Outsourcing and Managed Services Developing a Common Language

Outsourcing/Managed Services: Developing a Common Language Between Suppliers and Purchasers to Reduce Risk:

Outsourcing/Managed Services: Developing a Common Language Between Suppliers and Purchasers to Reduce Risk Alan McSweeney

Objectives:

January 11, 2011 2 Objectives Describe at a high-level a structured approach to implementing outsourcing/managed services from both service provider and end-user organisation

Scope:

January 11, 2011 3 Scope Provide a high-level view of a common set of processes to be used by service providers and end-user organisations to implement and operate an outsourcing/managed services arrangement

What is Outsourcing:

January 11, 2011 4 What is Outsourcing Outsourcing is delegating the responsibility for performing an information technology or business function to a third party You outsource because the outsourcing supplier will do: What the organisation currently does At the same or better level of performance For the same or lower price

Advantages of Managed Services:

January 11, 2011 5 Advantages of Managed Services Better use of staff: allows agencies to focus human resources on strategic planning and core mission support Cost savings: choose not to build and support IT and network infrastructure available in the commercial sector; use limited capital to purchase needed service levels and reduce total cost of ownership Ability to use optimal technologies: adjust types and mix of hardware, software, skilled labour, capital investment and technology to support changes in mission needs Rapid response to organisation and business changes: supplier is measured by ability to produce solutions

Types of Outsourcing Arrangement:

January 11, 2011 6 Types of Outsourcing Arrangement Efficiency/Utility (Make it Cheaper) arrangement outsourcing focuses primarily on cost control and, over time, cost reduction, with the goal of maintaining consistency in the delivery of services Business Enhancement (Make it Better) arrangement is about business productivity. The organisation’s performance, as compared with their competitors, will improve, resulting in movement toward defined business goals Transformational (Make me Money) arrangement is characterised by a partnership between the service provider and service recipient that is focused on innovation and new business, changing the very basis on which an organisation competes

Benefits of Managed Services:

January 11, 2011 7 Benefits of Managed Services Managed Services offers an alternative approach for a client to acquire IT or telecom support services Managed services solutions are designed and delivered by service providers according to a predefined statement of deliverables and generally includes end-to-end service, service level agreements, and assets (if desired) A managed service typically includes monthly recurring service-based pricing offering a more predictable cost approach for the client Ongoing visibility of operational performance is provided and managed through pre-agreed performance parameters (known as service-level agreements) The client may include their unique performance requirements such as degree of control and visibility, security, availability, capacity, service continuity and other requirements as it relates to the specific service Because this is a core competency, the service provider is able to optimise the best balance of facilities, processes, resources, tools, and metrics, resulting in the best overall value for the client Cost effectiveness is typically achieved through instituting process standards and establishing and supporting a standard operating environment (SOE) consisting of COTS (Commercial Off the Shelf) services and solutions Managed services can be delivered either in a BOCO (Business-owned, contractor- operated) or COCO (contractor-owned, contractor-operated) model and is largely based on client preference

Outsourcing Organisations - Developing a Vision for IT Services is Required:

January 11, 2011 8 Outsourcing Organisations - Developing a Vision for IT Services is Required What do we do today? What do our customers want us to do? What changes do we need to make to align with our customers needs? How will they pay for those services? How will we deliver those services consistently and measure their delivery? What kind of organisation (Governance/Contract Management/Structures/Staff/Skills/Service Providers) will we need to achieve it? What service management processes we should use?

Reasons Organisations Outsource:

January 11, 2011 9 Reasons Organisations Outsource

Outsourcing Experiences:

January 11, 2011 10 Outsourcing Experiences 13% to 25% of outsourcing contracts are brought in-house within the first two years Buyers replace 80% of their service contractors in the first three years Contractors turn over 40% of their contracts each year, on average Nearly 70% outsourcing organisations feel their service provider does adequately understand what they are supposed to do

Key Issues For Successful Outsourcing:

January 11, 2011 11 Key Issues For Successful Outsourcing Many outsourcing relationships fail, are terminated early, are unsatisfactory to either or both of the service provider and the client Outsourcing is a business issues and should be treated as such Many common issues, problems and concerns arise across outsourcing contracts Learn from the issues to avoid them

