Readings
- What different kinds of IT outsourcing are there?
- What is business process outsourcing and how is it related to IT?
- If you were the manager of a major outsourced service and heard you were to be audited, what aspects of the outsourcing arrangement would you want to make sure were strong?
- What is the difference between an outsourcing contract and a statement of work? Which should you be interested in as an auditor? Why?
- What are the different reasons a firm may wish to outsource a particular function or process?
Crafting and Executing an Offshore IT Sourcing Strategy: GlobShop’s Experience
Think about these questions as you prepare for next week’s class (Jan’s section) or Webex (Rich’s section).
- If you were auditing GlobShop’s move to offshoring how would you evaluate their decision? Did they do the right thing? Why or why not? What evidence do you see?
- Briefly list the critical challenges that GlobShop faced in executing its offshore strategy? What would you look for if you were auditing the implementation of this outsourcing deal?
- Suppose GlobShop moved its more mission-critical activities offshore. How would your audit of the relationship change?
Magaly Perez says
1.. What different kinds of IT outsourcing are there?
The different kinds of IT outsourcing are as followed:
-Offshoring outsourcing: having an outsourced IT business function done in another country; used to reduce labor expenses, enter new markets and tap talent; ex: India, China
-Nearshoring outsourcing: combines the benefits on offshoring and nearshoring to create a strategy that cuts cost and improves services (lowers cost, greater speed to market and shorter travel times to do business); countries that border your own
-Onshore or Domestic outsourcing: contracting a third party located in the same country to provide IT work, off-site or in-house.
-Cloud Computing: contracting a third party to provide IT functions via internet help-desk
-Managed Services: contracting a third party to provide network management function in regards to integration and security
These types of outsourcing allow businesses to professionally outsource their IT function such as infrastructure, support, software development and maintenance in order to reduce their overhead cost and growth while being able to maintain their business.
Sean Patrick Walsh says
Nice breakdown of the various types of outsourcing. Where would you fit in 3rd party personnel that work in-house on a business’s own site? Would that fall under a “managed service” or would it be an entirely different level of outsourcing?
Magaly Perez says
Thanks Sean. I actually have that addressed in the Onshore or Domestic outsourcing which I summarized as contracting a third party located in the same country to provide IT work, off-site or in-house.
Sean Patrick Walsh says
I apologize. I completely missed that second sentence when I read your post!
Andres Galarza says
Nice post, Magaly.
Since we’re in the U.S., I wondered how prevalent nearshoring actually is. The popular stereotype of IT outsourcing brings to mind offices in South Asia or China, but I have a family member that runs a (seemingly) booming business outsourcing web development services to Latin America (Ecuador specifically).
Below is a VentureBeat article that gives some reasoning for choosing Latin America over more traditional sources of IT outsourcing.
http://venturebeat.com/2016/04/02/7-reasons-to-choose-latin-america-for-your-dev-outsourcing/
…and I’ll plug my cousin’s business while I’m at it: http://www.jobsity.com/
Ahmed A. Alkaysi says
The company I work for outsources the infrastructure and application support. Many times, if there is ever an issue that arises on the mainframe, instead of having us figure it out, we end up hiring the provider for a quick fix. This is also the case when we are designing a program to use on the mainframe. If we aren’t sure about something on the mainframe, a consultant will be hired to provide us an answer. Also, before having a large production release, he lease infrastructure from another company replicating prod for testing purposes. Although this is very expensive, its worth it to make sure the new code going into production isn’t breaking anything.
Sean Patrick Walsh says
5. What are the different reasons a firm may wish to outsource a particular function or process?
Some of the different reasons a firm may wish to outsource are listed below:
– Cost – It may be cheaper to outsource a function like data storage as opposed to building and outfitting and entire site for storage.
– Expertise – The business may not have the experienced personnel employed to complete a function or process, so the business outsources to those who can.
– Focus – A business may outsource functions and processes it feels are not a part of its core competencies, and doesn’t want to waste resources on anything that isn’t a core competency.
– Agility – A business may outsource specific functions or processes because a 3rd party vendor may be able to deploy its services faster than the business can. A 3rd party vendor may be able to respond to expansion needs more quickly as well than the business can.
– Expansion – A business growing rapidly may outsource since a vendor can respond to new and deploy services more quickly for a business.
– Resources – A business with limited resources may outsource to preserve and/or free up resources for more critical functions and processes in-house.
Sean Patrick Walsh says
4. What is the difference between an outsourcing contract and a statement of work? Which should you be interested in as an auditor? Why?
An outsourcing contract, or the Master Service Agreement (MSA), encompasses many different aspects of the service being outsourced to a 3rd party vendor including but not limited to: principles, services, assets, authorities, auditing, indemnity clauses, responsibility limits, party rights, contract expiration, etc. Whereas a statement of work is a part of the MSA and specifies only the service(s) to be provided, and when and how they will be delivered. An auditor should be more interested in the MSA because that assortment of documents entails what an auditor would be verifying if the process or function were carried out in house. The MSA will have the information needed for an auditor to asses requirements for service levels, insurance, roles for personnel and responsibilities, confidentiality, liability, record keeping and audits performed, authority, sub-contractor requirements and stipulations, and statutory/regulatory compliance associated with the industry and service being provided. These are all things the auditor would inquire about if the business itself provided the service in-house, so since the MSA covers the topics for a 3rd party vendor the auditor should focus on that agreement and associated documents.
Andres Galarza says
Sean, I was looking to answer this question as well and agree with what you say. Our “Audit of Outsourcing” reading this week gave some good definitions to the contact and the statement of work. I did some further reading and stumbled upon this article which raises another point I’d add to your response.
https://goo.gl/hdphBd
Mr. Moran’s explanation made me think of the MSA as the tree trunk and the statement of work as a branch on that tree. When it comes time to renegotiate a contract, the “branch” of the statement of work might only need to be looked at, and not the entire MSA “tree”.
I like analogies and hopefully that makes sense.
Richard Flanagan says
Andres,
I like the article, future 5202 students may be seeing it.
Rich
Candace Nelson says
I actually came across the same article. I think it would be good for the future students to have a more current article to guide them. I was surprised to read about Statement on Auditing Standards No. 70 (SAS 70) in the Gartner article, then I realized it was dated 2010.
The new service organization reporting standard, Statement on Standards for Attestation Engagements (SSAE) No. 16, went into effect as of June 15, 2011, at which time it superseded SAS 70 with the professional guidance on performing the service auditor’s examination.
Richard Flanagan says
True enough. Unfortunately some good articles never get rewritten and 90% remains true. That’s why I always like to hear of things that you find.
Sean Patrick Walsh says
Great article, and great analogy. I am hesitant to agree that the only the SOW be looked at when renewing a contract in lieu of the entire MSA. For example, looking back at the data breach at TJX we can see that their WAN was accessed by attackers who were able to easily crack the technology used at the time to secure the WAN known as Wired Equivalency Protection (WEP). WEP at the time was pretty widely used and accepted by many businesses to be a safe method of authorizing access to their networks. Well right around the time of the hack, and definitely afterward, it became widely known how easily WEP could be cracked. In this instance, an audit team on top of their game would definitely want to look over contracts for services to see if that type of security access control was in play with any vendors being used when renewing contracts to ensure the security of the networks their data might be stored in. So, although I like the analogy in how it explains in an easily visualized manner the relationship between an SOW and its associated MSA, I think it would be ill advised to neglect MSA review when renewing any contract because security is such a dynamic environment. What do you think with this example in mind?
Anthony Clayton Fecondo says
I had the same hesitancy as you Sean. I would agree that anytime a contract is renegotiated, all relevant documentation should be reviewed. I think components of an MSA would potentially need to be altered depending on the specific work being contracted, but more importantly, I think its important to review the MSA periodically due to the rapid changes inherent to the field of technology. Reviewing the MSA every time a new SOW is introduced will ensure that the MSA is reevaluated regularly and hopefully keep it from getting dated.
Brou Marie Joelle Alexandra Adje says
Jan’s Section
5) What are the different reasons a firm may wish to outsource a particular function or process?
First of all, the decision to outsource a particular function or process is a strategic one and not deciding to outsource is a tactical choice when you think about it.
Some reasons for outsourcing are:
Reduce and control operating costs
Improve company focus – By outsourcing non-core functions, a firm can focus on growing the company.
Gain access to world-class capabilities – For small businesses seeking investors and partners, showing that the company outsources its financial functions to a professional and insured service provider firm with secure technology will help potential investors realize the small business owner is running the business well.
Sean Patrick Walsh says
The point you make about gaining access to world-class capabilities is great. A small business that uses a well-known brand for a specific service could get residual business from the customer brand-awareness from that world-class vendor. For instance, there is a restaurant I really like where I live and its desserts are made by a well know local bakery, and are delivered daily. By outsourcing that portion of the business’s menu with a name recognized provider assures the consumer of quality of the deliverables.
Andres Galarza says
Sean,
Some good local examples of that happening in Philadelphia are with La Colombe Coffee and Amoroso’s bread rolls.
You can’t walk a block in Center City without seeing the ubiquitous La Colombe Open/Closed signs in restaurants and cafes which build on the appeal of their coffee. Amoroso’s bakery is so synonymous with the cheesesteak that sub shops on the west coast import them from Philadelphia.
Richard Flanagan says
A good example of this is software as a service for small companies. Why would a 100 person company want to run a data center and its own servers and applications with 1 or 2 IT people? They think they are in control and safer but really they are most likely vulnerable because being world class needs many skills that two people are not likely to have. Think about their security, is their data safer under their own roof but in a poorly executed data center or at AWS? I would always go with AWS.
Ahmed A. Alkaysi says
I would like to add ‘flexibility’ to one of the reasons that a company might outsource. By outsourcing, the company can assign them to projects by prioritization. The company can choose to assign contractors with the skills to high priority projects. Or, they could also choose to have them work on tasks that no one wants to do, allowing other employees to work on different projects.
Richard Flanagan says
Ahmed,
Very good. We had 400 IT employees in my company but kept about 100 contractors/outsourced functions around. We did this because we didn’t want to be firing employees in a long downturn. It allowed us to cancel contracts and shift our employees to other work when times were tough.
Said Ouedraogo says
Alex,
You are absolutely right. In fact, outsourcing is a strategic decision in order to gain competitive advantages, By outsourcing, an organization focus on its core business and decreases costs. In that way, they can improve what they do the best and benefit from the expertise of the vendor.
Richard Flanagan says
Said,
Resist the temptation to think that outsourcing is always cheaper, often it isn’t. It still makes sense for many of the reasons people are posting but you often end up paying for it.
Deepali Kochhar says
I would like to add another example to this. Almost every company outsource their communication network to a 3rd party. This helps them to manage the hardware and the maintenance cost of communication equipment such as wireless equipment, calling phones and so on. Also this helps them to have a high quality of services from specialized vendors. No company would want to set up their personnel infrastructure for such services and increase their cost.
Another example is backup services are outsourced. This gives them one of the biggest plus point apart from cost and that is they will always have a different source to retrieve their data in case their own data is lost. For this reason they are willing to pay tons to gain high quality of vendor services for this.
Mengxue Ni says
I think any company looking to offload costs and focus on its core competencies can benefit from outsourcing. The key is to outsource in a way that is aligned with the business’s overall goals. For example, if the business is a bookstore which could be a small local business. They don’t need to have a IT team, they can outsource their IT security to other companies which are experts.
Sachin Shah says
very good point about focus, where a company can dedicate attention to other pressing needs. Yet another reason is that usually when work is outsourced, it is to a company that has expertise in that task or responsibility. Hence the outsources company can likely do a better job and save cost. by the time it takes a company time to master the task, it is better to outsource it.
Anthony Clayton Fecondo says
This post was very popular! A comment that really resonated with me was that no one company can be world-class at everything. Many companies have 1, maybe 2 distinct competitive advantages that really drive the value of their business. In order to maximize the value that the organization is adding to the market, it would make sense to devote their efforts to the functions that feed into the company’s competitive advantages. By outsourcing you can leverage other companies’ core competencies to provide better service than you might have alone.
Nathan A. Van Cleave says
2. What is business process outsourcing and how is it related to IT?
Business Process Outsourcing (BPO) are services that an organization contracts a 3rd party to manage. Commonly they fall into two categories, back office and front office. The back office BPO services include internal business functions like billing or purchasing, while front office services would include customer-related services like marketing or tech support.
As we have encountered in readings and discussions, IT forms the backbone and are enablers for the business processes in the organization’s of today. One example I can offer from my work experience is around the BPO strategy that my company was looking to implement. The BPO strategy was around our inside sales and response call centers. The underlying business processes cover sales of vaccines and pharmaceuticals and managing incoming customer calls for product information and adverse events.
However, as they worked through the strategy with the 3rd party vendor, it became apparent that it did not make sense for the company to move off a legacy system, migrate all the processes to a 3rd party vendor if it would only be for the US market. The company came to the conclusion that a global strategy needed to be implemented. Ultimately, they did not go with the BPO, but rather, decided to upgrade the existing platform and keep ownership of the process. I am sure that there were other considerations; risks that deemed too critical to outsource.
Andres Galarza says
Nathan,
Your post is a good example of how BPO can be a tool for discovery rather than the end of the process. It’s important to weight the total costs and effects of a transition, and your anecdote shows how nicely this week’s topic ties into what we’ve been learning in previous weeks.
Richard Flanagan says
Great example. Think of this from and Enterprise Architecture strategy. The company was not very agile because of its systems.
Nathan A. Van Cleave says
5. What are the different reasons a firm may wish to outsource a particular function or process?
Outsourcing is a strategy that an organization utilizes to contract out major functions to specialized and efficient service providers. In many cases, these 3rd party vendors become valued business partners.
