LEVERAGING OUTSOURCING STRATEGIES TO OPTIMIZE KEY OPERATIONAL AREAS FOR FINANCIAL SERVICES

Webcast notes Resources List: Download today s slides and access other helpful links by clicking the icon Q & A: Have a question? Click the icon Polling questions: click on the radio button (circle) to the left of your desired response, then click Submit to record your response Help: For technical assistance, click the of your screen widget at the bottom

CPE credit eligibility Remain on the webcast for a minimum of 50 minutes Participate in polling questions (75% response required) To answer a polling question, click on the radio button to the left of your desired response, then click Submit to record your answer You do not need to have the correct answer but must participate to receive credit 1.0 CPE credit will be issued to eligible participants at the end of the event Visit the Certification center and click the download icon to access your certificate Be sure to save a copy to your computer before the end of the event RSM employees: CPE will appear on your MyLearning transcript Group CPE credit is not available for this event; each participant must be logged in to the webcast NASBA will not issue credit if all criteria are not met, without exception

Speaker Contact Information Aaron Donaldson Principal, TMC aaron.donaldson@rsmus.com 641-494-2127 George Simms Partner, RAS george.simms@rsmus.com 980-233-4696 Victor Padilla FIDS Director victor.padilla@rsmus.com 972-764-7128 David Voorhees FIDS Supervisor David.Voorhees@rsmus.com 816-751-4014 5

Why and When to Outsource IT Aaron Donaldson Principal, Technology and Management Consulting Specializes in network design, assessment and implementation, as well as business continuity project management, and Web site development. More than 15 years of helping clients identify current or future pain points and providing recommendations and solution plans to address those. Focus is on financial institutions. Agenda What Constitutes IT Outsourcing? State of the Market Business Drivers Knowing When to Outsource What to Avoid / What to Watch Next Steps 6

What Exactly Constitutes IT Outsourcing? Off-Shore application development? Embracing Cloud technologies? Use of a 3 rd Party for helpdesk services? The hiring of a consulting company to help develop a new mobile application? The use of a Virtual CIO to help develop and adopt strategy? The addition of a DRaaS (Disaster Recovery as a Service) provider to augment backup and recovery efforts? 7

IT Outsourcing Stuff vs Staff Pre-defined service Pre-defined deliverable and expenditure (mostly) that can be measured Service Objective Measurement 8

Spectrum of Services Management Responsibilities Traditional on-premise computing Co-Location or aka CoLo Infrastructure as a Service (IaaS) Private cloud Software as a Service (SaaS) YOU MANAGE Data Applications Runtime Middleware O/S Virtualization Servers YOU MANAGE Data Applications Runtime Middleware O/S Virtualization Servers YOU MANAGE Data Applications Runtime Middleware O/S Virtualization Servers YOU MANAGE Data Applications Runtime Middleware O/S Virtualization Servers Data Applications Runtime Middleware O/S Virtualization Servers Storage Storage Storage Storage Storage Networking Networking Networking Networking Networking AC/Cooling AC/Cooling AC/Cooling AC/Cooling AC/Cooling Facilities Facilities Facilities Facilities Facilities 9

State of the Market Increased reliance on technology coupled with increased complexity has created the perfect storm to attract and retain top IT talent! The days of THE Network Administrator are gone Security threats from every angle and increasing demands by staff and customers require 100% uptime and availability 2/3 rds of all organizations carry some level of outsourcing, with 1/3 rd outsourcing more than 20% of their IT budget The main areas typically outsourced include application development, application support, infrastructure and helpdesk The level of application development and infrastructure outsourcing is consistent amongst all sizes Application support outsourcing is more prevalent in SMB Helpdesk outsourcing is more prevalent in larger companies 10

Business Drivers Cost savings IT efficiency (improvement) Drivers Cost Savings IT Efficiency 11

Cost Savings Breakdown Infrastructure - highest avg. & median savings, low variability Application development - 2 nd highest savings rate, but highest variability Application support - similar to application development, with slightly smaller savings Help desk - lowest cost savings, BUT lowest variability and very stable Percentage of Savings 30 20 10 0 Infrastructure App. Dev App. Support Help Desk 12

