increasing flexibility through it outsourcing, por ernst & young

Insights on IT riskMay 2009

�� through IT outsourcing

1Insights on IT risk — May 2009

��are revisiting questions such as: can I restructure my �� !�"�� In order to investigate this process further and put it in the context of current events, Ernst & Young interviewed over 300 business leaders across the globe in January 2009. The results were surprising and indicated a considerable level of planned reorganization in the year ahead. A full 82% of respondents expected business restructuring to play an increased role in their company’s activities over the upcoming year and for many organizations, the IT function was clearly targeted as a priority.

There are several options available to companies for reshaping and restructuring their IT function, including: centralizing functions in a shared service center, relocating for better access to cheaper labor or specialized skills, or outsourcing IT functions to a service provider. In this article, we take a closer look at the potential ��

Opportunities for restructuring

2 Insights on IT risk — May 2009

#��$��Pressures to reduce costs are driving more organizations to consider or re-consider the outsourcing option. In Ernst & Young’s 2008 European outsourcing survey, 23% of organizations indicated an intention to outsource, or enlarge the scale of their outsourcing, over the next two years. For IT-related activities, the percentage was even greater, with 37% of the survey respondents planning to outsource within the next two years.

Cost reduction is certainly a primary driver, but outsourcing can also support non-traditional business models where specialists are engaged at every level of the value chain. In addition, outsourcing �� unable to develop in-house or has recently lost due to workforce reductions. By focusing on core business activities and outsourcing the routine or low value-added processes, many believe they can provide better service to their customers and achieve their objectives at a lower cost.

The outsourcing experience is generally felt to be positive, with 94% of respondents identifying at least one advantage. In addition to cost savings (49% response rate), companies increasingly ��standardization and improve compliance across the organization. Improved strategic organization and better quality services were ��

Investigating the outsourcing option

Outsourcing advantages (%) response rate��%��&��

Multiple responses permitted.Source: Ernst & Young’s 2008 European outsourcing survey

At least one advantage

Cost savings (and increase in productivity)

Better quality !�� "

Improved strategic organization/alignment

#��$�'��

94%

49%

33%

28%

25%

Questions to askThe following questions are critical for business and IT leaders to consider before evaluating outsourcing alternatives:

1. What services should be outsourced? Will we pay a premium for the types of services selected for outsourcing?

2. Where should the service provider be located?

3. How will we maintain control over the processes that have been outsourced?

4. How will we ensure shared data is protected and securely handled by the outsource provider?

5. How will we manage data quality?

6. Will there be cultural differences and communications issues that could impact the outsourcing relationship?

7. What should be included in the outsourcing contract? How ��*�+��$��disputes be settled?


#��;��<��always an easy one to make. There are many unique risks that must be addressed. Staff issues featured at the top of the list of ��<��=��respondents. Such staff problems may be at the buyer or provider end of the equation. For the buyer, there may be problems of an employee backlash, with fears of job losses and internal reorganizations. On the provider side, staff problems may arise due to the physical distance, which may make staff relationships more challenging. Different corporate cultures may also result in communication issues. Successful implementation may require more of a partnership type of relationship, rather than a complete delegation of responsibilities.

>��@�� associated with choosing the right partner are more important than ever in today’s economic climate. In the last year alone, we have ��G��G��@��of new risks has a direct and far-reaching impact on the process for choosing a provider. Organizations must consider possible service and operational disruptions, occurring from a transition of customers to remaining service providers if a change in provider is required. A reduction in quality from distressed service providers with overburdened employees may also be experienced; or the organization may need to absorb the impact of increased service costs resulting from less competition and fewer service providers.

�� $��(��%��&��

Source: Ernst & Young’s 2008 European outsourcing survey

Some of the challenges that companies relying on outsourced services now face due to today’s economic environment include:

L� N��<��<�� due to increases in motivational pressures and opportunities by service provider distress

L� Loss of reputation and customer goodwill

L� Lack of regulatory/government oversight in foreign jurisdictions

L� R� ��

L� U��

Some potential solutions to these challenges include establishing a steering committee or vendor and outsourcing oversight board. Organizations should explore multi-sourcing and/or maintaining some redundant expertise in-house. Companies should also take a �� V��for new providers as well as contract renewals.

