CHAPTER 6

Outsourcing and Risk Management

Nina Sodha

Introduction

In an environment where achieving competitive advantage solely through reducing costs or differentiation is not fully sustainable, companies are forced to strive for new business models that give them the strategic flexibility to adapt quickly without compromising their missions.

One such operating model is through outsourcing, which can relinquish certain risks, and hence rewards, to a third party, thereby allowing the company to focus on its core strategy.

Not all risks can be delegated, however; companies therefore need to identify these and investigate how they can be mitigated so that management is not distracted from its overall goals. Failure to do this will result in costly problems and time-consuming resolutions.

Commercial Models

A variety of commercial paradigms have evolved to meet the broad spectrum of business objectives that are on the strategy agenda of companies today, allowing them to gain access to different capabilities. The commercial models vary in terms of the extent of ownership and control that is surrendered, but the business drivers motivating companies to adopt these models are fundamentally the same. Companies are bowing to competitive industry pressures, particularly visible in financial services through maturing market segments, squeezed margins, compressed cost-income ratios, and greater customer intelligence. These factors combined with restricted management bandwidth have encouraged companies to consider a range of alternative operating models, some of which are described in Exhibit 19.1.

The Case for Outsourcing

Each of the above has its own unique benefits combined with trade-offs and, hence, for an informed decision, they should be appraised against an individual company’s own tactical preferences. The outsourcing option, which is the focus of this chapter, gives the following benefits.

Exhibit 6.1 Alternative operating models

In-house	Acquisition	JV	Outsource
Development of process/­capability using own resources	Huge outlay to purchase all assets and staff	Jointly owned assets and equity	Third party undertakes day-to-day management responsibility
Entire ­decision-making process in-house	Requires combining inherited culture and processes	Decisions made jointly (strategic and operational)	Vendor owns assets and equity
High investment and exposure to risk	High investment and risk	Reduced exposure to risk and divided returns	Limited risks and returns

Source: Author’s own.

• Speed. Outsourcing can offer the quickest route by exploiting partnerships with vendors who have built and invested in an existing operation and are therefore prepared to take on incremental services for different clients. If the deal ultimately does not work out, the exit option is smooth and less painful than terminating an in-house operation.
• Access to expertise. Third parties specializing in particular processes will have a demonstrated expertise and accumulated experience in conducting comparable ventures, which can be fruitfully leveraged. This means that the client would not have to bear any risks associated with the learning curve effects.
• Management focus. As it is the noncore activities that are ­principally outsourced, there is less management distraction and, hence, time is freed up for more value-added activities.
• Predictable financials. The outsourcing option can allow the company more certainty regarding costs. Margins and investments are agreed upfront and secured by the contract and the third party would take any additional financial burden that materializes in excess of this. In addition, the vendor can ­benefit from economies of scale and can pass some of the ­benefits onto the clients.

Offshoring

Another dimension to outsourcing arises from conducting cross-border operations within countries such as India and China that have a comparative cost advantage and have emerged as business havens. As companies desire to exploit greater financial benefits, principally from labor arbitrage from moving processes to these countries, the outsourcing model is being implemented in order to tap into cost-effective expertise. Furthermore, the majority of companies migrating processes offshore have realized that the talent pool and skill base offered could exceed that obtained domestically. An offshore operation also gives companies a footprint in new and growing markets that present attractive business opportunities. Moving offshore, however, brings its own set of risks and issues, which need to be addressed.

Exhibit 6.2 Illustration of the outsourcing models: onshore and offshore

Source: Author’s own.

Processes

Initially the trend for outsourcing began in services such as IT development and maintenance with technology companies, both onshore and offshore, taking the responsibility for delivering these services to companies. As confidence in outsourcing and acceptance have increased, the span of activities has extended up the value chain into a range of ­business processes including finance and accounting, claims processing, and HR processing. These can be classified as noncore activities, involving repetitive tasks and minimal training. More recently, this has expanded into more value-added activities such as research (public and client-­specific), which require higher-end skills and build intellectual ­capital and tacit knowledge.