There are varying reasons a company may choose to outsource certain business functions. Some of the most common reasons include:
– Reducing and controlling operating costs
– Improving company focus
– Gaining access to world-class capabilities
– Freeing internal resources for other purposes
– Streamlining or increasing efficiency for time-consuming functions
– Maximizing use of external resources
– Sharing or transferring risks with a partner company
In some cases, outsourcing involves the transfer of employees from the company to the outsourcing company. One example of this is when my current employer reduced headcount through a major transformation. Some of the functions in those areas were outsourced to a local company and that company hired several of the former employees as they had first hand knowledge of my company’s operating procedures.
Joseph Henofer says
Nathan,
All the reason you have stated are really good. As for your example, how did the employees handle the transition from going to your company to the outsourced company? Meaning did their work productive go down, go up, or stay the same? Sometimes in a transformation like that employees moral can go either way,
Thanks,
Nathan A. Van Cleave says
Joseph,
Unfortunately, the employees displaced were in RTP, NC so I didn’t know any of them. I can say that from the perspective of all the employees that remained after the transformation, morale was down.
I would imagine that a person being transitioned to the new company would feel bittersweet, bitter that they are being let go; sweet that at least they had a job.
Tough decision point for the company for sure.
Richard Flanagan says
Nathan,
Important point here. These types of outsourcing are really hard on everyone. Will the firm you are moving the work to hire all of your people? Some? Who goes and who stays? Are you opening up the remaining internal jobs for anyone to bid on? Cherry picking the best talent? Etc.
They are some advantages for the technical people who move. They are likely joining a IT technical company and hence their skills are part of the core business rather than a support service. This can lead to opportunities.
Sachin Shah says
I work at Penn and many years ago Penn IS went through this in 2001. They decided to outsource the entire IS department, except a few managers who were kept in house as a buffer. The IS department was outsourced to a consulting agency and they gave the employees an incentive ti stay in that if the stayed for 6 months they would get a 10,000 bonus. Yet after the 6 months were up the consulting company cut roughly 100 employees. the employees knew the consulting company\outsourced vendor would be cutting employees so they could stay for 6 months and collect 10k and risk losing their job or look for a new job immediately. This is the part that is hard but outsourcing companies do the dirty work of cutting employees who are not carrying their weight and their mission is too get the most work done by fewest amount of people.
Sean Patrick Walsh says
Nathan,
Can you give an example of how a business might share or transfer a risk with outsourcing? I know partnerships can share and transfer risk, but I’m not sure how outsourcing does since the parent business is still responsible for any losses when it comes to its stakeholders.
Richard Flanagan says
Sean,
I forget which pizza company it is but one of them uses UPS drivers to deliver their pizzas (not in uniform). That firm has transferred all the delivery risks (accidents, etc.) to UPS.
Sachin Shah says
I have seen outsourcing being a transfer of risk. The business knowledge is no longer internal and instead being shared, That new company can capitalize on it. Data is not secure and that is huge in healthcare. Also when you outsource the vendor had to deliver. I consider this no different to hiring a contractor to renovate your home and does a poor job. That was a risk when the task was outsourced.
Mengxue Ni says
Nathan,
I like that you mentioned sometimes outsourcing involves the transfer of employees from the company to the outsourcing company. Would you say this can be a risk though? Because employees who have access or are aware of sensitive information go to another company, you will never know what will happen. How could we mitigate this risk then?
Richard Flanagan says
It certainly could be a risk if careful thought isn’t given to who stays on board. Years ago some companies enthusiastically outsource all of IT only to find that they had no one to help the company think about its future strategy and how IT could enable the company. They all started hiring a few IT back to help them with this.
Sachin Shah says
this is risk that Professor Flanagan said happened to my friend’s company. His company outsourced work and tasks. But when you outsource work to a company they are doing the work that is assigned – nothing more or less. Hence they do not think outside the box or automating tasks or streamlining processes. Therefore my friend’s company had a n IS department that was very stale and there were scarce imporvements in his time there. He was in the Accounting division and their leadership had the mantra if a new project request for IT would lead to nothing happening as the outsourcing company would charge rates “a la carte” and would be too expensive for new work.
Richard Flanagan says
This sounds like avery poorly written contract. It raises the point though that you need to thinks about everything you do because the service provider won’t be throwing in a lot of freebies. You can’t expect them to bid on one set of work only to have you ask for different work in 6 months.
Loi Van Tran says
That is a very valid concern and my company went through that process in the recent months. We sold part of business unit, and some of our employees went to the company that bought the unit. To make matter more complicated, the buyer requested that they had access to open and historic purchase orders, requisitions, and vendor data from a customized program. Some of this information is sensitive and you could imagine all the risk assessments and mitigation that had to be considered before it could be done. It took them about a year until all the sensitive data was removed and were unable to be extracted by the buyer.
Candace Nelson says
That is very interesting Loi. Having been involved in due diligence activities prior to business acquisitions it amazes me that those type of arrangements – considering the potential detrimental impact on information security and confidentiality – were not contemplated in advance.
Vaibhav Shukla says
Professor Jan Section
5. What are the different reasons a firm may wish to outsource a particular function or process?
Outsourcing is a business strategy that moves some of an organization’s functions, processes, activities and decision responsibility from within an organization to outside providers
Reasons for outsourcing
-Lower operational and labor costs are among the primary reasons why companies choose to outsource.
-Companies choose to outsource less important time consuming process so that they can concentrate on core business processes
-Some companies also outsource to help them expand and gain access to new market areas, by taking the point of production or service delivery closer to their end users
-To gain access to new technology and outside expertise
-Many time company suffers with resources crunch or trained manpower to undertake the skilled stuff which may require significant investment in comparison to targeted resources available at outsourced location
_Utilizing client and customer relationship where customer is bound to provide quality services to its client in order to sustain in market
https://www.flatworldsolutions.com/articles/top-ten-reasons-to-outsource.php
https://smartchurchmanagement.com/advantages-and-disadvantages-of-outsourcing/
Joseph Henofer says
1.) What different kinds of IT outsourcing are there?
1. Multi-Sourcing– When companies find several qualified companies overseas to produce their product. This promotes competitive pricing and eliminates the dependency of one company for the product.
2. Nearshoring – This is when your company outsources their work to a nearby country. One example would be the U.S. sending work to Mexico or Canada.
3. Offshoring – This is when jobs or work are moved to another country. An example of this would be sending your help desk support to the Philippines.
4. Contracting Out – The practice of contracting out jobs overseas involves a company having jobs performed by another company or independent contractors.
5. Subsidiary of an Offshore company – This is an off shore company that is part of a foreign company. When this approach is used the company is a sister company of the parent foreign company and realizes the benefit of the overall economical conditions of the parent company.
Outsourcing is a great tool to utilize for a company, for instance it can reduce and control operating costs; as well as, improve company focus. At the same time when a company relies on outsourcing they are prone to the following risks like control may be lost and employee morale may be affected. In the end a company should try to maintain a balance when outsourcing so their risks are at an acceptable level.
Joseph Henofer says
2. What is business process outsourcing and how is it related to IT?
Business process outsourcing is the contracting of a specific business task to a third-party service provider. Business process outsourcing is usually implemented as a cost saving measure for tasks that a company requires but does not depend upon to maintain their position in the marketplace. BPO is often divided into two different categories back office and front office outsourcing. Back office outsourcing includes internal business functions like billing or purchasing and front office outsourcing includes customer related services like marketing or tech support.
BPO relates to IT by given the company an increase of flexibility. The company is now able to focus on its core competencies by freeing up their key employees so they can invest more time and energy in building the company’s core businesses. Another way that BPO relates to IT is the ability to save on resources related to staffing. For instance, your company may want to outsource your help desk so they don’t have to worry about the hiring and training a whole help desk department. The flexibility that BPO gives to IT can also be very risky. Some of the risk include overly dependent on service providers, the lack of communication that delay projects and data privacy breaches. Data privacy may be the biggest risk of all since we are not only entrusting our data with a vendor, we are also trusting they are securing our data properly.
Andres Galarza says
What are the different reasons a firm may wish to outsource a particular function or process?
This week’s question is in my wheelhouse, because I previously worked for a freight forwarder, which is a service that organizations purchase in order to outsource certain logistical requirements.
The freight forwarder (FF) that I worked for services a Fortune 100 global chemical corporation (DUP). Even though DUP has factories and facilities all over the world, they do not operate a fleet of planes or vehicles. This is where a FF becomes important. DUP pays FF to manage getting their chemicals (typically in shipping containers) from point A to point B. For this service, the FF bears the burden of dealing with dozens of shipping companies, railroads, trucking companies and import/export authorities around the world. As a benefit, DUP does not have to manage as many logistical details, and can focus on their core business functions.
Sean Patrick Walsh says
Great example. When I think of an outsourced business process my first thought is always outbound logistics. There are so many different companies that hire another company to handle that aspect of their business. And still yet there are other companies, the latest I can think of is Amazon, who choose instead to vertically vertically integrate that service into their product package. I think another service that is outsourced by many businesses is book-keeping. There are many start-ups that are great at creating their product or service, getting it to market, and everything in between those two points, but they are smart enough to go to professionals to handle their books so they can focus on what they do best early on with what little resources they have to do it with.
Richard Flanagan says
In my company we used the same FF if I am right and an accounts payable firm in China, helpdesk s services in India and China, an SAP maintenance team in India and an HR services company in the US to handle all our routine HR functions.
We had an advisory council discussion last year where one of our members reflected on auditing a big company around the security threat that 3rd party service providers presented. The company thought they had about 100 such providers. By the end of the audit, the team found several thousand. Everybody outsources a lot.
Daniel Warner says
Sean,
That is a great point. I work at a very small software company, and many aspects of our business are outsourced. We outsource bookkeeping/accounting and IT, although we still have an internal HR department. After coming from companies that did not outsource any internal departments, it was a change a pace and one that makes sense, especially when considering the ability to focus on the core business function.
Mengxue Ni says
Thanks for sharing your real life example, Andres!
I think in DUP’s case, they can focus on improving company core business. Also, since they outsourced it, they don’t need to worry about the operation costs. Would you say it is a successful example of outsourcing? In your anwer, I predict it would be successful though. Sometimes, outsourcing can be bad decision as well like loss of direct control over project management.
Priya Prasad Pataskar says
Q5. What are the different reasons a firm may wish to outsource a particular function or process?
There are more than one reasons for companies to outsource work. This decision is strategic in order to move towards business objectives and goals.
1. Increasing load – Companies generally start with hosting all functions in house but later the size of company and breadth increases such that it would need to outsource the work.
2. Specialization – Some companies establish themselves as specialized in the work they do. It is better to get the dedicated service or work done from these experts. Ex. A restaurant wants to focus on food and catering they would outsource risk assessment to a third party.
3. Improve focus on core function – Outsourcing the supporting tasks give more space, time and capacity to focus on the core job. Ex A IT company has to focus on developing software solutions, they can outsource the physical security to a firm which can have expert people who can guard the premises, manage their training, salaries.
4. Control costs – Not all companies can afford to host in house functions. They would need help in terms of infrastructure, services and human resource they want for completing a task. Ex. A small IT company would would outsource server management to a big company. The small IT firm would not have the space and infrastructure to host a server.
5. Share risks – A company may want to share the risk with partner company. So that a failure may not run to a complete loss but there will be less burden of risk.
6. Dedicate current resources to job they were hired for – There would be many supporting tasks which are mandatory tasks in a profile but are not that important but extremely necessary to continue process. They would outsource the time consuming easy tasks.
Ex. Business owners might be too busy to do the books or have tried but failed and as a result have a financial clean up.
7. Increase profit margins- Outsourcing would save money on operational costs and human resources hired for the job which if outsources can deliver significant savings and an increase profit margins.
8. Tax breaks and lower labor costs – In some cases handling business overseas could prove beneficial in terms of lower corporate salaries and tax rates.
Mengxue Ni says
Nice listing and anwer to the question, Priya. The most common reason I think for outsourcing is cost or headcount reduction. Today, the drivers often are more strategic and focus on carrying out value-adding activities in-house where an organization can best utilize its own core competencies.
Folake Stella Alabede says
1. What different kinds of IT outsourcing are there?
IT outsourcing involves sub-contracting or “farming out” certain information technology functions to independent, third-party companies or individuals, instead of keeping those functions in-house.
There are five types of IT outsourcing (defined by where the outsourced work happens) that offer businesses a number of options when contemplating outsourcing some or all of their IT functions:
1. Offshore outsourcing – sending IT-related work to a company in a foreign country that offers political stability, lower labor costs and tax savings; India, China and the Philippines are popular offshore outsourcing countries.
2. Nearshore outsourcing – sending IT-related work to a company in a country that shares a border with your own; presumably, it is easier to travel between the two and for the company and the provider to communicate with one another.
3. Onshore/domestic outsourcing/ Homeshoring – contracting with a third party located in the same country to provide IT-related work, off-site or in-house, rather than an office, factory, or related physical workplace
4.Cloud Computing – contracting with a third party to provide IT-related functions over the Internet or a proprietary network. Examples include Infrastructure-as-a-Service, Platform-as-a-Service and Software-as-a-Service.
5.Managed Services – contracting with a third party to provide network management functions including IP telephony, messaging and call centers, virtual private networks (VPNs), firewalls, and the monitoring of and reporting on network activity. In this type of outsourcing arrangement, a special emphasis is placed on the integration and certification of Internet security.
ref
http://www.thebalance.com/what-is-it-outsourcing-2072001
http://www.itmanagerdaily.com/it-outsourcing/
Folake Stella Alabede says
1. What different kinds of IT outsourcing are there?
IT outsourcing involves sub-contracting or “farming out” certain information technology functions to independent, third-party companies or individuals, instead of keeping those functions in-house.
