So you think that you should outsource your major IT functions, such as net- work and computer management, applications development and testing, and customer support and, perhaps, even some of your information security func- tions? How about really diving in with both feet and seeking an offshore pro- vider of services so as to reap the enormous cost and productivity benefits that these faraway places promise?
Professed Reasons to Outsource
Is your primary motivation to hand over responsibility to a third party so that you will not be on the hook when things go awry? Well, think again, because the function may move out the door, but the responsibility might very well stay behind, lurking in the shadows. On whose door will management knock if the service expectations are not met, or if the charges are higher than expected, or if the third party goes out of business—suddenly, and without warning? The inevitable question from management in such soul-destroying situations is “Whose idea was this in the first place?” as all eyes bear down on you, if you are unfortunate or unwise enough to have stayed around.
Perhaps you think that you are going to save piles of money for your organization. But are the savings real? How about sharpening your pencil and going over those numbers again? Did you include all those intangible costs? You have probably fully accounted for intangible benefits as if they were already in hand. But what about hidden costs? Are you still trying to keep them out of sight? And don’t forget the possible delayed costs of extricating yourself from a relationship turned sour? Were they included in the initial analysis or not?
Probably they were not. Perhaps you should have put more effort into calculat- ing the numbers ahead of time and remembered to put in a contingency cush- ion. Here management’s question will be: “Why didn’t you tell me we would be hit with such-and-such costs?”
Do you believe that you chose to outsource a peripheral function so that you could concentrate on your core businesses? Well, now you are more on track. This line of reasoning could make sense and may even be true. Your plan may not work out as expected, but at least outsourcing stands a chance of pro- ducing the desired benefits, that is, if you are positioned to take advantage of the situation. But don’t expect the kudos for the additional business opportunities or revenues to come to you. The sales and marketing staff will be sure to take the largest share of the credit. And worse, even in the face of success, an ungrateful management might ask: “Well, why didn’t you suggest this years ago?”
So it is for those who propose risky ventures such as outsourcing. You can be faulted whether or not the outsourcing venture is successful in terms of serv- ice, cost, and capability. So why do it at all? Clearly there must be more to this outsourcing business than meets the eye.
The Basis for Decision
The outsourcing decision is often highly subjective, even when the decision- maker has gone through an extensive quantitative analysis. Determining the costs of a particular outsourcing venture usually involves a fair amount of estimation and judgment. Cost estimates can be inflated or understated, or a cost category or two might be omitted entirely, either accidentally or intention- ally. However inaccurate cost estimates might be, quantitative estimates of bene- fits usually have very broad ranges, particularly for those that are intangible. It can be extremely difficult, if not impossible, to place an accurate value on cer- tain intangible benefits, and any valuation is likely to be highly subjective and engender significant error. Clearly, in such situations, personal bias can be the deciding factor, overriding any amount of precision in the cost analysis.
Reasons for Considering Outsourcing
Perhaps the best place to begin is to list and discuss the reasons one might give for considering outsourcing as an alternative to in-house functions. Some rea- sons are obvious and inarguable, while others are fuzzy and highly debatable. Sometimes a reason may appear obvious, but it might become the basis of heated arguments, politicization, and polarization.
I reviewed a variety of sources, some of which reported on surveys of those in a position to use information technology outsourcers, and others which
presented reasons based on direct experience [1–4]. It was an interesting exer- cise, especially as the same item can be a driver to one person and a risk to another. For example, a reason to outsource is to benefit from a particular exper- tise offered by the service provider. Yet, at the same time, there is a feeling that the in-house staff is not being given access to the feeding trough of knowledge.
However, let us willingly suspend our disbelief and come up with a list of good reasons to outsource. Here we shall discuss the arguments in favor of out- sourcing associated with costs, performance, security, expertise, support, and financial arrangements.
Cost Savings
Saving money is usually at or very near the top of the list of reasons to outsource. It is very difficult to justify a third-party service that is more expensive than per- forming the same service in-house, unless there is a significant material differ- ence in the type or quality of service.
The challenge at hand is to calculate the full cost of performing the same tasks internally or externally over a particular time period, which would gener- ally be the number of years over which a third-party agreement is expected to run. Different periods, such as three, four, or five years, might be considered, in order to determine the minimum time for which the arrangement must be in place to recoup initial costs through future savings and benefits.
Labor
Often the largest cost of service provision is for labor. For in-house full-time and part-time staff, there are a number of categories of cost. They include salaries, overtime, benefits, and payroll taxes for internal staff. For contractors and con- sultants, there is an hourly or daily basic rate, with a premium for overtime. The basic consultant rate covers salaries, benefits, and so on, as well as profit. For internal staff paid vacations and holidays as well as sick days must be added, whereas for consultants these are included in the basic rate applied to actual time spent on the job.
