Topics in this domain
- IT Governance vs. IT Management
- Board and Senior Management Roles
- IT Steering Committee
- IT Strategy and Business Alignment
- Balanced Scorecard
- COBIT
- ITIL
- ISO 27001/27002
- COSO: ERM and Internal Control
- Policies, Standards, Procedures, Guidelines
- IT Organizational Structure and Key Roles
- Segregation of Duties in IT
- Enterprise Architecture (Zachman, TOGAF)
- Risk Management Process
- Qualitative vs. Quantitative Risk Assessment
- Risk Responses: Mitigate, Transfer, Avoid, Accept
- Risk Appetite and Residual Risk
- Maturity Models (CMMI)
- KPIs and KGIs
- Outsourcing: Benefits and Risks
- Vendor Selection, Contracts, SLAs, Right to Audit
- Cloud and Offshore Governance
- Portfolio and Resource Management
- HR: Hiring, Training, Termination
- Legal and Regulatory Compliance
- Quality Management
Outsourcing: Benefits and Risks
Hiring someone else to do it
Plenty of organisations hand IT work to outside specialists: payroll processing, data centres, the service desk, whole applications. Done well, it brings skills and savings. Done badly, it brings outages, breaches and lock-in.
Think of hiring a builder to extend your house. They do the work, but if the extension collapses onto your neighbour’s car, the council and the neighbour still come to you. Outsourcing works the same way.
When an organisation outsources, it transfers the work. It keeps the accountability, including legal and regulatory responsibility for its data and customers. Any exam answer saying “the vendor is now responsible” is testing this.
Benefits and risks
| Risk | What it looks like |
|---|---|
| Loss of control | Less say over priorities, quality and security |
| Loss of knowledge | The people who understood the systems leave |
| Vendor lock-in | Switching becomes too expensive or practically impossible |
| Vendor failure | Bankruptcy, takeover, or the service simply failing |
| Data protection | Data handled outside your direct control, possibly abroad |
| Hidden costs | Transition, contract management, change requests, exit |
| Sub-contracting | The vendor passes work to companies you never checked |
| Legal and jurisdiction | Different laws; hard to enforce the contract |
The outsourcing life cycle
Before signing
- a business case weighing benefits against full costs and risks
- due diligence on the vendor: finances, capability, security controls, certifications, references, sub-contractors
- a contract with clear scope, SLAs, security and privacy duties, a right to audit, and exit terms
During the relationship
- monitoring SLAs and performance, with regular service reviews
- independent assurance: SOC 1 or SOC 2 reports, ISO 27001 certificates, or your own audits
- watching the vendor’s financial health and sub-contractors
- keeping enough skilled people in-house to manage the contract and challenge the vendor
At the end
- a written exit plan: data returned or destroyed, knowledge transferred, transition support, timelines
Example. A bank outsources card processing. The processor is breached. Regulators fine the bank, which is still accountable for its customers’ data. Whether the bank can recover any of its losses from the processor depends entirely on what the contract says about liability.
Auditing outsourcing
The auditor looks at the business case, how the vendor was chosen, the contract terms, how SLAs and risks are monitored, what assurance the organisation has over the vendor’s controls, and the exit plan. If the vendor won’t allow an audit, the auditor relies on independent reports, provided their scope and period are suitable.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who remains accountable for an outsourced function? | The outsourcing organisation |
| Most important contract clause for the auditor | Right to audit |
| What to do before selecting a vendor | Due diligence |
| Greatest risk of outsourcing | Loss of control, with accountability still retained |
| How to get assurance over a vendor’s controls | SOC reports, certifications, or a right-to-audit review |
In short
- Accountability for outsourced functions stays with the organisation; only the work moves.
- Benefits: access to skills, lower or predictable costs, flexibility, and focus on the core business.
- Risks: loss of control and knowledge, vendor lock-in, vendor failure, data protection, and hidden costs.
- Key controls: due diligence before choosing, a strong contract with SLAs and a right to audit, ongoing monitoring, and an exit plan.
- Keep enough in-house skill to manage the vendor and the contract.
- Assurance over the vendor comes from audits, SOC reports, certifications and performance monitoring.
Exam traps
- Outsourcing doesn't transfer accountability, legal responsibility or regulatory duties.
- Cost savings aren't guaranteed; count transition, oversight and exit costs.
- Without a right-to-audit clause, you only get whatever reports the vendor chooses to share.
- Plan the exit at the start, not when things go wrong.
- Due diligence happens before signing; monitoring happens throughout.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Benefits and risks
The outsourcing life cycle