On this page
Key takeaways
A task risk rating for outsourcing looks at four exposures: personal data, money, customers and compliance. Rate each candidate low, medium or high on the worst of the four. Low-risk tasks can move with standard checks. Medium-risk tasks need a specific control. High-risk tasks move only with strong controls, or stay inside.
- 4 exposures: data, money, customers, compliance.
- Rate on the worst of the four.
- Low: standard checks. Medium: a specific control.
- High: strong controls or keep inside.
Want your candidates risk-rated with you? Message us on WhatsApp.
Chat on WhatsApp →Why rate risk separately from the signals?
The six signals tell you whether a task can be done outside. The risk rating tells you how carefully it must be handed over. Two tasks can both pass the signals, yet one involves sensitive health data and the other a public price list. They need different contracts, access and checks, and should not be ranked as equals.
How do you rate each exposure?
Use these prompts and take the highest rating.
- Data: none or business only (low), personal (medium), special category (high).
- Money: none (low), records only (medium), moves money (high).
- Customers: none (low), routine contact (medium), complaints or vulnerable customers (high).
- Compliance: none (low), records for a filing (medium), a regulated activity (high).
What controls fit each rating?
Low risk needs a processor contract where personal data is involved, individual logins and a monthly sample. Medium adds a specific control, such as approval before release or call scripts with escalation. High adds strong controls, such as separation of preparation and approval, restricted data and full checks, or keeps the step inside.
What does this look like in practice?
A pattern we see: most shortlisted tasks rate low, some medium and a couple high. The low ones form the first handovers. The medium ones follow with approval steps. The high ones, such as payment runs and complaint responses, stay inside with their admin moved.
Task risk checklist
- Rate data, money, customer and compliance exposure.
- Take the highest rating.
- Match controls to the rating.
- Record ratings on the candidate register.
- Re-rate when a task changes.
Next step
Add a risk column to your shortlist and rate each task on the four exposures. Start your first handover from the low-risk rows.
Message us on WhatsApp for the risk rating sheet, or book a 30-minute consultation.
Chat on WhatsApp →Sources and further reading
- Special category data · Information Commissioner's Office
- FCA Handbook SYSC 8: Outsourcing · Financial Conduct Authority
Frequently asked questions
How do you rate the risk of a task?
Look at four exposures: personal data, money, customers and compliance. Rate each low, medium or high, and use the highest as the task's rating. Then match controls to it: standard checks for low, a specific control for medium, strong controls or keeping it inside for high.
Can high-risk tasks be outsourced?
Sometimes, with strong controls such as separating preparation from approval, restricting access and checking every item. Often the better route is to keep the risky step inside and outsource the admin around it, such as preparing a payment run but approving it in-house.
Does personal data make a task high risk?
Ordinary personal data usually makes it medium risk and needs a processor contract, limited access and transfer safeguards where relevant. Special category data, such as health information, raises it to high and needs extra care over who sees what.
Written by
Global Bridge Labs (GBL) is a UK–Sri Lanka partner for social media, websites and BPO. Everything here comes from client delivery, not theory.
