Buyers of sourcing services must seriously consider risk when they contemplate outsourcing — and the results are often included in the outsourcing contract. Outside of disaster recovery and business continuity, though, most clients never follow up with an action plan after the engagement begins, nor do they consider additional risks associated with outsourcing. Between the pressure of transition and startup and the daily demands to deliver services and satisfy business stakeholders, risk is often left for “later.” Resist this tendency by ensuring that operational, reputational, financial and relationship risks are actively managed.
Consider these Top 5 tips for making ongoing risk management a part of your governance process:
1. Identify risk responsibilities in the contract. Risk responsibility was documented and is likely scattered throughout your service provider contract in many different exhibits. Evaluate all your contract documents for every area where risk management and responsibility is identified, and make a risk responsibility matrix that shows what you and your service provider are contractually responsible for. Share the matrix with your entire management team and your service provider, and incorporate it into your governance process.
2. Identify and document additional risks in the engagement. Many potential risks in the engagement will not be addressed in the contract, including those your organization may cause. To determine potential risks, hold a series of workshops with your outsourcing management team, the service provider, business stakeholders, and any other organizational entities necessary. Contact us for a checklist of categories to examine closely for risk factors.
3. Rate the risks; develop and implement risk mitigation strategies. Rate each identified risk on a scale with two axes: probability and impact. Holding a group discussion can quickly identify risks that require mitigation strategies. Those that have high probability and high impact are obvious candidates for deeper consideration. Pay special attention to risks in the low probability/high impact category; strategize what you will do in every case where you think mitigation will be required, and identify (and act on) any mitigation requirements that might affect or change how you act in daily operations.
4. Manage your identified risks. Maintain a risk tracking log, noting when you encounter a situation where you need to activate your mitigation plan. Periodically meet with your key team members (and the service provider, when applicable) and review mitigation plan deployments to learn what worked and what could be improved. Periodically review your risk tracking log to determine if the risk profile (probability vs. impact) has changed, and update plans accordingly.
5. Publish your risk tracking tool. The risk tracking log can be as simple as an Excel spreadsheet, a more sophisticated Access or Lotus Notes database, or a commercial-off-the-shelf application. Whatever tool you use, ensure that everyone involved in the outsourced services management knows where to access the tracker. This is your roadmap for the organization to respond to risk events that will inevitably surface.
TPI’s Service Management & Governance experts can help you achieve your organizational goals through objective advice, knowledge of your industry and experience with arrangements from simple to complex. Contact Cynthia Batty, Director, ISG, to learn more.
About the authorCynthia brings 25 years of experience helping clients develop their sourcing governance and service management design. Having worked with more than 50 organizations to improve business management and service management processes in both single-provider and multi-provider environments, Cynthia has become a recognized expert in sourcing governance, vendor and contract management. She currently serves as the architect for ISG’s service methodology and global integrator of its products and services. Cynthia works to leverage ISG’s accumulated intellectual property resources to help enterprises create effective transformation and governance capability, and maintains a continuing role in the Strategy and Organizational Change Enablement practice.
About the author
Cynthia Batty
Cynthia Batty is the ISG’s Chief Knowledge Officer. In this role she is the ISG service methodology architect and global integrator of the company’s products and services, and is the leader for developing, growing and leveraging ISG’s accumulated intellectual property resources. Prior to this role, Cynthia was a lead in ISG’s Governance and Transformation practices, and maintains a continuing role in the Organizational Change Management practice. She brings 25 years of practical experience to advise clients on their sourcing governance and service management design, as well as organizational change management and maturity development. She is a recognized expert in sourcing governance, vendor and contract management. She has helped more than 50 governance organizations with business management and service management processes in both single-provider and multi-provider environments.