Next Steps Quick Self-Assessment What are we currently outsourcing? Is that right thing(s)? Are there opportunities? Assessment or Readiness Review Determine potential and appetite Cost benefit review Develop actionable roadmap Discovery Analysis Roadmap RSM Capabilities Cloud Provider for over 20 Years Top 15 Managed Services Provider (MSP) Advise/Deliver/Manage Depth & Breadth of Resources

Transition from Cost Reduction to Efficiency As the proportion of IT budget committed to outsourcing increases, cost reduction ceases to be a top priority. Instead, the value is seen in: Accessing deeper and wider skill sets Providing focus for in-house IT staff, along with career path Improving overall delivery Satisfaction Delivery timetable Product quality Reducing risk Enterprise grade 14

When to Outsource Critical initiative - Internal IT cannot meet need Strategic, high urgency Bottom up - Specific area of IT is underperforming IT efficiency & value Top down - Specific need isn t being addressed Cost savings 15

What to Avoid / Watch for Contract Term SLA Data ownership Personnel Hidden Costs What s not included Transition costs Point person Security Data residency / NDA Flexibility Track record with provider What happens if circumstances change, grow, shrink? 16

Why and When to Outsource Internal Audit George Simms Risk Advisory Partner Certified Public Accountant (CPA) More than 20 years of audit and consulting experience at big 4 CPA firms Acted as peer advisor to financial, regulatory and capital markets engagements in the US, EMEA and Asia-Pacific Leads teams that provide support in areas such as AML and regulatory compliance, internal audit and enterprise risk management. Agenda Sate of the Market Why Outsource an Internal Audit Issues Driving Need Benefits of Outsourcing The Outsourcing Solutions Next Steps 17

State of the Market The market for talented internal auditors is tight, with demand high and competition fierce. Companies are increasingly complex organizations, expanding into new markets and geographies, while adopting complex business processes and systems. Clients in multiple locations expect consistency in internal audits across locations. The regulatory environment and risk exposures, both domestically and internationally, have become more complex. Stakeholders, including boards, shareholders, lenders, etc., are increasingly expecting an internal audit function to actively help mitigate risk. 18

Outsourcing Internal Audit Many successful companies are counteracting tight labor market challenges by leveraging outsourcing strategies to gain efficiency, overcome staffing difficulties and better manage costs. Outsourcing can help combat hiring challenges by providing flexibility and coverage, while leveraging standardized processes and technology. In many cases, firms that provide outsourcing can attract and retain a strong talent base by incentivizing employees with diverse opportunities. Firms that provide outsourcing can provide resources on demand who have the necessary experience and skill sets. 19

Outsourcing Internal Audit Workforce and labor concerns are paramount for businesses, with labor factors threatening their vision and future strategies. Specifically, business leaders are concerned with: A shortage of employees with specialized skills and rising labor costs, which will diminish the business ability to respond to emerging trends, client demands, regulatory requirements, and security threats. A tightening, more competitive labor force that is making it harder to find and retain qualified employees. 20

Issues Driving Need Company currently has an internal audit function: Company has realized that attracting and retaining quality internal audit employees is a significant challenge. The internal audit function is not consistently meeting deadlines or efficiently executing according to their annual plan. The company has expanded (organically or through acquisition), and the travel cost of sending internal auditors across the globe is excessive. The existing audit function lacks language and culture skills needed at overseas locations. They may not yet have enough internal audit needs to warrant a full time hire. 21

Issues Driving Need Company does not have an internal audit department: Company has grown to the point where leadership can no longer monitor activities as closely as they would like. Expansion in new geographies Significant growth in volume Merger & acquisition activity A stakeholder has strongly suggested that an internal audit function would help mitigate risk. The company has come under scrutiny by a regulator and realizes it is struggling to monitor compliance effectively. 22

Benefits of Outsourcing Internal audit should help improve the control environment Educating managers / employees about risk management and internal controls Going beyond traditional compliance auditing and accounting controls - looking at best practices, key business processes, corporate governance Eliminating redundant controls from new systems / processes Internal audit should help improve business processes Analyzing performance gaps Interdependency - focusing on handoffs between internal silos Facilitating change Providing best practices information and benchmarking Assisting with integration activities of newly acquired entities 23

