Risks associated with an IT outsourcing project

The chief executive of a newly merged financial services company wanted to improve the effectiveness of the IT function. He initiated a major project to examine the options for achieving significant improvement. These included outsourcing all or part of the IT services to a specialist company that had previous experience in the sector. A project team was assembled from all the departments that might be affected, and their work was conducted in strict secrecy to avoid triggering premature and inappropriate actions.
 
The team researched the outsourcing options, and had very mixed views about the balance between suspected long-term risks and claimed benefits. They asked one of Zurich’s strategic risk consultants to help them identify and assess the risks and uncertainties over different timescales.

During a one-day workshop, the Zurich consultant helped the team identify 42 project risk factors. From these they developed 12 separate risk scenarios that were rated for their severity of potential consequences and probability of occurrence. In some cases, the scenarios were evaluated over different time horizons to reflect long- and short-term risks. Principal risks included:

• possible loss of core intellectual property and expertise
• changes in the source of economic benefits over time
• sole dependency on a company with different objectives and priorities
• resultant cost creep and escalation
• the reliability and financial stability of the vendor data security

After carefully weighing the risks against the benefits and considering various mitigation options, it was concluded that vendor selection, contract negotiation and project management skills were crucial to success. A weak contract with an unstable vendor and poor alignment of objectives could spell disaster, whereas an equitable deal with a well-managed vendor that has a really strong reputation to safeguard could prove highly successful. 
 
Armed with a clear understanding of the project risks, and having defined their selection criteria and key success factors, the project team were in a position to start a rigorous vendor selection process. Their ability to ask searching and pertinent questions was enhanced by the risk analysis, and their negotiating position was greatly strengthened, easily justifying the time and cost of the risk management exercise.