Cloud Sourcing and Mitigating Concentration Risk in Financial Services

Abstract

With the increased adoption of cloud services, the resilience of cloud providers is paramount to not only the firm, but also to the stability of the financial sector. Method: We use a “mixed” method of research by using a combination of data ranging from the UK regulator regulatory data and information from the public domain, supported by interviews with technology risk specialists at the FCA. Conclusion: This research acknowledges the strategic role of information systems and recognises the key advantages that cloud providers can bring to financial firms. Most firms are keen to leverage these benefits, by adopting “cloud” into their future IT strategy. However, we find that this may lead to increased reliance on key service providers, thus leading to concentration risk. We also find that lack of supplier due-diligence and interoperability standards between providers can be significant contributors to this risk. This research then arrives at three aspects—availability concerns, cyber-attacks and contractual issues, which could constrain the ability of service providers to provision contracted services—that could potentially cause detrimental effects across the financial sector. Before concluding, we look at factors that could mitigate this risk and the increasing role of regulators, firms and service providers in this endeavour.

Appendix: Methodology

See Table 1.

Table 1 Data sources

This paper analyses data from the following four sources. For a sector specific view, we will adopt a qualitative approach by using interviews to gather primary data. According to Myers (2009), there are three types of interviews that can be used—structured, semi-structured, and unstructured. This paper will use semi-structured interviews since this format allows the researcher to be flexible about the questions and at the same time, respondents can provide additional details or opinions about their thoughts on the research questions. We believe that this will supplement the information gathered in the quantitative phase, thus enabling us to benefit from the advantages of the embedded mixed mode approach.

To ensure uniformity, “technology risk specialists” from each of the FCA sector’s were selected as interviewees. The interview questions are specifically focused on outsourcing, concentration risk and sector impact. Since the interviews are semi-structured, the respondents will be given sufficient time to elaborate on issues that are important to their sector. Although, there was no a hard stop, we estimate each interview to lasted for about an hour. The interviews were anonymized and transcribed to preserve the confidentially and integrity of the responses.

For the Retail Banks and Payments sector, we will also use anonymized inputs from the Retail Banking Supervisory Review, also known as the Dear Chairman Exercise (DCE-2014 follow-up), which sought to understand levels of technology resilience among the UK’s seven largest banks. This research will support the sector specific findings by using information from significant incidents reported by regulated firms. These incidents are logged into an FCA database that captures fields such as firm name, incident impact and the root cause. Due to the confidential nature of this data, the firm name and associated vendor information were anonymized. However, when such incidents are subject to media coverage, we used the available information from the media to corroborate our findings.

To examine the interview data, we adopted the process suggested by Gioia et al. (2013), which allows the researcher to systematically introduce methodological rigor into qualitative analysis. The approach involves three phases, which begins by grouping similar respondent quotes resulting in first order concepts. In the second phase, these first order codes are organized to identify relationships and correlations (second order concepts) that can be further distilled into overarching aggregate dimensions in the third phase. The advantage of this process is that it can provide a constructive data structure that presents the raw data in terms of manageable discussion themes—drivers of concentration risk and mitigation factors, which could be related back to the original descriptive codes from the interviews.