There are five types of IT outsourcing (defined by where the outsourced work happens) that offer businesses a number of options when contemplating outsourcing some or all of their IT functions:
1. Offshore outsourcing – sending IT-related work to a company in a foreign country that offers political stability, lower labor costs and tax savings; India, China and the Philippines are popular offshore outsourcing countries.
2. Nearshore outsourcing – sending IT-related work to a company in a country that shares a border with your own; presumably, it is easier to travel between the two and for the company and the provider to communicate with one another.
3. Onshore/domestic outsourcing/ Homeshoring – contracting with a third party located in the same country to provide IT-related work, off-site or in-house, rather than an office, factory, or related physical workplace
4.Cloud Computing – contracting with a third party to provide IT-related functions over the Internet or a proprietary network. Examples include Infrastructure-as-a-Service, Platform-as-a-Service and Software-as-a-Service.
5.Managed Services – contracting with a third party to provide network management functions including IP telephony, messaging and call centers, virtual private networks (VPNs), firewalls, and the monitoring of and reporting on network activity. In this type of outsourcing arrangement, a special emphasis is placed on the integration and certification of Internet security.
ref
1. What different kinds of IT outsourcing are there?
IT outsourcing involves sub-contracting or “farming out” certain information technology functions to independent, third-party companies or individuals, instead of keeping those functions in-house.
There are five types of IT outsourcing (defined by where the outsourced work happens) that offer businesses a number of options when contemplating outsourcing some or all of their IT functions:
1. Offshore outsourcing – sending IT-related work to a company in a foreign country that offers political stability, lower labor costs and tax savings; India, China and the Philippines are popular offshore outsourcing countries.
2. Nearshore outsourcing – sending IT-related work to a company in a country that shares a border with your own; presumably, it is easier to travel between the two and for the company and the provider to communicate with one another.
3. Onshore/domestic outsourcing/ Homeshoring – contracting with a third party located in the same country to provide IT-related work, off-site or in-house, rather than an office, factory, or related physical workplace
4.Cloud Computing – contracting with a third party to provide IT-related functions over the Internet or a proprietary network. Examples include Infrastructure-as-a-Service, Platform-as-a-Service and Software-as-a-Service.
5.Managed Services – contracting with a third party to provide network management functions including IP telephony, messaging and call centers, virtual private networks (VPNs), firewalls, and the monitoring of and reporting on network activity. In this type of outsourcing arrangement, a special emphasis is placed on the integration and certification of Internet security.
ref
Paul Linkchorst says
What different kinds of IT outsourcing are there?
The three types of IT outsourcing that come to mind are offshoring, nearshoring, and onshoring. The difference between these types mainly lie in the geographic location that these functions are outsourced. For offshoring, these IT functions are outsourced outside the country with most of the functions going to emerging markets such as India and China. A main motivator for offshoring is due to the significantly reduced labor costs in those geographic locations. Next, nearshoring occurs when IT functions are outsourced to another country but that country usually borders the home-country. One of the benefits of this is over offshoring can be remaining within the same time zone, similar cultures, and similar economic conditions. Lastly, onshoring is a type of outsourcing where the IT functions remain within the country. For this type the cost benefits are not as good as offshoring or nearshoring, however the culture, time zone, economic conditions and government regulations are all the same. Depending on the type of business, one type might be more favorable than another. If I am a business which involves highly confidential information, then I might choose onshoring due to the regulations that might protect such information. However, if I am a manufacturer who is not dealing with any patents or trade secrets and want to significantly reduce costs, then offshoring might be the best choice. Therefore, businesses need to identify their own needs and choose a type of outsourcing that best serves them.
Joseph Henofer says
Paul,
That is a very informative write up on the different kinds of outsourcing. I do have a question, with security being such a big part of how we do business today would you still trust outsourcing even if your business is manufacturing and why? You stated that you would not agree to outsource highly confidential data, which I totally agree with.
Let’s say your company manufacture widgets and you outsource a specific function of your company. Now this function doesn’t have a confidential information but it may have what the widgets do and where they are going. If this information were to get to a competitor do you think that the cost of outsourcing outweighs the risk of your competitor getting this information and using this information to reduce the profits in a specific location?
Paul M. Dooley says
Joseph, that is an interesting perspective and one of the critical reasons that the decision to outsource work is a strategic one and should be taken after long and careful considerations from the necessary stakeholders internally at the company. In my previous role at Verizon, I was assigned to 8 high profile clients that were in either the manufacturing or automotive vertical markets. A number of my customers were aerospace manufacturing that produced parts for airplanes, both consumer and military grade. The biggest threat, specifically in the manufacturing space, is the leakage or stealing of intellectual property which is what sets their products apart from the competition. This is a constant battle and of course there are no definitive answers, you have to take this on a case by case basis and measure the impact to the overall business if one of the risks associated with outsourcing were to come to fruition as we’ve learned with all of our risk analysis topics. Also, in manufacturing, ever since the 60s there’s been a huge push to outsource a significant amount of their production overseas due to the cost of labor. Just like the production of widgets, considering moving IT functions and sensitive intellectual property, which is the sole reason that many manufacturers are in business today, needs to be taken very serious and in my experience should only be taken as a last resort measure, especially if considering moving the work to a country where the laws and regulations are relaxed in this area.
Joseph Henofer says
Paul,
I totally agree that they need to be looked at on a case by case basis. I think due to security breaches being heavily focused in the news today, companies may be in the process of rethinking their outsourcing strategies and who they outsource to with certain services. The priority in the past was how can we save money with outsourcing, but now I believe there has been a shift to how can we save money and make sure we are secure.
Folake Stella Alabede says
5. What are the different reasons a firm may wish to outsource a particular function or process?
As referenced from Wikipedia, Companies primarily outsource to reduce certain costs such as peripheral or “non-core” business expenses, high taxes, high energy costs, excessive government regulation/mandates, production and/or labor costs. The incentive to outsource may be greater for U.S. companies due to unusually high corporate taxes and mandated benefits, like social security, Medicare, and safety protection (OSHA regulations).
The different reasons a firm may wish to outsource a particular function or process include:
• Expertise: Outsourcing is said to help firms to perform well in their core competencies, fuel innovation, and mitigate a shortage of skill or expertise in the areas where they want to outsource. Sometimes an overseas vendor/business has special equipment and/or technical expertise, making them better at the given task than employees within the outsourcing organization
•Focus – Faster product launches due to increased focus and accessibility of technology needed to bring products to market.
•Reduced costs: a big draw to outsourcing work overseas is reduced costs for labor, operations, and even equipment. Reduced costs resulting from fewer capital investments and staffing requirements, less overhead, volume price breaks, and leasing options
•Budget/Staff flexibility and control: Outsourcing allows organizations to pay for the services and business functions they need, when they need them. This allows operations that have seasonal or cyclical demands to bring in additional resources when you need them and release them when you’re done. It also reduces the need to hire and train specialized staff, brings in fresh engineering expertise, and can reduce capital and operating expenses and risk.
•On-demand access to the latest technology
•Predictable expenses from flat fees and subscription-based pricing models
Wenlin Zhou says
What is business process outsourcing and how is it related to IT?
Outsourcing is a practice in which an individual or company performs tasks, provides services or manufactures products for another company — functions that could have been or is usually done in-house. Outsourcing is typically used by companies to save costs.
The outsourcing of IT work can be broadly grouped into the following areas:
Software development—The company provides either the requirements or sometimes the design and specifications, and the service provider does the analysis, design, coding, testing and integration and all other activities in the software development life cycle. The software development can be done either onsite (i.e., at the company’s office), nearshore (i.e., at a site of the service provider in nearby location in the same country or
region) or offshore (i.e., at a remote site generally at the office of the service provider, which could be thousands of miles away).
Application support and maintenance—The company could be using a number of applications. These may have been developed in house by the company or by someone else, or they may be implementations of packaged software. When application support and maintenance are outsourced, the service provider attends to the problems and bugs and all requests from users relating to the application software, often picking up the problem tickets from the help desk. For large applications, very often it is a combination of onsite and offshore. The services from offshore are provided through a network that enables the service provider to connect to the company’s applications.
Infrastructure management services—In this case, the activities outsourced are system administration of servers, database administration, network management, desktop management, security management, data center management and attending to help desk trouble tickets relating to all these areas. These services can also be provided with a combination of onsite and offshore presence.
https://drive.google.com/file/d/0B8S2SZTC04ViaFM5d0p5Z3JvbHM/view
Priya Prasad Pataskar says
Q 1. What is segregation of duties and why is it a commonly used control? Give an example of two (e.g. IT) roles that should be segregated?
Segregation of duties results in most important function, protection of company assets.
Purpose – Basically it prevents internal fraud and errors. To ensure that there is control over a process separation is done at the right point so that errors can be determined. When multiple people are involved in a task it is easy to keep them bound to ethical behavior. And in case of any unethical behavior the action can be flagged by other person with whom duty is shared. Segregation of duties plays a crucial role in risk mitigation. It is important to put these controls in open from the start to discourage fraud.
The fraud triangle speaks about opportunity, pressure, rationalization. Segregation of duties negates or tries to negate opportunity.
In accounting separation of task is done to segregate
1. custody of assets
2. authorization for use of assets
3. record keeping of assets.
4. reconciliation
Examples of SOD in IT company,
1. The person who has admin access will not have access to database must not be the one who is auditing the database. If he has both the rights, this person can approve whatever changes he is willing to make. There would be no authority over him to see is he has correctly use his admin privileges or exploited them.
2. The network team and incident management team must be separate. In occurrence of an network or security incident the incident management team should highlight the incident, create a ticket for the incident and assign to network team. The incident response team can only mark the status of incident as resolved after the network team completes their job. If the network team had access to resolve the incident, that would rise the opportunity area in fraud triangle.
Priya Prasad Pataskar says
Sorry, this post is not for MIS5202
Binu Anna Eapen says
5. What are the different reasons a firm may wish to outsource a particular function or process?
There are many reasons why a company may choose to outsource certain business functions. Some of the most common reasons include:
1. The desire to focus on the core function of the organization.
2. Pressure on profit margins
3. For cost saving- Controlling operational costs. With the increasing competition for any business, the company would want to spend more on its core function than on some other business functions. Sometimes even within the core functional units it may be cost effective to outsource. Ex.: Consulting Firms
4. Flexibility with respect to organization, structure and market size.
5. Gaining access to world-class capabilities: An organization which does not have knowledge expertise on a particular technology and still have world class technology with best resources available by outsourcing. Outsourcing vendor will have more experience with wide array of problems, issues and techniques than in-house function as they would be dealing with other clients as well.
6. Streamlining or increasing efficiency for time-consuming functions
7. More productive: Outsourcing vendors will devote more time and focus more effectively and efficiently than in-house staff.
8. Low Tax rates: By handling business overseas businesses can take advantage of the lower corporate taxes in other geographic locations.
9. The option of discontinuing the service if the required objectives are not being met.
10. Outsourcing helps in transferring or sharing of risks and can work together to mitigate the risks.
Paul M. Dooley says
Binu great write up on the various reasons that a company would consider outsourcing a specific business process or function. Which of the various drivers would you predict to be the most common? If I had to make an educated guess, I would say that cost consideration or savings would have to be one of the most common across all industries as well as a level of expertise in the specific process or project they are taking on. Specifically in IT, for a number of my clients there has been a major shift in thinking that you can see by growth by acquisition business models that to branch out or expand it makes sense to acquire somebody or contract with someone that does that as their core competency in business rather than trying to find the talent needed and bring them in house and grow this portion of the business organically.
Loi Van Tran says
From what I remember from the military, the drivers for IT outsourcing was mainly due to lack of expertise or not having the resources in-house to allocate to those functions. Yes, we had IT personnel; but they typically provide only certain functions like access control systems and specialized military equipment, I’m sure there’s more. For example we don’t have developer and programmers in-house to create new software or have soldiers wiring the place up. This is all down by third-parties. It goes back to outsourcing allows the organization to focus on its core business.
Daniel Warner says
Binu,
I think this is a great list, and it’s very informative. The tax benefits were something I hadn’t previously read about so that was interesting. From what I’ve experienced it’s been a combination of cost and expertise. At a previous company I worked at, only our shipping/shipping logistics was outsourced, but everything else was in-house. This is different than my current company where most of our internal services are outsourced, We outsource for many of the reasons you’ve mentioned which include the cost and effort it would take to implement the internal departments we currently outsource.
Deepali Kochhar says
Q 5. What are the different reasons a firm may wish to outsource a particular function or process?
Outsourcing refers to the way in which companies delegate the processes of their business functions to external vendors.
Companies outsource a particular function or process for the following reasons:
• COST BENEFITS: It can help performing a function at a lower cost and at a better quality. For example, due to difference in wages in western and Asian countries, the same kind of work can be done at less than half of cost and with that better quality of service is provided.
• INCREASED EFFICIENCY: The vendors to whom function is outsourced have function specific expertise. Thus they can do a better job to manage that function and help organization increase the efficiency. For example, background verification process is outsourced to vendors for most of the organizations. The vendors have expertise and help doing it with a good efficiency rate.
• FOCUS ON CORE AREA: It helps organization to focus on their core areas and building their brand value. Also it helps them to invest in more in the area of their expertise.
• SAVE ON INFRASTRUCTURE AND TECHNOLOGY: Outsourcing eliminates the need to invest in infrastructure. For example, it can be very painful for an organization to establish IT infrastructure from the core, so they outsource such services and at the same time saves them cost to manage hardware as well as resources.
