Outsourcing, Due Diligence and Dependencies

Outsourcing, Due Diligence and Dependencies

Outsourcing is, for many organisations, the only way to access some services. Nowadays businesses simply cannot be so integrated that they can do everything themselves. There is a reasonable assumption that some outsourced service providers (OSPs) are best in class and the experts in their fields but…

If any of your key business objectives or any of your customer obligations depend on an outsourced provider, you will need to be as familiar with aspects of that provider as you are with your own organisation.

Some years ago, we were engaged to conduct a risk assessment on a client’s business continuity arrangements. As part of the assessment they looked at their primary customer service objective; they realised that ‘what mattered’ most was availability. Internally, they were well prepared for the risks identified and had, for the most part, credible plans in place to protect their business objectives in the event of any of the envisaged failures.

However, their service depended on a banking system that was externally hosted in a data centre. Their customers utilised the system’s online portals to buy goods and services such as airline tickets, health and general insurance, groceries and also, among other things, to gamble. Successful completion of those transactions depended on the availability of our client’s process. Therefore, communication with the hosting data centre was critical.

Our client had developed a recognised dependency on (and a very good relationship with) the hosting service provider. They had written a four-second response time objective into the service level agreements coupled with a Six Sigma uptime clause and, for three years, performance was satisfactory. During that time not only did our client’s business grow significantly but their dependency on the outsourced provider had grown in parallel.

The business continuity due diligence risk assessment that we conducted on their OSP showed them to be an excellent risk through all of its key aspects until we got to this question:

Their ‘Don’t Know’ answer set off alarm bells within the OSP’s technical community.  The data centre was using two key telecom service providers and our question provoked an internal discussion about the fibre route maps of the connectivity providers in and out of their facility. They had discovered a single point of failure. The different fibre trunks ran within a foot of one another for almost fifty metres underground near the building’s carpark, meaning the backup resilience of their connectivity was compromised and they risked a total service failure from a single ‘Black Swan’ event.

The data centre and its telecoms providers worked quickly to mitigate the risk and reroute the cable ducting to re-establish the standard separation required. But our client, though appreciative of the immediate rectification and the speedy response to the identified risk, made the strategic decision to second-source. They added another data centre to their network and in doing so built resilience into the whole of their business process. While this decision resulted in additional cost, it facilitated further growth and represented their coming to a serious understanding of outsource or third-party dependency risk.

You cannot be naive about the risk outsourced service providers represent to your business. You will always retain the responsibility for any consequences of their failings. Continuous monitoring of your providers is extremely important; keep in touch, understand how they are doing, monitor the detail of your service level agreements. You can do this by measuring KPIs and / or KRI’s, or by any other method that will allow you to understand the level of your exposure. The point is not to worry unnecessarily but it is to be as prepared as possible for a potentially disruptive event – a withdrawal from a market; a major price change; a service interruption; an industrial relations issues; a change in ownership; reduced flexibility; or the ever-increasing risk of skill shortage.

One of the great indicators is how well prepared your key providers are for a business disruption event… Do you know?

For details on how CalQRisk can benefit your organisation, contact us today.

Recent News

Federation of Irish Sport announce three-year partnership CalQRisk

The Federation of Irish Sport is delighted to announce GRC software provider CalQRisk as its latest partner. The ...
Read More

10 Things You Need To Do If You Are Outsourcing an Activity

There is a growing trend towards organisations relying on outsourced service providers (OSPs) to deliver (often key) elements ...
Read More

Oaklee Housing implement CalQRisk

Oaklee Housing, one of Ireland’s most ambitious providers of customer-focused housing and support services have partnered with CalQRisk ...
Read More

The Five Pillars of Operational Resilience

The Five Pillars of Operational Resilience The Basel Committee (on Banking supervision) defines operational resilience as “the ability ...
Read More

The Charitable Purpose – the Touchstone for the Organisation

The Charitable Purpose – the Touchstone for the Organisation Many corporate mission statements are simply clever PR, designed ...
Read More

Webinar – Fundamentals of Anti-Money Laundering for Credit Unions

Webinar - Fundamentals of Anti-Money Laundering for Credit Unions We have teamed up with ID-Pal and Corrib Point to organise a CPD ...
Read More

10 Things you should know about Operational Resilience

10 Things you should know about Operational Resilience   Operational Resilience is the ability of an organisation to ...
Read More

Evidencing compliance with the Charities Governance Code – Webinar

Evidencing compliance with the Charities Governance Code - Webinar Good governance involves putting in place systems and processes ...
Read More

Risk Appetite – what does ‘good’ look like?

Risk Appetite - what does 'good' look like? Let’s begin with a definition of Risk Appetite. ISO 31000 ...
Read More

Charities Governance Code – Principle 4: Exercising Control… what’s that all about?

CalQRisk Analysis - Inside the Charities Governance Code Charities Governance Code – Principle 4: Exercising Control … what’s ...
Read More