The Outsourcing Solution Realize greater efficiency and reduced overall compliance costs You will free your internal resources to engage in activities that add strategic value, while simultaneously minimizing the need to hire additional personnel Receive best practice on quality assurance Meet client and regulatory expectations Creates value by: Providing objective technical and industry perspectives 24

The Outsourcing Solution Advise Improve Innovate Internal Audit Outsourcing Strategic partnership Security, Privacy and Enterprise Risk Management

Next Steps Assessment can be beneficial Unbiased, quick-hit, diagnostic evaluation helps identify key initiatives leading to improved business performance Discovery Analysis Roadmap Find the right partner Comprehensive model Flexibility Advisory Geographic footprint

Speakers: Financial Investigations and Dispute Services Victor Padilla FIDS Director Certified Fraud Examiner (CFE) More than 10 years of consulting experience in big 4 CPA firms and Fortune 500 companies Has conducted numerous international investigations in countries like Mexico, Venezuela and Brazil Leads the Forensic Data Analytics practice, is a DBA and has experience with numerous accounting systems. David Voorhees, CFE, CAMS FIDS Supervisor Certified Fraud Examiner (CFE) Certified Anti-Money Laundering Specialist (CAMS) Experience in criminal and civil investigations Extensive experience and training in investigative interview and interrogation Involvement in variety of Financial Institution compliance and investigative matters 27

Agenda Why and When to Outsource your Institution s Investigation Case Studies Rapid Fraud Risk Assessment 28

Types of FI Investigations Financial statement fraud Employee theft and embezzlement Corruption and FCPA violations Asset tracing Conflict Resolution Insurance claims Whistle blower complaints Hotline tips Employee misconduct and disputes Regulatory and compliance Suspect and witness interviews 29

Why and when to outsource Lack of experience in organization Ensure confidentiality Assure objectivity Limited resources Internal relationships Departure of key personnel Reputation protection 30

Case Studies Discriminatory Lending DOJ initiated an investigation into a bank for discriminatory lending practices Identify lending patterns indicative of discriminatory practices Additional on-going monitoring Customized investigative approach to address additional concerns raised by regulators Trust officer departure Departure of key bank officer Officer terminated Could not be bonded Officer had wide variety of control over accounts Few adequate controls in place Client requested an analysis of account and system activity for this person. 31

RAPID FRAUD RISK ASSESSMENT

How is Fraud Detected? The power of proactive data analytics Caught 50% faster Median loss 60% less 33

What is the Rapid Fraud Risk Assessment Method for testing certain datasets for: Data anomalies (red flags) indicative of fraud Control deficiencies Errors in data processing (collection, input, etc.) Uses RSM s in-house data analytics platform No sampling involved (completeness) Data sources: Client data (accounts payable, vendor and employee master files, payroll transactions, etc.) Public databases 34

Next Steps Your next steps Proactive: Identify areas of concern What keeps you up at night Water cooler talk Determine the potential impact of the incident RSM s role Proactive: Identify signs of fraud, waste and abuse Develop policy and control suggestions applicable to your specific institution Identify investigative team tailored to the specific incident 35

RSM US LLP 4801 Main St, Suite 400 Kansas City, MO 816.751.4014 +1 800 274 3978 www.rsmus.com This document contains general information, may be based on authorities that are subject to change, and is not a substitute for professional advice or services. This document does not constitute audit, tax, consulting, business, financial, investment, legal or other professional advice, and you should consult a qualified professional advisor before taking any action based on the information herein. RSM US LLP, its affiliates and related entities are not responsible for any loss resulting from or relating to reliance on this document by any person. Internal Revenue Service rules require us to inform you that this communication may be deemed a solicitation to provide tax services. This communication is being sent to individuals who have subscribed to receive it or who we believe would have an interest in the topics discussed. RSM US LLP is a limited liability partnership and the U.S. member firm of RSM International, a global network of independent audit, tax and consulting firms. The member firms of RSM International collaborate to provide services to global clients, but are separate and distinct legal entities that cannot obligate each other. Each member firm is responsible only for its own acts and omissions, and not those of any other party. Visit rsmus.com/aboutus for more information regarding RSM US LLP and RSM International. RSM and the RSM logo are registered trademarks of RSM International Association. The power of being understood is a registered trademark of RSM US LLP. 2017 RSM US LLP. All Rights Reserved.