Outsourcing red lines: write them down before you sign

Key takeaways

Outsourcing red lines are the short list of things a provider must never do without your explicit approval: commit money, change bank details, speak publicly for you, contact key clients, change prices or delete data. Write them down before you sign, put them in the contract and the process instructions, and test that the provider's systems enforce them.

• Keep the list short: 8 to 12 red lines is typical.
• Write each one as 'never without written approval'.
• Put them in the contract and the work instructions.
• Enforce them with system permissions, not just words.

Why write red lines down?

Because what feels obvious to you is not obvious to a new team. A provider trying to be helpful may offer a discount to save a customer, approve a payment to hit a deadline or reply to a journalist. Written red lines turn assumptions into instructions and give both sides a clear basis for the relationship.

• Which business processes should you never outsource?
• When your provider starts making your decisions

What are common outsourcing red lines?

Most come from the five A's: authority, access, accountability, advantage and asset.

• Never approve or release payments.
• Never change supplier or customer bank details.
• Never offer discounts, refunds or credit above agreed limits.
• Never speak to media or post publicly for the business.
• Never sign or agree contract terms.
• Never export, delete or share customer data outside agreed systems.
• Never contact named key clients without approval.

• The never-outsource test: five questions for any process
• Fraud controls: the checks that must stay inside

Where do red lines go in the contract?

In the scope schedule as explicit exclusions, in the data processing terms for anything involving personal data, and in the process documents the team actually uses. Link breaches to escalation and, for serious ones, termination rights.

• Contract clauses that keep control with you
• BPO contract terms to check before you sign

How do you enforce them day to day?

With system permissions first: payment-only access without approval rights, read-only views of bank details, no admin rights on social accounts. Then with sampling and a monthly check of any exceptions. A red line enforced only by trust will be crossed eventually, usually by accident.

• System access for outsourced teams: fast but safe
• Admin accounts and master passwords: never hand them over

What does this look like in practice?

A pattern we see: an outsourced customer service team gives a 20% goodwill credit to calm an angry customer, well meant but outside the owner's policy. Once a written limit and an escalation route are in place, those cases come to a manager within the hour instead.

• See client work
• BPO Solutions for UK businesses

Red lines checklist

• Draft 8 to 12 red lines using the five A's.
• Agree them with the provider before signing.
• Put them in the contract and work instructions.
• Set system permissions to match.
• Review exceptions monthly.

• The intelligent client: know enough to manage a provider
• A never-outsource list that is too long costs you

Next step

Write the three things you would be most upset to find a provider had done without asking. They are your first red lines.