focus1008633

TheRiskIntelligentapproachtooutsourcingandoffshoringRiskIntelligenceseries23Preface4Outsourcingandoffshoringdefined4KeydriversofO/Oinitiatives5WhyRiskIntelligentoutsourcingandoffshoring5Therisksarereal—andundermanaged6TheO/Olifecycle6Majorrisksateachstageofthelifecycle8HowdoyouaddresstherisksateachstageofthelifecycleStage1:Strategicassessment—RightsizingthedealStage2:Businesscasedevelopment—BuildasolidfoundationStage3:Vendorselection—ItnowmeanssomethingdifferentStage4:Contracting—StrikingthedealStage5:Servicetransition,deliveryandpost-transitionmanagement—Afterthedealissigned14Steppingupyourgame14Finalthoughts15Testyourorganization'sRiskIntelligenceforO/Oinitiatives16ContactusContentsTheRiskIntelligentapproachtooutsourcingandoffshoring3PrefaceThispublicationispartofDeloitte'sseriesonRiskIntelligence—ariskmanagementphilosophythatfocusesnotsolelyonriskavoidanceandmitigation,butalsoonrisk-takingasameanstovaluecreation.
Theconceptsandviewpointspresentedherebuilduponandcomplementotherpublicationsintheseriesthatspanroles,industries,andbusinessissues.
ToaccessallthewhitepapersintheRiskIntelligenceseries,visit:www.
deloitte.
com/risk.
OpencommunicationisakeycharacteristicoftheRiskIntelligentEnterpriseTM.
Weencourageyoutosharethiswhitepaperwithyourcolleagues—executives,boardmembers,andkeymanagersatyourcompany.
Theissuesoutlinedhereinwillserveasusefulpointstoconsideranddiscussinthecontinuingefforttoincreaseyourcompany'sRiskIntelligence.
Asusedinthisdocument,DeloittemeansDeloitte&ToucheLLP,asubsidiaryofDeloitteLLP.
Pleaseseewww.
deloitte.
com/us/aboutforadetaileddescriptionofthelegalstructureofDeloitteLLPanditssubsidiaries.
Certainservicesmaynotbeavailabletoattestclientsundertherulesandregulationsofpublicaccounting.
4Inrecentyears,manycompanieshaveincreasedtheiruseofanddependenceonoutsourcingandoffshoring(O/O).
Thesearrangementspresentbothrisksandrewardstotheorganizationsusingthem.
Butoutsourcingandoffshoringneednotbearollofthedice.
TherearestepsyoucantaketominimizetherisksandmaximizetherewardsateverystageoftheO/Olifecycle.
ThesestepswillcarryyoudownthepathtowardRiskIntelligentoutsourcingandoffshoring,andwillhelpreducethechancesthatyou'llexperienceanundesiredoutcome—an"Oh!
No!
"moment—duringyourO/Oinitiative.
O/OdefinedForthepurposesofthispaper,theterm"outsourcing"describescontractingwithanexternalserviceprovidertoperformspecificfunctionsorprocesses,including:Informationtechnologyoutsourcing(ITO)—applicationdevelopment,maintenance,productionsupport,etc.
Businessprocessoutsourcing(BPO)—callcenters,humanresources,accounting,etc.
Outsourcingvendorsperformaback-officeorfront-officefunction,incontrasttothetraditionalvendorroleofsupplyingmaterials.
O/Ovendorsactmoreasbusinesspartnersprovidingservicesonbehalfofyourorganization.
Theyare,ineffect,anextensionofyourcompany,abusinessrelationshipsometimesreferredtoasthe"extendedenterprise.
"Inthispaper,"offshoring"referstorelocatingoneormoreprocessesorfunctionstoadifferent(andusuallylowercost),foreignlocation,including"captive"sharedservicesfacilities.
VariousbusinessmodelsfallunderthedefinitionofO/O;seegraphic,"Offshoring/OutsourcingBusinessModels,"forsomerepresentativeexamples.
Regardlessofthebusinessmodelused,offshoringbenefitsmayincludelowerlabororoperatingcostsandotheradvantages.
Offshoringalsointroducesrisksthatexacerbatethoseofonshoreoutsourcing,includingtheavailabilityofqualifiedtalent;geopoliticalrisks;andrisksarisingfromforeigncultural,language,andinfrastructureissues.
Ifyou'reanexecutiveormanagerinamidsizetolargeorganization,youalmostcertainlyhaveastakeinthesuccessofoneormoreO/Oinitiatives.
Yourrolemayinvolveresponsibilityfordecisions,management,monitoring,governance,oroperationaldependenceontheinitiative.
Whateveryourrole,youcanbenefitbyconsideringaRiskIntelligentapproach.
KeydriversofO/OinitiativesOrganizationsemployO/Otocreateadditionalshareholdervalue,primarilybyseekingto:Reduceoperating,development,sales,orothercostsFocusmoreoncorecompetenciesTapvendors'bestpracticesandinnovationsIncreaseflexibilityandscalabilityofoperationsGainaccesstohumancapitalFuelglobalgrowthbygainingafootholdinagrowingeconomy.
O/Oinitiativesusuallydeliversomecombinationofthesebenefits—butrarelytotheirfullpotentialandoftenwithincreasedrisktotheorganization.
Ifnotmanagedwell,thoserisks,bothinternalandexternaltothecompany,canadverselyaffectthebusinessperformanceoftheentireorganization.
Forexample,aDeloitteConsultingLLPsurveynotedthatasignificantnumberofsurveyedcompaniesexpresseddisappointmentwiththeiroutsourcers'overallabilitytoprovidecontinuousprocessandtechnologyimprovements.
11"WhySettleforLessDeloitteConsulting2008OutsourcingReport.