Staff related problems

Finding the proper partner

Change management problems

IT and technical problems

Legal problems

Other

12%

9%

8%

6%

5%

15%


)��$��*� �� L� U��X��

reduce costs by eliminating institutional impediments to ��Z��outsourcer through: restructuring the services, achieving greater economies of scale, shifting to business partners (with other fee structures), shifting to countries with lower labor costs (Eastern Europe, India, China, Vietnam, etc.)

L� Service delivery improvements: outsourcing in many cases permits the use of state-of-the-art technologies without having to invest directly.

L� Concentration on core competencies: outsourcing helps enable corporate resources to be focused on core business.

L� Increased solvency: demand for capital and investment for the IT function is easier to predict and plan.

L� Realization of economies of scale: the outsourcing providers ��N�'��and the contract can be negotiated to share some of these savings between outsourcer and client.

L� Avoiding “over-servicing”: internal employees often perform more services than needed. This can be managed by service level agreements with the provider.

L� Increased agility: it is easier to switch between service providers than to change a complete IT function if the ��>��<��G��$�'��outsourcers’ global resources.

L� ]��X��<�transparency of costs, prevention of insider relationships, and the force to have open and comparable standards, the level of control can be increased.

�� L� Cost reductions cannot always be realized in full: this is often

the case where only a high level business case is prepared, the actual cost structure (internal baseline) and target costs are not correctly calculated, or the business case was based on wrong assumptions.

L� ^��<��<��$��X�in practice, there needs to be strong alignment with the outsourcer on the management of the transition. Poor training of employees, language problems, lack of consideration of cultural differences between outsourcer employees and remaining staff, plus fears, and loss of power and responsibilities of people are some of the reasons for ��$��

L� Dependence on one outsourcer with no possibilities for switch: contracts are generally signed for 5-10 years (3 years minimum). The wrong choice of outsourcer, combined �� project failure.

L� R��X��especially for “special services” or an above-average level of variable costs can lead to low economies of scale. The range of different systems and processes across many entities needs to be evaluated.

L� _��'��X��<��customer needs, or lack of hands-on approach lead to quality problems. Also, designing a “to-be” concept based on a misunderstood “as-is” situation or very complex interfaces between processes, organizational entities and applications can result in quality issues.

L� R�� G��X��can result in loss of control. The relocation of knowledge champions to another site can lead to a loss of internal business knowledge. An in-house service management organization should be created to control the service delivery ��V��


+��,��

Like other functional areas of the business, certain components of IT services are rarely or never outsourced. Organizations typically outsource repeatable or routine IT services, such as the management of a help desk, on-site technical support and security testing. Most organizations are unwilling to outsource the activities that require more unique or specialized skills. In the Ernst & Young 2008 Global Information Security Survey, less than 30% of the respondents indicated they would outsource disaster recovery, incident response or IT forensics.

The reluctance to outsource certain IT activities is decreasing as the pressures to reduce costs increase and a broader array of IT processes are now being outsourced. However, outsourcing these specialized services is not always a low-cost alternative. Many service providers now offer a standard portfolio of services and deviating from the ��<�� services cannot be easily provided by the outsourcing “factory” without additional specialists. The increased cost of the specialists is simply passed on to the service provider’s customers.

To address this issue, organizations should evaluate the outsourcing ��`@��G��There may be little or no incentive to outsourcing some specialized activities and could actually lead to a more costly outcome than the current situation. In addition, prior to entering into an outsourcing arrangement, they should closely examine the contract to identify and understand the “premium” pricing scenarios and the potential impact on the organization. The business relationship will be much more successful if all “surprises” or unexpected fees are avoided.

