d is:also:of:crucial:importance:since:the:costs:of:disaster:are:not:only:of:a:nancial:nature,:but:h ave also:high:visibility:and:high:image:and:reputation:risks.:Therefore,:banks:tend:to:ensure:that:b othof:these:services:are:kept:inhouse. Furthermore,:this:research:conrms:that:the:banks:do:see:organisational:data:as:a:strat egic advantage:that:must:be:operated:and:maintained:done:internally.:In:fact,:all:banks:surv eyed stated:that:they:operated:their:data:centre:internally.:This:is:in:line:with:current:practice:in :the banking:sector:worldwide.:On:the:other:side,:training:and:education:seemed:to:be:freque ntly outsourced:and:this:is:possibly:due:to:the:fact:that:most:of:the:software:is:bought:from:vend ors this:often:includes:training:clauses:in:the:contrac an d ts.

ARTICLE IN PRESS
B.C. Adeleye et al. / International Journal of Information Management 24 (2004) 167 175 180

4.3.2.Impact of Theoutsourcing decision:behind:outsourcing:is:strongly:inuenced:by:high:expectations:of:strategic: and operational:benets.:Different:banks:may:outsource:for:different:reasons,:therefore:it:is:import ant to:recognise:these:differences:when:assessing:the:impact:of:outsourcing:in:organisations.: The banks:surveyed:stated:a:number:of:reasons:improved:customer:relationships: (68.5%),:improved management:information:system:(60%):and:greater:efciency:in:business:processes: (65.7%),:as well:as:better:utilisation:of:staff:(60%):and:improved:security: (54.2%).:Other:benets:mentioned are:specialisation:and:the:need:to:adopt:new:management:strategies:and:procedural:meth ods; technology:infusion:through:contact:with:new:systems;:staff:skills:improvements;:redu ced overhead:costs;:slimmer:work:force;:avoidance:of:investment:in:areas:other:than:the:core:busin ess an guaranteed:technical:support: d In:terms:in:drawbacks,:banks:referred:to:a:very:disparate:set:of:factor (Fig.:4). s * lack:of:and:reduced:security * ; difculty:in:retaining:loyalty:of:existing:staff:after:organisational:changes,:which:bec ame necessary:by:the:introduction:of:the:outsourced:system * s; difculty:in:maintaining:motivation:of:existing:staff:due:to:the:perception:that:everyt hing related:to:IT:and:IS:is:the:responsibility:of:the:vendor * s; vendors:unwillingness:to:transfer:knowledge:related:to:the:outsourced:I * S; running,:maintenance:and:training:co * st; difculties:with:the:interface:with:the:outsourced:syste *increasing:dependency:on:the:contractor,:that:is:not:always:prompt,:or:even:willing,:to:att ms; end to:possible:problems:and:meet:deadline s;
100 90 80 70 Response (%) 60 50 40 30 20 utilisation ofty e.g. relationships in respect of management g. g. ents information Improvedent ciency e. in errors e. customer Inproved Improvedsystems speed, Reduced errorsBetter Greater business staff statem paym securi effi 68.5 60 65.7 60 60 54.2

Fig.:4.:Impact:of:outsourcing:in:banks:bank.

ARTICLE IN PRESS
176
*

B.C. Adeleye et al. / International Journal of Information Management 24 (2004) 167 180

