You can outsource the work, never the accountability

Key takeaways

Accountability cannot be outsourced: a contract can move work and share some financial risk, but regulators, customers and courts still look to your business. Directors stay responsible for filings, employers for right to work and pay, data controllers for personal data, and FCA firms for outsourced functions. Keep oversight, evidence and a named owner for every outsourced process.

• The duty stays with whoever the law places it on.
• A contract can share financial loss, not legal responsibility.
• Every outsourced process needs a named internal owner.
• Keep evidence that you oversee the provider.

Why can't accountability be outsourced?

Because the law attaches duties to roles, not to whoever does the work. UK GDPR makes the controller accountable for showing compliance, even when a processor handles the data. HMRC holds the employer responsible for payroll filings made by a bureau. Directors answer for company filings their accountant submits. The provider may owe you damages; it does not take your place.

• Which business processes should you never outsource?
• Director duties: what you can delegate and what you cannot

Which duties stay with your business?

The common ones for UK SMEs are below. Each can have its work outsourced, with oversight kept in-house.

• Data protection as controller, including breach decisions.
• Payroll, PAYE and pension duties as employer.
• Right to work checks before employment starts.
• Company filings and accounts as directors.
• Health and safety as employer.
• Regulatory duties, such as FCA, SRA, CQC or anti-money laundering rules.

• Data controller duties you cannot outsource
• Regulated processes: outsource the work, keep the duty

What does a contract actually transfer?

Work, service levels and, through indemnities and liability caps, some of the financial loss. That is valuable: it gives you leverage and recovery. But the regulator's fine, the customer's complaint and the director's personal exposure land on you first. Treat indemnities as a cushion, not a transfer.

• BPO contract terms to check before you sign
• Contract clauses that keep control with you

How do you show you are still in control?

Name an internal owner for each outsourced process, review a sample of the work each month, keep reports and meeting notes, and make sure you can get your data and records back at any time. Regulators typically ask what oversight you had, not just what the contract said.

• The process owner: who keeps an outsourced process healthy
• A simple BPO governance model for SMEs

What does this look like in practice?

A pattern we see: a business assumes its payroll provider 'handles compliance'. When a pension contribution is missed, The Pensions Regulator contacts the employer. Firms that keep a monthly sign-off and a simple exceptions report spot these issues before the regulator does.

• See client work
• BPO Solutions for UK businesses

Accountability checklist

• List the legal duties attached to each outsourced process.
• Name an internal owner for each duty.
• Review a sample of outsourced work monthly.
• Keep records of oversight and decisions.
• Check you can retrieve data and records on demand.

• Keep the decision, outsource the admin around it
• The intelligent client: know enough to manage a provider

Next step

Take your largest outsourced process and write down who in your business would answer the regulator's first question about it. If nobody comes to mind, that is the gap to close.