Moving processes to a third party raises the question of whether to improve and rationalize the business processes before the transfer or after. Most companies prefer to, particularly in an offshore context, “lift & drop” first and then engage in process improvement after set-up. The ­vendor, too, can then be involved in re-engineering the processes.

Current Trends

Outsourcing is most prevalent within the financial services industry. In August 2006, Prudential signed a £40m contract to outsource its UK life and pensions support to Capita for three years. It was announced that around 450 staff in Prudential’s customer services and support services operations in Belfast would move across to Capita. Earlier in 2006, Barclays awarded Getronics a five-year Ä200m contract to provide desktop and application support to more than 30,000 users, principally in the UK; this was Getronics’ largest ever financial services win. The aim of the deal was to focus on the transition of current technology and business practices, followed by the installation and integration of new technology in order to improve the efficiency of the workspace management system.

LloydsTSB also announced in August 2006 a five-year deal to outsource its human resources operations to UK-based IT services firm, Xansa. The deal is the first multi-process HR outsourcing contract within the UK financial services industry and Xansa will provide the bank with a range of HR services including administration and recruitment along with helpdesks for training, advice and guidance, and general queries. All these services will be provided from its offshore centers in India.

Exhibit 6.3 Relative importance of support activities outsourcing—EU banks

Source: European Central Bank, 2005.

The large investment banks too have explored and grown their offshoring capabilities, particularly in India, including Citigroup, Morgan Stanley, Lehman Brothers, and JPMorgan Chase. Typically, these banks have moved their research-analysis operations offshore in order to take advantage of the time difference as well as the cheaper labor costs. Given the intellectual capital involved, the majority of these players have opted for a captive model, although vendors in India are rapidly developing the capabilities to offer these services under an outsourced operation.

Risks

Even once the financial and nonfinancial factors for pursuing the outsourcing route have been established, there will still be risks that need to be assessed upfront and then mitigated in order to reach an acceptable level of risk threshold. These are explored in the following texts.

Partner

Failing to choose the right partner is probably the biggest risk and can have detrimental consequences, which could be extremely costly, not just financially. Engaging a partner is not solely about its operational capabilities; cultural issues also need to be considered as there could be conflicts with the external parties’ values and goals. There is a further risk if the partner defaults on payments to its creditors or goes bankrupt, thereby threatening the services it provides.

Financial

As the contract continues over time, and the company is accustomed and reliant on the third party for conducting processes and services, the balance of power begins to shift to the vendor. The company has a choice of succumbing to higher costs imposed by the third party or putting the contract out to tender again, which can be a prolonged and tedious process. In many cases, companies will opt for the former option and accept higher charges for a guaranteed and familiar service. There is also an opportunity cost for the company. Had the capabilities been developed in-house, there would have been a platform from which to generate future revenues. Other costs that need to be considered include resources devoted to vendor management, contract negotiation and costs associated with downsizing the workforce. Tax implications also need to be investigated, as the organization may have to pay VAT.

Exhibit 6.4 EU banks’ assessment of risks to outsourcing

Source: European Central Bank, 2005.

A further risk arises in the case of offshoring where the implications of local economic stability and inflation levels can impact the financial drivers of the deal. In India, for example, wage inflation levels are rising at approximately 10 percent due to the competitive nature of the industry. Therefore, in order to combat attrition levels, vendors are forced to offer attractive financial packages in order to retain staff. These costs will eventually be indirectly passed on to the company. In addition, payments are exposed to exchange rate risk that can impact the gains, especially in countries where the rate is susceptible to marked fluctuations.

Strategic

A company’s decision to outsource involves careful consideration of the potential consequences on its strategy. The vendor may not appreciate the detailed knowledge of the business which could have effects on customer satisfaction, particularly in call center activity and a company’s previous ability to be close to its customers will be compromised and removed as it hands over the customer service to its vendor. In addition, the outsourcing company undertakes the majority of the day-to-day management responsibility, which will restrict the client’s ability to influence and change the operations.

As companies begin to outsource higher value-added activities, there is a further risk of loss of intellectual capital and knowledge that is pertinent to retaining competitive advantage. The company also needs to recognize that losing the capability and know-how of performing the function in-house will have effects in the longer term should the company wish to reverse its original outsourcing decision.

