We’ve been asked if there is a certain size threshold at which an organization should or should not consider outsourcing. Whenever this question is posed, the discussion leads to a lot of thoughts. However, when it comes to our recommendation, it has very little to do with an organization’s size. Instead, the decision really comes down to several key considerations.
5 Key Considerations
- Does your organization have a well-formed third-party risk management program? If so, then you’ve likely already considered how many people and what skill sets are needed. This is information you’ll need to understand to evaluate if outsourcing is needed or not.
- Does your organization have sufficient staffing dedicated to the third-party risk program? Salary and benefits are huge line items and perhaps you simply don’t have enough resources – that could be a good time to consider some outsourcing some of your vendor management tasks to a third party.
- Does your organization have people with the right expertise? To properly assess a SOC report, you need someone with IT-related credentials. To properly assess vendor financials, a certified public accountant is usually your best bet. These are all fairly specialized fields and good, qualified people can be very expensive. Outsourcing to an independent set of experts can be an expense savings.
- Have you considered independent validation of your processes? Again, sometimes “we can’t see the forest because of the trees” – as you’re so wrapped up in how you do things, it’s easy to lose sight of best practices in the industry.
- Are team members overwhelmed? If team members are inundated with vendor management tasks, which isn’t allowing them time to focus on other important areas, too, then it may be time to outsource. You can strategically outsourcing time-consuming vendor assessments or other risk tasks to ease the workload for your internal teams.
Outsourcing Vendor Management Creates Efficiency
Let’s be clear – you can never outsource your responsibility to have a well-documented, highly effective third-party discipline, but you can certainly outsource portions of it. At the end of the day, it doesn’t come down to the size of the organization, but a strong consideration of the 5 questions above.
Whether it’s cost savings, resource allocation, specific expertise needed, or any of a number of other factors, creating an efficient process for managing your third-party risk can also create a real strategic advantage.