• ACCESS TO SKILLED RESOURCES: The vendors provide easy access to skilled resources hence saving time and cost needed to search resources. This also helps organization to save cost needed to train the employees.
• TIME ZONE ADVANTAGE: Outsource helps manage time zone difference between different countries of operation and helps organizations to function round the clock.
• FASTER AND BETTER SERVICES: Helps organizations to deliver services at a faster rate. For example, eCommerce companies like amazon outsource the processes of procure to pay process. They hire vendors to manage warehouse, delivery etc. which helps them provide better and faster customer services.
Loi Van Tran says
Thanks for the post. I really never thought about Time Zone as being an advantage of outsourcing. It makes sense that an company would outsource, like on-site support for a specialized product or call centers, if they i providing products and services globally. Distributed support centers would provide advantages like better response time, local expertise, and lessen the gap in cultural differences.
Kevin Blankenship says
Good summary of the benefits of outsourcing. I know in my company, I see big gains in focusing on core areas and time zone differences. We’ve handed a lot of support issues to overseas help, so our IT teams can become projects teams again, instead of IT support teams. And since they are based overseas, they cover a lot of overnight issues, so persons on-call are not woken up in the middle of the night.
Deepali Kochhar says
Q2. What is business process outsourcing and how is it related to IT?
Business process outsourcing (BPO) is the delegation of one or more IT-intensive business processes to an external provider that, in turn, owns, administrates and manages the selected processes based on defined and measurable performance metrics.
BPO offerings are categorized in two major categories:
• Horizontal offerings: Those that can be leveraged across specific industries
• Vertical-specific offerings: Those that demand specific industry vertical process knowledge
When outsourcing a business process, it is important to understand the dynamics of the process. Following details are needed before making a decision:
• The past data of the business unit which is to be outsourced which may include incidents and change requests
• Baseline should be defined
• Capacity of the service needed
• Cost metrics should be maintained
• Service level agreement must be maintained
IT play an important role in Business process outsourcing (BPO). Technology such as cloud computing, business analytics, social media and process automation software helps in aligning and managing outsourced services to the organization as well as enable them to lower costs and be more effective.
A research from Accenture states that those that deliver business values, use technology as a source of innovation and advantage and 40% of high performers consider technology to be an important component of BPO relationship.
Effective technologies and architectures contribute to cost reductions and more efficient operations by streamlining the systems environment and reducing the number of systems involved, often standardizing the technology environment on a unified, centralized platform.
It helps vendors to deliver better services and work closely on improving the service quality at less cost.
Said Ouedraogo says
What different kinds of IT outsourcing are there?
“IT outsourcing involves sub-contracting or “farming out” certain information technology functions to independent, third-party companies or individuals, instead of keeping those functions in-house.”
Type of IT Outsourcing:
– Offshoring: moving services overseas, typically to take advantage of lower costs and/or a more favorable economic climate
– Nearshoring: transferring services to another country close by, oftentimes sharing a border with home country
– Homeshoring/onshoring: allowing employees to work from home rather than an office, factory, or related physical workplace
Richard Flanagan says
Said,
Good but this is traditional IT outsourcing. Everyone should recognize that using cloud services of any kind (IAAS,PAAS, SAAS) is essentially an ourtourcing arrangement.
Alexander B Olubajo says
1. What different kinds of IT outsourcing are there?
IT Outsourcing is the use of external service providers to effectively deliver IT-enabled business process, application service and infrastructure solutions for business outcomes.
There are three main kinds of IT outsourcing:
i. Local Outsourcing: this is basically choosing and using external service providers/companies locally based in the same country to deliver your IT services and solutions.
ii. Offshore Outsourcing: this is outsourcing IT services and solutions somewhere else other than the organization’s home country. This typically to another continent.
iii. Nearshore Outsourcing: this kind of outsourcing can also considered as an offshore outsource, however IT services and solutions are being outsourced to external service providers in neighboring countries.
Another kind of IT outsourcing that is considered these days is the cloud-enabled outsourcing
Alexander B Olubajo says
2. What is business process outsourcing and how is it related to IT?
Business Process Outsourcing (BPO), one of the subset of outsourcing, is the contracting of the operations and responsibilities of specific business functions or processes to a third-party service provider. It primarily refers to the outsourcing of business processing services to an outside firm, replacing in-house services with labor from an outside firm.
Business Process Outsourcing relates to IT in so many ways such that the business processes are often Information Technology based, which are referred to as ITES-BPO, where ITES stands for Information Technology Enabled Service. ITES BPO is a type of outsourcing that relies on technology to deliver the requested service. The service is delivered electronically, typically over the Internet, but can use any sort of telecommunications or data network instead.
An example of ITES BPO that is not Internet-based is an outsourced IT helpdesk. Companies use an internal IT helpdesk to troubleshoot their own network. If this function is outsourced, the service provider manages service requests by phone or email, logs into the company’s network, uses software to remotely view and control an employee’s terminal, and solves problems through these and other electronic means.
An example of ITES BPO delivered over the Internet is a web-based customer service help desk system. Companies hire service firms to manage the email help desk that is part of a company’s website. The service provider uses a software solution to manage contacts by customers. Customers submit trouble tickets electronically over the Internet. The service provider processes the tickets and answers the questions via email.
Richard Flanagan says
Alexander,
You example is good but it still outsourcing an IT function. Think about outsourcing something like accounting. Its all information based so that if you have good processes and EA you don’t need to have people in the building You can send the information around the block or around the world with the same effort. This is where IT really becomes important. If you have poor processes and EA you can’t effectively use BPO.
Yu Ming Keung says
5 What are the different reasons a firm may wish to outsource a particular function or process?
1. Differentiation – outsourcing helps companies differentiate from the competition by prioritizing customer experience
2. Shared responsibility – the outsourcing partner will operate as part of the client’s business and share responsibility for outcomes
3. Cultural adaptation
4. Lower operational and labor costs – deliver significant savings for the companies
5. Free up internal resources that could be put on effective use for other purposes
6. Share the risk by having service level agreement that aligns with a company’s objectives, reduce risk, and deliver a higher return on investment – providing incentive for the outsourcer to deliver a superior quality experience. Sharing risks builds accountability into the relationship and focuses outsourcing on overall business strategy
Paul M. Dooley says
Great perspective Yu Ming. I have a question regarding your number 6 as far as sharing the risk. How practical is it really that you’re sharing the risk by moving the work to a third party service provider. From a conceptual stand point it would make sense to say that if something went wrong with that particular business process that you wouldn’t stand to incur any of the repercussions from such a blunder, however, in the real world and especially if it was identified and impacted your customer’s purchases of your goods/services it seems that all the risk would still lie with your company directly rather than with the outsourced third party. I just have difficulty seeing where the risk has truly been shared at all. Just a thought.
Xiaodi Ji says
Yu Ming,
I think Cultural adaptation is a good point. Different cultural has different cultural and policies. Some of them are very easy to understand but some of them are hard to describe, understand, and handle it. In addition, cultural conflict can cause serious problems. We can hire local people to solve this problem. However, it would spend lots of money and time in doing this and building new relationship. Some medium-sized enterprise cannot handle this problem. It also a serious problem for the big enterprise.
In this situation, outsourcing it real help company overcome this problem. They outsource their IT to a local company which can help them get into this market as soon as possible.
Ming Hu says
Outsourcing is a business strategy that moves some of an organization’s functions, processes, activities and decision responsibility from within an organization to outside providers.
Companies are willing to outsource an entire function or only a part of it for the following reasons:
Cost Savings – There can be significant cost savings when a business function or a part of it is outsourced. Employee compensation costs, office space expenses and other costs associated with providing a work space or manufacturing setup are eliminated and free up resources for other purposes.
Focus on Core Business – Outsourcing allows organization to focus on their expertise and core business. When organizations go outside their expertise, they get into business functions and processes that they may not be as knowledgeable about and could potentially take away from their main focus.
Improved Quality – Improved quality can be achieved by using vendors with more expertise and more specialized processes.
Operational Efficiency – Outsourcing gives an organization exposure to vendor specialized systems. Specialization provides more efficiency that allows for a quicker turnaround time and higher levels of quality.
Ahmed A. Alkaysi says
1. What different kinds of IT outsourcing are there?
The different types of IT outsourcing include: Application Development, Application Support and Maintenance, and Infrastructure Management.
Application Development: The outsourcing of coding, design, testing, and other functions of SLDC. Generally, the company requesting the outsource would provide the requirements and specifications of expected application.
Application Support and Maintenance: This generally means that any issues/bugs that need to be fixed, or help the company needs regarding one an application they use would be outsourced to another company. The application could something developed in house or bought. Could also be something they have leased.
Infrastructure Management: The outsourcing of Servers, Databases, Desktops, or other hardware to another company. The company that is providing the outsourcing service would also generally need to provide support and maintenance.
Richard Flanagan says
Ahmed,
See my earlier response and think about cloud services as outsourcing also.
Ahmed A. Alkaysi says
3. If you were the manager of a major outsourced service and heard you were to be audited, what aspects of the outsourcing arrangement would you want to make sure were strong?
The areas you would need to make sure are strong would include but not be limited to: Contract, Statement of Work, Monitoring, Network and data Security
The Contract is the official document that explains what the expected services are going to be received and the what will be returned in exchange.It will also list the terms for terminations, compliance, and any dispute resolution information among others. The contract is the most important aspect of the outsourcing agreement.
Statement of Work, which is generally part of the contract, would need to be strong. The Statement of Work will detail specifically what services the outsourcing company will provide. An Audit will check to see if what is actually being provided meets what the Statement of Work has promised.
As a manager, I would need to make sure that the company that provides the service is financial stable, following regulations, and is transparent in press releases.
Network and Data security are greatly scrutinized during audits. I would need to make sure all personal information is safely secured and encrypted. I would also need to make sure that connection between my company and the outsourcing company is secured through a VPN.
Fred Zajac says
Ahmed,
You brought up a great point about things you would worry about as a manager. It is important to put into place specific criteria for service providers. The criteria should be based around your company’s mission statement and the goals.
The proper vetting and due diligence should be performed prior to any decision is made. The best way to do this is to put out an RFP or request for proposals. In this document, you put specific criteria for the service providers. For instance, an RFP may require a service provider to be fully insured and bonded in the state. It may require “a right to audit” clause, which would allow the company to hire an audit company to inspect the service provider.
Set Criteria & List the Requirement in the RFP. This will help mitigate the risk of choosing the wrong service provider.
Richard Flanagan says
Very good. The regulation piece is very tricky. If you are a hospital and want to outsource your datacenter you need to ensure that your patient data is kept in the US. But what if your outsource provider outsources their server farm. How do your know where the data is? It can all get very confusing.
Ahmed A. Alkaysi says
Really good points Fred. By using an RFP with specific criteria, you would definitely mitigate the risk of getting audited with incomplete information/documents/or gaps in the processes between the two companies. Requiring “a right to audit” would be a great idea in order to make sure the company hired to provide the services are meeting compliance and are “doing things the right way.”
Ahmed A. Alkaysi says
4. What is the difference between an outsourcing contract and a statement of work? Which should you be interested in as an auditor? Why?
The contract will encompass many different areas between the agreement of the two companies. It is a legally binding agreement on what the outsourcing company will provide, and what they are expecting in return. Some of the sections that the contract includes are things such as: Services to be provided, Fees and Payment terms, Terms and Termination, Compliance, Insurance, Dispute resolution, the use of subcontractors, etc.. The Statement of Work does not include all these areas. The Statement of Work is used to specifically provide the detail on what the outsourcing company will provide.
As an auditor, I would want to be interested in both. The contract will hold much more information, the chances of finding lapses would be high. The Statement of Work would also be important as it will specifically detail what is expected, and I would be able to see whether or not the actual services provided meet the criteria.
Alexander B Olubajo says
3. If you were the manager of a major outsourced service and heard you were to be audited, what aspects of the outsourcing arrangement would you want to make sure were strong?
As a manager of a major outsourced service that is about to the audited, I first and foremost will ensure that both the Contract and Statement of Work are strong. This is important because both documents cover the nature and scope of service that the service provider will be providing, and are what will be requested for by the auditor(s) in order to get a basic understanding of what is being audited and what to audit. Clearly outlining the Terms & Termination conditions for the service(s) to be provided, the personnel to provide the service, possible use of sub-contractors are very essential aspects that must be strong without any room for ambiguity. I will also ensure that the aspect of Connectivity & Network Security as well as Data Security are also strong by having our in-house network engineers work with the service providers to confirm that only authorized personnel have access to the network, and also ensuring that our data that’s being handled by them are protected in every state it’s in, shared with only authorized users, and are properly isolated from each other. Lastly, I will ensure the Benefit Realization aspect of the outsourcing agreement was strong in explicitly defining, planning, and structuring when the actual benefits of the service is to be realized. I think it’s important as it will help the auditors determine whether or not the outsourced service is aligned with the company’s business objectives.
Richard Flanagan says
Alexander,
I like your list but I would nitpick your order. I think the first thing to ask would be “Was outsourcing a good idea? What benefits were they expecting to get? Are they getting them?” Only after that would I dive into the details. This is one more example of “Right things, done right”. First decide if it was the right thing to do and then look to see if it was well executed.
Alexander B Olubajo says
Prof. Flanagan,
I agree with the order in which you have laid in looking at aspects of the outsourcing agreement. I guess I didn’t really look at it from the “right things, done right” perspective. Thanks for explaining it this way.
