sector survey on outsourcing conducted by the central bank, identified issues across the life - cycle of outsourcing arrangements and suggests that outsourcing is not being considered a core priority of many financial services firms. some of the most critical observations from the survey, which tie in with findings from on - site inspection work, relate to poor governance and controls around the risk assessment and management of outsourcing, inadequate monitoring and reporting, failure to consider third - parties in business continuity plans and tests, and a lack of exit strategies or contingency plans should page | 6 the need for resilience in the face of disruption : regulatory expectations in the digital world the firm need to find a new service provider or bring the service back in house. these issues are more concerning given that a large proportion of outsourcing arrangements were reported to involve sensitive customer and business data, including to cloud service providers, and that 75 % of firms outsource all or part of their information technology. x with all outsourcing arrangements, boards and senior management must understand that they are placing the resilience of their firm into the hands of a third - party and while they may be able to monitor the service during normal operation, when something goes wrong, they are reliant on someone else to fix it. some firms might seek to take comfort from the fact that they outsource to a parent or sister group company rather than a third party, but, as has been seen with a number of high - profile events, firms cannot always rely on the parent to provide uninterrupted service. boards and senior management need to understand where their firm ’ s systems and data sit on the group priority list should something go wrong. cyber security risk as i am sure you are aware, october is cyber security awareness month. xi but cyber security and cyber resilience is not something we should focus on for just one month of the year. it requires vigilance and attention, day in, day out. former cisco ceo john chambers once said, “ there are two types of companies : those that have been hacked, and those who do not yet know they have been hacked. ” xii the cyber threat is constantly evolving – the frequency, sophistication and volume of attacks is increasing. the failure to adequately protect against cyber - attacks can have far - reaching repercussions given the interconnected nature of the financial system. xiii page | 7 the need for resilience in the

shocks, absorb the impacts of the shock and communicate effectively to stakeholders throughout, and to ultimately recover from the incident and use the learnings to further improve their future resilience. firms need to be better prepared for the future challenges that technology will pose to their firms ’ competitiveness and business models and they need to acknowledge and take ownership of the risks that go along with this changing environment. the approach of the central bank i have touched on the work of the it inspection team in the central bank. despite its relatively small size, the team has significantly enhanced the intensity and intrusiveness of our supervision of it related risk across the financial services sector. identified issues are required to be resolved through risk mitigation programmes and we will continue to issue thematic findings from our work to highlight areas for improvement for all firms. where necessary we have used our powers to sanction failures and require the use of third parties to help drive improvements. page | 9 the need for resilience in the face of disruption : regulatory expectations in the digital world the inspection team is ably supported by and contributes to policy and regulatory development within ireland and as part of the wider european system. we will continue to enhance and invest in our capability in this area. moreover, recognising the challenges and opportunities that arise from this revolution, we are continuing to enhance our data analytical capabilities, including through investment in our systems, our data collection and a restructuring of our organisation of prudential regulation to best utilise our resources. conclusion this is a very broad topic, in which i have only really scratched the surface. i have touched on the opportunities and risks, and recognised that for the financial services system to continue to serve the needs of the economy and its customers it must continue to evolve. to evolve it must leverage the advances of the fourth industrial revolution, while at the same time acknowledging and addressing the inherent risks. i expect boards and senior management of financial services firms to prioritise the issue of digital transformation and allocate the resources necessary to meet their customers ’ needs. firms need to demonstrate their understanding of the role technology plays in value chains. while looking at the opportunities for the future, many firms also need to continue to invest to get the basics right. significant improvements are required across the system to manage the incumbent and growing technology risks within it. a change in mindset is needed to see data as a valuable asset and to invest in protecting that asset. firms also need to be prepared for when