How do you manage the risks of outdated or incompatible software escrow deposits?

The route cause of the deposits becoming outdated sits with the lack of ownership of the risks of supplier failure, service deterioration and concentration risk at board level. Only at that level can policies, standards and procedures be effectively deployed to ensure the ramifications of these risks are understood, prevented, discovered and where necessary....corrected.

Following on from above, ensure ownership of the risks of supplier failure, service deterioration and concentration risk sits at board level. Don't leave the day to day management of escrow with your procurement teams. Escrow should sit jointly owned within controls, compliance, audit, IT, BCP, DR and non-financial risk. If left to procurement it will rapidly become outdated and of no use beyond it's legal framework. Personally I would advise that you do not let the supplier pay for the service unless you are 100% sure of their ability to keep the deposits complete and up to date. Regular knowledge transfers and scenario tests on your ability to handle the code are paramount too.

Obviously, keep in contact with your escrow provider. Ensure deposits are updated inline with your upgrade paths. Ensure the depositor informs you of any changes to their build process or 4th party suppliers. The main thing to do is ......check the deposit is complete. Everything you require to rebuild and manage the service should be deposited under the agreement, so check. Ask your escrow provider to perform a scenario test for you. In this process the escrow provider acts as a third party and performs a "mock release" event, essentially pretending the code has landed on their desk and goes through what you'd go through if that supplier failed. The results are enlightening .......worryingly eye-opening.

Having a robust supply chain is of paramount importance to any business. When selecting your Escrow supplier, do your due diligence and consider: - Do they have testimonials / reviews / case studies? - Do they hold accreditations? (ISO, Cyber Essentials etc) - Are they competitive in their pricing? - Do they deliver bespoke solutions or off the shelf? - Are they flexible with contractual terms to meet legal requirements? - Do they have dedicated testers who can validate application compilations and produce in-depth build guides?

Assuming that an Escrow agreement is a one-time task can be extremely detrimental to a business. The simple things like regularly reviewing your portfolio with your Escrow supplier and vendors are the minimum expectations. On a more granular level, you must consider: - What are acceptable recovery point and time objectives if an Escrow is triggered? - What materials are deposits and on what frequency? - Can you access your data? - Is there an exit strategy in place should a vendor be unable to support your business? - Is there a nominated person to manage you Escrow portfolio? - Is there an implemented standard relating to Escrow within your business?

There are a number of reasons why Escrow is implemented and the benefits are there to satisfy a number of parties. As a licensee, Escrow will help to satisfy risk appetites and ensure you can continue operations should a vendor no longer be able to support you. Further to internal policy, Escrow can help to satisfy external governance. Take the FS&I sectors for example; regulations like DORA mandate organisations to ensure continuity and resilience of business and operations in the event of supplier failure and 3rd party ICT service provider insolvency. Finally, vendors may choose to implement Escrow from a proactive standpoint in the event of failure. And, this in turn could act as a USP for them when bidding for new clients.

Remember the benefits of escrow agreements are not solely confined to the end user. Having escrow in place as a provider demonstrates clearly to a customer that your service is resilient, that you have considered the ramifications of your own failure and are able to mitigate the risks of supplier failure, service deterioration and concentration risk. Embracing escrow is a differentiator to your competition, it sets you out as an ethical service provider and your product as resilient.