IT-Outsourcing vs. Business Process Outsourcing …Business Process Outsourcing (BPO) Outsourcing...

1

IT-Outsourcing vs. Business Process OutsourcingSame Risky Business?

Heiko Gewald and Jochen Franke

E-Finance LabUniversity of Frankfurt

3

Agenda

• Motivation• Outsourcing and Operational Risk• Research Methodology• Results• Next Steps

4

Motivation: Analyze the new risk structure caused bythe outsourcing of business processes

+ (increased)

- (decreased)

= (unchanged)

Bank Service ProviderLe

vel o

fO

pera

tiona

l Ris

k

BPO

?

Risk Structure (Bank) in t Risk Structure (Bank) in t +1

Pre-Deal Phase ("Make") Delivery Phase ("Buy")

5

Agenda

• Motivation• Operational Risk and Outsourcing• Research Methodology• Results• Next Steps

6

Risk and Operational Risk

Risk is the measurable probability of the negative deviation of a target value from a reference value

[extending Jorion and Khoury 1996]

Operational risk is the risk of loss resulting from inadequate or failed processes, people and systems or from external events

[Basel Committee on Banking Supervision 2004]

7

Outsourcing Types

IT Infrastructure Outsourcing (ITO)Outsourcing hardware-orientated IT activities such as data centre operations (e.g. helpdesk services, network management etc.)

Application Service Providing (ASP)Managing and delivering application capabilities to multiple entities from a data centre across a wide area network

Business Process Outsourcing (BPO)Outsourcing one or more specific business processes together with the IT that supports them

8

Outsourcing History

• In 1963 EDS was the first company to take over the entire data processing for Blue Cross of Pennsylvania

• 'Modern' outsourcing has been conducted since 1989 - Kodak deal

• Outsourcing extends industrialization by specialization of organisations

9

Maturity of Different Types of Outsourcing

IT Infrastructure Outsourcing (ITO)

Application Service Providing(ASP)

Business Process Outsourcing (BPO)

com

plex

ity

mat

urity

, exp

erie

nce

Business Functionality

Applications

Hardware/Software

evol

utio

nov

ertim

e

1970

1980

1990

2000

1960

10

Phases of an Outsourcing Engagement

Pre-DealPhase

ContractualPhase

TransitionPhase

Delivery Phase

project management

processes, systems and people are handed over

business process provided by outside resources

ExitPhase

un-bundeling

hand-over to new provider (internal or external)

vendor selection

contract negotiation

service levelagreements

core competency examination

critical success factor analysis

business case calculation

Focus on Delivery Phase

11

Agenda


12

Research Methodology

• Focus on delivery phase of outsourcing• Focus on the financial sector (banks in Germany)

• Identify risks in ITO literature• Conduct semi-structured interviews with outsourcing

experts• Compare BPO risks with ITO risks• Provide reasoning based on experts assessments of

risks

13

Interviews

• Interviews took place in summer 2004• 7 interviews were conducted

– 3 banks that outsourced specific business processes – 2 outsourcing service providers– 1 consulting firm

• Interviewees were operational risk experts or management in charge of a specific BPO-deal

• Interviewees were presented the risks derived from literature

• Reasoning concerning individual risk tendency compared to ITO were gathered

14

Operational Risk in BPO – Four key risk areas

Operational Risk in BPO

Maturity of BPO market

Processcomplexity

Extent of human interaction

Competitivenessand specifity

Communicationmismatch

Failing interfaces Vendor exploitation of customer expertise

Security breaches

Measurementproblems

Incapable vendorresources Lock-in situation Misuse of trust

Default of vendor Loss of strategicbusiness flexibility

Inexperienced customeror vendor Loss of competences

Loss of cross-functional skills

Not achieving plannedbenefits

Service debasement

15

Agenda


16

Operational Risk in BPO compared to ITOOperational Risk in BPO


Processcomplexity



Security breaches

Incapable vendorresources

Default of vendor

Inexperienced customeror vendor


Service debasement


Lock-in situation

Failing interfaces

Measurementproblems

Vendor exploitation of customer expertise

Misuse of trust

Loss of strategicbusiness flexibility

Loss of competences


Tendency: same to higher

- depending on system/application landscape related to the process

- especially, if just a part of the system functionality is outsourced and system does not protect data on transaction level

17



Processcomplexity



Security breaches


Default of vendor



Service debasement


Lock-in situation

Failing interfaces

Measurementproblems


Misuse of trust


Loss of competences



- depending on complexity of process- 'same' for low complexity (e.g. basic

call centre services)- 'higher' for high complexity (e.g.