� � ��

-��*�.�� *��

L� Sourcing and business strategy alignment

L� Senior management buy-in

L� Right selection criteria for vendor/partner selection

L� Effective operating model

L� Risk-adjusted business case

L� �� and priorities

L� �� !�� "

L� ��#��

L� Sub-optimal sourcing strategy

L� Ineffective operating model

L� Credibility loss at executive management level

L� Structured governance

L� Effective contract

L� Effective service level key performance indicators and metrics

L� Dependency and impact analysis

L� Prudent program planning

L� $��

L� &�� "��

L� $�� !��

L� Stuck with a bad contract

L� {��G��

L� Bad experience with outsourcing

L� Timely transition

L� Policy enforcement

L� Process discipline and maturity

L� Effective program execution

L� Risk management

L� ��

L� '�!��

L� *� �� "��

L� + ��"��

L� ;��

L� Business case doesn’t hold true anymore

L� Relationship goes sour between client-vendor

L� Compliance management

L� Service-level management

L� Quality assurance and change management

L� Opportunistic renegotiation with vendors

L� &�� , ��!��,��

L� $��!��!��

L� Customer dissatisfaction

L� Vendor holding the balance of power

L� Litigation and regulatory issues

L� Brand dilution

L� Degraded quality of services

�� #�� Transition Monitor

��

��Ke

y ri

sks

��

��

��

��

��

��

�


In 2009, companies have become more convinced of the merits of developing markets. India, China and Eastern Europe all rate highly ��G��`��Gshoring destination by all respondents (45%) regardless of where their headquarters’ operations are situated. China ranks second and Eastern Europe third (26% and 23% of votes respectively). Surprisingly, the strong image of Eastern Europe as an off-shoring destination extends not only to European companies, but also those in North America.

Motivations for off-shoring certain activities to developing countries have changed as these markets evolved. Initial decisions were generally taken purely on a cost basis. This was largely behind the phenomenal growth seen in recent years in markets such as India. However, in recent years, the cost advantage of off-shoring to many developing markets has dramatically reduced. At the same time, these countries have moved up the value chain as their operations ��`��<��of services they are delivering are much more sophisticated. IT services such as remote infrastructure management and industry-��Ggrowth outsourced services.

In our experience, destination preferences also vary according to the particular function to be off-shored: Eastern Europe is preferred for industry and production processes, while a mix of local, near-shoring and, to a lesser extent, off-shoring is preferred for process ��!��"��>��'��Gshore sourcing is generally adopted for IT operations.

$��

-�� !�� "�� .� �� "�� /

(up to three responses possible)Source: Ernst & Young, Opportunity in adversity, January 2009

India

China

Eastern Europe

Southeast Asia

Latin America

Middle East

North America

45%

26%

23%

16%

14%

5%

5%

Africa

Australia and New Zealand

Western Europe 4%

3%

3%

0 "�� 1L� Collaborative strategies are increasingly valued. More

$�'��<��G��<�collaborative partnerships and new forms of out- and co-sourcing of production and service delivery bring new opportunities.

L� Talents are essential. The race for skills, talent and �� Z��develop protectionist strategies and, in turn, slow down a region’s ability to grow through new inward investment.

L� Emerging markets … have emerged. By 2050, the Emerging-7 (Brazil, Russia, India and China, together with Indonesia, Mexico and Turkey) are likely to overtake the economies of the G-7 countries in terms of gross domestic product (GDP). Will they be able to develop their �� *��G��undertake changes in transparency, fairness and openness?

L� Risk management is now at the heart of a company’s location decisions, prompted by the prevailing climate of uncertainty. The current priority is for transparency, stability and clarity in the countries chosen for investment projects. Companies put a sharpening focus on the balance of risks and rewards in economies everywhere. Investors look at a complex variety of costs, quality and risks factors before selecting their business locations.

Based on Ernst & Young’s research on location trends in “Attractiveness Survey — 2005/2008”


2��!��

IT outsourcing creates a new challenge for organizations to maintain control of services being supplied by personnel that are not your employees, and often out of your physical control. A starting point of control is a detailed contract which contains explicit requirements with respect to the quality of the provided services and the controls that must be in place to protect information. ]��a way to determine if the contractual obligations are being met. There are two dependable ways in which this can be done, supplier management and third-party reporting.