Alexander B Olubajo says
4. What is the difference between an outsourcing contract and a statement of work? Which should you be interested in as an auditor? Why?
I think the major difference between an outsourcing contract and a statement of work (SOW) is the contents and the level of information contained in both documents.
An outsourcing contract is a written legally binding document that contains an agreement between the two parties (i.e the outsourced company and the service provider) of the services and/or products to be performed/provided. A typical outsourcing contract should contain sections like the personnel, terms & termination, disentanglement, use of subcontractors, to name a few, and should examine/address service level agreements, penalties and rewards, timeframes and measurements, regular reviews, and exit strategies.
A statement of work doesn’t provide as much level of detail as does an outsourcing contract and in fact in some cases are defined within a contract. A statement of work is a document that describes the work requirements for a specific project along with its performance and design expectations. The main purpose of the SOW is to define the liabilities, responsibilities and work agreements between two parties, usually clients and service providers. A typical statement of work should define the scope and Key Performance Indicators (KPIs) for the agreement. These KPIs can then be used as a baseline to determine whether the service provider has met conditions of the SOW.
As an auditor, I will be interested in both documents as the outsourcing contract will give me other information on aspects of the outsourced service that the statement of work will necessarily not touch on or address. Things like the personnel, use of subcontractors or not, disentanglement and exit strategies will be important to know from the outsourcing contract, while the statement of work will specifically define the details (nature and scope) of the service to be provided (i.e work) as well as KPIs, which may not be part of the outsourcing contract.
Joshua Tarlow says
What are the different reasons a firm may wish to outsource a particular function or process?
* Cost: possible to complete functions/job at a lower quality with the same or better quality. If offshore the wages might be lower. Or the company maybe able to leverage economy of scales if it is a consulting firm for example
* Efficiency: Outsourcing partner will already have experience the business process/function which can lead to a faster completion time. Which in turn, can lead to increases in productivity in the company outsourcing, which might then ripple to other areas in the business.
* Focus on core areas: Core functions might be very different than IT so the company can transfer responsibility to a third party. It then no longer has to expend resources on something outside of its core competencies, which allow to devote more resources.
* Reduce infrastructure and technology expenses: A third party will already have or will be responsible for the technology and infrastructure development/expenses. It may not be prudent for a company to invest in areas where it may not require significant use. Possible the company may only need these services for a set amount of time, so permanent investments would cost more.
* Access to skilled resources: A third party may employee workers that have skills in the outsource functions. Or the quality maybe higher than the company’s internal employees. Outsourcing allows a company to use highly skilled resources on a temporary or permanent basis without internally developing these resources.
Fred Zajac says
Josh,
I like the point you make about “core business”. The business should focus on what it does best. If the business is an accounting firm, it should focus on accounting. If the business makes pens, it should focus on pens.
It might make more sense to let the foreman build houses, and pay another company to find and interview potential carpenters.
Paul M. Dooley says
Josh and Fred, to piggy back on what Fred’s response was I have to agree wholly. The major shift I’ve seen over the past decade or so with my clients is a shift into focusing just solely on what their businesses core competencies are and leverage third parties for other areas they may need to branch into. It’s my understanding that before the push to outsourcing in corporate America it was a typically just don’t in house and can cause some problems as outlined by Josh’s original post like trying to find sufficient talent and getting the capital approved to build out a new specialty or area of the business internally, rather it makes a lot of sense to find a business partner that has already mastered the nuances of the specific task at hand. Definitely would help going to market quicker and eliminating the learning curve whenever you try to expand the scope of your current business and operations.
Folake Stella Alabede says
3. If you were the manager of a major outsourced service and heard you were to be audited, what aspects of the outsourcing arrangement would you want to make sure were strong?
As a manager of a major outsourced service, aspects of the outsourcing arrangement to be strengthened may depend on the choice of service, but there are some aspects that may be applicable to all forms of outsourcing such as
1. Logical Access
Logical access is very important and essential to prevent unauthorized access from locations where sensitive data is processed or stored.
Logical access involves verifying that
• security requirements such as regulatory specifications specified in the contract are being implemented.
•Security breaches are reported regularly, such as invalid access attempts.
• Independent tests are used to check that security levels cannot be breached, such
as conducting penetration tests of IT networks and Web sites
• Access to sensitive data is being restricted and/or particular transactions is being restricted to key/specific staff.
2. Data Management
This is safeguarding substantial amounts of sensitive and confidential data, personal information, intellectual property and trade secrets from malicious attacks and accidental loss. Cobit defines effective data management as ensuring the quality, timeliness and availability of business data.
I would
• Verify and evaluate that the appropriate controls are in place to manage the organizations data.
• Ensure that the data management process includes the establishment of effective procedures to manage the media library, backup and recovery of data, and proper disposal of media.
3. Physical and Environmental Protection
Protection for computer equipment and personnel requires well-designed and well-managed physical facilities. Cobit states that effective management of the physical environment reduces business interruptions from damage to computer equipment and personnel.
I would ensure that the service provider’s documents, systems, and infrastructure are secured properly.
4. Business Continuity
I would ensure that business continuity plan is comprehensively addressed by all the key elements.
5. System and Software Change Management
Appropriate system controls exist to make sure all changes are properly made.
I would verify and evaluate controls relating to changes such as assessments of changes, authorizations of change requests, reviews, approvals, documentation, testing and implementation.
i would also verify that changes that could impact the organization’s information and/or data has sign-off or approval from the organization
6. Software Development and Acquisition
An enterprise software development and acquisition process is essential to reduce acquisition and implementation risks
Cobit states that “Applications are made available in line with business requirements. This process covers the design of the applications, the proper inclusion of application controls and security requirements, and the development and configuration in line with standards. This allows organizations to properly support business operations with the correct automated applications.”
As the manager, I would verify and evaluate the software development and acquisition process followed by the service provider and ensure that they are the industry’s best practices throughout the software development life cycle for all new application developments and major acquisitions.
7. Personnel Security
The personal security is essential to make sure all personnel who have access to sensitive information or a particular location have the required authority and approvals.
As the manager, I would verify and evaluate the controls related to personal security including but not limited to mandatory confidentiality agreements for all employees. Most outsourcing partners have a standard non-disclosure agreement, which states the penalties for a breach of contract, including termination of services.
ref- sans.org
Richard Flanagan says
I don’t see compliance on your list. Remember, you still own all the responsibilities of complying with laws and regulations even if someone else is doing the work for you. If they screw up, its you who’s in trouble.
Yulun Song says
1. What different kinds of IT outsourcing are there?
There are several reasons that a company needs IT outsourcing: it needs highly skilled staff but cannot afford to have one; it is in need of a temporary help; its budget is not sufficient for the office team maintenance; it wants to create something high tech, but lack the expertise. Most logical classification of outsourcing companies is based on their geographical locations: 1) local outsourcing, choosing a company in your own country; 2) offshore outsourcing, finding a team somewhere in Asia, like India, China; 3) nearshore outsourcing, choosing a company that is not far from yours.
Local outsourcing has many advantages including that the local teams are easily accessible, that companies speak a same language, that they live in a same time zone, etc. Offshore outsourcing has many advantages including that the foreign country offers political stability, lower development costs and tax savings, etc. Nearshore outsourcing has many advantages including the ease to travel and communicate between the nearby companies.
Fangzhou Hou says
1. What different kinds of IT outsourcing are there?
There are 5 mainly types of IT outsourcings:
1. Offshore outsourcing – sending IT-related works to a companies in a foreign country which offers political stability, lower labor costs and tax savings.
2. Nearshore outsourcing – sending IT-related works to a companies in a country which shares a border with your own; presumably, it is easier to travel between the two and for the company and the provider to communicate with one another.
3. Onshore or domestic outsourcing – contracting with a third party located in the same country to provide IT-related work, off-site or in-house.
4. Cloud Computing – contracting with a third party to provide IT-related functions over the Internet or a proprietary network. Examples include Infrastructure-as-a-Service, Platform-as-a-Service and Software-as-a-Service.
5. Managed Services – contracting with a third party to provide network management functions including IP telephony, messaging and call centers, virtual private networks (VPNs), firewalls, and the monitoring of and reporting on network activity. In this type of outsourcing arrangement, a special emphasis is placed on the integration and certification of Internet security.
Sources: http://www.itmanagerdaily.com/it-outsourcing/
Fred Zajac says
What different kinds of IT outsourcing are there?
On-shore & Off-Shore
On-shore outsourcing is a 3-party service provider located in the same country. Off-Shore is a 3rd party located in another country.
For example: Your company is in Philadelphia.
On-shore outsource is your email to Microsoft 365. You on-shore your customer service department to ABC company in Cleveland, OH.
Off-shore outsource is your application development to XYZ company in India. You off-shore your customer service department to ABC company in the Philippians.
Fred Zajac says
What is business process outsourcing and how is it related to IT?
BPO is outsourcing a function of the business. Typical examples of BPO are Accounting, Technology, and Human Resources, but can include any business processes, like maintenance at an apartment complex or refinery service for an oil & gas company.
BPO relates to IT in a “cost basis” way. A company will usually decide to outsource a function of the IT because it will be too expensive to bring the process in-house. The initial investment will be too great or the process costs doesn’t justify handling the process internally. Many times, it revolves around payroll expense. When you factor in an employee’s salary, benefits, taxes, & space, a $40,000 a year employee can cost an employer around $80,000 a year. For the same $80,000, a company may be able to get the same process, but 3x effective. Why? because the outsourcing company is spreading out their resources over several companies.
Richard Flanagan says
Fred,
See my earlier note. It is very difficult to outsource if you don’t have good processes and systems (think EA). Its all about moving data in a routine way and if you can’t or don’t, you can’t outsource functions.
Fred Zajac says
If you were the manager of a major outsourced service and heard you were to be audited, what aspects of the outsourcing arrangement would you want to make sure were strong?
Service Level Agreement or Scope of Work is the arrangement I would want to make sure were strong. These are the responsibilities of the outsource company. The SLA is the document that addresses the services to be performed and the responsibilities of the vendor. The terms of the contract do hold risks, but in the United States, many times the terms of a contract are void if services are not performed by either party. I would want to make sure the verbiage is detailed. statements are precise and clearly understood.
Fred Zajac says
What is the difference between an outsourcing contract and a statement of work? Which should you be interested in as an auditor? Why?
The outsourcing contract is a detailed agreement between the company and service provider. It will include the terms, and should include a statement of work. The terms include policies like the length, cost, termination, disagreement handlings, and everything else pertinent to the user & provider relationship. The Statement of Work is a list of responsibilities for performance. The SOW will outline the providers service offerings. It focuses on the duties and responsibilities of the service provider to determine what functions will be performed by what process.
Wen Ting Lu says
Q: What are the different reasons a firm may wish to outsource a particular function or process?
1. SAVE MONEY- I believe the greatest benefit of outsourcing is saving money, no matter which service are company out-sourcing. Outsourcing helps control capital outlay. In addition, outsourcing IT services to a company that specializes in business networks and support will alleviates some of its expense compare with businesses that perform operations internally.
2. FOCUS ON CORE OPERATIONS- Outsourcing allows company’s management to focus their energies on their competencies. It could be stressing when mangers have to split their energies between activities that engage prospective customers and concerns with operations outside of the core business objective.
3. IT RESOURCE SHARING- Outsourcing IT system and service create balance between small firms and large enterprises by sharing the IT resources. Often time small companies might not have the budget or resource that large companies have to implement IT systems and services they need.
Source: http://smallbusiness.chron.com/benefits-vs-risks-outsourcing-services-2504.html
Loi Van Tran says
I like your list Wen, but one important consideration that I might add is obtaining expertise, or what others have already stated “world class capabilities.” For example many organizations may lack the expertise in new technology, an implementation of SAP. We all know that this is a long a stringent process, even for those who have done it before. Wouldn’t a company consider hiring expert or consultants to guide them through?
Wen Ting Lu says
Q: What different kinds of IT outsourcing are there?
1. OFFSHORE OUTSOURCING – sending IT-related work to a company in a foreign country that offers benefits such as political stability, lower labor costs and tax savings.
2. NEAR-SHORE OUTSOURCING – sending IT-related work to a company in a country that shares a border with your own. It’s easier in communication because travel are much simple between two nearby country.
3. ONSHORE OR DOMESTIC OUTSOURCING – contracting with a third party located in the same country to provide IT-related work, off-site or in-house
4. CLOUD COMPUTING– contracting with a third party to provide IT-related functions over the Internet or a proprietary network.
5. MANAGED SERVICES – contracting with a third party to provide network management functions including IP telephony, messaging and call centers, virtual private networks (VPNs), firewalls, and the monitoring of and reporting on network activity.
Source: http://www.itmanagerdaily.com/it-outsourcing/
Mansi Paun says
5. What are the different reasons a firm may wish to outsource a particular function or process?
Crafting and Executing an Offshore IT Sourcing Strategy: GlobShop’s Experience
5. Some of the reasons a firm may wish to outsource a particular function are :
• Unavailability of expertise – Company not possessing sufficient expertise in the function area
• Better cost-returns ratio – A company that has sufficient funds to build a team in-house might still choose to outsource the function if after figuring the set-up and maintenance costs more than outsourcing the functions
• Increased Efficiency – A company may choose to outsource a function if there are vendors that specialize in providing the service and can be relied on.
• Flexibility – A firm may outsource a function or process if the process has a lot of variation in the staffing requirements through the year. For eg: A Financial company might not want to employ a large team of software developers that are going to be utilized only for 1 project.
• Availability of cheap skilled workforce – Companies often choose to outsource work to other countries that have availability better skilled workforce available at a fraction of the cost thereby greatly reducing the cost.