threaten:security,:namely:in:what:concerns:guaranteeing:the:loyalty:and:condentialit y:of vendor:and:vendors:staff * ; threats:of:having:overall:performance:dependent:on:vendor;:a * nd introducing:buck:passing:resulting:from:the:lack:of:clear:assignment:of:responsibilities:ov er IS:tasks:and:processes:shared:between:inhouse:and:vendors:staff. These:results:show:that:there:is:a:clear:awareness:of:the:benets:and:drawbacks:of:outsourc ing in:banks:in:Nigeria,:which:represents:the:realisation:of:this:researchs:rst:objective.:Managers,: IS staff:and:users:seem:to:be:aware:of:the:majority:of:problems:and:risks:associated:to:the:practic e:of outsourcing:as:reported:in:the:literature:in:the:eld.:So:they:are:well:informed:and:outsourc ing decisions:are:well:supported.:The:next:question:in:this:research:was:to:investigate:if:t his knowledge:of:risk:is:expressed:in:terms:of:appropriate:risk:management:strategies:and:policie s. 4.3.3.Risk management practices When:asked:if:the:organisation:had:a explicit risk:management:procedures:or:guidelines:fo ny r IS:outsourcing,:all:of:the:banks:admitted:that:they:had:none:in:place.:Furthermore:and:possi bly even:more:surprisingly,:none:of:the:banks:accepted:third:party:guidelines:be:it:from:vendors: or other:banks. This:situation:was:however:not:totally:unexpected,:since:some:of:the:risk:management:meth ods could:be:embedded:in:general:management:best:practice.:So:this:research:tried:to:determine:if: any of:these:were:actually:occurring:in:the:outsourcing:process,:although:not:explicitly:recognised :asrisk:management.:I fact,:the:proces of:risk:management:i usuall divide into:risk n s s y d identication,:risk:analysis,:risk:response:planning:and:risk:monitoring:and:control: (Hillson, 2002).:These:steps:are:sometimes:iterative:and:not:always:taken:in:sequence.:For:the:purpose these:organisations:during:outsourcing: :of this:research:it:was:necessary:to:express:these:steps:in:terms:of:activities:and:methods:undertak (57.1%).:6:of:the:banks:make:sure:that:joint:meetings:with systems:staff,:internal:control,:and:users:occur:regularly.:Five:of:the:banks:circulate:list:of:existi en ng in:the:organisation:while:outsourcing:their:IS.:Once:these:activities:were:identied,:it:was:t problems:in:the:different:departments:and:use:these:to:justify:decisions:for:change: hen possible:to:question:banks:regarding:their:usag and outsourcing e.The following:methods:were:identied:from:the:literature:review:on:risk:management: . However,:only:42.8%:of:the:respondents:declared:to:have:departmental:plans:to:avoid:t outsourcin he for occurrence:of:risks:and:its:impacts:and:only:1:bank:had:strategic:and:global:risk:control:pla g ns.circulation:of:list:of:existing:problems Similarly,:only:2:banks:considered:identication:of:the:risks:in:outsourcing:as:a:major:compon * entof:their:decision:making:process * ; identication:of:the:risks:in:outsourcing:a:service/functio . n; * On:the:positive:side,:71.4%:of:the:respondents:stated:that:their:organisation:had:a:disa examination:of:the:impacts:of:risk:on:outsourcin recovery:plan:in:place,:which:is:reviewed:periodically.:The:study:revealed:that:different:ban * ster g; review:of:documentation:of:existing:syst ks el have:different:reasons:for:adopting:a:disaster:recovery:plan.:For:example:in:Fig.:6,:55% * interviews:with:appropriate:in:ofhouse:users:and:managers; respondents:said:that:the:plan:covers:responsibilities:of:specic:individuals.:All:respondents:stat * documentation:of:transaction:ow ed * s; that:there:are:provisions:for:uninterrupted:power:supply.:All:respondents:also:said:their:disast joint:meetings:of:systems:people,:operators:and:end:users:of:reports;:an er * d recovery:plans:cover:procedures:for:protecting:integrity:of:data:and:information.:Again,:100% recommendations:designed:to:avoid:or:prevent:risk:from:occurrin :of respondents:said:these:plans:include:alternate:procedures:in:the:event:that:an:outsource g. d:IS banks:surveyed:were:asked:to:rank,:using:a:scale:of:5: breaks:down. The This:was:to:be:expected:since:the:Basel:Committee:on:Banking:Supervision:(BCBS): (highest:frequency):to:1(lowest frequency),:the:observance:and:adoption:of:these:risk:management:activities:during:outsourci (1998) imposed:the:need:for:adequate:preventive:measures:that:help:minimising:the:probability:t ng.The results:of:this:part:of:the:questionnaire:are:shown:in:Fig.: hat Interviews:with:appropriate:supervisory:and:clerical:staff:as:means:of:identifying:risks:a negative:events:occur.:The:BCB:also:proposes:that:management:should:ensure:that:adeq 5. uate systems:of:containment:measures:are:put:in:place:in:order:to:help:detect:and:limit:the:effects nd problems:were:found:to:take:place:68.5%:of:the:cases.:Documentation:of:transaction:ow,: :onthe:business:of:events,:which:may:bypass:preventive:controls:and:threaten:banks:operatio and having:joint:meetings:with:systems:department:people,:auditors:and:end:users:is:also:commo ns. n:in