Hidden Costs of Outsourcing:

January 11, 2011 12 Hidden Costs of Outsourcing Transfer of knowledge Processes and procedures Documentation Personal knowledge Quality issues and their resolution Inspection programmes Sustaining quality programmes Cost of rework Communication Poor customer service Daily operational issues

Phases of Outsourcing Relationship:

January 11, 2011 13 Phases of Outsourcing Relationship Ongoing Initiation Delivery Completion Analysis For outsourcing organisation For both outsourcing organisation and service provider

Phases of Outsourcing Relationship:

January 11, 2011 14 Phases of Outsourcing Relationship Phase Outsourcing Organisation Service Provider Analysis Analyse operations and functions to identify those services, processes or functions that could potentially be outsourced and develops the approach to be taken to source the identified opportunities Initiation Prepare for and transition to provision of service Prepare for and transition to provision of service Delivery Provide service and manage and measure its provision Provide service and manage and measure its provision Completion Close-out the service after the contract ends or the service has been terminated Close-out the service after the contract ends or the service has been terminated Ongoing Management of outsourcing lifecycle Management of outsourcing lifecycle

Roles of Service Provider and Outsourcing Organisation During Phases of Outsourcing Relationship:

January 11, 2011 15 Roles of Service Provider and Outsourcing Organisation During Phases of Outsourcing Relationship Initiation Delivery Completion Analysis Ongoing Service Provider Outsourcing Organisation Determine if outsourcing represents a business opportunity Prepare for service transition, transfer resources and personnel from outsourcing organisation and ensure service continuity Plan for outsourcing of selected services, evaluate and select a service provider, create an outsourcing agreement and transfer resources and personnel to service provider Define and agree requirements, negotiate contract, plan, design and deploy service, implement service delivery Implement the capability to manage the service provider, administer the agreement and the issues, challenges and changes that arise after the agreement has been reached, reviewing the service provider’s performance Implement knowledge management processes, perform people management, implement performance management, manage relationship, manage technology and manage risks and threats Develop outsourcing strategy management, manage relationship with service provider, ensure value, implement knowledge management processes, manage technology and manage risks and threats Prepare for service transition, transfer resources and personnel from outsourcing organisation and ensure service continuity Plan for completion, ensure service continuity, transfer resources and personnel from outsourcing organisation and transfer knowledge

Roles of Service Provider and Outsourcing Organisation During Phases of Outsourcing Relationship:

January 11, 2011 16 Roles of Service Provider and Outsourcing Organisation During Phases of Outsourcing Relationship Initiation Delivery Completion Analysis Ongoing Service Provider Outsourcing Organisation Common Language and Expectations Agreed Roles and Responsibilities

Key Capabilities and Constituent Practices:

January 11, 2011 17 Key Capabilities and Constituent Practices Idealised set of steps for a service provider and end-user organisations and outsourcing organisation to perform when taking on a new outsourcing service Provides a detailed checklist of work to be done Each practices contains a set of activities and tasks Can be modified to suit the circumstances: scope of outsourcing, size of service, duration of contract Can forms the basis of a project plan for elements of outsourcing work such as initiation Reduces risk of failure

Key Capabilities Within Outsourcing Lifecycle for Service Providers:

January 11, 2011 18 Key Capabilities Within Outsourcing Lifecycle for Service Providers Ongoing Initiation Delivery Completion People Management Performance Management Relationship Management Technology Management Knowledge Management Threat Management Contracting Service Design and Deployment Service Delivery Service Transfer Service Transfer

Key Capabilities Within Outsourcing Lifecycle for End-User Organisations:

January 11, 2011 19 Key Capabilities Within Outsourcing Lifecycle for End-User Organisations Outsourcing Strategy Management Governance Management Relationship Management Value Management Technology Management People Management Outsourcing Planning Outsourcing Agreements Sourced Services Management Outsourcing Completion Outsourcing Opportunity Analysis Ongoing Initiation Delivery Completion Analysis Knowledge Management Organisational Change Management Threat Management Outsourcing Approach Service Transfer Service Provider Evaluation

