Trends in IT Outsourcing Prompts New Guidance from The IIA on Considering Risks, Navigating the Process

ALTAMONTE SPRINGS, Fla. - Trends in information technology (IT) outsourcing have prompted The Institute of Internal Auditors (IIA) to focus its seventh Global Technology Audit Guide^® (GTAG) on this topic. Written in straightforward business language, GTAG 7 will help C-level executives and boards of directors understand various risks when navigating the complex task of IT outsourcing.

"IT outsourcing has grown in popularity as an efficient and cost-effective way to meet IT management demands such as systems implementation, maintenance, security, and operations," says IIA Manager of Technology Practices Lily Bi. "There are benefits from outsourcing this function, but they come with complexities, risks and challenges. It's important that executive management and boards understand how to conduct a comprehensive review of an organization's outsourced operations, evaluate the risk management process, and comply with applicable laws and regulations. When it comes down to it, those at the top are the ones accountable for ensuring that things are as they should be. Chief audit executives and audit supervisors can use GTAG 7 to help people who have limited technical knowledge to better understand these risks."

GTAG 7 describes some of the most common outsourcing risks and their potential strategic impact on an organization throughout the outsourcing lifecycle. Key issues discussed in this GTAG include: the outsourcing strategy and feasibility; selecting an IT service provider; drafting and managing contractual agreements; ensuring a smooth transition of internal operations to service providers; return on investment; effective frameworks for establishing outsourcing controls; and termination and renegotiation of services. The guidance also stresses the importance of evaluating the service provider's internal controls, and establishing a clear governance structure over the outsourcing activity to ensure accountability and effective project management.

The 30-page document, available in a printed version or for free download on The IIA's Web site, also reviews recent and expected trends in IT outsourcing.

• Application development continues to be one of the most outsourced IT activities, followed by application maintenance and support.
• Though mega deals in excess of US $1 billion represent a significant share of the total outsourcing contract value, they are set to decline in the near future and will be replaced by an increase in mid- and large deals in the US $100 million to $999 million range.
• Contract term lengths are declining. The average length of an IT outsourcing contract declined from 6.2 years to 5.3 years from 2003 to 2005. The trend is for shorter contracts that enable organizations flexibility and don't lock them in a particular service.
• Cost savings continues to be the key driver for IT outsourcing, though outsourcing arrangements that have focused solely on delivering savings have failed to meet client and service provider expectations.
• Europe will come close to catching up with the U.S. market share of IT outsourcing. India will continue to be the most preferred destination for IT outsourcing, although China is expected to emerge as a formidable competitor in the near future.
• The supplier landscape in the IT outsourcing industry will become more competitive as clients seek greater levels of domain experience in potential service providers.
• More companies are relying on pilot projects to ensure a good fit between the client organization and service provider. Often, companies will conduct a proof of concept with various service providers to compare results and choose the best service provider.
• Multi-sourcing will be one of the most visible trends, resulting in organizations' need to develop the competencies necessary to manage a multi-service provider environment.
• IT service providers will evolve their businesses around distinct models including the "global champion model," offering multiple service lines and solutions to large organizations; the "IT specialist model," focusing on three to four major IT industry or cross-industry services; and the "ADM factory model," positioning themselves as low-cost developers of applications and maintenance services.

GTAG 7, Information Technology Outsourcing, was authored in partnership with Parthasarathy Ramaswamy, Mayurakshi Ray, and Jaideep Ganguli, with PricewaterhouseCoopers in India. The authors also received input, review, and comments from 37 IIA members and various affiliates and chapters, professional organizations, universities, professionals, and practitioners working in a wide range of industries and positions all over the world.