ARTICLE IN PRESS
B.C. Adeleye et al. / International Journal of Information Management 24 (2004) 167 177 180
80

68.5

60 Responses (%)

60 57.1 54.2 48.5 42.8 42.8 57.1

40

20 documentation o f Interviews with ion g Review of in system f catrisks exist af st i f i Ident of n ion ion of gs ce io ning for ms in ake rren at ansact rs of flows t list proble meet holde t cumen all st ula ccu Circ n risk o t r in of Pla t J o of D o e risk h Examining t f s o act imp

5.7Conclusionandfuturewor k This:exploratory:empirical:study:investigating:the:risk:management:practices:in:the:outsourc ingf:IS:in:commercial:banks:in:Nigeria:has:led:to:several:important:conclusions.:While:some o :of these:have:conrmed:initial:assumptions,:others:have:been:contrary:to:ordinary:intuition.: The survey:showed:that:in:spite:of:the:lack:of:regulations:and:infrastructures:in:the:count ry, outsourcing:is:now:a:common:practice:and:has:achieved:some:considerable:degree:of:succe ss. However,:it:is:evident:that:banks:are:taking:a:reactive:approach:to:outsourcing:risk:managem entthat:may:make:them:vulnerable:to:a:number:strategic:and:operational:risks,:which:may:h ave considerable:nancial:and:reputation:costs.:In:order:to:avoid:these,:a:more:proactive:managem ent attitude:is:required:including:the:adoption:of:welldened:and:structured:risk:management guidelines,:policies:and:procedures . Although:the:sample:size:is:representative:of:the:population:of:banks:in:Nigeria,:and:the:res ults provide:valuable:insights:into:the:risk:management:practices:in:the:outsourcing:process,:the:n eed for:further:work:in:this:area:is:strongly:recommended.:Future:research:efforts:should:expand:t he body:of:literature,:but:also:critically:examine,:document:and:recommend:the:role:of:manager s:in banks:and:regulatory:and:supervisory:bodies:in:enforcing:the:adoption:and:adaptation:of:glo bal best:practices . References
Atkinson,:J.:(1985). exibility factor The , Institute:for:Manpower:Studies,:Sussex:University,:Sussex.

Fig.:5.:Risk:management.

178

B.C. Adeleye et al. / International Journal of Information Management 24 (2004) 167 180

120 Agusto:&:Co:(2001). Rated Banks Nigeria and bank prole .: [Online]:http://www.agusto.com/pub1/default.html [Accessed:August:11:2002]. Baranshamaje,:E.,:Boostrom,:E.,:Brajovic,:V.,:Cader,:M.,:Clement-Jones,:R.,:Hawkins,:R.,:Knight,:P.,:Schware,:R.,:& 100 100 100 Sloan,:H.:(1995). Internet Connectivity in Sub-Saharan Africa: issues, options, and World Bank Group role Increasing , 100 [Online]:http://www.uneca.org/eca:resources/publications/disd/old/padis/telemat/africa03.htm:[Accessed:August:11 Response (%) 80 71.4 71.4

60

55

40 master plan that event that in the alternate facility destroyed files insurance that power supply in in reconstructing power failure place uninterruptedresponsibilities Written down Provision of Copies of all Havecovers cost master the event of specified of outsourced files, prevention describes the banks transaction of programs files, and installed disaster Covers indiduals

Fig.:6.:Disaster:recovering:plan.