Key Capabilities Within Outsourcing Lifecycle for Service Providers and End-User Organisations :

January 11, 2011 20 Key Capabilities Within Outsourcing Lifecycle for Service Providers and End-User Organisations

Key Capabilities and Constituent Practices for Service Providers :

January 11, 2011 21 Key Capabilities and Constituent Practices for Service Providers

Key Capabilities and Constituent Practices for End-User Organisations - 1:

January 11, 2011 22 Key Capabilities and Constituent Practices for End-User Organisations - 1

Key Capabilities and Constituent Practices for End-User Organisations - 2:

January 11, 2011 23 Key Capabilities and Constituent Practices for End-User Organisations - 2

Analysis Phase:

January 11, 2011 24 Analysis Phase Service Provider Concerned with analysing operations and functions to identify those services, processes, or functions that could potentially be outsourced Understanding the current, or as-is, state of the client organisation’s structure and processes Identifying the relevant criteria for selecting outsourcing opportunities Identifying outsourcing opportunities to meet outsourcing objectives and criteria Organising options for outsourcing Developing and validating the Business Case for each outsourcing option Identifying the outsourcing approach and governance model for the proposed outsourcing action Performing impact and risk analyses of the proposed outsourcing action Making the decision whether or not to source the proposed outsourcing action

Initiation Phase:

January 11, 2011 25 Initiation Phase Service Provider Concerned with preparation for and initiation of service delivery Gather requirements Perform due diligence to validate customer information Assess if and how the requirements can be met Prepare for negotiation Negotiate and sign contract Confirm assumptions Confirm responsibilities and commitments Design the service Review the service design Create service specification Deploy the service Transfer resources - personnel, technology, infrastructure, applications Transition of service End-User Organisation Concerned with preparation for and initiation of managing outsourced services Preparing for service selection by developing the solicitation and criteria for selection Soliciting and evaluating potential service providers Preparing for negotiation by having an organisational position on cost, quality and other topics that need to be negotiated Defining the formal service level agreements and service provider performance measures Understanding service provider’s capabilities by gathering information about the service provider and confirming the assumptions that impact commitments Establishing a formal agreement with service providers that clearly articulates the clients’ and service provider’s responsibilities and commitments Providing feedback on the service design in order to ensure that the services are meeting the client’s requirements and the agreed-upon commitments Managing the effective transfer of resources needed for service delivery, including personnel, technology infrastructure and work environment

Delivery Phase:

January 11, 2011 26 Delivery Phase Service Provider Concerned with service delivery including management of service delivery, verification that commitments are being met and management of costs associated with the service provision Planning and tracking the service delivery activities Delivering services according to the agreed commitments Managing the finances associated with the service delivery Identifying and controlling modifications to the services being provided Identifying and controlling modifications to associated service commitments Identifying problems that impact the service delivery and taking both preventive and corrective actions End-User Organisation Concerned with monitoring the service provider’s service delivery capabilities, including the ongoing monitoring of service provider performance to verify that commitments are being met, monitoring changes, management of the finances and agreements associated with the service provision, fostering realistic expectations and performing value analysis Planning and tracking the outsourcing management activities Ensuring that services are delivered according to the agreed-upon commitments Managing the finances associated with the service delivery Identifying and controlling modifications to the services being provided or to the associated service commitments Facilitating problem resolution for problems that impact the service delivery Reconciling performance against expectations and ensuring that the service provision returns value to the client organisation

Ongoing Phase:

January 11, 2011 27 Ongoing Phase Service Provider Management functions that need to be performed during the entire outsourcing lifecycle Manage and motivate personnel to effectively deliver services Manage relationships with clients, suppliers and business partners Measure and review the organisation’s performance and taking action to improve it Manage information and knowledge systems so that personnel have access to the knowledge needed to effectively perform their work Identify and control threats to the organisation’s ability to meet its objectives and client requirements Manage the technology, systems and applications infrastructure used to support delivery of service End-User Organisation Management functions that need to be performed during the entire outsourcing lifecycle Manage and motivate personnel to effectively deliver services Manage relationships with clients, suppliers and business partners Measure and review the organisation’s performance and taking action to improve it Manage information and knowledge systems so that personnel have access to the knowledge needed to effectively perform their work Identify and control threats to the organisation’s ability to meet its objectives and client requirements Manage the technology, systems and applications infrastructure used to support delivery of service

