An outsourcing risk register for each process

Key takeaways

An outsourcing risk register lists, for each outsourced process, what could go wrong, how likely and serious it is, the control in place and who owns it. Keep it to one page per process. Review it before go-live, monthly for the first quarter, then quarterly. Regulated firms are expected to assess outsourcing risk as part of their oversight.

• List risks for data, quality, continuity, people and cost.
• Rate likelihood and impact 1 to 3.
• Name a control and an owner for each risk.
• Review monthly at first, then quarterly.

What risks should an outsourcing register list?

Five groups cover most processes. Data: breach, misuse, unlawful transfer. Quality: errors, drift, misunderstanding. Continuity: provider outage, staff turnover, key person loss. People: TUPE, morale, knowledge loss in your team. Cost: scope creep, price rises, exit costs.

• Data risks.
• Quality risks.
• Continuity risks.
• People risks.
• Cost risks.

• Which business processes should you outsource?
• The disadvantages of BPO and how to manage them

How do you rate each risk?

Score likelihood and impact from 1 (low) to 3 (high) and multiply. A score of 6 or 9 needs a strong control and monthly attention. A score of 3 or 4 needs a control and quarterly review. Lower scores can be accepted and noted.

• Process criticality: rate the damage if it fails
• Processes with sensitive data: can they be outsourced?

Which controls work for outsourced processes?

Processor contracts and limited access for data risks. Sampling and measures for quality. Continuity plans and back-up staff for continuity. Early communication and knowledge capture for people risks. Clear scope, change control and exit terms for cost. Each control needs an owner, or it is a hope rather than a control.

• Data security with an outsourced team
• Business continuity for outsourced operations
• Scope creep in outsourcing: how extra work erodes savings

When is a risk register too much?

For a small, low-risk process, a few lines in your process register may be enough. A separate register earns its place for critical, regulated or data-heavy processes, and for any process where a regulator or customer may ask how you manage outsourcing risk.

• Regulated processes: outsource the work, keep the duty
• A business process register: map every process once

What does this look like in practice?

A pattern we see: risk registers are written for the contract and never opened again. Reviewing the top three risks in each monthly provider meeting keeps the register useful.

• See client work
• BPO Solutions for UK businesses

Risk register checklist

Include these for each process.

• Risks across the five groups.
• Likelihood and impact scores.
• Control for each risk.
• Owner for each control.
• Review date.
• Top three risks in each monthly review.

• The process selection score: outsource, split or keep?
• A simple BPO governance model

Next step

Tell us which process you plan to outsource. We will suggest the risks we would put on its register and the controls we would expect.