• Tax breaks – Companies often choose to outsource to take advantage of the lower corporate taxes in some countries.
• Concentrating on core-business – Companies also choose to outsource to free up time and effort to focus on their core business so they can continue to stay ahead rather than having to worry about the supporting functions
Neil Y. Rushi says
I think you just picked my brain Mansi, these were the reasons I thought of as well. Some think outsourcing is a bad way to go but the main reasons in my opinion would be better to concentrate on the core business and flexibility. Even if the company has the resources, it can be a time issue to try and get projects done. So it can be better to give the duties to a company that makes IT project or anything IT as their core-business.
Jason Wulf says
Hi Mansi,
Tax breaks is an interesting area I hadn’t thought of for IT. I know Apple got in trouble a few months ago and was ordered to pay 13 billion euros for funneling monies. Do you have an example? My knowledge of international IT is limited.
Jianhui Chen says
Q: What different kinds of IT outsourcing are there?
Offshore outsourcing – sending IT-related work to a company in a foreign country that offers political stability, lower labor costs and tax savings
For example, many American company outsource its customer service and search engine optimization to oversea where has lower labor cost such as China, India, etc.
Nearshore outsourcing – sending IT-related work to a company in a country that shares a border with your own; presumably, it is easier to travel between the two and for the company and the provider to communicate with one another.
For example Many companies in the United States, for example, outsource work to Canada and Mexico. Geographic proximity means that travel and communications are easier and less expensive, there are likely to be at least some commonalities between the cultures, and people are more likely to speak the same language.
Onshore or domestic outsourcing – contracting with a third party located in the same country to provide IT-related work, off-site or in-house.
For example many apartment, education institute, and data center will outsource its safety service, like Temple univseristy outsource its campus safety service to Alliedbarton.
Cloud Computing – contracting with a third party to provide IT-related functions over the Internet or a proprietary network. Examples include Infrastructure-as-a-Service, Platform-as-a-Service and Software-as-a-Service.
For example many companies outsource its enterprise cloud service to Sungard.
Managed Services – contracting with a third party to provide network management functions including IP telephony, messaging and call centers, virtual private networks (VPNs), firewalls, and the monitoring of and reporting on network activity. In this type of outsourcing arrangement, a special emphasis is placed on the integration and certification of Internet security
Thymus Solution Ltd TSL provides delivery and management of network-based services, applications, and equipment to enterprises, residences, or other service providers.
Jianhui Chen says
source:http://www.itmanagerdaily.com/it-outsourcing/
Deepali Kochhar says
You made a good point here. Cloud computing has become one of the best source to outsource and manage services. Different platforms such as Salesforce are emerging to provide high quality services the customers.
One of the example is use of cloud computing in health care. Healthcare industry outsource services related to handling their important patient information. They are using cloud computing to share the patient data and to bring all the entities of the health care sector such as payers, patients, provider etc, under one umbrella. This gives them skilled services with high level of security to the PHI data.
Mengxue Ni says
1. What different kinds of IT outsourcing are there?
In order to answer this question, I think we need to understand why we need to IT outsource. Outsourcing may be a great choice when your company:
• Requires a highly skilled IT staff but can’t afford one
• Doesn’t have money to allocate to IT in its yearly budget
• Would benefit from the latest technology but doesn’t have the expertise to deploy it, or
• Needs temporary help
There are several types of IT outsourcing types:
1. Offshoring: moving business/service moving business/services overseas, typically to take advantage of lower costs and/or a more favorable economic climate
2. Nearshoring: transferring business/services to another country close by, oftentimes sharing a border with your own country
3. Homeshoring/onshoring: allowing employees to work from home rather than an office, factory, or related physical workplace
Any company looking to offload costs and focus on its core competencies can benefit from IT outsourcing. The key is to outsource in a way that is aligned with the business’s overall goals.
Loi Van Tran says
Thanks for the post Mengxue,
I would like to add Cloud Computing (SaaS, IaaS, PaaS) is also a type of IT outsourcing and is consideration that most companies are making. Cloud-managed outsourcing can range from software, platform, or even infrastructure as a service. You may think of a small business or even large organizations who needs additional storage. They can outsource storage needs to a cloud provider, instead of investing in their own, It is different from the others because it contracts with a third party to provide services over the internet or a proprietary network.
Jason Wulf says
1. What different kinds of IT outsourcing are there?
Offshoring: Work performed in another country. Subsets of this are farshoring and nearshoring.
Farshoring: Work performed overseas in a different country.
Nearshoring: Work performed in another country that is close by (i.e. a neighboring nation).
Onshore: Work performed in the same country (Sometimes called domestic).
Multi-sourcing: Uses a combination approaching of internal resources and third parties.
Outsourcing: A third party performs work for the organization.
Insourcing: An organization uses its own resources to perform the work.
Backsourcing: The process of going from outsourcing to insourcing.
A combination approach can occur with shoring and sourcing. Here are a few examples:
Onshore insourcing: Work is performed using the organizations resources in the same country.
Onshore outsourcing: Work is performed by a third party within the same country.
Nearshore insourcing: Work is performed using the organizations resources in a neighboring country.
Nearshore outsourcing: Work is performed by a third party located closer to the company.
Offshore insourcing: Work is performed using the organizations resources in another country.
Offshore outsourcing: Work is performed by a third party located in a different country.
Cloud Computing: A form of outsourcing, where typically a third party provides IT infrastructure or IT services.
Subsets of Cloud Computing including the following:
Public Cloud Computing: IT resources are used by multiple organizations.
Private Cloud Computing: IT resources are dedicated toward a single organization.
Hybrid Cloud Computing: An organization uses both Public and Private Cloud Computing.
IaaS: A third party provides an organization on-demand equipment, allowing an organization to install operating system and all necessary software needed by the organization.
PaaS: A third party provides in-house developers the equipment, operating systems, and resources to the organization.
SaaS: A third party provides a software application to an organization eliminating the need for hosting equipment and development personnel.
Paul M. Dooley says
What different kinds of IT outsourcing are there?
There are 3 types of IT outsourcing. The 3 types are as follows: Software Development, Application Support and Maintenance, and Infrastructure Management Services.
Software Development outsourcing involves outsourcing this work to a service provider who would do the analysis, design, coding, testing and integration in the software development cycle. The company who was having the work outsourced would be responsible to provide the service provider the requirements and specifications for the application. There are various types of this type of outsourcing and they are onsite (third party employees come to do work at company’s location), nearshore (service provider does the work at their own site but at a location close to the company), or offshore (typically done in a different country very far away from the company). Depending on the size and scope of the application a number of the outsourced phases of work can be done in any number of combinations of onsite, nearshore, or offshore.
Application Support and Maintenance is where a service provider is not developing the applications itself but rather supporting the application moving forward for its users. Additionally, this can be accomplished by a number of different combinations on where the actual work would be done.
Infrastructure Management Services is where the various functions such as system admins, DBA, network management, desktop management, security management, data center management are done by a service provider. Same as the previous 2, it is common to see a number of different combinations of onshore, offshore and onsite depending on the scope of what is being managed.
Anthony Clayton Fecondo says
5. what are the reasons a firm would outsource a function or process?
A firm outsources for a variety of reasons. If the function isn’t a core business function, a firm might outsource it to focus its resources towards its core competencies in order to better differentiate itself in the market.
Other times, it might be more cost effective to leverage a third party that has economies of scale and other advantages in a particular function rather than having a dedicated department.
If the company is lacking the necessary skills to perform a function, the firm may choose to outsource instead of going through the hiring process and paying a new employee for the job. Also, the skills might only be needed for a single project in which case it would be nonsensical to hire someone for that skill.
Another reason to outsource is too quickly provide additional resources in order to accommodate growth.
Yang Li Kang says
What are the different reasons a firm may wish to outsource a particular function or process?
Expertise – Vendors that provide outsourcing service usually specialize in that field. They have specific equipment and technical expertise that are usually better than the outsourcing organization. This enables them to complete that business process much more effectively, efficiently and at better quality.
Focus on core process rather than supporting process –By outsourcing supporting process, the organization can focus more time and resources on improving their own core business that actually helps raise their revenue.
Risk Sharing – Outsourcing helps shift certain responsibilities to the outsourced vendor. Since they are specialists, they should be able to plan risk mitigating factors better.
Reduced Cost – Operational and recruitment cost can be reduced since the organization does not have to hire and operate in-house.
Anthony Clayton Fecondo says
1. What different kinds of IT outsourcing are there?
There are three primary types of outsourcing:
1. onsite: the service provider renders the service/performs the process on the contracting firm’s property
2. nearshore: the service provider renders the service/performs the process at its own facilities within the same country or region of the contracting firm
3. offshore: the service provider renders the service/performs the process at its own facilities thousands of miles away from the contracting firm
Outsourcing can utilize any one or a combination of these methods
Anthony Clayton Fecondo says
What is the difference between an outsourcing contract and a statement of work? Which should you be interested in as an auditor? Why?
The difference between an MSA and a SOW is the scope of the documents. An MSA is the broad, overarching contract that manages all aspects of an outsourcing agreement. A SOW is a component of the MSA and it establishes the service to be rendered and the relevant details in terms of the deliverables and the schedule of the work.
An auditor should be more concerned with the MSA because its a more robust document and can provide more necessary information that the isn’t within the scope of the SOW. When auditing outsourcing, the work being done is not the only aspect to consider. MSAs cover the services, personnel, insurance, legal compliance, documentation, retained authorities, and more. In order to audit the entire process, the auditor needs a document that can relay the information relating to every step of the process and the only document that can provide that information is the MSA
Andrew P. Sardaro says
Anthony,
I agree with your statement that an auditor is more concerned with a MSA rather than a SOW. The MSA provides detailed information as to how two companies will do business together. This specific encompassing details allows an auditor to fully understand the agreement process.
Noah J Berson says
5. What are the different reasons a firm may wish to outsource a particular function or process?
Each firm prioritizes their reasons differently but they usually go with a combination of the following reasons.
Lowering operational costs is often the most cited reason of outsourcing. Labor and equipment are often available at different prices in other companies due to different regulations across state or country borders.
Focusing on core competencies is when a company knows what they are good at so outsources functions/processes they have little experience in. They may not be good at marketing for example and may outsource that function. Another benefit of this is that the company you work with may specialize in that aspect increasing the overall quality of your business. Utilizing expert resources can have a great positive effect on a process.
Outsourcing can also decrease the overall risk your company faces. Having agreements with your partners is a good way to mitigate risk. You also may be able to avoid certain regulations entirely.
Abhay V Kshirsagar says
There are four types of IT outsourcing:
1) Nearshore outsourcing: In this type, the company sends the IT relevant work to another company that shares the border as it is convenient to travel between the two countries for better communication.
2) Onshore outsourcing: In this type, the company hires a third-party contractor that is located in the same country for off-side or in-house IT work.
3) Offshore outsourcing: In this type, the company sends the IT work to a different company that is in a foreign country. The purpose is to get past the obstacles that rise while entering a new country and to gain political stability with lower labor costs. For e.g.: Microsoft’s BPOs in India for technical assistance.
4) Managed Services: The company uses a Managed Service Provider (MSP) for network management functions like VPN, call centers, monitoring network, etc.
Joseph Henofer says
5. What are the different reasons a firm may wish to outsource a particular function or process?
Below are some of the different reasons why a firm may wish to outsource a particular function or process.
1. Cost – Cost is the main reason why a company will take outsourcing into consideration for a particular function or process. Companies have the opportunity to save money by off-loading a department like customer service to a under developed country. As outsourcing to the under developed countries becomes more prevalent for companies the cost may not be as beneficial as it was before but it should be explored.
2. Time – Projects run the risk at times of not meeting its deadline and without the proper people and skills, the project can be a disaster. Now the company can hire more skilled people but that cost more money, which is expensive and with the left over manpower may not be needed. This is where outsourcing is a great alternative for specialized projects. A company can do its research to find the outsource company that can provide the skills and people to meet any strict deadline.
3. Skills – Leveraging an outsource company can provide a certain set of skills that the current company doesn’t have. For example if you need some software coded in a particular technology but the your company does not have anybody with those skills to do the job. You can outsource this work to a company who has the skilled people to complete this task, but keep in mind that if your outsourcing this type of work you may run into problems with maintenance in the future.
Jason Wulf says
Hi Joseph,
I’m thinking an additional reason maybe regulatory reasons to place IT services in different countries to comply with laws. Outsourcing services or infrastructure to a particular country lends itself to your first point of cost.
Kevin Blankenship says
What different kinds of IT outsourcing are there?
1. Onshore outsourcing: This is where an organization hires a 3rd party company or contractor that is located in the same country as the organization for the purpose of doing in-house work.
2. Offshore outsourcing: This is when an organization sends work to a foreign contracting company to do work. Often these are countries with lower wages or lower workers restrictions.
3. Nearshore outsourcing: This is where an organization sends work out of country, but within a short distance from the organization. This makes border travel simple keeps the work close by.
4. Multi-sourcing: This is when an organization uses both 3rd party and internal resources to complete a project.
Ryan P Boyce says
1. There are several different forms of outsourcing but the three largest are Multi-sourcing, Nearshoring, Offshoring, and Contracting Out. IT outsourcing takes the form of all these within modern companies. An example of Multi-sourcing within IT would be when a company uses more than one company to do its software development. Company X might be used to design the front end of an application, while Company Y produces the backend or designs the database. Offshoring is commonly seen in all aspects of IT. One area in which Offshoring is widely used is in product support. At my previous employer, we used Symantec Backup Exec to perform our data backups. Being new to the software, I had to call their product support office several times and initially I would speak with someone in the US but then be redirected to someone in what seemed to be the Middle East. Nearshoring in IT might occur when a company moves the physical production of its hardware to a country like Mexico or further south to another Latin American country. The best example if Contracting Out would be when a company contracts out its infrastructure to a cloud computing provider such as AWS or Google Cloud.