"DeloitteConsultingLLP,December2007.
TheRiskIntelligentapproachtooutsourcingandoffshoring5WhyRiskIntelligentoutsourcingandoffshoringRiskIntelligence,ourphilosophyandapproachtowardriskmanagement,2consistsofpracticesthat:AccountforthefullspectrumofrisksinbusinessdecisionsandactivitiesCutacross"silos"toprovideanintegrated,organization-wideviewofriskConsiderupsideopportunitiesaswellasdownsidepossibilitiesIdentify,avoid,mitigate,detect,andreportonrisksincomprehensive,cost-effectivewaysProvideacommonlanguageandcontextforriskmanagementAllocateriskmanagementresourcesbasedontheimportanceofthethreatsandopportunities.
2ToaccessallthewhitepapersintheRiskIntelligenceseries,visit:www.
deloitte.
com/risk.
Suchpracticesareparticularlyimportant—andoftenlacking—inO/Oinitiatives.
ThispapershowsonewaytoapproachO/Odecisions,employingRiskIntelligenceateverystageofthesourcinglifecycle.
Therisksarereal—andundermanagedThebasicriskinanybusinessendeavoristhatitwillfailtodelivertheintendedvalue.
Bythatmeasure,manycompaniesfaceseriousO/Orisks.
InaDeloitteConsultingLLPoutsourcingsurvey,330percentofparticipantsstatedtheyweredissatisfiedorverydissatisfiedwiththeiroutsourcingarrangement.
Additionally,39percentoftherespondentshadterminatedanoutsourcingcontract,transferringthecontracttoadifferentvendor.
3"WhySettleforLessDeloitteConsulting2008OutsourcingReport.
"DeloitteConsultingLLP,December2007.
Offshoring/outsourcingbusinessmodelsCaptiveOutsource100%Degreeofownership0%LowerDegreeofriskHigherAssitedcaptiveJointVenture(JV)Build—Operate—Transfer(BOT)Wholly-ownedfacility,builtoracquiredFullcontroloverpeople,assets,systems/processSpecicskillsetmightbesourcedsuchasrecruitment,benets,buildingmaintenance,etc.
Wholly-ownedfacility,builtandmanagedwithassistanceofanexperiencedpartner,usuallyasingleentityAssistancecanbesoughtfor:1.
People(e.
g.
,recruitment,training,benets)2.
Assets(e.
g.
,rent/buy,maintenance,t-out)3.
System/process(e.
g.
,ITinfrastructureprocurement,audit,transitionsupport)Facilitysetupwiththird-partytofacilitatespeedofentryintomarket,reducerisk,andprotectIPRPartnerchosenforlocalmarketknowledgeandspecicsectorexpertiseFacilitymanagedbythird-partypartnerinitiallyandtransitionedovertofullclientownershipatanagreed-uponlaterstageOwnershipofpeopleandassetsrestswiththird-partytobeginwith;controloverspecicproprietarysystems/processescouldresidewithclientrightfromthestartFacilityfullymanagedbythethird-partyprovider6Moreover,severalgrowingtrendshaveincreasedO/Orisks:Companiesnowrelyonthirdpartiesandoffshoreentities,notjustforspecificprojectsandback-officefunctions,butmoreoftenforcorebusinessprocesses.
Increasedcompetitionforglobaltalenthascontributedtoshortagesofqualifiedlocaltalent,whichrequiresacompanytofocusonitshumancapitalstrategytooptimizequalityandcostofservices.
Regulatorydevelopmentshaveincreasedexposuretoliabilityformalfeasanceormisfeasance;insomecases,seniormanagementandtheboardcanbeheldaccountablefornon-complianceassociatedwiththird-partyoperations.
Piracy,securitybreaches,andtheftofinformationcanerodethevalueofbrands,intellectualproperty,andotherintangibleassets,inwhichcompanieshavemoreheavilyinvestedinrecentyears.
Amorevolatilepoliticalenvironmentinsomepopularoffshorelocationsincreasestheriskthatunrest,terrorism,orrelateddevelopmentswillthreatenthevalueofproductsandphysicalassets,aswellascreateaclimateofinstabilityprecludingeffectiveandefficientoperations.
Third-partysuppliersmaymorphintodefactopartnerships,albeitwithouttheanalysis,reporting,andcontrolthattypicallycharacterizetruepartnerships.
Todealwithsuchcomplexanddynamicrisks,companiesmustemployaholisticriskmanagementapproachtoguidesourcingdecisionmakingthroughouttheO/Olifecycle.
TheO/OlifecycleTheO/Olifecycleisasequenceofdecisionsandtasksthatmovetheinitiativeforward.
Eachstageofthelifecyclepresentsrisksthatyoucanaddresswithspecifictools,techniques,andmitigationtactics.
ThestagesoftheO/Olifecycleare:1.
Strategicassessment:Decidingwhy,how,andinwhatformO/Omaysupportyourbusinessstrategy,andwhetherinternalcapabilitiescansupporttheinitiative.
2.
Businesscasedevelopment:Analyzingexpectedcostsavingsandotherfinancialandoperationalbenefitsoftheinitiative.
3.
Vendorselection:Choosingavendoraccordingtocriteriarelatedtothestrategicassessmentandthebusinesscase.
4.
Contracting:Negotiatingacontractthatcapturestheneedsandexpectationsofbothparties,andaddressescomplianceandriskfactorsidentifiedinthepreviousthreestages.
5.
Servicetransition,deliveryandpost-transitionmanagement:Managingthemigration,orinitiation,oftheserviceinthevendororoffshorelocation.
Monitoringtheongoingperformanceandriskoftherelationshipaccordingtothecontractandservicelevelagreements(SLA),aswellasfortheattainmentofstrategicobjectives.