+��According to the Ernst & Young ICT Barometer report for October 2008 (an outsourcing study of 600 Dutch companies), the responsibility for managing service providers generally rests with an existing line of business function or an organizational function (e.g., procurement); although a small number of organizations (15%) have established a special department to oversee these activities. Whether it becomes the responsibility of an existing department or a newly created department, managing service providers is usually done through the following mechanisms:

L� Contract: the contract between the user organization and the service provider is used as a control mechanism by the use of special clauses related to bonuses and penalties.

L� Governance structure: procedures and structures agreed upon in advance to resolve any issues that may arise.

L� Service level agreement: this instrument provides a way in which the quality of the services delivered can be evaluated and measured in pre-determined units.

L� Service level reporting: this method utilizes periodically prepared reports on the realized service levels for which the service provider can be held responsible.

Despite occasional disputes, maintaining a good relationship with the service provider is often the most important objective for an organization when it comes to supplier management. The ICT Barometer study found that 33% of organizations have had a dispute with their service provider, but only 20% have ever exercised a clause in a contract to resolve the dispute.

��/��While implementing governance and service-level reporting processes are important, they do not relieve an organization of responsibility for evaluating the quality of services received. This can be performed by either the organization sending its own personnel to the supplier location to perform evaluations of the services or obtaining a report on the services prepared by a independent auditor. While sending its own personnel provides an organization with the maximum control over the process, a report from an independent auditor is usually more cost effective and the cost can be shared by several of the supplier’s customers.

One type of independent auditor report is a SAS 70 report. While the purpose of this report is to provide information regarding ��<��type of report may also be useful in understanding the supplier’s processes and controls as it relates to operations and compliance.

However, many aspects of a supplier’s processes will not be covered by a SAS 70 report. Other types of independent auditor reports, such as SysTrust®, have been developed to address security, ��<��<��may not be included in a SAS 70 report. In addition, an organization may work with its supplier to have an independent audit performed on those aspects of the services received that are of particular interest to the organization.


The increase in IT outsourcing also means more data and sensitive information is being shared with external service providers. Sharing data does not mean that the risk or responsibility for protecting ��way to protect their information even when it has left their own information systems.

Ernst & Young’s 2008 Global Information Security Survey (GISS) provided evidence that many organizations are struggling to address third-party risk. The survey found that 29% of all respondents indicated that they do not perform any type of audit or assessment of the third parties with whom they exchange information.

Information security must go beyond physical borders. The organization’s data needs to be protected whether the information is stored within its own building or at the service provider’s location. For this reason, it becomes important that an organization can obtain assurance that their service providers are providing a level of security to match or exceed their own.

Securing shared data

'�,��"�� "�� .� �� 3�� "��#��4��!��/

Multiple responses permittedSource: Ernst & Young’s 2008 Global Information Security Survey

Assessments performed by your organization’s internal audit function

Reviews of internal self-assessments performed by

partners, vendors or contractors

Reviews of independent external assessments of partners, vendors

or contractors

No reviews or assessments performed

39%

36%

32%

29%


Why do organizations overlook the security aspects of an outsourcing initiative? Among other things, they are often unaware of the risks or they may assume that data protection will be well organized by their service provider. In addition, rarely are the right ��V��service contracts are being constructed.

To effectively address information security in an outsourcing situation, organizations should focus on the following:

L� Utilize the service contract as a control mechanism by use of special clauses related to bonuses and penalties.

L� Perform a risk analysis to determine the associated risks and how the potential service provider is planning to address them.

L� Involve the security resources within your organization to assess potential service providers.

L� # ��in which the service provider will implement and adhere to security measures.

L� U�� risk analyses.

L� Periodically assess the service provider using an international standard such as ISO/IEC27001 or by means of a third-party report (i.e., SAS 70, ISAE 3402).

L� Make security a part of the governance structure between the organization and that of the service provider at a strategic, tactical and operational level.

Considering security early in the outsourcing process — before contracts and agreements are made with service providers — can prevent many problems from developing in the future.

7��;��"�*��"��*��


Data quality is the reliability and integrity of the data used in electronic processing. It can be measured by the degree in which ��'��'��of poor data quality are duplicate entries, incomplete data and incorrect data. Poor data quality can lead to an unreliable ��>��internal control processes. It can also restrict the organization’s ability to recognize fraud and result in poor management decisions based on incorrect information.