Reputation

Positive corporate reputations are built through effective management, sound business ethos, and a clear communication of the values by which a company operates. Given the strong correlation between shareholder value and reputation, it is important for companies to be aware of the implications of external interest on the perceptions of the company’s activities. An outsourcing strategy communicated purely as one based on cost reduction will result in customers expecting to see an immediate translation into lower prices. In addition, customers will be very keen to ensure that service is not affected. Any criticisms arising from not meeting customer expectations can affect the company almost instantly and any loss in company value could easily eradicate the financial savings.

Regulatory

Financial service companies will have to comply with industry regulators. The regulator needs to be satisfied that measures are in place to approach the operational risks attached to outsourcing and that those risks are being properly managed as the deal continues.

In an offshoring situation, regulators will need to gain even more comfort on aspects such as governance, through lack of physical ­proximity and business continuity procedures. As companies cannot contract out of their regulatory obligations, the compliance responsibility will remain with the UK entity and the firms must demonstrate to the UK regulator that they have as much control over the activities as they did when they were onshore. Clients can seek contractual rights against the vendors to ensure they maintain the compliance of the function. It may be necessary, however, to set up a compliance function in the offshore centers as most suppliers will not have the experience or resources to run a similar ­function offshore. In instances where the regulator sees a higher risk, it can request banks to increase the amount of capital allocated to these business functions.

Data Protection

For some processes such as call center activity, the service provider would need access to personal and confidential data of the customer and this involves significant data protection issues. Although the supplier would sign confidentiality agreements and could ultimately be sued, there is still a chance that this trust could be broken.

The EU Directive provides several rules that companies have to comply with while collecting and using personal information. For offshoring, the EU and UK data protection laws prohibit the export of personal data to countries outside the European Economic Area that do not have adequate data protection. Consent is required from the individual customers to allow their data to be exported, but this can be difficult to exercise, therefore alternative approaches need to be examined.

Intellectual Property

As the breadth of the services outsourced increases, and hence the possibility that higher value-added activities move to a third party, intellectual property considerations are an important part of outsourcing arrangements. Intellectual property can take the form of copyright in processes, documentation and software, know-how and patents.

The client will wish to retain ownership and control over any intellectual property (IP) generated in the service center. The service provider, however, will want to retain rights to re-use and develop that intellectual property to provide services to other customers. A compromise has to be agreed between the parties, which allows both the freedom of use and exploitation they require.

Consideration also needs to be given to the treatment of IP in other countries where the levels of protection detailed in local laws and the appropriate enforcement system in place will be different.

TUPE (Transfer of Undertakings)

Within the EU, the regulation surrounding TUPE exists to protect employees and imposes certain responsibilities on the existing and new employers in an outsourcing deal. It ensures that all employees transferred under TUPE retain the same terms and conditions to which they were entitled with their former employer. If the TUPE regulations do apply to the transfer, the effect will be automatically to transfer the existing contract of employment and all employer liabilities under that contract from the customer to the outsourcing supplier at the time of the transfer. The customer and the supplier will, therefore, need to take advice on whether TUPE does apply and they may need to negotiate appropriate contractual risk transfer mechanisms to apportion the liabilities fairly in the same way that they would for an onshore outsourcing transaction.

Employment law

In the instances of offshoring, countries may have different employment laws, which will require attention. Although the vendor bears the risk and responsibility, the laws still need to be noted. These could be on the number of hours worked, level of trade union activity, statutory redundancy payments, and the profile of the worker.

Country-specific

If processes are moved across borders, social and geopolitical risks can deter external investment because of the threat of instability in the ­business environment and subsequent disruption to operations.

Reducing the Risks

Governance

Commitment at the outset from senior management demonstrates responsibility, buy-in, and accountability, which are necessary to keep up the momentum of the outsourcing decision. Issues such as job losses will result in social and political repercussions and resistance to change, which require tight management and conflict resolution.