MajorrisksateachstageofthelifecycleAlthoughweassociatespecificriskswithspecificlifecyclestages,—thoserisksandstagesareinterconnected.
Thatiswhyriskmustbeevaluatedearlyinthelifecycleinaninterconnected,RiskIntelligentmanner.
Itisessentialtoidentifyandprioritizerisksatthefirsttwostagesthestrategicassessmentandbusinesscasedevelopment.
Subsequentphasescanthenfocusmoreonriskassessmentandmitigationthanonidentification.
Indeed,mostfailurestomanageO/Orisksstemfrominadequateriskidentificationearlyinthelifecycle.
Ifyou'reanexecutiveormanagerinamidsizetolargeorganization,youalmostcertainlyhaveastakeinthesuccessofoneormoreO/Oinitiatives.
TheRiskIntelligentapproachtooutsourcingandoffshoring7Basedonourexperience,thefollowingareexamplesofsignificantrisks:Strategicassessment:OutsourcingobjectivesnotalignedwithoverallbusinessstrategyBusinesscasedevelopment:Incorrectoutsourcingassumptions,forinstanceregardingprojectedcostsavings,paybackperiod,orinvestmentneededtobuildgovernanceandmanagementcapabilitiesVendorselection:Failuretodevelopvendorselectioncriteriathatcontemplateoutsourcingobjectivesandrisks,andfailuretoexercisethoroughduediligence.
Contracting:Contractprovisionscoveringservicelevels,incentives,contingencies,vendorpersonnel,security,privacy,priceprotection,andterminationaremissingorfaulty.
Servicetransition,deliveryandpost-transitionmanagement:Inadequatetransitionplanningcausessuboptimalknowledgetransferandpoorchangemanagement,and,perhaps,riskoflosingkeypersonnel.
Lackofformalgovernanceoversightpracticesleadtolowservicelevels,costoverruns,andotheroutcomesthaterodevalue.
Itisessentialtoidentifyandprioritizerisksatthefirsttwostages—thestrategicassessmentandbusinesscasedevelopment.
Majorrisksateachstageoftheoutsourcing/offshoringlifecycleThefollowingareexamplesofsignificantrisksassociatedwitheachstageoftheO/Olifecycle.
Thislistisintendedtobearepresentative,notcomprehensive,sample.
Manyotherrisksmayariseinadditiontothesecited.
Stage1:StrategicassessmentOutsourcingobjectivesnotalignedwithoverallbusinessstrategyStage2:BusinesscasedevelopmentIncorrectoutsourcingassumptions,forinstanceregardingprojectedcostsavings,paybackperiod,orinvestmentneededtobuildgovernance,measurement,andvalidationcapabilitiesStage3:VendorselectionFailuretodevelopvendorselectioncriteriathatcontemplateoutsourcingobjectivesandrisks,andfailuretoexercisethoroughduediligence.
Stage4:Contracting—Contractprovisionscoveringservicelevels,incentives,contingencies,vendorpersonnel,security,privacy,priceprotection,andterminationaremissingorfaulty.
ProvisionsformeasuringkeySLAsarenotinplace.
Stage5:Servicetransition,deliveryandpost-transitionmanagementLackofformaltransitionplanning,governanceoversightpracticesleadtolowservicelevels,costoveruns,andotheroutcomesthaterodevalue.
8HowdoyouaddresstherisksateachstageofthelifecycleGetafixontherisksAligningriskmanagementwiththeO/Olifecycleenablesyoutoaccountfortheinteractionsamongthelifecycleactivitiesandtoidentify,assess,prioritize,andmitigateO/Orisksattherightstage.
Companiestendtooverlookanumberofkeyriskmanagementconsiderations,includingtheneedto:Stage1:Accountforstrategicalignmentandinherentriskexposureinthesourcingdecision,andtoassessgapsinresources,processes,capabilities,andcultureneededtosupportexecution.
Stage2:Factorcostsandexpectedefficacyofriskmitigationandongoingmanagementintobusinesscasedevelopment,andtotrackbusinessvaluerealization.
Stage3:Leveragethevendorselectionprocesstomanageoperationandcomplianceriskexposureproactively.
Stage4:Developcontractsthataddressperformance,compliance,andglobaldeliveryrisks.
Stage5:Planadequatelyforthetransitionandmanagechange.
Alignthesourcinggovernanceprogramtotheparties'visions,providevendoroversight,andcontinuouslyimprovetheprocess.
OnthefollowingpagesweexamineeachstageofthelifecycleandtheseRiskIntelligentstepsinmoredetail.
Stage1.
Strategicassessment—RightsizingthedealWhenyouassessyourO/Oinitiativeinlightofstrategicbusinessgoals,youcanevaluatehowtheinitiativewillsupport—orperhapsnotsupport—thosegoals.
Thisassessmentalsopositionsyoutodefinethecapabilitiesyouneedinaserviceprovider,selecttherightprovider,andspecifyrequiredservicelevels.
Toputyourselfinthatposition,youmustfirstlookaheadtothemajordecisionpointsandrisksateachstageofthelifecycle.
Then,youshouldassessyoursourcingmodelchoicesandyourinternalresourcesandcapabilitiestosupportandmonitortheinitiative.
Thisearlypointintheprocessisthemostappropriatetimetoalignyourbusinessobjectiveswiththesourcingrisksandrequiredmitigatingactions.
Intheprocess,besuretoanswertwoessentialquestions:WhatinherentriskswillresultfromoursourcingdecisionTheseriskswillbedrivenbythenatureandscaleoftheservicesbeingoutsourcedoroffshored,andtheymustbemanagedinthesubsequentphases.
Whatistheadequacyofourinternalprocesses,resources,andcapabilitiestosupporttheproposedsourcingstrategyCompaniesthatlackthenecessarycapabilitiesarelikelytofail.
