1

IT-Outsourcing vs. Business Process OutsourcingSame Risky Business?

Heiko Gewald and Jochen Franke

E-Finance LabUniversity of Frankfurt

2

3

Agenda

• Motivation• Outsourcing and Operational Risk• Research Methodology• Results• Next Steps

4

Motivation: Analyze the new risk structure caused bythe outsourcing of business processes

+ (increased)

- (decreased)

= (unchanged)

Bank Service ProviderLe

vel o

fO

pera

tiona

l Ris

k

BPO

?

Risk Structure (Bank) in t Risk Structure (Bank) in t +1

Pre-Deal Phase ("Make") Delivery Phase ("Buy")

5

Agenda

• Motivation• Operational Risk and Outsourcing• Research Methodology• Results• Next Steps

6

Risk and Operational Risk

Risk is the measurable probability of the negative deviation of a target value from a reference value

[extending Jorion and Khoury 1996]

Operational risk is the risk of loss resulting from inadequate or failed processes, people and systems or from external events

[Basel Committee on Banking Supervision 2004]

7

Outsourcing Types

IT Infrastructure Outsourcing (ITO)Outsourcing hardware-orientated IT activities such as data centre operations (e.g. helpdesk services, network management etc.)

Application Service Providing (ASP)Managing and delivering application capabilities to multiple entities from a data centre across a wide area network

Business Process Outsourcing (BPO)Outsourcing one or more specific business processes together with the IT that supports them

8

Outsourcing History

• In 1963 EDS was the first company to take over the entire data processing for Blue Cross of Pennsylvania

• 'Modern' outsourcing has been conducted since 1989 - Kodak deal

• Outsourcing extends industrialization by specialization of organisations

9

Maturity of Different Types of Outsourcing

IT Infrastructure Outsourcing (ITO)

Application Service Providing(ASP)

Business Process Outsourcing (BPO)

com

plex

ity

mat

urity

, exp

erie

nce

Business Functionality

Applications

Hardware/Software

evol

utio

nov

ertim

e

1970

1980

1990

2000

1960

10

Phases of an Outsourcing Engagement

Pre-DealPhase

ContractualPhase

TransitionPhase

Delivery Phase

project management

processes, systems and people are handed over

business process provided by outside resources

ExitPhase

un-bundeling

hand-over to new provider (internal or external)

vendor selection

contract negotiation

service levelagreements

core competency examination

critical success factor analysis

business case calculation

Focus on Delivery Phase

11

Agenda

• Motivation• Outsourcing and Operational Risk• Research Methodology• Results• Next Steps

12

Research Methodology

• Focus on delivery phase of outsourcing• Focus on the financial sector (banks in Germany)

• Identify risks in ITO literature• Conduct semi-structured interviews with outsourcing

experts• Compare BPO risks with ITO risks• Provide reasoning based on experts assessments of

risks

13

Interviews

• Interviews took place in summer 2004• 7 interviews were conducted

– 3 banks that outsourced specific business processes – 2 outsourcing service providers– 1 consulting firm

• Interviewees were operational risk experts or management in charge of a specific BPO-deal

• Interviewees were presented the risks derived from literature

• Reasoning concerning individual risk tendency compared to ITO were gathered

14

Operational Risk in BPO – Four key risk areas

Operational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Communicationmismatch

Failing interfaces Vendor exploitation of customer expertise

Security breaches

Measurementproblems

Incapable vendorresources Lock-in situation Misuse of trust

Default of vendor Loss of strategicbusiness flexibility

Inexperienced customeror vendor Loss of competences

Loss of cross-functional skills

Not achieving plannedbenefits

Service debasement

15

Agenda

• Motivation• Outsourcing and Operational Risk• Research Methodology• Results• Next Steps

16

Operational Risk in BPO compared to ITOOperational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Security breaches

Incapable vendorresources

Default of vendor

Inexperienced customeror vendor

Not achieving plannedbenefits

Service debasement

Communicationmismatch

Lock-in situation

Failing interfaces

Measurementproblems

Vendor exploitation of customer expertise

Misuse of trust

Loss of strategicbusiness flexibility

Loss of competences

Loss of cross-functional skills

Tendency: same to higher

- depending on system/application landscape related to the process

- especially, if just a part of the system functionality is outsourced and system does not protect data on transaction level

