LESSON 14: INTERNAL AUDIT – OUTSOURCING

Video Activity Text Additional reading and references

14.1 PURPOSE

Review outsourcing as transforming the risks of managing an activity into one of managing and relying on a third-party
provider whose day-to-day actions are outside its direct control.

14.2 KEY CONCEPTS

Outsourcing Risk assessment Request for proposal (RFP)

Selection Governance Service level agreement (SLA)
Transition Offshoring Exit strategy

14.3 LEARNING OUTCOMES

On completion of this lesson, you should be able to

 explain the concept of outsourcing

 relate outsourcing to transforming operational risk
 discuss the motivation behind outsourcing
 discuss the outsourcing project in terms of a risk assessment and the selection process
 define a service level agreement (SLA)
 discuss the management of an outsourcing project in terms of governance, transition, monitoring and
reporting as well as change and offshoring
 discuss the importance of having an outsourcing exit strategy

14.4 LEARNING MATERIAL

Chapter 14 of the prescribed book: Outsourcing.

14.4.1 What is outsourcing?

Outsourcing is the transfer of selected projects, functions or services and the delegation of day-to-day management
responsibility to third-party suppliers.

Study “What is outsourcing?” in chapter 14.

14.4.2 Outsourcing – transforming operational risk

Outsourcing transforms the risks of managing an activity into one of managing and relying on a third-party provider whose
day-to-day actions are outside its direct control. It does not eliminate risk, but it should reduce the original risk by placing its
management in the hands of somebody who can manage it better, somebody who can provide access to experienced skills at
a reasonable cost.

Study “Outsourcing – transforming operational risk” in chapter 14.

14.4.3 Deciding to outsource

Benefits of outsourcing

 concentrating management on core activities

 achieving higher activity levels
 improving customer service(s)
 improving financial control

Costs - the decision to outsource should be made on reasonable business grounds, looking at the overall value outsourcing
can bring and not solely, or even primarily, on the grounds of saving costs or improving return on investment.

High-level principles and policy for outsourcing - a fundamental part of outsourcing risk governance is for the board to agree
on the principles and policy which will govern outsourcing within the firm.

Deciding what to outsource – consider the possible functions or activities as candidates for outsourcing.

Study “Deciding to outsource” in chapter 14.

14.4.4 The outsourcing project – getting it right at the start

Two of the most significant risks in outsourcing projects are not having clearly defined goals and objectives and not planning
properly. Clear goals and objectives have to be set before any risks to the project can be identified.

Study “The outsourcing project – getting it right at the start” in chapter 14.

14.4.5 Risk assessment

The next stage is to undertake a full risk assessment and identify the threats to successful implementation. There are three
initial risk assessments, namely the current situation, the project itself and the desired situation.

Study “Risk assessment” in chapter 14.

14.4.6 Some tips on the request for proposal

The first step towards the request for proposal (RFP) is the request for information, and this should go out to as wide a field
of candidates as possible. The goals and objectives for outsourcing determine the selection criteria, which will indicate the
requirements for outsourcing.

Study “Some tips on the request for proposal” in chapter 14.

14.4.7 Selecting the provider

The selection approach requires a variety of perspectives and the appropriate skills to manage the process effectively:

 assessment and evaluation

 capability and competence
 pricing
 data security
 chain of dependency
 compatibility and culture
 commercial soundness and sustainability
Study “Selecting the provider” in chapter 14.

14.4.8 Some tips on service level agreements

The service level agreement (SLA) governs the future relationship between the firm and the service provider. It specifies the
requirements for regular reporting of risk and control assessments, relevant key risk indicators and key control indicators, and
also details the reports required for incidents and losses.

Study “Some tips on service level agreements” in chapter 14.

14.4.9 Managing the project

Governance provides a set of guidelines for the outsourcing relationship and a forum for dealing with legal and service issues.
The key to good governance is a good governance team of high-level executives from both organisations who communicate
regularly about what is working and what is not. A well-planned transition to the provider is one of the critical determinants
in the selection process. Experienced staff with the necessary expertise must supervise and monitor the outsourced activity
and provider. Outsourcing contracts are never static, and the governance team must be able to deal with change throughout
the life of the contract. Outsourcing is a partnership, and there needs to be full collaboration between buyer and service
provider. This can be a particular challenge where collaboration has to be with an offshore team, probably working within a
different culture.

Study “Managing the project” in chapter 14.

14.4.10 Exit strategy

The SLA provides for contingency plans to cope with serious problems which arise during the term of a contract. However,
there will be times when the contract has to be terminated, and there can be many reasons why it may be necessary to exit
the contract. Failure of the provider or failure to deliver to the required standard or quality are the most obvious reasons, and
action by the provider that causes reputational damage can be another.

Study “Exit strategy” in chapter 14.

14.5 ACTIVITY

Self-assessment questions: Go to the Online assessment tool to do activity 14.5.

14.6 REFLECTION

Before you continue to the next lesson, reflect on the following personal questions:

a. Where, in your professional life, do you think you will be able to use the skills you have learnt in
this lesson?
b. What did you find difficult? Why do you think you found it difficult? Do you understand it now, or
do you need more help? What are you going to do about it?
 c. What did you find interesting in this lesson? Why?
d. How long did it take you to work through chapter 14 for this lesson? Are you still on schedule, or
do you need to adjust your study programme?
e. How do you feel now?

Blunden, T & Thirlwell, J. 2013. Mastering operational risk: a practical guide to understanding operational risk and how to
manage it. 2nd ed. London: Pearson.