An outsourcing initiative can be a compelling reason to increase efforts related to improving the quality of data. However, for organizations which strive to optimize the use of their information systems, it is critical to incorporate data quality activities within their current IT processes and not wait for an external spark such as outsourcing to drive improvements.

Depicted below is the impact of a shortcoming in data quality.

The key to data quality is sound data management and can be ��X

L� Organization: it is imperative to have clear roles and responsibilities, training and education, planning and change management processes.

L� ��X��<�monitoring and measuring, data access, data availability and ��

L� Standards: it is important to incorporate taxonomies, reference dates, an enterprise data model and use of proven tools.

The impact of poor data quality is often underestimated and proper attention is often only given after an outsourcing initiative has begun. Organizations that currently take steps to safeguard data quality are much better prepared to work with external service providers and will have fewer issues to address during the outsourcing process.

2��5��"

Poor data 5��"��"

��management issues

��management ��

#��

L� Poor data capture

L� Duplicate master data

L� Incomplete data

L� Data inconsistencies

L� Inaccurate source data

L� Inappropriate data usage

L� `��business processes

L� Poor business insights

L� `��reporting

L� Inability to identify fraud

L� Sub-optimal business decisions

L� Litigation/regulatory ��

L� Financial restatements

L� Loss of market share/��

L� Financial instability/liquidity and/or solvency issues

L� Loss of stakeholder ��

L� Poor product development

6� �!��!�� ! ��


�� !��

��`@��challenge in terms of cultural differences and communications. Results from the Ernst & Young ICT Barometer study show that ��`@��are outsourced to other countries. In regard to a reason for this dissatisfaction, 67% of the respondents viewed cultural differences as the primary reason and 46% cited problems with communications as the main issue. Surprisingly, cultural differences are more than twice as likely to be a problem as the actual application not meeting expectations.

@��$��and communications problems. Technical problems can usually be solved with more resources and budget. This approach does not work for cultural differences. To close the gap and develop a successful business relationship with an organization that is abroad requires an acceptance that there will be differences and there must be an investment in knowledge of each other’s culture. Open and honest communication is of vital importance, making clear agreements concerning common targets, milestones and sanctions at the onset can help prevent communication mistakes and lead to mutually realistic expectations.

-�"��"�� "�� /

Source: Ernst & Young’s ICT Barometer

Cultural differences

Problems with communication abroad

Application does not (fully) meet the expectations

Project has run out of time

Experienced project leader unavailable

Application does not work due to ��

Application does not work due to ��

67%

46%

30%

18%

17%

17%

15%

Problems with supplier

Project budget was exceeded 14%

13%

)��$��


Outsourcing arrangements should be recorded in a formal document ��$��'��+��<��pressures and time constraints on legal staff, process managers, human resources, IT staff and the organization’s executives ��V��that does not meet the needs of the organization. It is important to recognize that this scenario will result in a business relationship that will suffer due to the lack of a common understanding.

=�$��A good contract, like a good business relationship, should be regularly reviewed and revised if necessary. Besides comparing achieved performance with the fees charged, it is important that performance levels be objectively measured on a timely basis. ��V��$��Z��techniques must also have been fully disclosed in the contract.

It is also important that the outsourcing contract include any agreements related to sanctions, guarantees, exit strategies and ��@��thinks of when entering a new business relationship, but they are vital provisions if something does go wrong.

>��Outsourcing arrangements are usually expected to be a long-term relationship. But it does not always work out this way and an organization may want to or need to take back control of the outsourced activities or migrate to another outsourcing provider. N��$��<�� the dispute:

1. End the relationship in a structured manner by making use of ��'��

2. Both parties submit to binding arbitration by an independent third party. The expertise of the independent third party can help settle the dispute in such a manner that both organizations are treated fairly. This helps to prevent high ��

3. ��@��'��route for all involved.

Because the dispute resolution process forces both parties to walk through the process together once again, a better arrangement can sometimes be reached and the parties often end up cooperating and completing or modifying the contract.

