By Tan Shong Ye, Paul Zanker, David Beattie, CIO.com,
From recent surveys done by PricewaterhouseCoopers (PwC) and others, it is clear that Chief Executive Officers' zeal for using outsourcing as a business management tool remains strong globally.
This is reflected by the media, which continually reports of customers entering the outsourcing marketplace and news items about existing contract renewals also abound. It is obvious from the overall picture that the CEOs' keenness for outsourcing is driving (or being driven by) these critical industry trends:
-- The number of service providers and service advisors is increasing rapidly.
-- The number of countries hoping to attract outsourcing business is also rising.
-- The complexity of outsourcing activity undertaken by organizations is increasing.
Taken together, these trends mean that outsourcing decision making is getting more difficult.
Outsourcing on the Rise
These trends get organizations thinking about the benefits outsourcing can deliver and how these benefits can be realized. While manufacturing, logistics and IT outsourcing contracts have been commonplace for years, the range of business functions being outsourced is increasing .
What may have been considered 'core functions' are all being outsourced today. Organizations are also likely to outsource several business functions concurrently. They may also enter multiple contracts with different service providers for one function (multi-sourcing).
Changing Mindsets
This paradigm shift is the result of decision makers becoming more aware that defining business functions as 'core' and 'non-core' is a subjective process that is difficult to carry out meaningfully. Senior managers are now making function-by-function outsourcing decisions based on careful analyses of the business benefits and risks likely to arise from outsourcing particular business functions in various scenarios.
This change in mindset is also being fuelled by the growing realization among CXOs and managers that there are non-monetary paybacks:
-- Improved timeliness (better time-to-market for new products, for instance).
-- Reduced management workload (for example, removal of overlapping elements at the business unit level).
-- Better governance (customer can use contractual mechanisms to enforce the use of business controls).
-- Enhanced business knowledge (customer gains access to up-to-date expertise).
Making an Outsource Decision
One iterative approach could be:
-- Identify potential outsource scenarios (the business function being investigated, service provider, infrastructure arrangements, expected tax regime, etc.).
-- Evaluate the business benefits and risks associated with each scenario.
-- Rank each scenario in terms of its evaluated business benefits and risks.
-- Repeat the cycle, refining scenarios and analyses.
The ultimate iteration should yield two outputs:
-- An outsource scenario that senior management has approved and intends to contract out.
-- An 'audit trail' of the assumptions and critical decisions made by senior management during the selection process.
Assessing Business Risks
Conceptually, the relationship between the various scenarios investigated and their business benefits and risks can be visualized as a 'window pane' diagram (see Figure 1). Here, Outsource Scenario D is the 'winner', as it has 'acceptable' benefits and risks. The others are all 'unacceptable.' In practice, this representation is often misleading. The principal danger lies in attempts to quantify qualitative data, like non-monetary business benefits and some types of business risks (for example, security breaches). It is frequently observed that quantification can shroud common sense, i.e. numbers are sometimes accepted with blind faith by managers, simply because they are unaware of the assumptions behind the data.
A more realistic representation can be found in Figure 2. Here, the 'clouds' for each scenario highlight the inherent imprecision of the data being considered. Scenario D is still the preferred option, but Scenario A is a feasible alternative (business risks are greater than for Scenario D, but benefits may be greater in some circumstances).
Ranking Outsource Scenarios
It is obvious that the identification and quantification of business risk is central to ranking outsource scenarios. This being so, how should managers go about these tasks?
To understand the steps involved, it must be noted that every business risk has to be defined in terms of probability of occurrence and the impact when it occurs, and new risks arise with political, social and technological changes.
Risk Identification
In its Uncertainty and Risk Analysis Guide, PwC suggests risk identification workshops, in which brainstorming sessions are conducted. Considerable business risk literature is also available on the Internet. Other experience indicates that stakeholder analysis can highlight likely groups of risk (value net analysis has proved useful in this area). In its Enterprise-wide Strategic Risk Management Framework, PwC suggests that CXOs keep the following in mind for the complete lifecycle of any outsourcing contract:
-- Political and country risk.
-- Cultural risk.
-- Operational risk, including information security risk, process controls risk and business continuity risk.
-- Contractual and regulatory risk.
-- Other hidden risks.
Setting up a Risk Register
Notwithstanding the sources of business risk or the methods by which they are identified, it is critical that the risks be assembled into a risk register. This should contain the following information:
-- The generic risk category the risk falls into.
-- A description of the specific risk.
-- An assessment of the impact of the risk, using a uniform approach throughout the register (consistent with risk assessments used elsewhere in the enterprise).
-- An assessment of the probability of the risk.
-- A quantification of the risk (by probability and impact).
All of these require considerable effort. This may be a reason for getting help, especially during the initial stages of scenario ranking. Senior managers should carefully consider where 'the need to know' applies both internally and in the wider outsourcing marketplace.
This article was written by Tan Shong Ye (partner and head of Security & Technology), Paul Zanker (advisory associate director) and David Beattie (advisory consultant) of PricewaterhouseCoopers.
Copyright © 2007 IDG. All rights reserved.