Risk Analysis for Outsourcing Decisions
Linda Duvall
CMGT/442
Mr. Thomas Maricle
February 23, 2011
Abstract

The purpose of this paper is to identify the possible risks to an organization in each of the following outsourcing situations: a) the use of an external service provider for your data storage; b) the use of an enterprise service provider for processing information systems applications such as a payroll, human resources, or sales order taking; c) the use of a vendor to support your desktop computers; and d) the use of a vendor to provide network support. The paper will include a risk mitigation strategy for each situation. Risk Analysis for Outsourcing Decisions “Outsourcing”, as defined by Wikipedia, the free encyclopedia, is the contracting out of a business function to an external provider. In this sense, two organizations enter into a contractual agreement involving an exchange of services and payments. Paul Strassmann, in his paper “The Squandered Computer” would prefer the term “out-tasking” because one organization is utilizating the specialization of another organization. According to “Microsoft Business for Small and Mid-Size Companies”, small business owners are outsourcing a range of services, from Human Relations to finance and accounting to customer services. Small businesses can now tap outside facilitators for a much greater range of services. As an example, entrepreneurs with strong sales often assume a full-time bookkeeper is needed to oversee the books. But, in fact, the company might not actually require a full-time bookkeeper; such services have little to do with the volume of sales and more to do with the level of accounting activity, such as invoicing, bill paying and payroll. The advantages of outsourcing will vary with the kind of business services being outsourced and the quality of the provider. Outsourcing can provide cost savings, access to intellectual property and wider experience and knowledge, operational expertise, tax benefits and risk management. The problems associated with outsourcing are security risks, loss of control of business data, not understanding the service provider capacity limitations and poor communications between the small business owner and service provider. The consensus of opinion is to move slowly and commit one service at a time. Each of the following services has its own unique risk associated with outsourcing: a) the use of an external service provider for your data storage; b) the use of an enterprise service provider for processing information systems applications such as a payroll, human resources, or sales order taking; c) the use of a vendor to support your desktop computers; and d) the use of a vendor to provide network support.
Data Storage Outsourcing data storage and backups has proven to be an excellent way for businesses to capitalize on technology benefits without having to make the hardware and software investment themselves. There are a large number of service providers who specialize in data storage and backups. The business owner should be concerned about exactly how the data is being handled. Primary areas of concern are data integrity, data availability and data recovery. For data integrity or data leakage: ensure that one company’s data does not co-mingle with other companies' data that the service provider is supporting. While the service provider might host several businesses’ data on the same storage server, each company’s data should be segregated the across different blades and/or be isolated by the use of virtualization software. For data availability: identify and prioritize the data availability requirements, how quickly is primary data available to be accessed, how long is the delay for secondary data considered acceptable. The cost of each level of availability is different due to its placement on the server. For data backup: decide between simple data backups, which only backs up the application data or a wider data back-up method, which backs up the applications themselves and the operating system. The regularity and location of the backups should be reviewed for compatibility with the business’ activities and physical security awareness.
Service Providers Small business do not need or usually want to hire extra employees to provide non-core related services, such as accounting, public relations or human resource functions. For many small businesses these non-core related jobs either require less time than a full or part time job or are only need to be done as an occasional project. Therefore, it makes business sense to research service or infrastructure outsourcing providers. The major disadvantage to outsourcing infrastructure services is the risk of putting part of the company in someone else's hands. Careful research will determine if the service provider is trustworthy or will stay in business or can adapt to your company’s growing and changing needs. Outsourcing is not a new. Outsourcing is said to have been around a few thousand years, many business owners of the earlier times had already practiced this kind of business model. People with specific skills have always offered their services to other businesses in exchange for an equivalent service. Because accounting, bookkeeping, tax services, and public relations have been available as outsourced services for years, there are rules, regulations and laws governing the companies that provide these services. In many cases, these service providers are bonded, insured and have a reputation for solid business dealings. While the business owners is putting company sensitive information into the someone else’s hands, with some research, the business owner can feel secure knowing he is dealing with a reputable firm.
Desktop Operations Many organizations seek to reduce the cost of Personal Computer(PC) ownership by outsourcing desktop operations. The concept is to employ an outside service provider to maintain and service the desktop infrastructure. However, the response time of the service provider can contribute to a serious problem called “self-support”. End-user “self-support” is defined, by Alex Kozlov, in his article “The Hidden Cost of Outsourcing Desktop Support” as the time spent by employees fixing or trying to fix their own or their colleagues’ PCs. In addition to distracting employees from their primary job responsibilities, self support contributes to a wide range of performance problems. As an example, do-it-yourselfers often introduce inconsistencies between standard configurations, thereby reducing compatibility and increasing demand for central support activity. Self support can also hide problems from the central support team, so instead of a single investigation and resolution, the same problem is repeated and resolved many times over. There are two levels of desktop support, in-house and remote. In-house support requires office or desk space within the small business premises in order for the technician to arrive at the disabled desk to troubleshoot problems with software applications, operating systems, printers, or network connectivity within “minutes”. Remote support usually addresses problems associated with a mobile and distributed workforce, using the service provider’s hardware or software to troubleshoot hardware and software issues as well as install and upgrade software. In some instances, a combination of both support is necessary for the company’s support needs. The small business owner needs to assess the level of support required for his unique requirements and research service providers accordingly.
Network Support Network support covers a large area of general business activities, including telephone service, internet access, email and web-based applications. What might have started as a single server will grow exponentially larger as the company expands its business networking needs. Networking needs will spread out far beyond the walls of a single office when the business wants to maintain secure data networks at multiple locations or add video, Voice over IP(VoIP) and wireless internet access capabilities. Outsourced network providers are better suited to understand and address network-centric risks, such as hackers, spam, phishing and denials of service attacks. However, even companies that keep their networking in-house are subject to these network-centric problems. The small business owner is faced with the same loss of control issues with each of these areas being outsourced. The risks of data loss or company sensitive information compromise or worker productivity or network slow-down is to some degree, the same with each outsourcing provider. The small business owner should minimize risks by using service-level agreements offered by most outsourcing companies to keep down the cost of risks. Comprehensive contracts for these services can keep downtime and lost productivity risks to a minimum and mitigate the chances of liability due to the compromise of client or corporate data. While outsourcing has been blamed for loss of jobs in America, business owners can use outsourcing to enhance and streamline their core business by leaving the non-core business activities to expects.
References
Chaudhury, Reuben, Terfloth, Christian, (2009) “The Lure of Network Outsourcing” www.oliverwyman.com referenced February 20, 2011

Dern, Daniel, (2010), “Seven steps for outsourcing data storage for SMBs” SearchSMBStorage.com referenced on-line February 21, 2011

Kozlov, Alex, “The Hidden Cost of Outsourcing Desktop Support” Compass America referenced on-line February 21, 2011

Microsoft Business for Small and Mid-Size Companies, http://www.microsoft.com/business Referenced on-line February 21, 2011

Strassmann, Paul A (1998), “The Squandered Computer”, Published in Across The Board, Referenced on-line February 21, 2011 http://en.wikipedia.org/wiki/Outsource referred on-line February 20, 2011