1. Van dienstverlening naar partnership
Third Party Assurance, (g)een overbodige luxe?
Carlo Pietersma en Ruud Kerssens
10 juni 2010, Zeist

2. Roadmap
Outsourcing life cycle
Drivers for outsourcing
Drivers and risk profile
Risks of outsourcing
Mitigation
Partnership
Third party reports
Best practices
donderdag 20 mei 2010 Page 2 © 2010 BDO

3. Outsourcing lifecycle
donderdag 20 mei 2010 Page 3 © 2010 BDO

4. Drivers voor outsourcing
• Improve focus on core competences
• Reduce costs
• Reduction of capital investment
• Increase flexibility
• Gain access to external competencies & capabilities
• Improve quality and productivity
• Better service
• Control and Quality improvement
< Drivers / risks gebaseerd op praktijkcases --> benoemen cases>
donderdag 20 mei 2010 Page 4 © 2010 BDO

5. Drivers and Risk profile
donderdag 20 mei 2010 Page 5 © 2010 BDO

6. Buyer’ risks
s
• Becoming dependent on service provider
• Savings not realized
• Poor quality of service
• Loss of control
• Loss of skill
• Difficulty in implementing changes
• Technology not in aligned with business
• Security
• Lowering personnel motivation
donderdag 20 mei 2010 Page 6 © 2010 BDO

7. Service provider’ risks
s
• Unanticipated cost
• Large initial investments
• Restrictions in standardization architecture
• Discussions about responsibilities
• Return on investment
donderdag 20 mei 2010 Page 7 © 2010 BDO

8. Mutual risks
• Unclear contractual terms
• Not agreed upon responsibilities
• Unanticipated requirements
• Change management
• Incident response
• Conflict in goals
• Relationship …
donderdag 20 mei 2010 Page 8 © 2010 BDO

9. Mitigation
• Executive-level support for outsourcing
• Good communication to all key stakeholders
• Well defined contracts, SLA’ concrete DAP’
s s
• Demand organization in place to manage, monitor and control the service
provider
• Communication demand and supply is regulated and defined in procedures at
both sides
• Include control objectives based on best practices in contract
• Right to audit / external audit for assurance
Partnership between client organization
and service provider
=
Win Win
donderdag 20 mei 2010 Page 9 © 2010 BDO

10. Partnership
QUOTE ATTRIBUTABLE TO PARTNERSHIP TRIGGER VENDOR MANAGEMENT
“ two walk together, except they be agreed?”
Can Document the understanding and all expectations
with the IT Vendor in writing
“ sickness and in health, to love and to cherish,
in Beware long term outsourcing agreements. Once
till death do us part” signed, it can be very expensive to terminate.
“ an ideal marriage one partner is blind and the
In No one is perfect. Seldom is only one party (e.g.,
other is deaf” the IT vendor) always at fault. Control weaknesses
contribute to poor vendor relations.
donderdag 20 mei 2010 Page 10 © 2010 BDO

11. Confidence
Trust me Tell me Show me Prove me
subjectief Niveau van relatie tussen objectief
serviceorganisatie en u
Stuurmiddelen:
vertrouwen Periodiek overleg / SLA, DAP, TPM
rapp. Rapportage
SAS70 / ISAE 3402 SAS70 / ISAE 3402
Type I Type II
donderdag 20 mei 2010 Page 11 © 2010 BDO

12. Relationships
donderdag 20 mei 2010 Page 12 © 2010 BDO

13. SAS70 type I and II
<wat behelst het>
< plus en minpunten>
donderdag 20 mei 2010 Page 13 © 2010 BDO

14. ISAE3402 type I and II
<wat behelst het>
< plus en minpunten>
donderdag 20 mei 2010 Page 14 © 2010 BDO

15. ISO27001
<wat behelst het>
< plus en minpunten>
donderdag 20 mei 2010 Page 15 © 2010 BDO

16. TPM
<wat behelst het>
< plus en minpunten>
donderdag 20 mei 2010 Page 16 © 2010 BDO

17. Practice
< wat hebben de betrokken partijen ermee gedaan en aan gehad
Terugkoppeling naar klant indien die in de zaal kan zijn. Anders lijstje op basis van
wat hij heeft aangegeven>
donderdag 20 mei 2010 Page 17 © 2010 BDO

18. Vragen
donderdag 20 mei 2010 Page 18 © 2010 BDO

19. Contactgegevens
donderdag 20 mei 2010 Page 19 © 2010 BDO