DownsidepossibilitiesIfO/Oobjectivesdonotalignwiththebusinessstrategy,orifrisksarenotproperlyidentifiedandmitigated,theinitiativewillnotsupport—andmayevenundermine—thatstrategy.
Theproblemisfarfromrare.
ADeloitteConsultingLLPsurvey4asked300executiveswhattheywoulddodifferentlywithrespecttotheiroutsourcingarrangements;39percentsaidtheywouldbetterdefineandaligntheirbusinessgoalswiththeoutsourcinginitiative.
Insomeinstances,thismisalignmentcanscuttletheentireoutsourcinginitiative.
Forexample,thesameDeloitteConsultingsurveyfoundthat50percentofcompaniesthatsaidtheyweredissatisfiedorverydissatisfiedwiththeirlargestoutsourcecontractwoundupbringingthefunctionbackinhouse.
UpsideopportunitiesAppropriatestrategicassessmentminimizestheadhocO/Odecisionsthatresultinapatchworkofmismatchedinitiatives.
TheassessmentshowshowrelatedandunrelatedO/Oeffortssupporttheorganizationalstrategyandenablesyoutoaddressanyweaknesses.
Arigorousstrategicassessmentenablesamoreholisticviewofoutsourcingthatadvancestheagendabeyondjustcostsavingsandeliminatesredundantoroverlappinginitiatives.
Inthisway,youmayalsosolvethemostcommonO/Olimitation,whichistorealizecostsavingsandnothingelse.
Youmayalsoavoidpotentialfutureissuesstemmingfrominadequatecapabilitiesandresourcestomanagetheinitiative.
Anotherupsideisoptimalallocationofresourcestosourcingobjectivesandbetterperformanceduringthecontractperiod,whichenablesyoutooutperformcompetitorswhoarealsooutsourcing/offshoring.
4"WhySettleforLessDeloitteConsulting2008OutsourcingReport.
"DeloitteConsultingLLP,December2007.
TheRiskIntelligentapproachtooutsourcingandoffshoring9KeystoRiskIntelligentstrategicassessmentDecidewhatyouwanttoaccomplishatthestrategiclevel,andthendecideifandhowO/Owillhelpyouachieveit.
AnO/Oinitiativecansupportthebusinessstrategyorsimplysolveashort-termproblem.
Thekeyistoalignyourchoiceofvendor,contracttermsandconditions,andinternalprocessesandcapabilitiestosupportyourshort-andlong-termobjectives,whatevertheymaybe.
TocreateanenvironmentthatencouragesaRiskIntelligentstrategicassessment:Integrateyourcompany'sformalsourcingstrategiesandformalbusinessstrategyMatchyourorganization'ssourcingvisionandsourcingcapabilities;investinthedevelopmentofinternalresourcesoracquireexternalexpertisetobuildessentialinternalcapabilitiesSystematicallybuildriskmitigationintodownstreamsourcinglifecycleactivities,includingvendorselection,contracting,servicetransition,andongoingoperations.
Stage2.
Businesscasedevelopment—BuildasolidfoundationAsoundbusinesscasefollowslogicallyfromthestrategicassessment.
Itbeginswithassumptionsrelevanttoyourbusinessgoalsandshouldextendbeyondoperationalcostsavings.
AnO/Oinitiativetypicallyincludesgoalstoincreaseflexibility;toimprovetechnical,operational,andprocessmanagementskills;toreallocateinternalresourcestomorevalue-generatingactivities;tocutproductdevelopmentcyclesandimprovemarketplace"nimbleness";toexpandcapabilities;and,ultimately,toincreasecompetitivenessandaddshareholdervalue.
AspecificbusinesscaseforanO/Oinitiativemustfullyconsiderprojectmanagement,communications,HR,legal,finance,andothercostsdirectlyrelatedtothetransition,whichmanyanalysesfailtodo.
Thebusinesscasemustalsoaccuratelyconsiderongoinggovernanceandmanagementcosts,whichmanycompaniesunderestimate.
DownsidepossibilitiesManycompanies—38percent,accordingtoa2005DeloitteConsultingLLPstudy5—havepaidadditionalorhiddencostsforservicestheyinitiallybelievedwereincludedintheircontracts.
IncorrectassumptionsregardingitemssuchascostsavingsandpaybackperiodhavealsocontributedtosuboptimalO/Odecisions.
Theseproblemsoccurwhencompaniesfailtoaccuratelyidentifyallrelevantcostsofthecurrentoperationortothinkthroughfutureprocessesandgovernancestructures.
Inaddition,mostcompaniesomitacomprehensiveriskanalysisandthusunderestimateriskmitigationcosts.
Thesetrendshavecontinuedsincethe2005study,asdemonstratedbythe2008DeloitteConsultingsurveythatfoundthat63percentofrespondentsdidnotuseabusinesscase/strategyassessmentindevelopingtheiroutsourcinginitiatives.
6UpsideopportunitiesWhenabusinesscaseisbasedonvalidatedassumptions,youcanrationallycompareO/Ooptions,anddecidewhethertooutsourcethefunctionatall.
Youcansavesignificantsumsofmoneybyheadingoffbaddecisionsatthisstage,which,admittedly,canbedifficultifothersinyourorganizationhavemadeacommitmenttooutsourcingoroffshoring.
YetifyoucannotmakethebusinesscaseforanO/Odecision,youareactuallymakingthecaseforanalternative.
Soavoidpotentiallossesandallocateyourresourcestomore-productiveinitiatives.
KeystoRiskIntelligentbusinesscasedevelopmentStartbyassessingyourorganization'sgovernancestructureandtheresourcesrequiredtooverseeandinterfacewithO/Ooperations.