Completion Phase:

January 11, 2011 28 Completion Phase Service Provider Concerned with closing down the engagement at the end of the outsourcing lifecycle Manage the transfer of resources to the new service provider, whether it is to the client or to another service provider Ensure service continuity during transfer Identify and transferring the knowledge critical for the delivery of service End-User Organisation Concerned with closing down the engagement at the end of the outsourcing lifecycle Planning for closing down a outsourced service and managing the agreement during the close-down period including managing the agreement during termination proceedings, during renewal, or during normal completion Managing the transfer of resources to the new service provider, whether it is to back to the organisation or to another service provider including the potential transfer of people, technology infrastructure and intellectual property Ensuring service continuity during the transfer of responsibilities for service provision Identifying and transferring the knowledge capital critical for the delivery of service

Sample Activities by Service Provider and End-User Organisation – Threat Management in Ongoing Phase:

January 11, 2011 29 Sample Activities by Service Provider and End-User Organisation – Threat Management in Ongoing Phase

Threat Management - Risk Management:

January 11, 2011 30 Threat Management - Risk Management Service Provider Risk Management Scope Establish and implement a policy on risk management Activities Provide support for creating and maintaining a policy for managing risk Document and implement a policy for managing risk Support the implementation of a policy for managing risk End-User Organisation Outsourcing Risk Management Scope Establish and implement procedures to identify, assess and manage outsourcing risks Effective risk management is particularly critical in the early stages of a outsourcing initiative, where requirements are being organised and service is being designed to meet those requirements Problems encountered here can impact the success of service delivery and associated business benefits throughout the life of the initiative. Activities Provide support for creating and maintaining the procedures for identifying, assessing and managing outsourcing risks Document and implement the procedures required for identifying, assessing and managing outsourcing risks Support the implementation of identifying, assessing and managing outsourcing risks

Threat Management - Risk Management:

January 11, 2011 31 Threat Management - Risk Management Service Provider Engagement Risk Scope Identify, assess and manage risks specific to the client engagement Activities Provide support for creating and maintaining the work products and tasks for identifying, assessing and managing engagement-specific risks Document and implement the work products and activities required to identify, assess and manage engagement-specific risks Support the implementation of identifying, assessing and managing engagement-specific risks End-User Organisation Organisational Risk Management Scope Establish and implement procedures to manage risks across multiple outsourced services and service providers Effective identification and assessment of risks enables the client organisation to take mitigating actions to lower the impact should a risk event occur Effective risk management improves the stakeholders’ confidence in the client organisation’s ability to maintain needed services and service levels Activities Provide support for creating and maintaining the procedures for managing risks across multiple outsourced services and service providers Document and implement the procedures required for managing risks across multiple outsourced services and service providers Support the implementation of managing risks across multiple outsourced services and service providers

Threat Management - Risk Management:

January 11, 2011 32 Threat Management - Risk Management Service Provider Risk Across Engagements Scope Establish and implement procedures to manage risks across client engagements Activities Provide support for creating and maintaining the procedures for managing risks across client engagements Document and implement the procedures for managing risks across client engagements Support the implementation of the procedures for managing risks across client engagements

Threat Management - Security and Privacy:

January 11, 2011 33 Threat Management - Security and Privacy Service Provider Security Scope Establish and implement procedures to meet security requirements Activities Provide support for creating and maintaining the procedures for meeting security requirements Document and implement the procedures for meeting security requirements Support the implementation of the procedures for meeting security requirements End-User Organisation Security and Privacy Scope Establish and implement procedures to meet security and privacy requirements Breakdowns, such as security breaches, can impact the client organisation’s ability to provide business continuity, thereby damaging the relationship and making the involved parties vulnerable to legal action Effective security is essential for meeting privacy requirements and protecting intellectual property Security requirements may come from the client organisation or statutes and regulations governing the service being delivered Activities Provide support for creating and maintaining the procedures for meeting security and privacy requirements Document and implement the procedures required for meeting security and privacy requirements Support the implementation of meeting security and privacy requirements