17

Operational Risk in BPO compared to ITOOperational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Security breaches

Incapable vendorresources

Default of vendor

Inexperienced customeror vendor

Not achieving plannedbenefits

Service debasement

Communicationmismatch

Lock-in situation

Failing interfaces

Measurementproblems

Vendor exploitation of customer expertise

Misuse of trust

Loss of strategicbusiness flexibility

Loss of competences

Loss of cross-functional skills

Tendency: same to higher

- depending on complexity of process- 'same' for low complexity (e.g. basic

call centre services)- 'higher' for high complexity (e.g.

processing of international tax requests for mutual funds)

18

Operational Risk in BPO compared to ITOOperational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Security breaches

Incapable vendorresources

Default of vendor

Inexperienced customeror vendor

Not achieving plannedbenefits

Service debasement

Communicationmismatch

Lock-in situation

Failing interfaces

Measurementproblems

Vendor exploitation of customer expertise

Misuse of trust

Loss of strategicbusiness flexibility

Loss of competences

Loss of cross-functional skills

Tendency: same to higher

- basically the same as with ITO- exception if service is offered (only)

by small/new company

19

Operational Risk in BPO compared to ITOOperational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Security breaches

Incapable vendorresources

Default of vendor

Inexperienced customeror vendor

Not achieving plannedbenefits

Service debasement

Communicationmismatch

Lock-in situation

Failing interfaces

Measurementproblems

Vendor exploitation of customer expertise

Misuse of trust

Loss of strategicbusiness flexibility

Loss of competences

Loss of cross-functional skills

Tendency: higher

- BPO least mature outsourcing service in the market

- learning curve experience needs to be managed

20

Operational Risk in BPO compared to ITOOperational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Security breaches

Incapable vendorresources

Default of vendor

Inexperienced customeror vendor

Not achieving plannedbenefits

Service debasement

Communicationmismatch

Lock-in situation

Failing interfaces

Measurementproblems

Vendor exploitation of customer expertise

Misuse of trust

Loss of strategicbusiness flexibility

Loss of competences

Loss of cross-functional skills

Tendency: higher to same

- also matter of learning curve- for the first engagements, usually

more effort than anticipated needs to be put in, thus spoiling the anticipated benefits

21

Operational Risk in BPO compared to ITOOperational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Security breaches

Incapable vendorresources

Default of vendor

Inexperienced customeror vendor

Not achieving plannedbenefits

Service debasement

Communicationmismatch

Lock-in situation

Failing interfaces

Measurementproblems

Vendor exploitation of customer expertise

Misuse of trust

Loss of strategicbusiness flexibility

Loss of competences

Loss of cross-functional skills

Tendency: same to lower

- basically same as ITO- possibly more vendor efforts during

the 'start up' of the market

22

Operational Risk in BPO compared to ITOOperational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Communicationmismatch

Failing interfaces Vendor exploitation of customer expertise

Security breaches

Measurementproblems

Incapable vendorresources Lock-in situation Misuse of trust

Default of vendor

Inexperienced customeror vendor

Not achieving plannedbenefits

Service debasement

Loss of strategicbusiness flexibility

Loss of competences

Loss of cross-functional skills

Tendency: lower

- higher level of documentation for processes compared to IT- mainly driven by banking regulation

23

Operational Risk in BPO compared to ITOOperational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Communicationmismatch

Failing interfaces Vendor exploitation of customer expertise

Security breaches

Measurementproblems

Incapable vendorresources Lock-in situation Misuse of trust

Default of vendor

Inexperienced customeror vendor

Not achieving plannedbenefits

Service debasement

Loss of strategicbusiness flexibility

Loss of competences

Loss of cross-functional skills

Tendency: same to higher

- depending on the standardization and complexity of the process- also depending on the level of market maturity

24

Operational Risk in BPO compared to ITOOperational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Communicationmismatch

Failing interfaces Vendor exploitation of customer expertise

Security breaches

Measurementproblems

Incapable vendorresources Lock-in situation Misuse of trust

Default of vendor

Inexperienced customeror vendor

Not achieving plannedbenefits

Service debasement

Loss of strategicbusiness flexibility

Loss of competences

Loss of cross-functional skills

Tendency: higher

- higher level of intra-personal interaction (communication)- therefore chance of failing interfaces is higher thus more control

resources necessary

25

Operational Risk in BPO compared to ITOOperational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Communicationmismatch