Planning for any outsourcing arrangement is a business necessity and a key element to de-risking the transaction. Investment in time to allow for detailed documentation, identification of procedures, and desired requirements will reap rewards when preparing for deal negotiation and implementation. A core team with representatives from finance, IT, legal, HR, risk, and the business area should be formed to ensure effective delivery of the project and that the business model is on the correct path to success. The team should also continuously evaluate the performance of the activities and benefits against expected gains. If independent advice is required, some companies use external strategy advisory firms that specialize in formulating the outsourcing strategy and implementing it.

Partner Selection

Partners can range from global firms (e.g., Accenture, Capgemini), to process specialist providers (e.g., IBM for IT, Hewitt for HR), to those that specialize in offshore services (e.g., TCS in India). The right choice of partner is a fundamental decision that can impact on the ultimate success of the operations. Some companies conduct a pilot in order to assess the concept of outsourcing and test the partner’s capabilities. Wherever the location of the third party, ideally the relationship with the outsourcing provider should resemble a partnership whereby both parties investigate efficiencies and re-engineering of processes together.

Companies are advised to conduct the partner selection process aggressively in order to bring to the forefront any issues that need to be resolved. The following framework can be considered as part of the ­selection process.

Exhibit 6.5 Framework for partner selection

Source: Author’s own.