processing of international tax requests for mutual funds)

18



Processcomplexity



Security breaches


Default of vendor



Service debasement


Lock-in situation

Failing interfaces

Measurementproblems


Misuse of trust


Loss of competences



- basically the same as with ITO- exception if service is offered (only)

by small/new company

19



Processcomplexity



Security breaches


Default of vendor



Service debasement


Lock-in situation

Failing interfaces

Measurementproblems


Misuse of trust


Loss of competences


Tendency: higher

- BPO least mature outsourcing service in the market

- learning curve experience needs to be managed

20



Processcomplexity



Security breaches


Default of vendor



Service debasement


Lock-in situation

Failing interfaces

Measurementproblems


Misuse of trust


Loss of competences


Tendency: higher to same

- also matter of learning curve- for the first engagements, usually

more effort than anticipated needs to be put in, thus spoiling the anticipated benefits

21



Processcomplexity



Security breaches


Default of vendor



Service debasement


Lock-in situation

Failing interfaces

Measurementproblems


Misuse of trust


Loss of competences


Tendency: same to lower

- basically same as ITO- possibly more vendor efforts during

the 'start up' of the market

22



Processcomplexity





Security breaches

Measurementproblems


Default of vendor



Service debasement


Loss of competences


Tendency: lower

- higher level of documentation for processes compared to IT- mainly driven by banking regulation

23



Processcomplexity





Security breaches

Measurementproblems


Default of vendor



Service debasement


Loss of competences



- depending on the standardization and complexity of the process- also depending on the level of market maturity

24



Processcomplexity





Security breaches

Measurementproblems


Default of vendor



Service debasement


Loss of competences


Tendency: higher

- higher level of intra-personal interaction (communication)- therefore chance of failing interfaces is higher thus more control

resources necessary

25



Processcomplexity





Security breaches

Measurementproblems


Default of vendor



Service debasement


Loss of competences



- generally the same, but higher if complex processes involved- very difficult if 'quality' is a measure

26



Processcomplexity



Security breaches


Default of vendor



Service debasement


Lock-in situation

Failing interfaces

Measurementproblems


Misuse of trust


Loss of competences


Tendency: same

- no significant difference has been reported

27



Processcomplexity



Security breaches


Default of vendor



Service debasement


Lock-in situation

Failing interfaces

Measurementproblems


Misuse of trust


Loss of competences


Tendency: higher

- risk is regarded to be higher compared to ITO, as it is (usually) necessary for the service provider to assess the client data directly (non-encrypted, not on machine level)

28



Processcomplexity



Security breaches


Default of vendor



Service debasement


Lock-in situation

Failing interfaces

Measurementproblems


Misuse of trust


Loss of competences


Tendency: higher

- assumed to be higher, as driver for flexibility and innovation are assumed to be business processes (not hard- and software)

- lack of flexibility due to one-to-many business models of vendors (standardisation etc.)

29



Processcomplexity



Security breaches


Default of vendor



Service debasement


Lock-in situation

Failing interfaces

Measurementproblems


Misuse of trust


Loss of competences


Tendency: higher

- this risk is assumed to be higher for BPO compared to ITO, if the process is closely related to the core (banking) business

30



Processcomplexity



Security breaches


Default of vendor



Service debasement


Lock-in situation

Failing interfaces

Measurementproblems


Misuse of trust


Loss of competences


Tendency: same

- loss of personnel with broader view (e.g. IT and business, cross-process know-how) is regarded to be same as with ITO

31

Operational Risks of the delivery phasein BPO compared to ITO

Operational Risk in BPO


Processcomplexity





Security breaches

Measurementproblems


Default of vendor Loss of strategicbusiness flexibility

TendencylowerInexperienced customer

or vendor Loss of competencessame to lowersame


Not achieving plannedbenefits same to higher

higher to sameService debasement higher

32

Graphical Display of Results

33

Agenda


34

Further Research

• Compile factor model of operational risks in BPO

• Empirical study within the German banking sector– Payments– Securities settlement

• Extend to a quantitative approach to asses operational risk in BPO

35

Contact:

Heiko Gewald Jochen [email protected] [email protected]

E-Finance LabInstitut für Wirtschaftsinformatik

Johann Wolfgang Goethe-Universität Frankfurt am Main

IT-Outsourcing vs. Business Process Outsourcing …Business Process Outsourcing (BPO) Outsourcing...

Documents

Transcript of IT-Outsourcing vs. Business Process Outsourcing …Business Process Outsourcing (BPO) Outsourcing...