Strategic technology risk: Core systems replacement

Abstract

Following a number of recent information technology (IT) outages affecting the provision of key services to customers, UK regulators have become worried about the ‘resilience’ of banks’ IT systems environments. Over time, banks develop, purchase and maintain, sometimes, many hundreds of ‘sub-systems’, which, when combined, provide the full range of services to their customers. Any disruption of the most important (or ‘core’) systems will invariably cause serious inconvenience to customers and often require remediation actions to resolve customers’ losses. Because of their sheer size and the complexity of the many internal and external interactions, however, replacing core systems takes many years and is very risky. Because of the enormous risks involved, any decision to undertake a major core systems replacement (CSR) programme must be taken by the board of a firm as part of the firm’s overall technology strategy. This paper discusses the problems of CSR through drawing lessons from three case studies that illustrate the complex risks that can be encountered by boards making such strategic decisions. The paper finally proposes a framework for managing the risks of a CSR programme.