1. RFI (Request for Information)—the information and supporting documentation received from prospective vendors should be evaluated against detailed criteria that have been structured in line with the individual company’s specific requirements. The information required should include the following.
   • Financials. Details of revenues, profitability, and ­funding sources can provide good indications of the ­reliability of the partner and the long-term sustainability of its ­operations.
   • Relevant experience. The credibility within the market for its capabilities can be demonstrated by market share, ­quality of client profiles and experience across industries (e.g., banking, medical), geography, and service lines (e.g., call center, back-office processing). Most companies would state that gaining reassurance on these factors is more important than the cost.
   • Quality management. The types of quality management ­systems and certifications in place display the partners’ stance toward continuous improvements. These practices can also indicate how the partner will deal with potential ­downsides in operations performance and the extent of ­support for quality change in the future.
   • People management. The quality of training and recruitment indicates the skills levels of the personnel employed and also the dedication to deliver the best possible customer service.
   • BCP. Ensuring that procedures are in place demonstrates commitment to alleviating ongoing risks.
2. Site visits—the RFI process narrows down the initial partner selection process to only those that possess the required experience and financial stability. The key strengths and weaknesses identified would provide further areas to explore during visits and to refine any concerns. Some areas to consider include the following.
   • Supplier’s capabilities. A tour of the site can reveal how efficiently and effectively the supplier conducts its operations and its ability to scale up if needed. Detailed presentations by each of the business units and corporate functions can give further valuable insights. The approach toward security can also be explored by investigation practices such as document control, separation of different clients’ data, and building/computer access restrictions.
   • Cultural fit. Discussions with management will help lay the initial foundations to building trust, which will be crucial as part of the relationship-building process. In addition, alignment of strategic objectives will be important for the future survival of the partnership as this ensures that both parties are working toward the same goals.
3. RFP (Request for Proposal)—the effort that a partner puts into developing the RFP is itself a demonstration of its commitment to the deal. The proposal should cover the approach to the ­migration, ­projected timescales, and possible constraints in meeting the ­operating solution. Information on pricing structures for different commercial models should be requested so that fees can be compared easily across different partners.
4. Due diligence—the ultimate aim within this phase is to assess crucially and validate the partner’s capabilities in delivering value and determine its willingness to perform. In addition, the process allows the identification and quantification of risks that could materially impact the decision to proceed with a particular partner and hence prevent the contract from being signed. Keeping more than one partner at this stage introduces healthy competition. The areas that need to be considered in detail are the following.
   • Senior management capabilities. An evaluation of the senior management team can be made through an assessment of CVs, employment contracts, and by conducting interviews to identify the relevant experience, roles, and responsibilities. This gives an understanding of the directors’ potential capabilities in managing the new venture and highlights any conflicts of interest. It also gives a firmer idea of who the key decision makers are and identifies any future changes in the organizational structure that could impact the deal and decision. In addition, an insight into the culture through observing the management style will give an indication of how smoothly the integration process will run, and whether there is a partnership mentality and commitment ethos instilled within the company.
   • Financial strength. An understanding of the historic and future financial health and stability of the company can be achieved by studying the financial statements and forecasts. This will determine profitability, liquidity, and gearing. The capital structure of the company will also be a useful source of information on key investors and the availability of any financial guarantees. Scenario analysis can be used to identify any sensitivity to different growth and economic assumptions prevalent. An assessment of the company’s reporting process will be key in confirming its ability to provide timely and accurate management information to the client and hence procedures such as authorizations, approvals, ­controls, and system capabilities will be important areas to gain ­reassurance on.
   • Legal and regulatory. It is important to understand the structure and ownership of the company to ascertain the voting conditions and, therefore, whether the strategic direction of the company is influenced by any specific people or groups. From a compliance angle, the relevant regulatory bodies’ requirements will need to be met. Failure to do this could result in delays to the set-up of the operations and possibly penalties. Further areas to investigate include any legal matters or issues outstanding that could have an adverse effect on the company and details of the insurance (indemnity and negligence) coverage for any material exposures. For data protection, contract provisions can be used to impose obligations on the offshore service provider similar to the obligations imposed by the Data Protection Act. If the ­service provider is acting only as a “data processor” then, in the UK, for example, the UK Office of the Information Commissioner (OIC) states that the exporting party will remain responsible under the Data Protection Act for that processing.
   • Risk management. The risk procedures need to be reviewed in order to understand the current risks being faced by the company and any mitigating actions in place. The process of internal controls, which prevent fraud and theft, should be considered as well as any opportunities to manipulate information. Business continuity procedures are also crucial in providing contingency arrangements in case of disaster. The loss of customer information and deterioration in customer service could be costly. It is essential to understand how the company would cope in these situations and whether regular tests are carried out of the back-up systems and centers.
   • IT systems. The specific requirements for aspects such as processing, bandwidth, servers, and power capacity all need to be provided by the partner. Any failure to do so may result in the deal stalling as IT is a crucial factor within business operations. The availability of adequate support should be assessed to meet any initial teething problems and ongoing user activity. Data security and confidentiality are important—therefore, any controls in place need to be identified and tested. If third parties are involved, they should be highlighted as their services could require additional time and costs within the set-up process.
   • Relevant experience. In order to gauge the range of experience the partner possesses, management should be able to provide details of the current customer base, together with client references. Ideally, speaking to these clients would help management to understand any issues that were faced and how the vendor handled these. Enquiring about further work with existing or new clients can identify any areas of conflict and also help identify the major income streams from particular customers. A loss of business from a key client could have negative financial and business consequences on the outsourced service provider. To put the business operations into context, it is useful to ascertain the strength of the partner’s offering relative to competitors and where the areas of competitive advantage lie.
   • HR. An understanding of the HR policies regarding recruitment, employee relations, health and safety, exit, redundancy, and disciplinary issues needs to be obtained. The recruitment process should be developed specifically for the client; therefore the chosen criteria used for selection must match the skill sets required. Remuneration systems govern motivation levels and, hence, the system used to pay staff should be examined. In particular, external factors such as wage inflation and the possibility of staff being poached by competitors may influence the process. Staff retention is a key issue—therefore, the partner should have considered suitable incentives to prevent attrition. Ultimately, the training process will govern the outputs and the service provided to customers, and consequently details of the training programme, frequency, and quality control need to be obtained.
   • Operational processes. Information on how the company operates on a day-to-day basis needs to be analyzed in order to understand the efficiency and effectiveness of the operations. Factors such as communication, coordination, and relationship management are all important aspects ­governing how the business operates. Adherence to any internal quality standards, for example, six sigma, demonstrates the priority given to quality. The flexibility of the operations to scaling-up is a crucial area to examine, as any obstacles preventing this will delay any future changes to the project. Management’s commitment to meeting service-level agreements needs to be confirmed as this stipulates contractually the requirements and governs the way the partner performs.

Contract

The contract’s role will be to underpin the ongoing relationship between the relevant parties and to bring to the forefront any potential misunderstandings. The formation of the contract needs to balance the needs of both parties such that the obligations are clearly documented. If constructed effectively, the contract will serve as the basis for a trusting and long-lasting relationship between both companies and result in a win-win scenario. The key clauses should include the following.