Whileyou'reatit,conductacompleteriskanalysistoidentify,prioritize,andevaluatetherisksandpotentialmitigationresponses—andcalculatethecostsofriskmeasurementandmitigation.
Thekeytoarobustbusinesscasedevelopmentisaformalmethodofidentifyingthebenefitsandtotalcostofoutsourcing,andusingadequateduediligencetovalidateassumptions.
It'salsousefultocategorizeexpendituresintoone-timeandongoingcosts.
5"CallingaChangeintheOutsourcingMarket:TheRealitiesfortheWorld'sLargestOrganizations.
"DeloitteConsultingLLP,April2005.
6"WhySettleforLessDeloitteConsulting2008OutsourcingReport.
"DeloitteConsultingLLP,December2007.
10ARiskIntelligentbusinesscasewouldalso:ReviewsuccessesandfailuresofyourpreviousO/Odecisions,andthoseofcompetitorsValidatefinancial,operational,andotherassumptions,forexample,regardingsavingsachievedbypeersProjectone-timeandongoingcostsaccurately,includingthecostofriskmeasurementandmitigation.
Stage3.
Vendorselection—ItnowmeanssomethingdifferentIt'snaturaltoblamethevendorwhenthingsgowrong.
However,manyproblemscanoriginateinyourownorganization,especiallyincaseswhereyourcompanyhasnotclearlyarticulateditsobjectivesandexpectations—andhasfailedtovalidatethesame.
Ifyoudon'taddressthesefoundationalissues,theprobabilityofabadoutcomerisessubstantially.
Vendorselectionis,ofcourse,amilestonestageoftheprocessthathelpsmakeallyourplansandprojectionsreal.
Butastemptingasitmaybetofast-tracktheselection,theurgeshouldberesisted.
First,makesureyouhaveattendedtostagesone—strategicassessment—andtwo—businesscasedevelopment.
Then,becertaintocarefullyworkthroughtheselectionprocess,withnoshortcuts.
Significantproblemscanarisewhencompaniesgivevendorselectionshortshrift.
Thisusuallystemsfrompredeterminingthevendorattheoutsetorchoosingonlyonthebasisofcostsorrelationships.
It'salsotheresultofrequestsforproposals(RFPs)thatomitrequirementsandexpectationsfromthestrategicanalysisandthebusinesscase—acommonoccurrence.
Diligentvendorselectioncanrepresentthedifferencebetweendisaster,failure,success,andphenomenalsuccess.
DownsidepossibilitiesInadequateduediligencecanleadtosuboptimal—andrisky—O/Orelationships,ascanmismatchesbetweenoutsourcingobjectives,significantrisks,andvendorselectioncriteria.
Indeed,44percentofcompaniesintheDeloitteConsultingLLPstudy7foundthattheirvendorsultimatelydidnothavecapabilitiesrequiredtodeliverexpectedqualitylevelsandcostsavings.
Ofcourse,7"CallingaChangeintheOutsourcingMarket:TheRealitiesfortheWorld'sLargestOrganizations.
"DeloitteConsultingLLP,April2005.
selectionofthewrongvendoroftencreatestheneedtorepeatthewholeprocessinordertoselecttherightone.
The2008DeloitteConsultingsurvey8foundthat35percentofrespondentssaidtheywouldspendmoretimeontheserviceproviderselectionprocessiftheycouldgobacktothebeginningoftheirinitiative.
UpsideopportunitiesIfyouexerciseduediligenceregardingvendors'capacity,capabilities,andresources,youmaximizethechancesthattheinitiativewilldeliveronallexpectations,smoothlyandconsistently,foryearstocome.
KeystoRiskIntelligentvendorselectionRememberthatonceyouenterintoanoutsourcingarrangement,yourvendor'srisksessentiallybecomeyourown.
Evenifyoulegallytransferrisktothevendor,accountabilityremainswithyou.
Thus,yourduediligenceprocessshould,totheextentpossible,assessvendors'riskmanagementcapabilitiesaswellasoperating,management,andreportingcapabilities.
Thisassessmentincludesthevendor'soperationalreadinesstobegindeliveringservicesanditsabilitytocomplywithcontracttermsandregulatoryrequirementsinallrelevantindustriesandjurisdictions.
8"WhySettleforLessDeloitteConsulting2008OutsourcingReport.
"DeloitteConsultingLLP,December2007.
Vendorselectionis,ofcourse,amilestonestageoftheprocessthathelpsmakeallyourplansandprojectionsreal.
TheRiskIntelligentapproachtooutsourcingandoffshoring11Asoundselectionprocesswouldalsogenerallyinclude:Deliberationattheentitylevelofyourorganizationratherthananadhoc,"silo-style"selectionbybusinessunitsRFPswithclearlydefinedperformancerequirementsandtechniquesforsecurity,recovery,audit,andcontrolValidationofinitialassumptions,reviewofoperatingandqualityassurancecapabilities,andsensitivityanalysisofproposedpricingAssessmentofvendors'businesscontinuityplans,giventheproliferatingsourcesofrisktooperations(See"RiskIntelligenceintheAgeofGlobalUncertainty"atwww.
deloitte.
com/risk)Exitandswitchingstrategies.
Yourinternalauditorscanplayacriticalroleinassessingtheserviceprovider'sinternalcontrolsduringduediligenceandthroughouttheoutsourcingagreement.
Ofcourse,internalaudit'saccessmaybelimitedinapre-contractsituation,assomecompanieswillbereluctanttohandoverthe"keys"priortoaformalengagement.
Nonetheless,youshouldattempttoobtainsufficientaccesstoinformationtoattainreassuranceregardingtheserviceprovider'ssystemofinternalcontrol.
