Possession of source files can be valuable without providing a working alternative to the supplier who maintains a banking application. The bank may still depend on undocumented rules, supporting tools, deployment knowledge or people who know how an exception is normally resolved. I want a CIO's account of supplier dependence to describe those practical conditions. A contract creates an important set of rights and obligations, but the institution must examine what its own team can actually do with them.
This is not an argument for reproducing every supplier's entire operation inside the bank. Specialisation can be useful, and maintaining duplicate capability has a cost. It is an argument against presenting untested access as though an alternative service already exists. Management needs enough evidence to understand the dependence it is accepting, the options it is buying and the work required before a different arrangement could operate. That is a more useful basis for negotiation than a broad claim of independence.
Ask what the bank could operate tomorrow
I start with a limited operational question. Could our team reproduce a specified part of the workflow using the material and access currently available? The question should be narrow enough to attempt and important enough to reveal a meaningful dependency. A demonstration on a supplier's machine may show that the function works, but it does not necessarily establish that the bank can reproduce it. The environment, supporting components and assumptions should be part of the evidence rather than left outside the account.
Our loan-workflow review exposed nine rules that the internal team could not explain from the delivered files. Until then, discussions had concentrated on whether the bank possessed the source. The reproduction exercise changed the question to whether we understood how the service behaved. Lending specialists were essential because a technically successful run could still implement the wrong business interpretation. The finding did not prove bad faith by the supplier. It showed that our own description of the alternative was more confident than the evidence justified.
Timing matters. If the first practical test occurs shortly before renewal, both parties have less room to price and organise the missing work. The bank may discover that its negotiating position depends on capability it does not yet possess. I would prefer an earlier exercise, with enough time to distinguish a documentation gap from a deeper dependence on tools or expertise. The result may support a change of supplier, a different contract or a conscious decision to retain the present arrangement with clearer conditions.
Legal and commercial specialists still have distinct responsibilities. I would not ask an engineer's successful reproduction to settle questions about usage rights or contractual obligations. Equally, a well-drafted clause should not be treated as evidence that the technical work has been completed. The decision becomes stronger when the separate accounts meet: what the bank is entitled to do, what its people can demonstrate and what operating responsibilities remain. Each can expose a different constraint on the proposed alternative.
Buy evidence of transfer rather than attendance
A transfer programme can become a calendar of workshops whose completion says little about retained capability. I prefer to define practical outputs before the sessions begin. Which rule should the internal team explain? Which process should it reproduce? Which exception should it diagnose, and under what conditions? The answers provide a basis for reviewing progress that is more demanding than a record of attendance. They also help the supplier understand the work expected instead of relying on a vague request to share knowledge.
The bank must supply capable participants and time for them to practise. It cannot expect useful transfer while repeatedly withdrawing its own specialists to deal with unrelated delivery pressure. In our case, engineers worked with lending colleagues to examine the reproduced behaviour, and supplier staff reviewed the results. That collaboration consumed capacity on both sides. I wanted management to see it as work requiring resources rather than as a free consequence of renewing support. Otherwise the programme would have carried an ambition without an execution plan.
We accepted a higher annual support charge, from CNY9.6 million to CNY11.2 million, as part of the revised arrangement. Procurement had initially sought a reduction. The choice was therefore a real trade-off: more spending for a better examined and progressively understood relationship. I would not call that a saving or claim that the additional fee alone removed dependence. The relevant evidence was the work completed under the arrangement and the gaps that remained after the expenditure, not the fact that management had approved a more detailed contract.
Version control also matters to the usefulness of a successful reproduction. A team may demonstrate a rule in one release and later find that an application change has altered a dependency. The record should identify the configuration used and the conditions under which the result remains relevant. This does not require repeating every exercise after every minor change. It does require a reasoned decision about which changes could invalidate the bank's earlier understanding, with responsibility for arranging another test when that becomes necessary.
An incomplete alternative is still worth describing accurately
After eight months, our team had reproduced seven of the nine identified rules. Two continued to require supplier involvement. The honest conclusion was progress with remaining dependence. Reporting that position allowed management to consider whether the next increment of capability justified its cost and how the unresolved rules affected an eventual transition. Announcing independence would have removed the very question the programme was designed to make examinable. An incomplete result can be useful when its limits remain visible.
There is also a difference between reproducing individual rules and operating the complete service. A replacement would need to address the wider environment, support arrangements, operating procedures and approvals appropriate to the actual transition. I would not infer readiness for a whole-service exit from seven successful demonstrations. Those demonstrations improved our knowledge and options, but they were evidence at a particular level. A CIO should resist expanding a bounded technical achievement into a conclusion that the work has not established.
For the board, I would explain the dependence in terms of the service consequences and available choices. Which important activities still require the supplier? What would management do if access changed? What capability is being developed, by when, and at what cost? The answer should distinguish a prepared option from an aspiration and retain the parts that remain uncertain. Directors can then challenge the chosen level of dependence without needing to assume that complete internal reproduction is always the cheapest or most sensible outcome.
I see supplier knowledge as something the bank must manage throughout the relationship. A renewal is a useful decision point, but the application and the people supporting it continue to change afterwards. Periodic practical examination gives the institution a more credible account of its options. Source access remains valuable within that account. It becomes misleading only when possession of files is allowed to stand for an operating capability that no one has yet demonstrated.