Failing interfaces Vendor exploitation of customer expertise

Security breaches

Measurementproblems

Incapable vendorresources Lock-in situation Misuse of trust

Default of vendor

Inexperienced customeror vendor

Not achieving plannedbenefits

Service debasement

Loss of strategicbusiness flexibility

Loss of competences

Loss of cross-functional skills

Tendency: same to higher

- generally the same, but higher if complex processes involved- very difficult if 'quality' is a measure

26

Operational Risk in BPO compared to ITOOperational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Security breaches

Incapable vendorresources

Default of vendor

Inexperienced customeror vendor

Not achieving plannedbenefits

Service debasement

Communicationmismatch

Lock-in situation

Failing interfaces

Measurementproblems

Vendor exploitation of customer expertise

Misuse of trust

Loss of strategicbusiness flexibility

Loss of competences

Loss of cross-functional skills

Tendency: same

- no significant difference has been reported

27

Operational Risk in BPO compared to ITOOperational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Security breaches

Incapable vendorresources

Default of vendor

Inexperienced customeror vendor

Not achieving plannedbenefits

Service debasement

Communicationmismatch

Lock-in situation

Failing interfaces

Measurementproblems

Vendor exploitation of customer expertise

Misuse of trust

Loss of strategicbusiness flexibility

Loss of competences

Loss of cross-functional skills

Tendency: higher

- risk is regarded to be higher compared to ITO, as it is (usually) necessary for the service provider to assess the client data directly (non-encrypted, not on machine level)

28

Operational Risk in BPO compared to ITOOperational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Security breaches

Incapable vendorresources

Default of vendor

Inexperienced customeror vendor

Not achieving plannedbenefits

Service debasement

Communicationmismatch

Lock-in situation

Failing interfaces

Measurementproblems

Vendor exploitation of customer expertise

Misuse of trust

Loss of strategicbusiness flexibility

Loss of competences

Loss of cross-functional skills

Tendency: higher

- assumed to be higher, as driver for flexibility and innovation are assumed to be business processes (not hard- and software)

- lack of flexibility due to one-to-many business models of vendors (standardisation etc.)

29

Operational Risk in BPO compared to ITOOperational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Security breaches

Incapable vendorresources

Default of vendor

Inexperienced customeror vendor

Not achieving plannedbenefits

Service debasement

Communicationmismatch

Lock-in situation

Failing interfaces

Measurementproblems

Vendor exploitation of customer expertise

Misuse of trust

Loss of strategicbusiness flexibility

Loss of competences

Loss of cross-functional skills

Tendency: higher

- this risk is assumed to be higher for BPO compared to ITO, if the process is closely related to the core (banking) business

30

Operational Risk in BPO compared to ITOOperational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Security breaches

Incapable vendorresources

Default of vendor

Inexperienced customeror vendor

Not achieving plannedbenefits

Service debasement

Communicationmismatch

Lock-in situation

Failing interfaces

Measurementproblems

Vendor exploitation of customer expertise

Misuse of trust

Loss of strategicbusiness flexibility

Loss of competences

Loss of cross-functional skills

Tendency: same

- loss of personnel with broader view (e.g. IT and business, cross-process know-how) is regarded to be same as with ITO

31

Operational Risks of the delivery phasein BPO compared to ITO

Operational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Communicationmismatch

Failing interfaces Vendor exploitation of customer expertise

Security breaches

Measurementproblems

Incapable vendorresources Lock-in situation Misuse of trust

Default of vendor Loss of strategicbusiness flexibility

TendencylowerInexperienced customer

or vendor Loss of competencessame to lowersame

Loss of cross-functional skills

Not achieving plannedbenefits same to higher

higher to sameService debasement higher

32

Graphical Display of Results

33

Agenda

• Motivation• Outsourcing and Operational Risk• Research Methodology• Results• Next Steps

34

Further Research

• Compile factor model of operational risks in BPO

• Empirical study within the German banking sector– Payments– Securities settlement

• Extend to a quantitative approach to asses operational risk in BPO

35

Contact:

Heiko Gewald Jochen Frankeheiko.gewald@de.ibm.com jfranke@wiwi.uni-frankfurt.de

E-Finance LabInstitut für Wirtschaftsinformatik

Johann Wolfgang Goethe-Universität Frankfurt am Main