Itemstobeassessedinclude:Serviceprovider'scontrolenvironmentandgovernancestructure––Doesthevendorhaveacodeofconductandexpectationssimilartoyourcompany'sIsitadheredto––Arethevendor'sstructure,competencies,andexperienceadequatetoprovidetherequiredservices––DoesthevendorconductperiodicriskassessmentsthatconsiderfactorsaffectingservicesprovidedtotheclientServiceprovider'ssecurity,privacy,andbusinesscontinuitypractices––Isacomprehensiveinformationsecuritycontrolarchitectureinplacebasedontheclient'scontrolrequirementsandvendor'sriskassessment––HowarethesecuritypoliciesandguidelinescommunicatedHowistheoperatingeffectivenessofthecontrolsvalidatedServiceprovider'soperationaldeliveryprocesses––AreservicedeliveryprocessesthoroughlydocumentedArerolesandresponsibilitiesbetweenthecompanyandthevendorclearlydefined––Areadequatecontrolsinplacetocoverservicelevelagreementreportingandbilling––Arechangemanagement,incidentmanagement,andissueescalationandresolutionprocessesformalizedServiceprovider'shumanresourcespractices––Arehiring,compensation,training,andterminationpracticesadequatelycontrolledandcompliantwithlocallawsAretheyphilosophicallyalignedwithyourowncompany'spracticesYourownVendorRiskManagement(VRM)program––DoyouhaveaformalizedVRMprogram––Doestheprogramconsiderrelevantrisksunderaglobaldeliverymodel––AreserviceproviderrisksperiodicallymonitoredbasedonriskrankingStage4.
Contracting—StrikingthedealAfterthekeydealpointshavebeennaileddownandrisksidentified,contractingshouldbearelativelyeasyexercise.
That'sthepayofffortheeffortandduediligenceexpendedinthefirstthreestagesoftheprocess.
Duringthoseearlystages,adraftcontractwilloftenhavebeenprepared(atleastinoutlineform),settingthestageforamutuallyadvantageousrelationship.
Thecontractingstageisnotthetimetofixapoorstrategicassessmentoraquestionablevendorselection;unfortunately,itisafairlycommonmistakeforcompaniestotrytodoso.
DownsidepossibilitiesMissingorinadequateprovisionsregarding(amongotherthings)servicelevels,incentives,transitionmanagement,vendorpersonnel,security,privacy,contingencyplans,priceprotection,"auditclause,"andterminationcanleaveyouwithlittleleveragedowntheroad.
However,contractscanalsobesorigidthatitbecomesdifficulttoamendthemevenifconditionswarrantachange.
Good-faithnegotiationandamutuallyrewardingcontractcandecreasetheserisks.
Forty-ninepercentofrespondents12inthe2008DeloitteConsultingsurvey9wishedthattheyhaddonemoretodefinerealisticservicelevelsthatalignedwiththeirbusinessgoalsandobjectives.
UpsidepossibilitiesClearlydefinedcontracts,alongwithservicelevelagreementsorbalancedscorecardprovisions,enablebothpartiestoclearlysetexpectationsandallowforunderstoodmonitoringofoneanother'sperformanceunderthecontract.
Thissetsthestagefortransparencyandcooperationratherthansecrecyandcorner-cutting.
Clear,faircontractsarealsoessentialtoausefulcontractriskandcompliance(CRC)programthroughouttheongoingrelationship.
KeystoRiskIntelligentcontractingIdeally,thepartiesshouldviewcontractingasthecementthatbindsamutuallyrewarding,ongoingrelationship.
ThepartiesshoulddevelopcontractswithaviewtowardtheformalCRCprogramunderwhichthecontractwillbeadministered.
(IfyourcompanydoesnothaveaformalCRCprogram,nowisthetimetostartdevelopingone.
)RiskIntelligentcontractingreallydependsonthequalityoftheprovisionsandmetricsinthecontractandthemeansofmonitoringperformanceunderthem,andthatdependsongettingthepreviousthreestagesright.
Thatsaid,thereshouldbeclearlydefinedsecurityandcontrolrequirementsbasedonthenatureandconfigurationofthesourcingrelationshipaswellasexistingstandards,policies,andprocedures.
Companiesthattrytoinsertcontrolrequirementslateinthecontractstage,orworse,afterthecontractissigned,oftenfindthisdifficultandcostly.
Inaddition,RiskIntelligentcontractingcallsfor:PerformancecriteriaandSLAmetricslinkedtobusinessvalueMechanismstomanagevariationsinvolumeaswellascostincreases,decreases,ceilings,andfloorsDefinedpaymentterms,currency,andexchangeratesChecklistsoflegal,regulatory,contract,andinsurancerequirementsandclearlystatedimplicationsofnon-compliance9Ibid.
RighttovalidatetheperformanceofthevendorinrelationtothecontractprovisionsContractterminationandtransitionrightsintheeventeitherpartywishestoendtherelationship.
ElementsofaCRCprogramAneffectivecontractriskandcomplianceprogramconsistsoflinks,processes,structures,andinteractionswithexternalpartnerstorealizevalueandmanagerisksinbusinessrelationships.
It'saformalprogramofsettingobjectivesandmeasuresofsuccess,monitoringperformanceandrisks,andestablishingownershipandaccountabilityforpersonnelforbothparties.
CoreactivitiesinaneffectiveCRCprograminclude:Clarifyingbusinessobjectives,risks,controls,andbenefitsforeachbusinesspartnerCreatingacommonunderstandingofcomplianceandnoncompliancewithcontractsValidatingtheaccuracyofinformationreportedbybusinesspartnersPerformingriskassessmentsandcontrolreviewsofbusinesspartners.