Outsourcing is not without risks or possible consequences, but many of these factors can be mitigated by having a solid contract in place with agreed-upon measures to help prevent a dispute situation from escalating.

Structuring the agreement

)��


7��8��9�:��

?��-��@�A��.��B��$��"��;��Information technology is one of the key enablers for modern organizations to compete. It gives the opportunity to get closer, more ��<��]��grows, so does risk. Effective information technology risk management helps you to improve the competitive advantage of your ��<�� systems. Our 6,000 information technology risk professionals draw on extensive personal experience to give you fresh perspectives and open, objective advice — wherever you are in the world. We work with you to develop an integrated, holistic approach to your information �� '��<��matter knowledge and the latest insights from our work worldwide. It’s how Ernst & Young makes a difference.

For more information on how we can make a difference in your organization, contact your local Ernst & Young professional or any of the people listed in the table below.

��

;��Norman Lonergan (Advisory Services Leader, London)

+44 (0) 20 7980 0596 [email protected]

#��C��(IT Risk and Assurance Services Leader, Amsterdam)

+31 88 40 71271 [email protected]

7��"�� Robert Patton (Americas Leader, Atlanta)


Norman Lonergan(Europe, Middle East, India and Africa Leader, London)

+44 (0) 20 7980 0596 [email protected]

D��C��(Far East Leader, Shanghai)


Isao Onda(Japan Leader, Chiba-shi)


=��+��(Oceania Leader, Sydney)


IT Risk and Assurance Services%�� (Americas Leader, Atlanta)


#��C�� (Europe, Middle East, India and Africa Leader, Amsterdam)


��C��(Far East Leader, Hong Kong)


Giovanni Stagno (Japan Leader, Chiyoda-ku)


��%��(Oceania Leader, Perth)


Ernst & Young

Assurance | Tax | Transactions | Advisory

About Ernst & YoungErnst & Young is a global leader in assurance, tax, transaction and advisory services. Worldwide, our 144,000 people are united by our shared values and an unwavering commitment to quality. We make a difference by helping our people, our clients and our wider communities achieve their potential.

For more information, please visit www.ey.com.

Ernst & Young refers to the global organization of member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.

The Ernst & Young organization is divided into five geographic areas and firms may be members of the following entities: Ernst & Young Americas LLC, Ernst & Young EMEIA Limited, Ernst & Young Far East Area Limited and Ernst & Young Oceania Limited. These entities do not provide services to clients.

About Ernst & Young’s Advisory ServicesThe relationship between risk and performance improvement is an increasingly complex and central business challenge, with business performance directly connected to the recognition and effective management of risk. Whether your focus is on business transformation or sustaining achievement, having the right advisors on your side can make all the difference. Our 18,000 advisory professionals form one of the broadest global advisory networks of any professional organization, delivering seasoned multidisciplinary teams that work with our clients to deliver a powerful and superior client experience. We use proven, integrated methodologies to help you achieve your strategic priorities and make improvements that are sustainable for the longer term. We understand that to achieve your potential as an organization, you require services that ��<��broad sector experience and deep subject matter knowledge to bear in a proactive and objective way. Above all, we are committed to measuring the gains and identifying where the strategy is delivering the value your business needs. It’s how Ernst & Young makes a difference.

© 2009 EYGM Limited. All Rights Reserved.

EYG no. AU0425 Supersedes EYG no. AU0288

In line with Ernst & Young’s commitment to minimize its impact on the environment, this document has been printed on paper with a high recycled content.

This publication contains information in summary form and is therefore intended for general guidance only. It is not intended to be a substitute for detailed research or the exercise of professional judgment. Neither EYGM Limited nor any other member of the global Ernst & Young organization can accept any responsibility for loss occasioned to any person acting or refraining from action as a result of any material in this publication. On any specific matter, reference should be made to the appropriate advisor.

increasing flexibility through it outsourcing, por ernst & young

Technology

outsourcing relationship

outsourcing alternatives

outsourcing experience

outsourcing canbeen

percentage outsourcing

outsourcing contract

european outsourcing

yl yf gj