2. Business Process Outsourcing is the practice of contracting out a specific business function to a third party. I have first-hand experience in this area as I previously worked for a tax software consulting company. Our clients were state and city governments whose tax systems were running on legacy software. Many large consulting companies such as Accenture and Deloitte have teams dedicated to tax software work but the company I worked for was only one of two consultants in the country whose focus was specifically in tax software. The issue governments face is that data about tax payers is spread across multiple systems. It is extremely difficult for them to devote resources to aggregating this data and also to update existing software to reflect these changes. Tax software consultants are a classic example of BPO for the business units who are responsible for collecting and processing taxes within governments.
3. If I were the manager of an outsourced service such as cloud computing and I knew we were about to be audited, the first aspect of the outsourcing arrangement I would be concerned with is connectivity and network security with a heavy focus on security. It goes without saying in 2016 that security in any aspect of IT is highly important. With so many ways in which criminals can hack any part of an information system-infrastructure, network, software, people-the odds off there being vulnerabilities in a system are high. I would want to be certain the service we were providing was highly secure. Next, I would group compliance with regulatory requirements and project monitoring and governance in the same category and ensure the audit showed we were within scope in these areas. Being out of compliance, especially if we are processing sensitive data, can become financially burdensome due to fines and penalties.
4. An Outsourcing Contract, essentially, details what will be outsourced including the levels of service that need to be met. A Statement of Work comes after an Outsourcing Contract is agreed upon and its primary focus is on how the work will be done including project guidelines and deliverables. Basically, the Outsourcing Contract is the “what” and the Statement of Work is the “how”. As an auditor, both documents would interest me but I would be more interested in the Outsourcing Contract. The contract is where I would find the service level agreement, what services are being delivered and why, and, most importantly, what penalties are required if these services or the quality of the services are not being met.
5. A firm may wish to outsource a particular function or process for many reasons but the biggest and most obvious is outsourcing saves them money. Outsourcing server infrastructure is very cost effective now especially since the security, performance and reliability of cloud computing have drastically improved. Many costs are eliminated here especially employee costs (salary and benefits) and utility costs (electric). A company might also not have the resources wo devote to a particular function such as accounting or specifically the development of new accounting software. This is a mandatory business process so companies who do not have the personnel or capital to develop a solution are forced to outsource here to avoid incurring costs.
Ryan P Boyce says
1. There are several different forms of outsourcing but the three largest are Multi-sourcing, Nearshoring, Offshoring, and Contracting Out. IT outsourcing takes the form of all these within modern companies. An example of Multi-sourcing within IT would be when a company uses more than one company to do its software development. Company X might be used to design the front end of an application, while Company Y produces the backend or designs the database. Offshoring is commonly seen in all aspects of IT. One area in which Offshoring is widely used is in product support. At my previous employer, we used Symantec Backup Exec to perform our data backups. Being new to the software, I had to call their product support office several times and initially I would speak with someone in the US but then be redirected to someone in what seemed to be the Middle East. Nearshoring in IT might occur when a company moves the physical production of its hardware to a country like Mexico or further south to another Latin American country. The best example if Contracting Out would be when a company contracts out its infrastructure to a cloud computing provider such as AWS or Google Cloud.
2. Business Process Outsourcing is the practice of contracting out a specific business function to a third party. I have first-hand experience in this area as I previously worked for a tax software consulting company. Our clients were state and city governments whose tax systems were running on legacy software. Many large consulting companies such as Accenture and Deloitte have teams dedicated to tax software work but the company I worked for was only one of two consultants in the country whose focus was specifically in tax software. The issue governments face is that data about tax payers is spread across multiple systems. It is extremely difficult for them to devote resources to aggregating this data and also to update existing software to reflect these changes. Tax software consultants are a classic example of BPO for the business units who are responsible for collecting and processing taxes within governments.
3. If I were the manager of an outsourced service such as cloud computing and I knew we were about to be audited, the first aspect of the outsourcing arrangement I would be concerned with is connectivity and network security with a heavy focus on security. It goes without saying in 2016 that security in any aspect of IT is highly important. With so many ways in which criminals can hack any part of an information system-infrastructure, network, software, people-the odds off there being vulnerabilities in a system are high. I would want to be certain the service we were providing was highly secure. Next, I would group compliance with regulatory requirements and project monitoring and governance in the same category and ensure the audit showed we were within scope in these areas. Being out of compliance, especially if we are processing sensitive data, can become financially burdensome due to fines and penalties.
4. An Outsourcing Contract, essentially, details what will be outsourced including the levels of service that need to be met. A Statement of Work comes after an Outsourcing Contract is agreed upon and its primary focus is on how the work will be done including project guidelines and deliverables. Basically, the Outsourcing Contract is the “what” and the Statement of Work is the “how”. As an auditor, both documents would interest me but I would be more interested in the Outsourcing Contract. The contract is where I would find the service level agreement, what services are being delivered and why, and, most importantly, what penalties are required if these services or the quality of the services are not being met.
5. A firm may wish to outsource a particular function or process for many reasons but the biggest and most obvious is outsourcing saves them money. Outsourcing server infrastructure is very cost effective now especially since the security, performance and reliability of cloud computing have drastically improved. Many costs are eliminated here especially employee costs (salary and benefits) and utility costs (electric). A company might also not have the resources wo devote to a particular function such as accounting or specifically the development of new accounting software. This is a mandatory business process so companies who do not have the personnel or capital to develop a solution are forced to outsource here to avoid incurring costs.
Folake Stella Alabede says
4. What is the difference between an outsourcing contract and a statement of work? Which should you be interested in as an auditor? Why?
As referenced from our reading for the week – Audit of Outsourcing-
The contract is a legal document that defines all the requirements and characteristics of an outsourcing arrangement. Most outsourcing arrangements are put in place after a detailed process of evaluations, due diligence and negotiations, with exchange of communications between the company and the service provider over a period of time.
“A comprehensive contract should be documented. Legal counsel is always advisable. The organization should seek the services of a lawyer who specializes in such contracts.” (CICA, 2003)
The statement of work lists the work to be done by the service provider. (this could be any of – Software development, Application support and maintenance, Infrastructure management services etc)
As an auditor, you should be interested in the contract. This is because the contract is a more detailed and comprehensive document. The auditor should verify that the key provisions are addressed in the contract. The service provider might actually be doing the job stated in the SOW, but it is reviewing the Contract that lets an auditor reconcile both documents to ensure that the service Provider’s performances are aligned with the outsourcing contract.
Alexander B Olubajo says
5. What are the different reasons a firm may wish to outsource a particular function or process?
A firm may wish to outsource a particular IT function or process for numerous reasons, some of which are:
— Cost efficiency: which I think is the most obvious and popular reason firms outsource IT functions or process. This enables a firm to save money on IT services that will have cost them more if they were done in-house or even locally (i.e this is a reason that makes the most sense for offshore outsourcing). Firms tend to save administrative and operating costs.
— Accessibility and availability: firms that was their IT services or functions to be easily accessible globally by their customer and readily available all the time opt to outsource that particular function of process. This will make the most sense for offshoring and cloud-enabled outsourcing.
— Freeing up resources: because there are limited resources as an organization, a firm has limits to the type of things that can be accomplished in an IT context. Firms offloading their IT support to a third-party frees up internal resources that can be allocated to processes that can expand its business.
— Expertise: firms may also choose to outsource IT processes and functions in order to have access to high levels of technology and resources that they would otherwise have no access to. This will help firms stay competitive in their industry.
— Room to focus on other things: offloading your IT support responsibilities lets you focus more on your business. When you’re handling all of your IT support internally, your focus is often divided by a bunch of different technical priorities to keep your site, product and/or application up and running. Outsourcing IT lets you focus on what matters: growing and supporting your business – not troubleshooting software, hardware and user issues.
Jason Wulf says
Hi Alexander,
I’m thinking another reason may be risk transfer to indemnify the organization from legal risk. For example, privacy laws different countries maybe incompatible. Offshoring particular IT services may remove, mitigate, or transfer the risk.
Joseph Henofer says
Jason,
Even if you transfer the risk you are still liable to a certain degree. Offshoring will not remove a risk, because risk will never be fully removed. Yes it can be mitigated or transferred, but even with that you have to maintain continuous auditing so if the risk you transferred gets compromised you can cover yourself when it comes to legal issues. The courts could say you did not perform due diligence or due care, therefore your company acted in a negligent way.
Alexander B Olubajo says
Joseph,
I was going to say just that but I guess you beat me to it, and it couldn’t have been said in a better way.
Jason – I would agree with Joseph’s comment. I necessary wouldn’t see “transfer of risk” as a reason firms outsource processes or functions because regardless of whether or not you outsource them, risk cannot be totally eliminated. In fact, I was going to add that in my post to that question but I remembered what Professor Flanagan had said in his last video lecture on compliance – which ensures that the organization is fully aware and understands that they are still liable for any potential breech (security risk) and not the third-party vendor or service provider.
At the end of the day, if stuff hits the fan, I don’t think your investors or board members will be querying the service provider. They will be coming at the firm.
Daniel Warner says
2. What is business process outsourcing and how is it related to IT?
Business Process Outsourcing (BPO) is when some of the internal business functions of a company are outsourced to a service provider. Some of these business processes may include, HR, accounting, and customer service. The variety of business processing outsourcing available is vast, and can range from data entry, to internal administration (making copies, filing).
There are several internal business functions that IT supports. If an internal IT department were to support a vendor that was performing a business function, IT would have to ensure that the link between the service provider and the company was secure. IT would need to test for any vulnerabilities between the company and service provider.
Andrew P. Sardaro says
What different kinds of IT outsourcing are there?
IT outsourcing is the use of external/third party service providers to effectively deliver IT- business process, application service and infrastructure solutions for business results.
Types of outsourcing are as follows:
On-shoring: refers to the relocation of business processes to a lower-cost location inside the same country.
Nearshoring: refers to a company contracting a business process to an external or third party company located across national borders within its own region. The advantage here is that there will be similarities in language, political, cultural economic, geographic linkage and time zone.
Offshoring: refers to outsourcing which is done across national borders. The term refers to the relocation of business processes in another country for cost effectiveness purposes.
Cloud Computing: – contracting with a third party to provide IT-related functions over the Internet. Examples IaaS, PaaS, SaaS.
Andrew P. Sardaro says
What are the different reasons a firm may wish to outsource a particular function or process?
There are numerous reasons why a company may choose to outsource certain business processes. Some examples:
1. Reduce operating costs. Eliminate and control the costs associated with hiring employees, training, health insurance, employment taxes, retirement plans, management oversight of the employees.
2. Lower tax rates. By moving business processes overseas, you can take advantage of the lower corporate taxes in other geographic locations.
3. Access to exceptional resources and experience. When outsourcing, companies benefit from the collective experience of a team of IT professionals for specific IT functions.
4. Expand company focus. Outsourcing lets you focus on your core competencies.
5. Free internal resources for hired purposes. Outsourcing allows you to retain employees for their areas of specialty and usage.
6. Difficulties with managing a problematic or out of control business function.
7. Properly utilize capital funding. Focus capital funds on items that are directly related to your product and customers.
8. Share and reduce risk. Outsourced IT providers work with multiple clients and need to keep up on industry best practices, they typically know IT trends and make correct decisions. This reduces the risk that your company will implement the wrong technology resulting in time and financial loss.
9. Time Zone: As your company closes shop for the day, your business process and services continue in a different geographical location. This advantage gives you the benefit of round-the-clock business operations.
Sheena Thomas says
Andrew,
I never thought about lower tax rates or time zone aspects for outsourcing functions. Great findings. Now, that I think about it a number of vendors I deal with while working at Temple University outsource their Tech Support team after hours. Its nothing for me to call a vendor in the morning or late at night and speak with tech support in India or England.
Andrew P. Sardaro says
2. What is business process outsourcing and how is it related to IT?
Business process outsourcing (BPO) is the contracting/outsourcing of non-core business competencies and functions to a third-party provider. BPO examples are front office customer services (such as tech support) and back office business functions (such as billing).
Often, business processes are information technology-based, and are referred to as ITES-BPO (Information Technology Enabled Services). ITES BPO is an outsourcing model that uses IT, typically over the Internet, in the delivery of the outsourced process. This type of outsourcing has the same features as BPO with the use of IT as the service delivery mechanism.
The ITES BPO model allows companies the flexibility to allocate resources towards its core competencies (design, production, and delivery of its products), rather than to ancillary business processes.
Andrew P. Sardaro says
What is the difference between an outsourcing contract and a statement of work? Which should you be interested in as an auditor? Why?
An MSA defines how two companies will do business together. It is a legally binding contract that governs every SOW you accept together. The MSA includes important things like: payment terms, compliance, Insurance, liability, how to solve disputes, and no solicitation of employees.
The SOW defines the scope of a project, the deliverables, timelines, price, invoicing, conditions for any particular project. From a client perspective, this is what the other company is legally agreeing to deliver. If you are the Vendor, the SOW is what you are agreeing to deliver.
As an auditor, I would be interested in both documents as they provide unique information for when auditing outsourcing. However, the MSA provides me specific encompassing details as to how both parties are in agreement.
Kevin Blankenship says
That’s a good concise summary. I agree with you that the MSA would be a bit more interesting to an auditor. Generally the MSA is going to be more specific about things in the agreement. Like you said, often the payment terms and monetary issues are laid out in it. Also, if there is a conflict between the MSA and SOW, the MSA generally takes precedence in settling the issue.
