HB240-2004Guidelines for managing risk in outsourc

HB240—2004GUIDELINESFORMANAGINGRISKINOUTSOURCINGUtilizingtheAS/NZS4360:2004processAccessedbyUNIVERSITYOFTASMANIAon17Feb2006HB240—2004GuidelinesformanagingriskinoutsourcingutilizingtheAS/NZS4360:2004processEditedbyDennisGoodwin,DepartmentofDefence,DrDaleCooper,BroadleafCapitalInternationalPtyLtdProfessorJeanCross,UniversityofNewSouthWales,andKevinW.KnightandTomWalker,representativesofTheAssociationofRiskandInsuranceManagersofAustralasia(ARIMA).StandardsAustraliagratefullyacknowledgesDrNickSeddonoftheAustralianNationalUniversity,andKateReidandDrJennyStewartoftheUniversityofCanberra,fortheircontributionstowardsthedevelopmentofthisdocument.AccessedbyUNIVERSITYOFTASMANIAon17Feb2006ThisAustralianHandbookwaspreparedbyJointTechnicalCommitteeOB-007,RiskManagement.ThefollowinginterestsarerepresentedontheCommitteeOB-007:AustralianComputerSocietyAustralianCustomsServiceAustraliaNewZealandInstituteofInsuranceandFinanceCSIRO(CommonwealthScientificandIndustrialResearchOrganisation)DepartmentofDefence(Australia)DepartmentofFinanceandAdministrationEmergencyManagementAustraliaEnvironmentalRiskManagementAuthority(NewZealand)InstituteofCharteredAccountants(Australia)InstitutionofEngineersAustraliaInstitutionofProfessionalEngineersNewZealandLocalGovernmentNewZealandMasseyUniversity(NewZealand)MineralsCouncilofAustraliaMinistryofAgricultureandForestry(NewZealand)MinistryofEconomicDevelopment(NewZealand)NSWTreasuryManagedFundNewZealandSocietyforRiskManagementRiskManagementInstitutionofAustralasiaSafetyInstituteofAustraliaSecuritiesInstituteofAustraliaUniversityofNewSouthWalesVictorianWorkCoverAuthorityWaterServicesAssociationofAustraliaISBN0733762530©StandardsAustraliaInternationalAllrightsarereserved.Nopartofthisworkmaybereproducedorcopiedinanyformorbyanymeans,electronicormechanical,includingphotocopying,withoutthewrittenpermissionofthepublisher.PublishedbyStandardsAustraliaInternationalLtd.,GPOBox5420,Sydney,NSW2001,AustraliaAccessedbyUNIVERSITYOFTASMANIAon17Feb2006CopyrightiiiGuidelinesformanagingriskinoutsourcingPrefaceTherapiddevelopmentintheareaofInformationTechnologyhasprovidednewopportunitiesandnewrisks,broughtaboutchangestoindustrialprocesses,andmadethemarketplacemorecomplexandquicktoreacttochanges.Globalization,deregulationandfiercecompetitionhavemadeorganizationsevenmorevulnerable,withtheultimateriskbeingtheireliminationfromthemarket.Productlifecyclesandlead-timesareevenshorter.Concentrationmayevenleadtoasinglesupplierwherebefore,throughregulation,theremayhavebeentwo.Goodstodaycanbedeliveredfromanyplacearoundtheworldtoanorganization’sdoorstepjustasquicklyasfromthelocalregion.Consequently,longstandingrelationshipsbecometenuouswhilecustomerloyaltyquicklydiminishes.Inboththepublicandprivatesector,theoutsourcingofservicesandnon-corebusinessisbecomingthenormratherthantheexceptiontotherule.Similarlytheprivatesectorownershipandoperationofpublicfacilitiesandservicesisincreasing.Withmanyactivitiesnowinvolvingamultitudeofparticipants,eachwiththeirown(inmanycasesconflicting)needs,goals,andinternalandexternaldemands,itisnotsurprisingthatsignificantrisksabound.Thecomplexnatureofmanyprojectsaddstotheserisks.TheapplicationofarobustanddisciplinedriskmanagementprocessutilizingAS/NZS4360:2004(thestandard),fullyintegratedintotheearlyoutsourcingconsiderations,shouldgreatlyassistthemanagementofanyorganizationinfindingthatdelicatebalance.Intermsofaccountability,ariskmanagementapproachdemonstratesthatmanagementhas:■consideredalloftheidentifiedrisksintermsoftheirconsequencesandlikelihood;and■implementedarisktreatmentplaninordertoavoid,reduce,transferorretainadverserisks(orputinplaceanumberofinitiativestotakeadvantageofriskopportunities).AccessedbyUNIVERSITYOFTASMANIAon17Feb2006ThispagehasbeenleftblankAccessedbyUNIVERSITYOFTASMANIAon17Feb2006CopyrightvGuidelinesformanagingriskinoutsourcingContentsPrefaceiiiPart1:Introduction1TheAustralianandNewZealandoutsourcingguidelines—Anopportunityandachallenge1Whatisoutsourcing?2Whatisrisk?6Theprocessformanagingrisk10Theintegratedprocessofriskmanagementandoutsourcing14Part2:Riskmanagement–Process,methodologyandtechniques17Communicationandconsultation17Step1Establishthecontext19Step2Identifyrisks28Step3Analyserisks31Step4Evaluaterisks35Step5Treatrisks37Continuallymonitorandreview47Implementingacorporateprogramformanagingrisk49AppendicesASomemajorrisksinoutsourcing59Discussesindetailanumberofissues/risksthatmayariseasaconsequenceofoutsourcing.BTools,tipsandtraps73Provideschecklistsforimportantissuesthatneedtobeaddressedthrougheachofthephasesofoutsourcing.CCasestudies81Providescommentaryonsomecasestudiespertinenttooutsourcing.Furtherinformation91References92Glossary94AccessedbyUNIVERSITYOFTASMANIAon17Feb2006ThispagehasbeenleftblankAccessedbyUNIVERSITYOFTASMANIAon17Feb2006CopyrightPart1:Introduction1GuidelinesformanagingriskinoutsourcingPart1:IntroductionTheAustralianandNewZealandoutsourcingguidelines—AnopportunityandachallengeTheseGuidelinespresentanopportunitytolearnaboutthestrategicissuesassociatedwithouts