Various overhead costs, such as those related to facilities occupied by the staff (e.g., rent, utilities), administrative costs (e.g., secretarial staff, costs of printing, copying) and management, can be handled in a variety of ways. Within a company such costs as facilities and administrative costs are generally depicted as allocations from the corporate cost centers to the specific staff cost centers. The cost of management and corporate staff may be included in admin- istrative costs or may be specifically assigned to individuals. This is also true of service providers and consulting firms, although here the senior managers are often billed directly, whereas administrative support staff is included as a per- centage, such as a surcharge of 20% of total other charges.
It should be noted that, in calculating internal costs, contractors and con- sultants may be engaged in support of the in-house service in addition to in- house staff. For third-party services, internal employee costs will likely be mini- mal, and most staff costs will be for consultants, even in the case where internal employees are transferred to the service provider. In Table 3.1, we show how staffing varies for internal or external services and the general degree to which the staff is provided internally or externally. This illustrates that some mix of internal and external staff is necessary regardless of the nature of the service, although the ratios can change dramatically. This is important to remember when costing out a particular service since accounting for internal staff in a third-party relationship and, to a lesser extent, the external staff assisting on an in-house service can be easily forgotten.
Besides costs directly attributable to individuals, other costs can be ascribed more generally to the role that a particular person has and what activi- ties the person does in relation to that role. Perhaps the most obvious of these are travel-related costs, which include transportation, accommodation, meals, and costs related to entertaining clients. Often a consulting firm will charge travel-related expenses attributable to a project or service at cost with an admin- istrative fee, as mentioned earlier. However, it should be noted that travel costs to a primary place of business are generally borne by an employee, whereas a consultant might charge for travel to the same client premises regardless of dis- tance. For offshore service providers, the travel component can be considerable, not only in terms of airfares and accommodations, but also in the time required for the travel, which will be charged to the client.1
Other employee-related costs include those for training and attendance at seminars and conferences. Costs include those directly attributable to travel, accommodations, and registration, but also the cost of lost opportunity by not
30 Outsourcing Information Security
Table 3.1
Staff (Internal and External) by Type of Service
In-House Service Third-Party Service Provider Internal Staff Full- and part-time employees Minimal (relationship managers)
External Staff Some consultants, contractors Almost all consultants
1. The factors that affect the decision to use offshore and near-shore outsourcers are examined in a separate section. However, as we go through the general factors, I will point out aspects of those factors that pertain specifically to the selection and use of out-of-country service providers.
working during the training period. However, the training activity will probably more than pay for itself through higher productivity and effectiveness and new opportunities to create revenues and reduce costs. Companies often have formal standards for training, such as requiring so many days of training per year, or a minimum number of continuing education units (CEUs), for certain business- related or technology-related certifications. For consulting services, such costs are built into the rate, which includes an allowance for a certain number of nonbilla- ble days per employee per year, some of which may be earmarked for training.2
Then there are one-time, per-person costs, such as those for recruiting, hir- ing, and firing. It can be more difficult for an organization to hire specialists than for a service provider or consulting firm to do so, since the latter can gener- ally offer more interesting work, greater responsibility, more variety of work and environment, and a better career growth path. Thus, service providers may be able to save on these one-time personnel costs if being able to offer more attrac- tive work environments and opportunities results in lower staffing turnover.
Various labor-related costs, and how they are calculated and assigned or allocated, are shown in Table 3.2 for both in-house and externally provided services. The main observation is that for internal workers the individual cost categories have to be defined and quantified, whereas for outside service provid- ers most categories are included in a base rate. Of course, the service provider must go through the same definition and quantification of its internal costs to arrive at a suitable base rate.3
Justifying Outsourcing 31
2. In difficult times, companies often cut back on training and other discretionary expenditures. Not investing in maintaining staff at the forefront of their respective fields can result in lower future productivity and reduced savings. It becomes a real issue in the outsourcing environ- ment, where the service provider is motivated to keep up-to-date, but skills of internal staff can atrophy. This leads to greater dependency on the outsourcer by customers, with the po- tential for substantial rate increases and inability of the customer organization to seek better providers or move in-house.