Anthony Clayton Fecondo says
Briefly list the critical challenges that GlobShop faced in executing its offshore strategy? What would you look for if you were auditing the implementation of this outsourcing deal?
The first challenge of outsourcing was deciding on a suitable place from which to outsource. GlobShop researched several different geographies, but instabilities, uncertainty regarding the protection of intellectual property, and other such events made selecting a suitable company difficult. After consideration, GlobShop determined that India was the best fit for outsourcing as far as geographic location was concerned. However, even after deciding on the country, GlobShop still had to choose a specific vendor.
The next issue was an incompatibility of GlobShop’s internal resources and ISS’s processes. After this hurdle was identified, GlobShop and ISS both had to invest time and effort into redesigning their systems and processes to better facilitate the offshore interactions. However these accommodations were worth the investment as GlobShop reaped generous savings by utilizing ISS’s services which eventually led to the development of a partnership between the two companies. Globshop focused on developing this partnership and started entrusting ISS with core business systems, increasing ISS staff working onsite with Globshop, providing culture training to facilitate better cooperation with onsite ISS staff, and including ISS staff in high level decision making.
One of the larger struggles involved in the outsourcing of IT functions was laying off large portions of the internal IT staff. Determining the best method of laying people off, when to inform the employees that they were being laid off, determining severance pays, retention pay, information transferring, career transition help, and personal interviews. These processes were demanding and costly, but were necessary to facilitate amicable separation.
Perhaps the largest issue that GlobShop will experience with offshoring is yet to come. At the end of the case, various higher-ups from GlobShop were expressing their thoughts about the company’s relationship with ISS going forward and GlobShop’s state of reliance on ISS. Whenever a company depends too highly on a third party, there is significant risk involved. In GlobShop’s case, there’s the risk of ISS failing, but there’s also the risk of ISS having other more important clients to cater to.
If I were to audit this process, I would pay more attention to the controls in place to ensure that ISS is meeting the needs of GlobShop in terms of committing the necessary time and resources. All the evidence in the case indicates that ISS is capable of providing the necessary services and does so in an effective, well managed way. For this reason, I wouldn’t be overly concerned with the specific processes, but rather the dedication that ISS has to GlobShop. As indicated towards the end of the case, GlobShop is essentially dependent on ISS, whereas ISS could do without the GlobShop account. When auditing the MSA, I would focus on the controls that guarantee GlobShop’s needs are being met.
Xiaodi Ji says
What are the different reasons a firm may wish to outsource a particular function or process?
1. This firm do not have ability to build this product.
For example, Apple use other companies’ cell phone screen because Apple cannot product it.
2. They can build this product. However, other company have more complete and excellent product.
For example, Apple used powerPC for it’s desktop. However, its performance was not good, so Apple choose to use Intel CPU.
3. This company can build great product but they want to saving cost or vendors can provide cheaper product.
4. Company wants to gather people to develop new product. Then they choose put some unimportant function to other companies’ to save time.
5. Patent authorization and raw material are quit expensive and complex. Thus, they outsource these from other company to reduce spend and avoid trouble.
Xiaodi Ji says
2. What is business process outsourcing and how is it related to IT?
Business process outsourcing means that one company give some tasks to other companies to ask them help to do it together. It likes a team work. One company is a leader. It gives tasks and projects to other people or companies. However, they also have some difference. During the Business process outsourcing, the leader company own this program. They can decide which companies they want or not. During this process, company can save a lot.
It has the same situation with IT. A company or IT department cannot do anything perfectly by themselves. Thus, they need “team work” to get together to finish this program. Take a middle company as an example. If they want to build a department for repairing computer, they have to hire one or two people. However, these people do not have work everyday. Thus, this is the wast of resources because company have to pay money for them and manage them. If they hire a vendor to do this, they can get a professional computer engineer. Meanwhile, if they do not satisfied with this person, they can require vendor change it rather than caring about complex legal question.
Xiaodi Ji says
What different kinds of IT outsourcing are there?
There are five different IT outsourcing.
1. Offshore outsourcing. Putting IT-related work to a foreign country. Different have different situation. In some country, the tax or the labor costs is quite low. Meanwhile, some countries have specially policies for the IT company. Thus, set IT-related work in these place can save a lot.
2. Nearshore outsourcing. Putting IT-related work to a neighboring country. By using first method, it has a serious problem that it is not easy to travel between two company. Thus setting to a neighboring country can solve this problem. We may not only can get preferential policies, but also if this vendor has some problems, we can get it immediately and solve this problem as soon as possible.
3. Onshore or domestic outsourcing. Putting IT-related work in the same country. Sending works to other country. We have to follow different policies which are quit complex. Sometimes, we also have some language or logical problem. However, sending to a third -part domestic vendor can solve these problems.
4. Cloud computing outsourcing. Putting IT-related work in the Internet. This is a new outsourcing which mainly include infrastructure, development platforms, and software applications. When we want to build a website for our company, we do not need build a server. We can just rent it from Google or other companies. We do not care about where servers locate in. We use Internet connect it.
5. Managed service. Providing network management. A third party vendor provide network management. They take care about the company’s all activity which connect to the network.
Source:
http://www.itmanagerdaily.com/it-outsourcing/
http://www.itmanagerdaily.com/cloud-computing-101/
Folake Stella Alabede says
2. What is business process outsourcing and how is it related to IT?
Outsourcing services can be specific to a process or internal procedure, which is commonly referred to as process-specific Outsourcing. It has become a recent trend to outsource specific IT-related aspects to other companies or units that specialize in that specific service
Business process outsourcing (BPO) is the contracting of a specific business task to a third-party service provider
Business process outsourcing is related to IT in the sense that IT is a major part of any organization and its decisions, a lot of IT services such as Networking, Help-desk, Website Hosting, Software development, Disaster recovery, Data center functions like data processing and storage, Data back-up, recovery and transfers, Application support and maintenance, Infrastructure management services etc are being outsourced by organizations. These are IT services that are also specific to an organizations business.
Sheena Thomas says
2.What is business process outsourcing and how is it related to IT
Business process outsourcing consist of sending internal job functions such as billing, payroll, purchase, customer service, etc to a service provider I think these processes relate to IT in how the service provider receive the data from the client. The data can be sent via batchfile or uploaded to sftp server to the service provider. Once the service provider receive the data how/where the data is processed and stored in their environment.
Richard Flanagan says
Sheena,
Your examples are at the low end of BPO. You also need to think about arrangements that have the service provider directly connected to your system and using it to process transactions. So in the example I used earlier. A service provider in Shanghai was using our SAP system to pay all of Rohm and Haas’ bills.
Sheena Thomas says
1.What different kinds of IT outsourcing are there?
Following IT outsourcing
-Tech support
-Software & Application Development
-IT Security
-Storage
-Data Back up
-Website hosting
-Email (google)
-Network Installation
-Disaster Recovery
-Incident Response
Sheena Thomas says
5.What are the different reasons a firm may wish to outsource a particular function or process?
A firm may wish to outsource for the following reasons below..
-Cost Savings
-Customer Satisfaction
-flexibility and scalability
-Can help the company to focus resources in other areas for expansions.
-Transfer responsibility and liability of sensitive material/data
Ivy M. McCottry says
Sheena – I like that you added customer satisfaction and transfer responsibility and liability of sensitive material/data. Customer satisfaction is critical to business success and sometimes others are able to driver things better than the original service provider because of the attention that can be provided by a dedicated third-party. Transferring responsibility is a big deal especially for a small company that just might not have the capacity to deal with certain issues.
Kevin Blankenship says
What is the difference between an outsourcing contract and a statement of work? Which should you be interested in as an auditor? Why?
And outsourcing contract, or Master Services Agreement (MSA) is a governing document for the entire contract relationship between the two organizations. It covers both broad a specific aspects of the contract including payment, project management, services delivered, expenses, audits, term, and other things like indemnification and insurance.
A Statement of Work (SOW) is more specific to the actual work being done. It cover timelines, actual work rendered, billable hours, milestones, and other aspects of the project.
If I was to audit, I would probably be more interested in the MSA. While project specifics are good, the MSA covers a lot of the information and auditor would want to see. This includes the payments, terms of contract, insurances, payments, workload, and other aspects. Many of the different rights and information shared between the parties is outlines in the MSA as well.
Sachin Shah says
4. What is business process outsourcing and how is it related to IT?
Business Process Outsourcing refers to when a company sends company job roles or functions to a third party. It can be up front or customer related or back office and more operations geared. In my work we outsource patient billing or coding and that data is transferred to companies via SFTP or TCP\IP connections. I would say that is back office and we used to contract our help desk to a consulting company CSC, before bring that in-house. I think of jobs where a company will hire a temp agency to do back office work such as accounts payable or receivable or front office work like data entry or customer service. BPO can relate to IT or any industry in some form or another.
Jaspreet K. Badesha says
1. If you were auditing GlobShop’s move to offshoring how would you evaluate their decision? Did they do the right thing? Why or why not? What evidence do you see?
I think their decision was very well made. They tested the waters to see if they were doing the right thing and then created a partner relationship with one specific vendor to execute that relationship. They did the right thing in the sense of providing diversity training for both teams to ensure seamless integration and teamwork. They also saved a lot of money and incentivized the vendor with some to ensure IT would work better and they would maintain their relationship.
Ivy M. McCottry says
What is the difference between an outsourcing contract and a statement of work? Which should you be interested in as an auditor? Why?
An outsourcing contract outlines the contractual terms of the outsourcing relationship. It establishes parameters for the provider, recipient, services, standards, and any other expectation considered necessary to capture and memorialize such as liability, insurance, personnel requirements etc.
A statement of work spells out the specifics of the work accomplished by the provider for the recipient. It’s the map of what’s done, whether for the duration of the contract or on a day-to-day business and is a part of the contract, possibly as an addendum.
An auditor should be in interested in the contract because it includes the statement of work. The contract and statement of work together show what the provider performs on the recipient’s behalf and provides perspective into what vulnerabilities are incurred by the contract whether on the recipient end or provider end.
Ivy M. McCottry says
What different kinds of IT outsourcing are there?
There are various types of IT outsourcing. Some common IT outsourcing that I see in my work and outside of work are:
1) call center outsourcing for tech/help desk support (some telco’s outsource help desk support)
2) application/software development outsourcing
3) network monitoring (Government, military)
4) website management for large audience portals (ex. healthcare provider and insurance portals)
5) IT infrastructure (IaaS) outsourcing (for scale and ease of management by both large and small companies)
Jaspreet K. Badesha says
1. What different kinds of IT outsourcing are there?
There are three major types of IT outsourcing. 1. Off-shoring which is literally selecting a vendor from a different country to perform those set IT functions you plan on outsourcing. This is usually done to cost cut as foreign countries salaries or conversion rates are lower.
2. On-shoring – this is selecting a domestic vendor to perform those IT functions you plan on outsourcing.
Within these generalities there is
1. Near shoring – basically off-shoring your work but to a country that is closer like Mexico instead of India, so you avoid the time difference and its closer incase you need to visit.
2. Selecting multiple vendors to complete your work both offshore and onshore or having some parts of your function be performed within your company as well as offshore. For example, my company has majority of our QA department offshore – but internally we have QA managers and leads on shore who guide some of those offshore resources. Each project gets a mix of internal and offshore QA resources to make up for holiday and knowledge gaps.
Ivy M. McCottry says
What are the different reasons a firm may wish to outsource a particular function or process?
A firm may wish to outsource a particular function or process for:
-cost savings: a small company might scale infrastructure easier with outsourcing; a large company might gain cost savings because of not having in-house capability or legacy infrastructure that is costly to maintain
-geographic reach: a company might need to outsource to cover a specific territory
-skill gap: a company might not have in-house capability
-time savings: a company might save time getting the capability by outsourcing
-continuity: a company might outsource for continuity and disaster recovery planning purposes
Jaspreet K. Badesha says
What are the different reasons a firm may wish to outsource a particular function or process?
Reasons a firm may want to outsource particular functions are because they are simply not the best at those functions and they do not want their organization to suffer. Another reason is to cut costs, if I am paying all of my internal developers at least $120k but if I hire similar talent off-shore for $70k I will be saving. However, I may want to combine the two to get the best service and products. Some functions may not be worth the effort for the cost internally and are better to just pay someone else to do it to simply save time.
Xiaodi Ji says
4. What is the difference between an outsourcing contract and a statement of work? Which should you be interested in as an auditor? Why?
Outsourcing contract is a legal document. Once both parts sign it. It has legal effect, which both sides cannot change it alone. It looks like the structure of a house.
A statement of work defines the scope of a project, specific deliverables, scheduling and additional responsibilities. This statement gives more detail about outsourcing. It seems like furniture in the house which make house more beautiful and comfortable.
In my opinion, as an auditor I am interested in outsourcing contract. Outsourcing contract is a framework document which is important. First of all, it is a legal document. If you do not make clear in it. Vendor can refuse your requirement which our of the contract. Then, it makes rules for cooperation, which is the foundation of cooperation. If we do not have strong foundation, we cannot build or decorate house.
Therefore, both of them have significant position in outsourcing. However, Every work or cooperation base on the outsourcing contract. Beautiful furniture need stable house.
Ivy M. McCottry says
What is business process outsourcing and how is it related to IT?
Gartner: Business process outsourcing (BPO) is the delegation of one or more IT-intensive business processes to an external provider that, in turn, owns, administrates and manages the selected processes based on defined and measurable performance metrics.
http://www.gartner.com/it-glossary/business-process-outsourcing-bpo/