Is outsourcing too risky?

Category Business Continuity Management Briefing BCM - BCM & Risk Management - Outsourcing - Services - General

Not if you plan carefully ...

23 Jan 2008 Before an organisation decides to follow the outsourcing trend, attention must be paid to the many risks involved in this way of doing business, says Anthony Plewes. No matter what the reason is for outsourcing key IT processes, there's always an element of risk. Will the supplier deliver? Was the contract appropriately scoped? Are the business objectives truly being fulfilled? These issues shouldn't be left to chance. Anyone considering the outsourcing route must take deliberate, methodical steps to mitigate the potentially high risks involved. Here are the areas you should be sure are covered thoroughly.

Due diligence

The first step in risk mitigation is to carry out due diligence on the outsourcing service provider. Amongst other information, this will help identify whether the outsourcer has the capacity to carry out the work and whether it will be sufficiently financially stable to service the contract for its entire length. The continued importance of offshore outsourcing means the outsourcers' business continuity planning also needs to be robust to cope with any shaky infrastructure and outages.

Internal audit

Before assessing the outsourcer's capabilities, you need to work out exactly what is being outsourced. If you cannot accurately identify the current state, it's not possible for you and the outsourcer to agree the scope of the contract, costs and service levels involved. Scoping the current state will help prevent the risk of poor performance, future disagreements and the cost and disruption of renegotiating the contract.

"There is no substitute for doing an internal audit on your organisation," says Kit Burden, partner and outsourcing specialist at law firm DLA Piper. "It is vital to accurately define the outsourcing service scope, because the 'your mess for less' approach is a recipe for disaster. The customer needs to spend enough time with its internal people to find out exactly what it is they do." A business impact analysis will also identify exactly what processes are important and will help companies set relevant service level agreements (SLA).

Many disputes between customer and outsourcer are sparked by a disconnect between what the client is expecting and what the outsourcer thinks it should be delivering. For example, a 2007 report from outsourcing analysts TPI found unrealistic expectations on behalf of the customer were a problem in more than half of all outsourcing contracts, forcing many companies to restructure their agreements within as little as 18 months. It is also essential to build flexibility into the contract because it's inevitable that your requirements will change over the lifetime of the relationship.

One way of mitigating the risk of change is to have shorter contract lengths but even then it is essential to have a clear governance structure that sets out a procedure to cope with any changes. The most common change is in volumes of transactions and this can be easily accommodated by having some form of utility pricing that allows them to be scaled up or down.

Ongoing management

Once the contract has been signed, the focus must be shifted to managing the relationship with the supplier. Just because a company is outsourcing a function doesn't mean they can no longer pay attention to the area. "Outsourcing can be very effective in transferring risk, especially in pricing and operational risk, but supplier management is absolutely crucial to make it a success and some companies don't put enough emphasis on it," warns Susan MacLean, a member of law firm Morrison & Foerster's Global Sourcing group.

Poor contract management is a major reason for dissatisfaction with outsourcing, according to the same report from TPI. It found that 61 per cent of outsourcing buyers admitted they placed more emphasis on setting up the outsourcing contract than managing it. "As buyers become more skilled both in fully understanding what outsourcing can deliver and in proactively managing their agreements, we can expect them to realise the benefits of outsourcing more fully," comments Stuart Harris, partner at TPI. "It is also critical for buyers to recognise that the manner in which an outsourcing relationship is managed is as important as forging the relationship at the outset - if not more so." Managing outsourcing suppliers is no simple task. It requires the retention of internal knowledge of the function that has been taken over.

Although the original management team is well suited to this role, there is a big difference between managing an internal team and an external outsourcer, so the transition may take some time. A crucial part of successful supplier management is to make sure that both parties are happy. If the supplier's needs are ignored, the chances are that the contract will not attract the best people and performance will ultimately suffer. Supplier management role is made more complicated by multisourcing - this is where a company deals with a range of outsourcers to handle different functions rather than a single partner who delivers the whole package.

A June 2007 report from outsourcing analysts Equaterra found that multisourcing was an increasingly common choice for companies particularly when combined with some internally delivered shared services. While this approach cuts the risk of being reliant on a single supplier, it does make relationship management much more complex.

Regulation and risk

The continued pressure on companies to abide by multiple national and international regulations is another source of risk to outsourcing engagements. Outsourcing adds a new dimension to regulations and outsourcer and customer will have to agree both who monitors new laws and regulations and who is responsible for the cost of meeting them. One approach is that the responsibility for identifying new regulations in the customers' specific sector will fall to the customer, while operational regulations will be that of the outsourcer. However, whatever contractual agreement exists, the risk ultimately falls upon the customer. "As far as the regulator is concerned it is crystal clear - you can outsource the services but you can't outsource the responsibility," warns Burden. "If your provider causes you to breach the regulations, then you are responsible, you may have a contractual clause to deal with it but that is between you and the outsourcer." Getting compensation may be a very long process, particularly if the customer and outsourcer are in different jurisdictions. "Offshoring adds a layer of risk to the equation, particularly if they are in a country with a different legal or political system," warns Emily Freeman, head of the technology and media risks practice for insurance broker Lockton. "You will need to enforce your contractual rights over there, so need to know where the vendor will be." And of course, any financial penalties will only be as effective as the outsourcer's ability to pay them, which means that the final part of the jigsaw is to have some form of insurance to cover these risks.

While outsourcing does pose new risks, it is important that you don't become too beholden to risk. Many internal departments can also create substantial risk for companies but in many cases they won't be aware of it. The biggest risks to outsourcing are experienced by companies who don't take adequate care in defining their service scope or managing their relationship with the outsourcer. Companies that approach outsourcing methodically will actually be able to decrease their overall risk.