Competition Update: Small Banks Try Renting CTOs

thePoint
November 8, 2004

Two years ago, when Effingham State Bank executives considered hiring a chief technology officer, they had some worries.

Core processing had already been outsourced, so the new CTO would not get to run a complete data center. The $370-million-asset bank was just looking for someone with expertise installing a wide area network and, later, a telephone system. And Effingham, Illinois, about halfway between Indianapolis and St. Louis, is at least a 90-minute drive from any major city.

"If we hired someone full-time, they would be pretty bored," says Rex Entsminger, the bank's senior vice president of corporate services. "What kind of person could we attract?"

It is a common problem, according to a recent issue of American Banker. Information technology officer, compliance executive, and trust executive are the hardest jobs for community banks to fill, according to a 2004 survey from the American Bankers Association and the ABA Banking Journal. Geography is a factor, but bankers say the pool of qualified experts is pretty small to begin with. After all, a CTO should be proficient not just in technology but in practically every facet of the banking business. One option is outsourcing.

In recent years firms such as Vitex of Charlotte, M One Inc. of Tempe, Arizona, and Brintech of New Smyrna Beach, Florida have begun offering services that essentially amount to a "CTO for hire."

Though their offerings differ, the companies generally include an assessment of a financial institution's technology infrastructure, the development of a strategic plan, and ongoing interaction and advice related to new projects, purchases, or contract negotiations. Effingham State ultimately sprang for that kind of arrangement. It now pays about $1,500 a month to regularly pick the brain of its rented CTO and get an annually updated strategic technology plan. Entsminger guesses the bank would have had to pay a six-figure salary to an in-house CTO. The consulting firms that make CTOs available for hire, in contrast, can generally offer more competitive salaries because they spread one individual's talent out over a handful of bank clients. They recruit seasoned professionals, often with decades of experience, in either banking or project management, and usually try to establish long-term relationships between individual consultants and the banks they serve. After an initial assessment of technology needs, much of an outside CTO's consultations are done by phone or e- mail. In-person visits may occur annually or in the event of a major technology undertaking. One attraction for the CTO-for-hire is the flexibility and variety of working with a number of bank clients. There is, of course, the risk that a consultant will switch jobs or even be reassigned within the firm, but an in-house situation has the same sort of risk.

Deciding on whether to have a head technology officer in-house or to draw from outside resources will often depend on a financial institution's size and structure. "The more technology you have, the more complex you are, the greater the need for an in-house CTO," says Timm Ciampolillo, a senior manager in the business risk services group at the Chicago accounting and consulting firm Grant Thornton. About 50 banks use Vitex's CTOs-for-hire. Its chief executive, Randall A. Roth, said that as a general rule banks with assets of more than $300 million have enough projects going on that they might need to hire an in-house project manager, who could be groomed as chief technology officer. Another consideration is whether technology processing is already outsourced. For a bank that runs its loan and deposit system, Internet banking, and network in-house, "it would be hard to outsource the technology position and have adequate oversight of the technology," Ciampolillo says.

Community Bank of Dearborn, Michigan runs all of its processing in-house, and is big enough (assets of $500 million) to give serious consideration to having a CTO in-house. But "I don't ever see the day when we'll have one of those guys walking around here," says Michael J. Ross, the president and CEO. "I couldn't care less about having the fanciest technology. I'm just trying to run a bank." (Community does not have a website or Internet banking, though it expects to offer both by year-end.)

Despite Ross' skepticism toward technology, his bank decided to take a more formal look at it, and contracted the services of an outside CTO. Previously, Community Bank left tech decisions up to the operations officer, which Ross indicates was the "wrong way" to do it. Now, instead of being "stuck with" technology and struggling to find uses for it, the bank talks about what it needs and then, with the help of the outside CTO, finds the appropriate software and services.

Those institutions that decide to use an outside CTO have to guard against laziness. "The biggest mistake I see CEOs making is that they just wash their hands of technology," says Vitex's Roth.

Top executives need to be briefed on technology at least every quarter and to participate in technology decisions at least once a year. Otherwise their bank could end up getting "all the bells and whistles, but not necessarily technology that focuses on their business objectives," Roth says.

The best way to get the most from an outsourced CTO relationship is to define both sides' expectations and be clear about it. For instance, institutions might want to specify up front how frequently communication will occur and in what manner—phone, e- mail, or in person.

A thorough audit of an institution's technology programs by the outside CTO is equally important.

"If there's no adequate oversight of technology, then it becomes a regulatory problem," states Grant Thornton's Ciampolillo. Regulators are cracking down on institutions' oversight of third-party relationships. They know there's a tendency to presume, wrongly, that an outsourcer or a hired CTO is responsible for certain procedures.

"You can always outsource the technology, but you can't outsource the responsibility for it," adds Robert Engebreth, the director of information technology risk and critical infrastructure protection at the Office of Thrift Supervision.

Some community bank executives will turn to an outside CTO to find out what other institutions are doing.

"We have the advantage of seeing best practices all over the country," comments Marilyn Seymann, M One's president and CEO. "We know what works, what doesn't, and where the risk is the greatest."

Reprinted with permission from The Point for CU Research and Advice at http://thepoint.cuna.org.