Outsourcing

Outsourcing is an agreement in which one company contracts out a part of their internal business activity to an external party.

Organisations have traditionally seen outsourcing as a way to reduce costs and simultaneously increase their return on investment. Today outsourcing has become a key business strategy for organisations that believe in devoting their resources to their key business operations. Outsourcing has only continued to grow and is now being embraced by organisations of all sizes and in all fields. From start-ups to large enterprises, outsourcing continues to be a tool of choice to gain competitive advantage.

The most serious risks associated with outsourcing are summarised below:

  • qualified audit academy outsourcingGovernance risks: outsourcers that commit to an outsourcing partnership without a strong governance capability usually do not have the means to properly manage the outsourced activity.
  • Operational and delivery risk covers the consequences due to schedule and budget mismanagement, unfulfilled client expectations, inadequate knowledge transfer and staffing, resulting in the lack of fully derived benefits.
  • Relationship risks for service providers include cultural differences, structural changes in the organisation, and opportunistic behaviour by favouring their own interests to the detriment of those of the outsourcer.
  • Information security. The higher the volume of confidential and/or sensitive data that a third party manages and the more frequently data is processed, the greater the risk that the confidentiality and/or the integrity of that data will be compromised.
  • Business continuity should ensure that the third party is able to continue the service delivery in the event that its core infrastructure or business is impacted by a major disaster.
  • Legal risks. The absence of a well-drafted agreement could lead to a situation in which the outsourcer might be unable to fall back on a legally binding document to ensure compliance with intended contractual terms.
  • Regulatory compliance. Insufficient legislation knowledge or the failure to act according to the regulations may lead to potential breaches of regulatory compliance.

Getting the right to audit!

Managing the outsourcing risks has made the audit a necessary component for all outsourcers. The internal auditor plays a crucial role in evaluating the service provider’s control environment. As a result, auditors need to assess the strength of the control framework and control activities affecting the outsourced processes, as well as to inform management about the effectiveness of outsourcing operations from an operations and compliance standpoint.

Alternatively, the provider could provide SOC reports, in which an external auditor describes, evaluates, and issues an opinion on the service provider’s security and data protection controls.

Drawing audit key lessons

Internal audit should get involved at the early stages to help avoid outsourcing contract failure. It is important to assess how well risk is being jointly considered between the outsourcer and the provider. Internal audit can add value by benchmarking supplier/contractor performance to drive overall improvements. Moreover, the “right to audit” clauses should be invoked in cases where high value and/or high profile contracts are of concern.

Related trainings

Related news

 

Back to overview