'Board bears final responsibility': Financial sector's third-party IT risk management guidelines to take effect in November

Guidelines clarifying the responsibilities of boards of directors and management in outsourcing IT operations have been established. They are expected to take effect sequentially from November, following the adoption of best-practice standards by each financial sector association.

The Financial Supervisory Service said Wednesday it had developed the guidelines together with financial associations and federations across industry sectors to more effectively manage third-party risks arising from the outsourcing of information-processing operations.

As digitalization spreads across the financial industry, financial firms are increasingly relying on external IT services and outsourcing IT operations. Although major financial sectors have been running self-regulatory frameworks for third-party risk management, critics have said the specific characteristics of IT operations — including cybersecurity and information protection — have not been adequately reflected in those frameworks.

In this regard, the Korea Federation of Banks introduced its own "Third-Party Risk Management Best Practices" standards, which took effect in April. The standards include measures to block risks related to IT outsourcing. (See the March 31 report, "Bank executives held responsible for data leaks by outsourced firms — effective April")

The new guidelines set out standards covering three areas: clarification of board and management responsibilities, risk assessment frameworks and methods, and risk identification and response at each stage of the contracting process.

First, the guidelines explicitly designate the board of directors as bearing final responsibility for third-party IT risk management, and stipulate that key matters related to risk management policy and oversight be subject to board deliberation and resolution. In addition, management is designated as the party responsible for establishing, implementing and maintaining the third-party IT risk management framework, and is required to put in place effective safety measures through the operation of a dedicated oversight department.

On that basis, financial firms will be required to build and operate a three-tier control structure — comprising an overall management department, a risk management department and an internal audit department — to systematically manage third-party IT risks.

To effectively manage third-party IT risks, firms must also identify the financial soundness and key operational information of third-party contractors and update that information through periodic reviews conducted at least once every six months. Particularly, third parties deemed "major third parties" — those with a significant impact on a firm's operations or on financial consumers — must be separately designated and subject to enhanced risk management standards.

Beyond that, firms must present step-by-step management procedures to proactively identify and address third-party IT risks that may arise throughout the entire outsourcing process — from contract review and execution through maintenance and management to termination.

Industry associations plan to adopt best-practice standards based on the guidelines and implement them from November onward.

An FSS official said the agency plans to work with industry associations to monitor and evaluate compliance with the guidelines, and to refine and supplement them as needed.