Outsourcing Risk: A Separate Operational Risk Category?

Abstract

Financial authorities and supervisors have emphasized concerns about outsourcing risk for about a decade. A recent European Banking Authority consultation paper discusses "outsourcing" as a subtopic within "operational risk arising from outsourced services and activities, and whether these can affect the institution's ability to process transactions". However, it remains open whether there is an additional operational risk if one compares internal and external sourcing, qualifying "outsourcing" as a separate risk category. Starting from the perspective of the boundary of a firm (ie, the boundary between internal and external production), this paper identifies three steps in sourcing. First, there is business risk, linked to the ex ante entrepreneurial decision to "make or buy", with the required due diligence to make the "best" selection with regard to the allocation of resources. Second, all sourcing has intrinsic risk, although this is independent of the selection of internal production or external sourcing, ie, the boundary of the firm. Third, multisourcing generates a new type of risk, which emerges from the complexity of the sourcing ecosystem at either provider or firm level.

Keywords: outsourcing, regulatory requirements, make or buy, governance, multisourcing, complexity