IT outsourcing is almost always decided for sound reasons: reaching skills you cannot recruit, smoothing a workload, turning a fixed cost into a variable one. The reasoning is sound.
What goes wrong comes afterwards. Once the contract is signed, the temptation is to treat the matter as settled. It is not: it has changed nature. What was a delivery problem has become a governance problem, and the two call on different skills.
What can be delegated
The doing delegates without difficulty: running the systems, monitoring, applying patches, handling routine incidents, keeping backups. These are tasks that can be written down, measured and checked.
What cannot be delegated
Four things stay with you, whatever the contract says:
- Defining the requirement. A supplier answers what it is asked. If it defines the requirement itself, it will define it to the measure of what it knows how to do.
- Regulatory responsibility. Where personal data is concerned, the controller answers for its choice of processor and for the instructions it gives.
- The ability to check. You need to keep someone who can read an operations report and spot what is missing from it.
- The ability to leave. Without an organised exit, outsourcing becomes dependency, and renewal is negotiated with no leverage.
You delegate the doing. You never delegate the standard — because nobody else has an interest in setting it.
The usual objection
“We do not have the skills in house, which is exactly why we outsource.” The objection holds for the doing. It does not hold for the checking, because checking does not require knowing how to do.
You do not need to know how to administer a server to ask when the last backup restore was tested, nor to notice that nobody answered you. That skill — putting the right requirement to the right person — is acquired far faster than a technical one, and it is the one most often missing.
The minimum arrangement
A review meeting at fixed intervals. A set of measures chosen by you, not supplied by the vendor. A written report for every major incident. An exit clause you can actually invoke. Four things, none of them expensive, and their absence is always paid for at the same moment: when the relationship turns.