Threat Management - Intellectual Property:

January 11, 2011 34 Threat Management - Intellectual Property Service Provider Intellectual Property Scope Establish and implement procedures to protect the intellectual property of stakeholders Activities Provide support for creating and maintaining the procedures for protecting the intellectual property of stakeholders Document and implement the procedures for protecting the intellectual property of stakeholders Support the implementation of the procedures for protecting the intellectual property of stakeholders End-User Organisation Intellectual Property Scope Establish and implement procedures to protect the intellectual property of stakeholders Inappropriate use or disclosure of intellectual property can damage the relationship with stakeholders, may cause financial loss and make the client organisation vulnerable to disputes or legal action Organisation should have a formalised policy on the protection of intellectual property that is used to provide direction for creating the procedures on protection of intellectual property Activities Provide support for creating and maintaining the procedures for protecting the intellectual property of stakeholders Document and implement the procedures required for protecting the intellectual property of stakeholders Support the implementation of protecting the intellectual property of stakeholders

Threat Management - Compliance:

January 11, 2011 35 Threat Management - Compliance Service Provider Statutory and Regulatory Compliance Scope Establish and implement procedures to comply with statutory and regulatory requirements Activities Provide support for creating and maintaining the procedures for statutory and regulatory compliance Document and implement the procedures for statutory and regulatory compliance Support the implementation of the procedures for statutory and regulatory compliance End-User Organisation Compliance Scope Establish and implement procedures to comply with applicable standards and statutory and regulatory requirements Client organisation must implement procedures to address governance, risk and compliance Procedures ensure that they comply with standards, statutes and regulations that impact their outsourcing capability and their outsourced services in order to meet statutory, regulatory and stakeholder requirements and to avoid stakeholder dissatisfaction and legal or audit issues Activities Provide support for creating and maintaining the procedures for complying with applicable standards and statutory and regulatory requirements Document and implement the procedures required for complying with applicable standards and statutory and regulatory requirements Support the implementation of complying with applicable standards and statutory and regulatory requirements

Threat Management - Disaster Recovery and Business Continuity:

January 11, 2011 36 Threat Management - Disaster Recovery and Business Continuity Service Provider Disaster Recovery Scope Establish and implement disaster recovery procedures Activities Provide support for creating and maintaining the procedures for disaster recovery Document and implement the procedures for disaster recovery Support the implementation of the procedures for disaster recovery End-User Organisation Business Continuity Scope Establish and implement procedures to ensure business continuity of outsourced services Prepare for possible disasters in order to minimise their impact on the client organisation’s ability to continue business activities Preparation covers service delivery, security, the protection of intellectual property, crisis management and the safety of personnel and promotes confidence in the client organisation’s and service providers’ ability to react effectively to adverse situations Activities Provide support for creating and maintaining the procedures for ensuring business continuity of outsourced services Document and implement the procedures required for ensuring business continuity of outsourced services Support the implementation of ensuring business continuity of outsourced services

Benefits of Structured Approach:

January 11, 2011 37 Benefits of Structured Approach Service Provider Minimises problems Provides common language Provides common understanding of roles and responsibilities Provides mechanism for resolving issues Know what is expected and what should be done End-User Organisation Provides structured approach to evaluating and adopting outsourcing Demonstrates due diligence in selecting outsourcing partner Provides common understanding of roles and responsibilities Provides mechanism for resolving issues Knows service to be provided and measures delivery

Summary:

January 11, 2011 38 Summary Outsourcing experiences and implementations has been poor A structured approach to implementing outsourcing arrangements by both providers and end-users can enable effective outsourcing A common language and a common understanding of roles and responsibilities will reduce problems and assist in issue resolution

More Information:

January 11, 2011 39 More Information Alan McSweeney alan@alanmcsweeney.com