Nasdaq-listed outsourcing firm EXL Services seems to have come a long way from the breach of confidentiality fiasco it faced last year. On November 1 last year, American insurance player Travelers Indemnity Company had scrapped its client relationship with the business process outsourcing firm on this issue. The Nasdaq-listed Travelers was contributing about 10 per cent to the overall revenue of EXL as on November 4 last year.
While the immediate effect of this action was a 21 per cent fall in EXL share price, the larger consequences included doubts over the company's ability to protect customers' data.
As a first step towards course correction, EXL fired the three employees responsible for this fiasco. The employees, in a bid to showcase EXL's capability to its prospective client, had shared a process document externally with a third party from their private email account. Rohit Kapoor, Vice-Chairman and CEO, says there was no fraudulent intent and it was poor judgment on the part of the employees.*
On the revenue front, Kapoor says that it would take the company 18 months to cover the losses suffered from Travelers's exit. "We expect the Travelers' ramp down to be completed by the end of the first quarter of 2015. For the calendar year 2014, it will have an impact of $12 million to $20 million on the revenue," Kapoor said to Edward Caso, analyst of Wells Fargo, an equity research firm, during the 2014 second quarter earnings call. As on year-ended 2013, the EXL top line was $478.5 million.
Travelers initially did not want to terminate the contract as it was nearing renewal. Instead, it took advantage of the situation and pushed for a new contract with a new set of conditions. But it was not acceptable to EXL and so Travelers terminated the contract. EXL had to make public the loss of client in compliance with the SEC guidelines.
"So for us that was a very severe blow. In our business, client confidentiality - information security, managing and protecting our customers's data - is the life blood," says Kapoor.
It was the first instance of client loss due to breach of confidentiality for EXL. But EXL is not new to client loss in itself. In 2008, it lost the captive business of insurance major Aviva when it was contributing 20 per cent to the company's top line. This was followed by Dell's exit in 2005. In 2002, it lost the business of insurance company Conseco when it went bankrupt. Conseco was then EXL's biggest client.
According to Sanchit Vir Gogia, chief analyst and co-founder of Greyhound Research, EXL has come out of disastrous situations many times. "For a BPO to lose its client because of confidentiality breach is near-death. But EXL has survived that. After Travelers's exit, it has only added clients," he says.
For Kapoor all that recovery was not an easy job. He first tried to fix the confidentiality breach issue by retrieving all the leaked Travelers-related documents from the company. EXL also got a confirmation in writing that the company with which it was shared has not misused the information. All copies of the shared documents were then destroyed. Kapoor then went on to start an internal review of all EXL's processes even as he had to find new clients to recoup from the revenue loss. "Once a large client moves out it leave a doubt in every client's mind. If you don't care its loss of reputation," says David Panna, Partner at Grant Thornton India.
At EXL, a team of senior leaders was formed. They visited each and every customer to reassure them about information security. Despite this, many clients advanced the audits. They sent full-fledged teams to EXL's offices to review controls, processes, technology and people. Town hall meetings were held by senior leaders and training on dos and don'ts were imparted. Currently access to personal mail accounts have been blocked barring some exceptions where the team might need access to public sites to serve the clients. "The minute anyone sends out (any information) the tool generates a report, and then we have got a team of people who will investigate that report," says Kapoor.
For training and to also define the standard at which the company will operate, EXL partnered with Everest, a research and advisory firm. Everest spent 12 weeks. The firm interacted with EXL's rivals, employees and clients to create the framework. But Kapoor now wants to publicise the framework so that the entire industry could benefit from it.
In the past five years, EXL has grown at a compounded annual growth rate of 25 per cent. This includes about a dozen acquisitions. Without Travelers and without acquisitions, Kapoor still expects EXL to grow at a minimum nine per cent to touch $480 million to $500 million by 2014 end. Kapoor might have weathered confidentiality breach fiasco for once, but he might not be lucky if it happens again.
*The quote of Rohit Kapoor has been changed to reflect the correct version.