The document discusses outsourcing risk management. It defines outsourcing and provides examples of common outsourcing models. It discusses the ISO 37500 standard for outsourcing governance and risk management. The presentation covers performing risk analysis, identifying risks, analyzing risks using techniques like probability/impact matrices, evaluating risks, treating risks through options like risk modification or sharing, and accepting residual risks. It emphasizes the importance of risk assessment and treatment in outsourcing governance.

1. Outsourcing Risk Management

2. Barbro Thöyrä
Owner of CeBeLOT AB
Barbro Thöyrä is owner of CeBeLOT AB, BCMS consultant and trainer and a PECB Certified Trainer. Ms Thöyrä is certified for ISO
22301 Master, ISO 22301 Lead Auditor, ICT Disaster Recovery Manager, ISO 28000 Provisional Implementer, and for Outsourcing
Manager from PECB.
+46 (0)708794652 https://se.linkedin.com/in/barbro-thöyrä-119b0427
barbro@thoyra.eu
www.cebelot.se
https://www.facebook.com/barbro.thoyra

3. General information
- About me
- Content of this webinar
- Duration of the webinar
- Questions

4. Definition of outsourcing
Outsourcing is the contracting out
of business processes
or activities to another party.

5. Why outsourcing
• Financial aspects
• Back to core business
• Lack of competence
• Lack of equipment in production
• Reduction of business

6. Models of outsourcing:
- Offshoring
- Nearshoring
- Co-sourcing
- In-sourcing
- Crowdsourcing
- Multi sourcing
- Cloud Computing

7. ISO 37500: The standard provides clear guidance in the space of outsourcing
considering an outsourcing lifecycle model which consists of four phases
with outsourcing governance being at the heart of the standard.
SelectionStrategy analysis Transition Deliver value
Outsourcing governance

8. • Risk assessment

9. When do you perform risk analysis
Risks will occurs along the outsourcing process.
Risk analysis is therefor critical to overall outsourcing governance.

10. Align with ISO 31000: the generic framework on risk management
Risk identification
Risk analysis
Risk evaluation
Risk treatment
Risk acceptance
Risk assessment

11. What risks are there with outsourcing
Risk Assessment should at least include areas like:
• Security
• Legal
• Safety
• Environment/geographic
• Finance
• Reputation
• Operational service risk
• Availability
• Media

12. Techniques and tools to use with risk assessment
• Brainstorming
• Work shops
• Scenarios
• Decision tree
• Hazard analysis
• Consequence/probability matrix
• Cost/benefit analysis
• Interviews
• Questionnaire
• ……..

13. Risk Identification
• Identify Assets and Processes
• Identify Threats , take into account
Owners
Users
Employees
Specialists
Insurances
• Identify controls in place
• Identify consequences
Service outage
Increased complaints
Loss of customers
Legality
Reputation

14. • Identify threats to which the asset/process is subject
• Assess the probability that a threat will affect the asset/process
• Assess the vulnerability to the threats
• Identify preventive measures which could be implemented to reduce risk
should the threat occur
• Analyse measures already in place to reduce risk should the threat occur
Risk Analysis process

15. Scale of impact
Scale Impact
Insignificant 0
Low 1
Medium 2
High 3
Very high 4

16. Guidelines
1. Rate the Probability(P) or likelihood of this threat occurring
2. Rate the Vulnerability(V) of asset/process to each threat identified
3. Rate the level of controls(C) in place to protect against this threat

17. Scoring/Grading of Threats
Probability refers to the likelihood of this threat occurring
Rate as H= High, M=Medium, L= Low
Vulnerability refers to a measure of the effect such threats may have
ie identifies weaknesses
Controls refers to the existing measures to counteract the effects of these threats
Rate as H= High, M=Medium, L= Low
Rate as H= High, M=Medium, L= Low
H=very good controls in place
M=some controls in place
L=inadequate controls in place

18. Risk Evaluation
High impact
Low impact
Medium impact
High High None
SomeMedium Medium
Low Low Many

19. Content of this webinar
• Risk assessment
• Risk treatment
• Risk acceptance

20. • Compare the estimated level of risk against risk evaluation and acceptance
criteria
• Identify preventive controls which could be implemented to reduce risk
should the threat occur.
• Analyse controls already in place to reduce risk should the threat occur.
• Assess the cost to the company should a control be implemented.
• Which risks will be treated with priority, ranking of the threats
Risk Evaluation

21. • Risk treatment

22. Risk Treatment
The options for risk treatment are:
• Risk modification
• Risk retention
• Risk avoidance
• Risk sharing
Set up a Risk treatment plan
Residual risk

23. • Risk acceptance

24. Risk Acceptance
Criteria for risk acceptance
Acceptance of residual risks

25. Reduce outsourcing risks
- Call for tenders and evaluate propositions before deciding
- Sign a contract which takes into consideration:
- Quality and result expectations
- Definition of roles and responsibilities
- Means of control and audit
- Intellectual property
- Confidentiality agreement
- Implement monitoring and review processes to ensure contractual
and service level requirement are being met
- Implement third party change management processes
- Security aspects etc
- Determine premiums for reach of verifiable results

26. Review of risk assessment and risk treatment
Risk and Impact assessments should be conducted on a
regular basis and reviewed at key intervals by the relevant
governance committees.
This will allow suitable decisions to be made and risks to be
effectively managed before they become specific issues
which need to be managed.

27. 2016-03-22 27
“By failing to prepare
you are preparing to fail.”
— Ben Franklin

28. ?
QUESTIONS
THANK YOU
+46 (0)708794652 https://se.linkedin.com/in/barbro-thöyrä-119b0427
barbro@thoyra.eu
www.cebelot.se
https://www.facebook.com/barbro.thoyra