• Schedule of services. A clear description of the range of services that will be provided must be documented, together with any service-level agreements outlining the quality levels that should be adhered to. These should be prepared by consulting the relevant members of the company from all appropriate business areas to ensure the key points have been addressed. The service levels targeted should be practically achievable by the vendor and have specified deliverables, the range of performances to be measured (through key performance indicators or KPIs) and methods for measurement. The vendor should provide periodic reports on the performance of the services and the contract will define the content of these reports (e.g., exception reports, trend reports). In instances where the KPIs are not met, the company can seek a discount or in severe cases, suspend payment until services levels resume as normal.
• Price factors. The contract will specify the fees that are payable to the vendor. This could be a lump sum amount or be determined by the activity levels. Penalties or bonuses must also be factored in to meet under- or over performance. Details of future changes and assumptions should be noted; expectations of potential increases or decreases can be compared against inflation rates or competitor pricing levels.
• Flexibility. The agreement should have provisions for increasing the scope of the services and the fees that would be charged. The client needs to be aware and comfortable that the partner is capable of offering and meeting any changes to current operations.
• Dispute resolution process. In the case of disputes, there should be clearly detailed procedures outlining methods of resolution and any necessary intervention from third parties or courts.
• Exit. If the deal is terminated early because the vendor breaches terms in the contract, the client would not normally incur a penalty. In cases of terminations for no specific reason, it is likely that the company would have to compensate the supplier for loss of future earnings. The further complications of this could include reputational damage and transfer of assets and staff. Also, retendering to another supplier will incur time delays and more contractual obligations.

Communication

Communication within the company is important in an outsourcing deal where job redundancies in-house are likely to arise. A well-structured communication set-up can ensure efficient knowledge transfer and also a feedback mechanism to boost morale and improve performance.

Externally, communication is just as important, particularly where media interest is prevalent. Offshoring specifically has received controversial and emotive media comments around issues such as labor relations and fear over quality of service. Any external media communication needs to demonstrate a commitment to understand and meeting stakeholder needs. Commercial realities and the positive business case need to be expressed through accurate facts and figures.

Future Trends

The trend for outsourcing is growing rapidly as companies strive to adopt leaner and fitter operational models. The financial services industry has so far achieved significant cost savings and this has provided sufficient evidence for other players in the market to investigate “right-sourcing.” In addition to the outsourcing decision, the location conundrum has also taken importance on the business agenda. Currently, more than 70 ­percent of the global financial service companies are using offshore operations. This is rapidly increasing and the trend is set to continue. A recent Deloitte report predicted that the financial services industry would move 20 percent of its total cost base (equating to US$400bn) offshore by the end of 2010, from a figure of less than 10 percent in 2006. Two-thirds of these costs will be investment in offshore operations; the remaining third will be cost savings due to the offshoring. Deloitte also predicted two million global jobs in the industry would move offshore by 2010.

As offshoring brings with it additional risks, companies are revaluating their target operating model. Many companies are exploring the captive route through a wholly owned subsidiary so that they retain control of the cost savings and service quality. Recently, hybrid models have been emerged and experimented with, which allow the company to keep control of certain activities and choose to outsource others. The build-­operate-transfer approach (BOT) uses a vendor to set up and establish the business, with the client taking full ownership after a fixed period of time. Assisted build-out (ABO) is similar, but the client uses the third party to help set up its own operations from the outset.

From a process perspective, the scope of activities being outsourced is confidently moving up the value chain as vendor capabilities grow to keep up with demand. Once compliance approvals have been obtained, it is even envisaged that banks will shift some deal-making responsibility onto its foreign employees and they may even be able to conduct due diligence and screening of prospective clients for investment banking business.

As outsourcing becomes more sophisticated in terms of structure and scope, companies need a robust selection process in order to choose the right partner. It is recognized that there is a trade-off between the desired amount of cost savings and the level of associated risk. Although outsourcing may potentially offer lower returns than a full ownership model, the inherent risks should not be ignored. Companies should invest in identifying, assessing, and mitigating these risks in order fruitfully to reap the rewards of outsourcing.