3. It should be noted that only certain types of consulting and professional services proposals lend themselves to base-rate charging. Often, a service provider will charge based on some other measure, such as number of items processed per unit of time, or propose a fixed rate. What is even more interesting is that the revenue per internal employee and employee pro- ductivity is sensitive to whether or not the number of staff embodied in the outside services charges is included in the head count for these calculations. It can make an enormous differ- ence in productivity numbers (e.g., number of calls answered or lines of code programmed) in particular. For example, the recent growing trend for outsourcing such activities as soft- ware development to countries such as India and China means that a certain amount of work can be done more cheaply. But it could be less productive in units of work per person, if the additional relationship management and project management staff and the likely larger num- bers of programmers required are included in the calculation. Perhaps some of the noted in- crease in productivity seen recently in the United States is due in part in the conversion of head count–related costs to lump-sum fixed-price contracts.
Computer and Network Equipment and Software
The comparison between costs for equipment and software used in-house and which are either provided directly, as in the case of an application service pro- vider (ASP), or embodied within a service, as for a business service provider
32 Outsourcing Information Security
Table 3.2
Labor-Related Costs for In-House and External Workers
In-House External
Ongoing Costs
Salary Specific cost Included in base rate
Overtime Percentage, say, 150%, of salary Charged as a percentage of base hourly rate
Benefits Percentage, say, 30%, of salary Included in base rate Payroll taxes As required by taxing agency Included in base rate Travel and entertainment Specific cost Billed at cost or cost plus
Training Specific cost Included in base rate
Company car May be taxable benefit May be included in base rate or
charged to client per mile
One-time Costs
Hiring Specific cost Included in base rate
Firing Specific cost Included in base rate
Setup Specific cost Included in base rate
Overhead Costs
Facilities (rent, utilities) Specific cost Included in base rate
Administration Specific cost Charged as percentage, say, 15%, of
price
Corporate staff Specific cost Included in base rate or as part of
administrative cost
Management Specific cost Charged on hourly basis and/or
(BSP), can be difficult because such products are acquired in a number of differ- ent ways.4
Whether equipment is leased or purchased accounts for the most obvious cost differential. Leasing is reflected as a recurring periodic cost, usually monthly, whereas for purchased equipment, the company will depreciate the asset over a given number of years. Either way, costs include ongoing maintenance charges and, possibly, charges per unit of output, as in the case of a printer. Installation and de-installation charges are likely also, as are sales taxes and the like.
Software usually cannot be purchased; instead, the buyer is confronted with a periodic license fee plus a maintenance charge. There may or may not be installation and de-installation charges for software products, but there are often significant charges for professional services. Software pricing varies considerably, ranging from costs for unlimited licenses to very specific licenses according to the size and number of central machines on which the software is running, the number of end-users, the amount of use, and other factors.
Networks incur additional expenses for ordering, installing, maintaining, and de-installing circuits. Such costs are generally charged as a set fee per month for dedicated circuits, and for shared networks often on the basis of units of use. The ready access to the Internet and proliferation of portable wireless devices has changed forever the way in which communications technologies are used and charged for.
All of the above examples indicate that there are certainly opportunities for quantity discounts based on the volume of products acquired. The discount can apply to either the service provider or the customer, but often a service provider will get a better deal than the customer, especially for specialty products, and may or may not pass such savings though, depending on the competitiveness of the market for those particular services.
With third-party service providers, the costs of equipment, software, serv- ices, and networks are usually rolled into a stated price regardless of whether the cost will change over time or the equipment has been fully depreciated.
For offshore outsourcing, the telecommunications costs can be consider- able due not only to the distances involved, but also because of the increased need to communicate due to different time zones. In addition, different coun- tries have different equipment requirements, telecommunications tariffs, and rules and regulations.
Justifying Outsourcing 33
4. There are many types of service providers. Prevalent are ASPs and BSPs or Business Process Outsourcers (BPOs). In general, ASPs offer customers use of proprietary applications or cus- tomized off-the-shelf computer applications, where the customers interact directly with the computer applications housed with the ASP from their organization’s location. For BPOs, the customer usually deals with persons who offer an interactive services, such as help desk services, and the outsourcer’s staff interacts with appropriate computer systems.
For internal use, the cost can vary widely based on not only how the prod- ucts have been acquired but on whether or not they are shared with other applications.
Facilities
People and equipment require space, furniture, heating and cooling, electrical power, light, and air. In particular, they not only require a regulated physical environment, but also supplies, food, drink, bathroom facilities, and more.
Space, fixtures, equipment, and furniture can be rented or purchased, and, if purchased, depreciated for tax purposes over a number of years. Buildings are amortized over decades compared to depreciation over a few years for equip- ment and furnishings. If a building is purchased, the owner must pay for prop- erty taxes and utilities, such as electricity, gas, and water, and maintenance and support of the facilities, including the costs of janitorial and security staff. Some-