IT support is often judged by what people see day to day. Tickets get answered, systems stay available and staff can get help when something goes wrong. Much of what determines whether the underlying environment is being managed well happens quietly in the background, through reviews, documentation, tested recovery and clear ownership. In financial services, where firms remain responsible for risks connected to outsourced technology, that side of the service deserves as much attention as the helpdesk.
A professional services firm recently learnt this. It had stayed with the same provider for more than twelve years, never quite unhappy enough to move. An audit later found servers left unpatched for hundreds of days, excessive permissions, a default firewall password and nine months of failed cloud backups. Day-to-day support had looked fine throughout.
Start with a clear understanding of the environment
A provider needs an accurate picture of the systems it has taken responsibility for. That means understanding how the environment is set up, which applications and services the business depends on, who has access and where known risks already exist.
A thorough onboarding review creates that baseline, which should continue to develop as the organisation changes. Without one, support can become too dependent on the issues that happen to reach the helpdesk, while outdated software, unnecessary access or weaknesses in recovery arrangements remain unresolved in the background. The absence of disruption says little about whether those areas are being managed well.
The FCA guidance on outsourcing and operational resilience expects firms in scope of the operational resilience rules to understand the resources and dependencies supporting important business services. That becomes much harder without a documented baseline.
Keep ownership of your own IT information
Technical documentation gives the provider a consistent record of the environment, but it also protects the client’s control over its own systems.
Administrative credentials, configuration details and current records of the technology being managed should remain accessible to the organisation. An external provider may maintain this information as part of its service, but the business should still be able to obtain it when needed.
This matters because oversight depends on having enough information to understand what is being managed on the company’s behalf. The FCA’s operational resilience observations place emphasis on understanding third-party dependencies and managing those relationships actively. If important system information sits almost entirely with a supplier, the business has less ability to review decisions, commission independent advice or assess its own level of risk.
Ownership also matters when circumstances change. A firm may decide to bring part of its technology in-house, seek a second opinion or change provider. Those decisions are much easier when documentation and access have been kept current throughout the relationship. A well-run service leaves the client with a clear record of its own environment, so that knowledge is never dependent on a single supplier.
Test the controls the business relies on
Backups are a useful example of why evidence matters. A successful backup report confirms that a process has run, but recovery depends on whether the information can be restored properly when required.
The ICO’s guidance on data security expects organisations to be able to restore personal data promptly after a physical or technical incident, and recommends regular testing and review of security measures so weaknesses can be found and addressed.
Restore testing gives the business stronger evidence that its recovery arrangements work. Testing needs to happen deliberately, with results recorded and failures acted on. Datek, for example, restores and verifies client backups quarterly and does not treat a completed backup notification as evidence on its own.
The same principle applies to monitoring. Continuous monitoring can identify faults and warning signs before they cause noticeable disruption, but the value comes from what happens after an alert appears. Significant issues should be investigated, recorded and followed through to completion. Problems that require longer-term work should stay visible once the immediate alert has been cleared, not quietly drop off the list.
Keep oversight active as the business changes
An onboarding audit provides a starting point, but the picture it creates will gradually change. People join and leave, access requirements move, new applications are introduced and older systems remain in place longer than originally planned.
Regular reviews help keep that picture current. They provide an opportunity to revisit known risks, check progress against previous work and decide where future attention should be focused. They can also help identify issues that have developed gradually and may not have generated any obvious support problem.
This gives management a clearer basis for overseeing the IT relationship. Management can see which areas have improved, what remains unresolved and where investment or further decisions may be required, based on evidence rather than impression.
Consider what would happen if the relationship ended
A firm may be entirely satisfied with its current arrangement and still benefit from understanding what a change of provider would involve. The exercise is a useful test of how much operational control the business genuinely holds. Long-term agreements are a legitimate commercial choice; the more important test is whether the option to move stays with the client.
Datek works on rolling monthly terms and gives clients ownership of documentation, credentials and system access throughout the relationship.
Questions to put to your current or prospective provider
The sections above set out what good oversight looks like in principle. The following short list gives financial services buyers a practical starting point for testing that against their existing arrangement.
- When was our last full review or audit, and what risks were identified?
- Can we access our current IT documentation and administrative credentials?
- When was our last successful backup restore test?
- What parts of our environment are monitored continuously?
- How are unresolved risks recorded and prioritised?
- How often do we formally review the condition of our IT environment?
- What information would you provide if we needed to demonstrate how a particular system or risk is being managed?
- What would the handover process look like if we moved to another provider?
Look for evidence behind the service
Good IT support should leave a clear trail of what has been checked, what has been found and what has been done about it.
These standards give financial services firms a stronger basis for judging the quality of their IT support than response times alone. They make it easier to understand where risk sits, challenge assumptions and maintain control over technology that supports the wider business.
Datek Solutions supports financial services firms with an approach built around detailed onboarding, client-owned documentation, tested backups, 24/7 monitoring and regular service reviews. If you would like a clearer view of how your current IT environment is being managed, contact Datek Solutions to arrange a review.