ARTICLE IN PRESS
B.C. Adeleye et al. / International Journal of Information Management 24 (2004) 167 179 180

2002]. Basel:Committee:on:Banking:Supervision:(1998). Operational risk Basel:Committee:Publications:No.:42, management: [Online]:http://www.bis.org/publ/bcbs42.htm:[Accessed:July:10:2002]. Boiney,:G.:L.:(1999).:Knowledge:is:Power:but:knowledge:management:requires:organizational:change. Journal of Contemporary Business Practice Spring:1999,:[Online]:http://gbr.pepperdine.edu/992/infotech.html:[Accessed:July:1 , 2002]. Broady-Preston,:J.,:&:Hayward,:T.:(2001). Strategy, information processing and scorecard models in the UK nancial services sector. Information:Research, (1),:[Online]:http://InformationR.net/ir/7-1/paper122.html:[Accessed:July:4 2002]. Butler,:M.,:Holt,:M.,:Menzies,:K.,:Jones,:G.,:Jennings,:T.,:Jagger,:E.,:Smith,:E.,:Newman,:J.,:Jones,:T.,:&:Gibbes,:K. (2001).Strategic sourcing: Effective alternatives for the enterprise. Butler:Group,:Technology:Infrastructure, Research:and:Advisory:Services. Computer SciencesCorporation (CSC) (2000).CSC entersoutsourcing agreement wit Swiss bank, [Online] h http://www.csc.com/newsandevents/news/221.shtml.:[Accessed:June:11:2002]. DeLoach:Jr.,:J.:W.:(2000).Enterprise-wide risk Strategies for linking risk and .:London management opportunity Financial:Times. De:Looff,:L.:(1997).nformation systems outsourcing decision making I A managerial approach .:London:Idea:Group Publishing. Drucker,:P.:F.:(1995). Managing in a time of great change .:New:York:Truman:Talley:Books. Dyer,:J.:F.,:&:Ouchi,:W.:G.:(1993).:Japanese-style:partnership:giving:companies:competitive:edge. Sloan Management Review4(16),:5163. , Fan,:Y.:(2000).:Strategic:outsourcing:Evidence:from:British:companies. Marketing Intelligence and , 18 (4), Planning 213219. Fleck,:F.:(2002). Clients left out in cold by Swiss private bank mergers , [Online]:http://www.milleniumassociates.com / PDF/Complinet%20Clients%20left%20out%202Jul2002.pdf.:[Accessed:July:4:2002]. Hillson,:D.:(2002).:Extending:the:risk:process:to:manage:opportunities. International Journal of Project , Management 20 235240:[Online]:www.elsevier.com/locate/ijproman.:[Accessed:20:July:2002]. , Huber,:R.:L.:(1993).:How:Continental:Bank:Outsourced:its:Crown:Jewels. arvard Business Review (1), H , 31 7784. Jason, P. (1998). Turn around in Nigeria banking: New Africa Marke . NEWAFRICA [Online] April. t http://dspace.dial.pipex.com/town/terrace/lf41/na/apr98/namb0406.htm.:[Accessed:July:20:2002]. Lacity,:M.:C.,:&:Hirschheim,:R.:(1993). Information systems outsourcing Myths, metaphors and .:London realities Wiley. Loh,:L.,:&:Venkatraman,:N.:(1992).:Diffusion:of:information:technology:outsourcing:Inuence:sources:and:the Kodak:effect.nformation Systems Research I , 3, 334358. Lonsdale,:C.:(1999).:Effectively:managing:vertical:supply:relationships:A:risk:management:model:for:outsourcing supply:chain:management. An International Journal , 4(4),:176183. McFarlan,:F.,:&:Nolan,:R.:(1995).:How:to:Manage:an:IT:Outsourcing:Alliance. Management Review Sloan , 36 (2), 923. Mylott:III,:T.:R.:(1995).Computer outsourcing Managing the transfer of information .:Eaglewood:Cliffs,:NJ systems Prentice:Hall. OBrien,:J.:A.:(1996). Management information systems Managing information technology in the networked. enterprise Boston:McGraw-Hill. Pearlson,:K.:E.:(2001). Managing and using information systems a strategic .:Chichester:Wiley. approach Scott,:S.:V.:(2000). IT-Enabled:Credit:Risk:Modernisation:A:revolution:under:the:cloak:of:normality. Accounting, Management and Information Technology , 10 (3),:221255.