Specificrequirementsandactivitieswill,ofcourse,varybyindustry,butthebasicintentandfunctionofaCRCprogramremainstherealizationofvalueandmanagementofrisk.
See"MoreThanaMatterofTrust:ManagingRiskinExtendedBusinessRelationships"atwww.
deloitte.
com/us/crc.
TheRiskIntelligentapproachtooutsourcingandoffshoring13Stage5.
Servicetransition,deliveryandpost-transitionmanagement—AfterthedealissignedServicetransitionThisisacriticaljunctureoftheO/Olifecycle,andsuccessdependsonhowwellyou'vedoneeverythinguptothispoint.
Iftheeffortismisalignedwithyourstrategyandrestsonafaultybusinesscase,orifyouselectedthewrongvendoranddrewupaninadequateorinappropriatecontract,agoodoutcomemaybejeopardized.
Yetevenifyouhavedoneeverythingrightuptonow,youstillhaveworktodo.
DownsidepossibilitiesLackofformaltransitionplanningunderminesknowledgetransfer,changemanagement,andproblemresolution—andretentionofkeypersonnel.
DeloitteConsultingLLP'sstudy10foundthat20percentofparticipantssawunexpectedlyhighvendoremployeeturnover,andconcomitanterosionoftheknowledgebase.
Worseyet,poorservicetransitioncanseriouslydamageyourrelationshipswithcustomers,employees,andotherstakeholders.
UpsideopportunityProperplanningandmanagementwillcontroltransitioncosts(andrisks),setthestageforaproductiverelationship,andmaintaintheknowledgebase.
Thisstageenablesyoutoupdateandstreamlineoperationsor,ifappropriate,"liftandshift"anexistingprocessorsystemtoathirdpartyoroffshorelocationinacost-effectivemanner.
KeystoRiskIntelligentservicetransitionThekeyactivitiesinthisstagearetransitionplanning,knowledgetransfer,training,andkeypersonnelretention.
Althoughyoumayanticipateeitherahoneymoonperiodorashakedowncruise,it'susefultoevaluateoutcomesduringthisphaseagainstpresetcriteria.
Thesecriteriashouldincludevisibilityintothevendor'soperationsandgovernanceprogram,qualityofthevendor'splanning,adherencetodeadlinesandqualitytargets,andlevelofcommunicationaboutproblems.
TheSLAcanpotentiallybefinetunedhereaswell.
Overall,thekeystosuccessfultransitionsareeffectiveknowledgetransferandacceptanceofresponsibilitiesatanindividuallevel;thus,thisrequiresaproactivehumanresourceschange-management10Ibid.
program.
Manycompaniesareill-preparedforthisstage.
TheDeloitteConsultingsurveynotedthat75percentofoutsourcingserviceprovidersstatedthattheirclientswerenotwellpreparedtoinitiatetheiroutsourcingarrangement.
11ARiskIntelligentservicetransitionenablesyouto:Reengineerprocessesandsystemsbeforethetransitionorleveragethetransitionitselftoreengineerthem,accordingtoplanMonitorvendorperformanceandsettherightexpectationsregardingcommunicationsandcompliancethrougharobustCRCprogramEvaluatethetransitionitselffor"thingsgoingright"and"thingsgoingwrong,"particularlyintheareasofknowledgetransferandhumanresourcesRequest—orjointlydevelop—aplantocorrectwhateverneedscorrection.
Deliveryandpost-transitionmanagementHereisthe"happilyeverafter"stageofthelifecycle—youhope.
Theproductivityandbenefitsoftheongoingrelationshipdependonconstantvigilance.
EvenO/Oeffortsthatstartoffsatisfactorilyarepronetoentropy,andonlyactivemanagementoversightcanforestallorreversepotentiallynegativetrends.
Thismeansmonitoringthequalityandtimelinessofservicedeliveryandvalidatingcontinualcompliancewithkeycontractprovisions,particularlythoserelatedtoriskmanagement(e.
g.
,trainingandback-upplans).
DownsidepossibilitiesDecreasingservicelevels,costoverruns,andcompliancedifficultiesmightsignaltheneedtoswitchvendorsorbringthefunctionbackinhouse.
Eithermoverepresentsincreasedcostsanddiversionofmanagementattentionfromothermatters,soit'susuallypreferabletotrytocorrectsuchsituations.
Butifyoumustmovethefunctionelsewhere,doso.
Worstcasescenariosincludeseriousdamagetoyourorganization'sreputation,brands,markets,finances,orlegalstanding.
11Ibid.
14UpsideopportunitiesWhentheyworkwell,O/Oinitiativesdelivernotonlycostsavingsandflexibility,butongoingtwo-waytransfersofknowledgeaswellasincreasinggrowthandprofitabilityforbothparties.
Also,everysuccessfulO/Oeffortprovidesnumerouslessonsforthefutureif,andonlyif,thoselessonsaresharedacrosstheorganizationinusefulways.
(FailedO/Oprojectsalsoprovidelessons,ofcourse,butatsignificantcost.
)KeystoRiskIntelligentpost-transitionmanagementAnongoingmonitoringprogramtovalidatecompliancewithnumerousexpectationsandassumptions(bothhopefullycontainedinthecontractorSLAs)shouldgivebothpartiesgreatertrustineachotherandconfidencethatprocessesareoperatingasexpected.
ItshouldalsoidentifymutuallybeneficialopportunitiestoimproveSLAmetricsandcustomersatisfactionwhenyourenewthecontract.
Thegovernanceprogrammustdetectandreporteventsrelatedtonon-performanceandnon-complianceregardlessofhowlongtherelationshipendures.
Thisoccursmostreliablyinthecontextofagovernancestructurewithcleardefinitionofrolesandresponsibilities;cross-functionalintegrationamongIT,business,compliance,security,privacy,andprocurement;andbalancebetweencentralizedstandardsandlocalrequirementsatoffshorelocations.
