Risk Assurance Retail Audit Forum How can Internal Audit add value to outsourcing arrangements?
Agenda/Intro Introductions What is outsourcing? IA role in outsourcing Know your risks Common pitfalls High performing businesses get it right 10 practical actions to take away 2
What is outsourcing? In business, outsourcing is the contracting out of a business process to a third-party. The term "outsourcing" became popular in the United States near the turn of the 21st century. Outsourcing sometimes involves transferring employees and assets from one firm to another, but not always. Outsourcing is also used to describe the practice of handing over control of public services to for-profit corporations. Outsourcing includes both foreign and domestic contracting, and sometimes includes offshoring or relocating a business function to another country. Financial savings from lower international labour rates is a big motivation for outsourcing/offshoring. 3
Why do it and what exactly is outsourced? Why do it? Improving service while keeping down costs Creating value from your support functions What are you outsourcing? People, processes and sometimes systems might be stripped out of the organisation but the reputational risk remains within it. In some cases regulatory risk may be passed over but not always. What could be outsourced? HR/Payroll, Call Centres, IT, Finance functions, Banking, Facilities Management, Shop fitting, Marketing and many more! Exercise: What does your table outsource? 4
Getting it right means looking at the full term of the deal. Our experience has indicated that there are 6 stages of the outsourcing life cycle Detailed handover in place Re-assessment of services and rates Clear performance measures Is there a clear business case? Why is outsourcing the answer? Are you just moving a problem? Termination or re-negotiation Strategic decision What monitoring is in place? Is this real time or reactive? Are the controls clear? Can you rely on data provided? Is this a lift and shift Roles and responsibilities defined Has the scope been met? What are the risks? Monitoring & controls Transformation of business Scoping & requirements Selection Has the business spent adequate time defining what will be outsourced? Are they clear about who does what, where, when and how? Do the people in this stage have the knowledge/experience to do this? How has the business identified potential outsourcers? Have they performed adequate supplier diligence? Is the selection criteria clear? 5
What are the typical risks to look out for? Regulatory or reputational risk Risk management (business failure) Remedial actions Are you getting what you paid for? Are you paying more than you should? Change control/monitoring Information is lost during handover Sufficient knowledge is not retained in-house Lack of expertise or experience of outsourcing 6
Exercise #2: Know your risks The contracts heat map below shows the contracts that, in our experience, are most likely to be at risk of value leakage during the delivery phase High Subjectivity of determining value Insurance Catering & Venues Legal & consultancy Office Supplies Energy IT infrastructure & services Maintenance Distribution Marketing Facilities Management Telecoms Fuel Logistics Waste Capital Projects Business process outsourcing Key Complex service arrangements Contracts with conditional pricing Contracts for quantity of goods at an agreed price Value leakage 2 15% Red zone Amber zone Green zone 0.5 4% 0.1 2% Periodic Continuous Low assessment monitoring Complexity of pricing Proactive management High 7
What are the common pitfalls? Lift and shift Lack of clarity of performance Awareness & knowledge of contract Lack of governance Poor service delivery Remedial actions not taken 8
What do high performing businesses get right? Understand what is important Defined accountabilities and capabilities Contract is fit for purpose Chain of dependencies is clear Governance and monitoring framework in place Proactive management of pivotal promises 9
10 practical actions to take away 1. Identify your outsourcing arrangements 2. Locate all documentation and review so you understand contractual position 3. Are the outsourced arrangements on the risk register? 4. Are the risks known and if not document? Are these risks being managed? 5. Where are you in the contract lifecycle? 6. Talk to the business owner of the arrangement and ask what they would like from internal audit 7. Brainstorm how internal audit can add value to the arrangement 8. Review how performance of the outsourcer is perceived and measured (by your company and customers) 9. Review services provided are in line with the contract 10. Consider invoking the right to audit clause 10
Our contact details Sara Binns Sara.binns@uk.pwc.com 07799 623792 Lucy Jevons Lucy.a.jevons@uk.pwc.com 07812 497246 This publication has been prepared for general guidance on matters of interest only, and does not constitute professional advice. You should not act upon the information contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is given as to the accuracy or completeness of the information contained in this publication, and, to the extent permitted by law, PricewaterhouseCoopers LLP, its members, employees and agents do not accept or assume any liability, responsibility or duty of care for any consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it. 2014 PricewaterhouseCoopers LLP. All rights reserved. In this document, refers to PricewaterhouseCoopers LLP which is a member firm of PricewaterhouseCoopers International Limited, each member firm of which is a separate legal entity.