ARiskIntelligentpost-dealmanagementprogramwillalso:ValidatecomplianceagainstcontractandSLAprovisionsperiodicallyBebuiltintoaformal,centralizedcompliancemonitoringandenforcementfunctionandcultureEstablishrobustvendorriskmanagement(VRM)programsthatensureeffectiveandefficientongoingvendoroversightAssigninternalauditanongoingroleinpost-dealgovernancemonitoringEstablishandenforcepenaltyprovisionsforSLAnon-compliance.
SteppingupyourgameTakingevenafewofthesestepstowardRiskIntelligentoutsourcingandoffshoringshouldplaceyourO/Oinitiativesaheadofthoseofcompetitors.
Andtakingmorestepsprovidesevengreaterbenefit,becauseeachstepbuildsonthepreviousone.
Alucidstrategicanalysismakesforasoundbusinesscase,whichfostersselectionoftherightvendorandacompletecontract.
Thatcontract—andtheforegoinganalysis—makesforasmoothtransitionandawell-managedrelationshipinthepost-transitionstage.
So,beforeyouturntoyourcurrentorfutureO/Oinitiatives,takethetestonthefollowingpage,thenadvancetowardRiskIntelligentoutsourcingandoffshoring.
FinalthoughtsOutsourcingandoffshoringoffermanypotentialbenefits.
Yetitisworthnotingthattheneedformanagementaccountabilityremainseverpresent,regardlessofanyO/Oinitiative.
Manytaskscanbeoutsourced,butoversightcannot.
Yousimplycan'toutsourceyourresponsibilitiesaway.
It'snaturaltothinkofriskmanagementasjustanothercost,and,yes,itdoescostmoneyandrequireresourcesandmanagementattention.
However,giventhestakes—boththepotentialbenefitsandtheinherentrisks—ofoutsourcingandoffshoringtoday,aRiskIntelligentapproachpresentsthesurestroutetorealizingthemaximumvalueofyourO/Ostrategy.
Evensmallstepstowardthatendcantakeyoufar.
TheRiskIntelligentapproachtooutsourcingandoffshoring15Testyourorganization'sRiskIntelligenceforO/OinitiativesTowhatextentdoesyourcompanyconsideroutsourcingandoffshoringinitiativesinlightofitsstrategicbusinessgoalsDoesitusetheseinitiativesbasicallyforcostcontrolandtosolveshort-termproblemsOristherealargerstrategicpurposeHasyourcompanyanalyzeditsreadinesstooutsourceHasitassessedthegapbetweenexistingcapabilitiesandthoseneededtooptimizethevalueofO/OinitiativesHasyourcompanyaddressedthegapsDoyoudeveloprigorousbusinesscaseswithresearched,verifiableassumptionsAresourcingrisk-analysisresultsincorporatedintoyourvendorselection,duediligence,andcontractingprocessesArevendorsthoroughlyresearchedandvettedOraretheychosenmainlyonthebasisofcostsorexistingrelationshipsAreyourcontractsone-sidedandaimedatextractingmaximumadvantageattheexpenseofvendorsandpartnersOraretheybalancedDotheyconsiderandaddressglobaldeliveryrisksinoffshoringIsthereaseparate,well-groundedtransitionplanforeachinitiativeArethoseplansactuallyusedandreviewedforefficacyDoesyourcompanyweavesourcinggovernanceintotheorganizationanditsrelationshipsOrdoesitviewriskmanagementasaone-offexerciseforeachinitiativeDoesyourcompanyhaveaformalriskmanagementframe-worktoaddressrisksateachphaseofthesourcinglifecycleDoyouestablisheffectiveriskmitigationbasedonriskprioritiesDoesyourcompanyhaveaformalcontractriskcomplianceprogramIsitappliedasdesignedandintendedDoesyourcompanyhaveaformalvendorriskmanagementprogramDoyouallocateriskmanagementresourcesbasedonriskrankings,andmonitorserviceproviderrisksperiodicallybasedonariskrankingDoesyourcompanyprioritizeallO/OrisksaccordingtolikelihoodandseverityDoesitallocateriskmanagementresourcestoO/OrisksaccordinglyDoesyourcompanyconsidervalue-killingvulnerabilitiesinitsassessmentDoesyourcompanyhaveariskassessmentframeworkandarepeatableriskassessmentmodelapplicabletofuturedecisionsanddeploymentsDoesyourcompany,attheentitylevel,trackandreportitsexperiencesinO/OinitiativesandapplythelessonslearnedtofuturedeploymentsDoesyourcompanyrequirevendorstoprovideregularservicelevelmanagementreportsconsistentwithspecifiedservicelevelobjectivesArepenaltiesfornon-compliancewithservicelevelagreementsestablishedandenforced16ContactusTolearnmoreaboutDeloitte'sgovernanceandriskservicesortocontactoneofourgloballeaders,pleasevisit:www.
deloitte.
com/risk.
ThispublicationcontainsgeneralinformationonlyandDeloitteisnot,bymeansofthispublication,renderingaccounting,business,financial,investment,legal,tax,orotherprofessionaladviceorservices.
Thispublicationisnotasubstituteforsuchprofessionaladviceorservices,norshoulditbeusedasabasisforanydecisionoractionthatmayaffectyourbusiness.
Beforemakinganydecisionortakinganyactionthatmayaffectyourbusiness,youshouldconsultaqualifiedprofessionaladvisor.
Deloitteshallnotberesponsibleforanylosssustainedbyanypersonwhoreliesonthispublication.
Copyright2013DeloitteDevelopmentLLC,AllrightsreservedMemberofDeloitteToucheTohmatsuLimited